{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8985074758529663,
        "class": 0
      }
    ],
    "prob": 0.8985075,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8985075,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.05050505,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.2514535,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-19T08:09:11Z"
  },
  "path": "VirusShare_ffce0590465767b7a81655cd6c3f26eb",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "k": {
          "hash.rich_header": "b83514e7a46f69c0ed71aefebecc0df822fadfc9244b7f36f2b5d00fd0d13e95",
          "pe.rich_header.xor_key": "0xc6714d31",
          "binary.top_complex_unnamed[0].cc": 75,
          "binary.top_complex_unnamed[1].cc": 2,
          "binary.top_complex_unnamed[2].cc": 2,
          "binary.top_complex_unnamed[0].bbs": 85,
          "binary.top_complex_unnamed[1].bbs": 4,
          "binary.top_complex_unnamed[2].bbs": 4,
          "binary.top_complex_unnamed[0].addr": "0x401460",
          "binary.top_complex_unnamed[0].size": 12560,
          "binary.top_complex_unnamed[1].addr": "0x401080",
          "binary.top_complex_unnamed[1].size": 440,
          "binary.top_complex_unnamed[2].addr": "0x401240",
          "binary.top_complex_unnamed[2].size": 417,
          "pe.rich_header.entries[0].use_count": 13,
          "pe.rich_header.entries[1].use_count": 1,
          "pe.rich_header.entries[2].use_count": 29,
          "pe.rich_header.entries[3].use_count": 195,
          "pe.rich_header.entries[4].use_count": 170,
          "pe.rich_header.entries[5].use_count": 7,
          "pe.rich_header.entries[6].use_count": 709,
          "pe.rich_header.entries[7].use_count": 41,
          "pe.rich_header.entries[8].use_count": 57,
          "pe.rich_header.entries[9].use_count": 1,
          "pe.rich_header.entries[0].product_id": 109,
          "pe.rich_header.entries[10].use_count": 1,
          "pe.rich_header.entries[1].product_id": 150,
          "pe.rich_header.entries[2].product_id": 149,
          "pe.rich_header.entries[3].product_id": 131,
          "pe.rich_header.entries[4].product_id": 132,
          "pe.rich_header.entries[5].product_id": 132,
          "pe.rich_header.entries[6].product_id": 1,
          "pe.rich_header.entries[7].product_id": 123,
          "pe.rich_header.entries[8].product_id": 138,
          "pe.rich_header.entries[9].product_id": 148,
          "pe.rich_header.entries[10].product_id": 145,
          "pe.rich_header.entries[0].build_number": 50727,
          "pe.rich_header.entries[0].product_name": "unknown",
          "pe.rich_header.entries[1].build_number": 20413,
          "pe.rich_header.entries[1].product_name": "unknown",
          "pe.rich_header.entries[2].build_number": 30729,
          "pe.rich_header.entries[2].product_name": "unknown",
          "pe.rich_header.entries[3].build_number": 30729,
          "pe.rich_header.entries[3].product_name": "C_VS2008_LTCG",
          "pe.rich_header.entries[4].build_number": 30729,
          "pe.rich_header.entries[4].product_name": "Cpp_VS2008_LTCG",
          "pe.rich_header.entries[5].build_number": 21022,
          "pe.rich_header.entries[5].product_name": "Cpp_VS2008_LTCG",
          "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier",
          "pe.rich_header.entries[7].build_number": 50727,
          "pe.rich_header.entries[7].product_name": "unknown",
          "pe.rich_header.entries[8].build_number": 30729,
          "pe.rich_header.entries[8].product_name": "unknown",
          "pe.rich_header.entries[9].build_number": 21022,
          "pe.rich_header.entries[9].product_name": "unknown",
          "pe.rich_header.entries[10].build_number": 30729,
          "pe.rich_header.entries[10].product_name": "Linker_VS2008"
        },
        "x": 3,
        "id": 0,
        "ms": {
          "file": {
            "size": 301311.0
          },
          "binary": {
            "code_size": 455168.0,
            "func_count": 7.0,
            "func_density": 0.02,
            "string_count": 84.0,
            "avg_func_size": 76847.29,
            "section_count": 5.0,
            "avg_complexity": 11.71,
            "max_complexity": 75.0,
            "string_density": 0.19,
            "overall_entropy": 6.43,
            "avg_basic_blocks": 15.0,
            "avg_section_size": 2019328.0,
            "avg_string_length": 5.01,
            "complexity_per_kb": 0.04,
            "max_string_length": 40.0,
            "wide_string_count": 1.0,
            "avg_string_entropy": 1.88,
            "code_section_ratio": 0.2,
            "code_to_data_ratio": 0.05,
            "data_to_file_ratio": 0.04,
            "rsrc_to_file_ratio": 31.35,
            "text_to_file_ratio": 1.51,
            "total_basic_blocks": 105.0,
            "func_analysis_depth": 2.0,
            "section_name_entropy": 3.21,
            "string_length_stddev": 4.09,
