{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9939925074577332,
        "class": 0
      }
    ],
    "prob": 0.9939925,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.95268506,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.9939925,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.9932365,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T12:34:43Z"
  },
  "path": "cb3ccebc84bf047a11cc16e738f0822a2b62c6b840e1bba795bfcb65b7e990d2.exe",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "k": {
          "hash.rich_header": "1a8a90764f9669fb489845b0112f577818fead698815fd20ceb0e6af5eaa3c9f",
          "pe.rich_header.xor_key": "0x0906c598",
          "pe.inflated_sections[0]": ".data",
          "pe.rich_header.entries[0].use_count": 12,
          "pe.rich_header.entries[1].use_count": 172,
          "pe.rich_header.entries[2].use_count": 24,
          "pe.rich_header.entries[3].use_count": 18,
          "pe.rich_header.entries[4].use_count": 29,
          "pe.rich_header.entries[5].use_count": 18,
          "pe.rich_header.entries[6].use_count": 7,
          "pe.rich_header.entries[7].use_count": 115,
          "pe.rich_header.entries[8].use_count": 17,
          "pe.rich_header.entries[9].use_count": 1,
          "pe.rich_header.entries[0].product_id": 241,
          "pe.rich_header.entries[10].use_count": 1,
          "pe.rich_header.entries[1].product_id": 243,
          "pe.rich_header.entries[2].product_id": 242,
          "pe.rich_header.entries[3].product_id": 259,
          "pe.rich_header.entries[4].product_id": 261,
          "pe.rich_header.entries[5].product_id": 260,
          "pe.rich_header.entries[6].product_id": 203,
          "pe.rich_header.entries[7].product_id": 1,
          "pe.rich_header.entries[8].product_id": 260,
          "pe.rich_header.entries[9].product_id": 255,
          "pe.rich_header.entries[10].product_id": 258,
          "pe.rich_header.entries[0].build_number": 40116,
          "pe.rich_header.entries[0].product_name": "unknown",
          "pe.rich_header.entries[1].build_number": 40116,
          "pe.rich_header.entries[1].product_name": "unknown",
          "pe.rich_header.entries[2].build_number": 40116,
          "pe.rich_header.entries[2].product_name": "unknown",
          "pe.rich_header.entries[3].build_number": 24123,
          "pe.rich_header.entries[3].product_name": "Cvtres_VS2013",
          "pe.rich_header.entries[4].build_number": 24123,
          "pe.rich_header.entries[4].product_name": "Cpp_VS2015",
          "pe.rich_header.entries[5].build_number": 24123,
          "pe.rich_header.entries[5].product_name": "C_VS2015",
          "pe.rich_header.entries[6].build_number": 65501,
          "pe.rich_header.entries[6].product_name": "unknown",
          "pe.rich_header.entries[7].product_name": "Imp_VS_v6_or_earlier",
          "pe.rich_header.entries[8].build_number": 24210,
          "pe.rich_header.entries[8].product_name": "C_VS2015",
          "pe.rich_header.entries[9].build_number": 24210,
          "pe.rich_header.entries[9].product_name": "C_VS2013",
          "pe.rich_header.entries[10].build_number": 24210,
          "pe.rich_header.entries[10].product_name": "Linker_VS2013_LTCG"
        },
        "x": 4,
        "id": 0,
        "ms": {
          "pe": {
            "checksum": 0.0,
            "export_timestamp": 0.0,
            "resource_timestamp": 0.0,
            "has_export_timestamp": false,
            "has_resource_timestamp": false,
            "max_section_inflation_ratio": 23.05
          },
          "file": {
            "size": 16420.0
          },
          "binary": {
            "code_size": 125952.0,
            "func_count": 5.0,
            "func_density": 0.04,
            "string_count": 8.0,
            "avg_func_size": 62824.8,
            "section_count": 6.0,
            "avg_complexity": 0.4,
            "max_complexity": 1.0,
            "string_density": 0.07,
            "overall_entropy": 6.03,
            "avg_basic_blocks": 1.8,
            "avg_section_size": 41386.67,
            "avg_string_length": 9.88,
            "complexity_per_kb": 0.02,
            "max_string_length": 40.0,
            "avg_string_entropy": 2.54,
            "code_section_ratio": 0.17,
            "code_to_data_ratio": 1.03,
            "data_to_file_ratio": 0.16,
            "rsrc_to_file_ratio": 4.12,
            "text_to_file_ratio": 7.67,
            "total_basic_blocks": 9.0,
            "func_analysis_depth": 2.0,
            "section_name_entropy": 3.52,
            "string_length_stddev": 11.42,
            "largest_section_ratio": 7.67,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.13,
            "writable_section_count": 1.0,
            "has_malformed_structure": true,
            "executable_section_count": 1.0,
            "normalized_section_count": 0.43,
            "nonstandard_section_count": 1.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            231,
            "Rich"
          ],
          [
            512,
            ".text"
          ],
          [
            591,
            "@.data"
          ],
          [
            632,
            ".gfids"
          ],
          [
            671,
            "@.rsrc"
          ],
          [
            711,
            "@.reloc"
          ],
          [
            11434,
            "/hHJC"
          ]
        ],
        "sz": 16420,
        "ts": [
          {
            "a": "T1027",
            "c": 0.30000001192092896,