            "largest_section_ratio": 31.35,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.01,
            "writable_section_count": 1.0,
            "has_malformed_structure": true,
            "executable_section_count": 1.0,
            "normalized_section_count": 0.27,
            "high_complexity_func_count": 1.0,
            "unnamed_complex_func_count": 1.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            496,
            ".text"
          ],
          [
            575,
            "@.data"
          ],
          [
            616,
            ".rsrc"
          ],
          [
            655,
            "@.reloc"
          ],
          [
            15682,
            "SVWP"
          ],
          [
            16996,
            "PSVW"
          ],
          [
            22878,
            "wide",
            "Gjjj"
          ],
          [
            75571,
            "Pjmh"
          ],
          [
            104864,
            "PQQSVW"
          ],
          [
            108557,
            "PQSUVW"
          ],
          [
            109421,
            "PQSVW"
          ],
          [
            110134,
            "SUVW"
          ],
          [
            116366,
            "SVWV"
          ],
          [
            116805,
            "QWQR"
          ],
          [
            117460,
            "QVQR"
          ],
          [
            117506,
            "QRQP"
          ],
          [
            118701,
            "PQVW"
          ],
          [
            121424,
            "8SVW"
          ],
          [
            123030,
            "XSVW"
          ],
          [
            125120,
            "LSUVW"
          ],
          [
            125824,
            "8SUVW"
          ],
          [
            127418,
            "QURP"
          ],
          [
            127620,
            "QRQW"
          ],
          [
            127664,
            "QPQU"
          ],
          [
            127782,
            "PQPU"
          ],
          [
            128089,
            "QPQW"
          ],
          [
            128201,
            "PQPW"
          ],
          [
            128244,
            "PQPR"
          ],
          [
            142653,
            "PSUVW"
          ],
          [
            142800,
            "LSUV"
          ],
          [
            142893,
            "SRPVP"
          ],
          [
            143756,
            "SWPQ"
          ],
          [
            144202,
            "RPQP"
          ],
          [
            146371,
            "SWVQ"
          ],
          [
            147663,
            "SWVW"
          ],
          [
            149989,
            "PQSW"
          ],
          [
            150204,
            "RPQV"
          ],
          [
            154455,
            "RPWQ"
          ],
          [
            157904,
            "QSVW"
          ],
          [
            158720,
            "u5h8"
          ],
          [
            160624,
            "QSU3"
          ],
          [
            160776,
            "F0PW"
          ],
          [
            166875,
            "QRPS"
          ],
          [
            172040,
            "D$()D$$"
          ],
          [
            172898,
            "PSUV"
          ],
          [
            175305,
            "9n0u"
          ],
          [
            175330,
            "L$()~t"
          ],
          [
            183408,
            "9wtu"
          ],
          [
            187056,
            "QSUVW"
          ],
          [
            188971,
            "PQSU"
          ],
          [
            193306,
            "WVSP"
          ],
          [
            193522,
            "VSWR"
          ],
          [
            193685,
            "QSWP"
          ],
          [
            205168,
            ")\\$("
          ],
          [
            206187,
            "RXQP"
          ],
          [
            212399,
            "SQWP"
          ],
          [
            213628,
            "F8SW"
          ],
          [
            226888,
            "Nxjd"
          ],
          [
            228684,
            "QQSV"
          ],
          [
            228748,
            "KLVP"
          ],
          [
            230091,
            "E S3"
          ],
          [
            232138,
            "WWWWS"
          ],
          [
            233417,
            "VFVW"
          ],
          [
            236918,
            "WWVPWWWW"
          ],
          [
            239733,
            "PQQQQQ"
          ],
          [
            247976,
            "t7j0"
          ],
          [
            248124,
            "F W3"
          ],
          [
            251021,
            "9p u"
          ],
          [
            259476,
            "QSVW3"
          ],
          [
            261126,
            "YYSP"