            "d": "PE header too corrupted to parse: Malformed entity: malformed resource table size (67080 bytes)",
            "e": [
              "Malformed entity: malformed resource table size (67080 bytes)"
            ],
            "i": "objectives/anti-analysis/pe-tampering/corrupted-header",
            "l": 2,
            "m": "B0001"
          },
          {
            "c": 0.8999999761581421,
            "d": "Native runtime has huge functions",
            "e": [
              "binary.avg_func_size = 62824.80"
            ],
            "i": "metadata/lang/compiler/aot::huge-runtime-average-function",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".data",
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 2560)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few functions detected",
            "e": [
              "binary.func_count = 5.00"
            ],
            "i": "metadata/binary/metrics/structural::few-functions",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 7.67"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 0.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 0.40"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 0.00)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 0.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 1.0,
            "d": "Binary has high overall entropy",
            "e": [
              "binary.overall_entropy = 6.03"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 8.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.75,
            "d": "Text section dominates file",
            "e": [
              "binary.text_to_file_ratio = 7.67"
            ],
            "i": "metadata/binary/layout::text-section-dominates-file",
            "l": 2
          },
          {
            "c": 0.8600000143051147,
            "d": "Inflated PE data section",
            "e": [
              "pe.max_section_inflation_ratio = 23.05"
            ],
            "i": "metadata/binary/section/metrics::inflated-data-section",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "Large zero-entropy placeholder section",
            "e": [
              ".rsrc (size: 67584, entropy: 0.00, perms: -r--)",
              ".reloc (size: 6144, entropy: 0.00, perms: -r--)",
              ".rdata (size: 45568, entropy: 0.00, perms: -r--)"
            ],
            "i": "metadata/binary/section/metrics::null-placeholder-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Import count is exactly zero",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-single-import-dll",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc",
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1620",
            "c": 0.8199999928474426,
            "d": "RegPhantom compact driver size",
            "e": [
              "UDS-DangerousObject.Multi.Generic-cb3ccebc84bf047a11cc16e738f0822a2b62c6b840e1bba795bfcb65b7e990d2"
            ],
            "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "UDS-DangerousObject.Multi.Generic-cb3ccebc84bf047a11cc16e738f0822a2b62c6b840e1bba795bfcb65b7e990d2"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.54"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE section declared larger than file (truncated/corrupt)",
            "e": [
              "binary.largest_section_ratio = 7.67"
            ],
            "i": "metadata/binary/metrics/structural::section-exceeds-file-size",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Average function size over 50KB",
            "e": [
              "binary.avg_func_size = 62824.80"
            ],
            "i": "metadata/binary/metrics/pe-details::extremely-large-avg-function",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.func_count = 5.00"
            ],
            "i": "metadata/binary/metrics/threshold::few-functions-3",
            "l": 1
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with very few imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 7.67"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 0.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few basic blocks (analysis-limited or sparse)",
            "e": [
              "binary.total_basic_blocks = 9.00"
            ],
            "i": "metadata/binary/metrics/structural::few-basic-blocks",
            "l": 3
          },
          {
            "c": 0.9200000166893005,
            "d": "Large null-filled PE resources",
            "e": [
              ".rsrc (size: 67584, entropy: 0.00)"
            ],
            "i": "metadata/binary/resource::large-null-rsrc",
            "l": 3
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with single import",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 0.800000011920929,
            "d": "Five or more PE sections",
            "e": [
              "binary.section_count = 6.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 0.40"
            ],
            "i": "metadata/binary/metrics/structural::low-average-complexity",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 7.67"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.has_export_timestamp = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 7.67"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          }
        ],
        "sha": "cb3ccebc84bf047a11cc16e738f0822a2b62c6b840e1bba795bfcb65b7e990d2",
        "path": "/data/samples/bad/datasets/MalwareBazaar/Bazaar.2025.12/UDS-DangerousObject.Multi.Generic-cb3ccebc84bf047a11cc16e738f0822a2b62c6b840e1bba795bfcb65b7e990d2",
        "type": "pe"
      }
    ],
    "tv": "51ad9"
  }
}