          ],
          [
            267667,
            "Pjoh"
          ],
          [
            271985,
            "YYPS"
          ],
          [
            277437,
            "PWVWWW"
          ],
          [
            277472,
            "WVWWW"
          ],
          [
            277524,
            "QQV3"
          ],
          [
            281830,
            "ADVW"
          ],
          [
            282329,
            "ADV3"
          ],
          [
            282420,
            "VVVVQVVVj"
          ],
          [
            285756,
            "CPR3"
          ],
          [
            286985,
            "WPPR"
          ],
          [
            291364,
            "C0PPQ"
          ],
          [
            298683,
            "t8Ht0Ht)Ht\"HuO"
          ],
          [
            299495,
            "QVW3"
          ]
        ],
        "sz": 301311,
        "ts": [
          {
            "a": "T1027",
            "c": 0.30000001192092896,
            "d": "PE header too corrupted to parse: Malformed entity: malformed resource table size (9445052 bytes)",
            "e": [
              "Malformed entity: malformed resource table size (9445052 bytes)"
            ],
            "i": "objectives/anti-analysis/pe-tampering/corrupted-header",
            "l": 2,
            "m": "B0001"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Resource section is major PE share",
            "e": [
              "binary.rsrc_to_file_ratio = 31.35"
            ],
            "i": "metadata/binary/section/metrics::major-rsrc-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 11.71"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "VirusShare_ffce0590465767b7a81655cd6c3f26eb"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial data section",
            "e": [
              "binary.data_to_file_ratio = 0.04"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "c": 0.800000011920929,
            "d": "Five section PE layout",
            "e": [
              "binary.section_count = 5.00"
            ],
            "i": "metadata/binary/section/metrics::five-section-pe",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Extremely large average function size",
            "e": [
              "binary.avg_func_size = 76847.29"
            ],
            "i": "metadata/binary/metrics/structural::giant-average-function",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 1.88"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.9200000166893005,
            "d": "Resource section dominates PE size",
            "e": [
              "binary.rsrc_to_file_ratio = 31.35"
            ],
            "i": "metadata/binary/section/metrics::dominant-rsrc-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Native runtime has huge functions",
            "e": [
              "binary.avg_func_size = 76847.29"
            ],
            "i": "metadata/lang/compiler/aot::huge-runtime-average-function",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few functions detected",
            "e": [
              "binary.func_count = 7.00"
            ],
            "i": "metadata/binary/metrics/structural::few-functions",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Large PE resource section (\u003e150KB)",
            "e": [
              ".rsrc (size: 9445376)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 1.0,
            "d": "Binary has high overall entropy",
            "e": [
              "binary.overall_entropy = 6.43"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Low function count metric",
            "e": [
              "binary.func_count = 7.00"
            ],
            "i": "metadata/binary/metrics/anomaly::low-function-count-marker",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Large zero-entropy placeholder section",
            "e": [
              ".rsrc (size: 9445376, entropy: 0.00, perms: -r--)",
              ".rdata (size: 112640, entropy: 0.00, perms: -r--)",
              ".reloc (size: 70144, entropy: 0.00, perms: -r--)"
            ],
            "i": "metadata/binary/section/metrics::null-placeholder-section",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Very low recovered function count",
            "e": [
              "binary.func_count = 7.00"
            ],
            "i": "objectives/anti-static/pack/polymorphic::very-low-func-count",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE section declared larger than file (truncated/corrupt)",
            "e": [
              "binary.largest_section_ratio = 31.35"
            ],
            "i": "metadata/binary/metrics/structural::section-exceeds-file-size",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 31.35"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "Large PE resource section",
            "e": [
              ".rsrc (size: 9445376)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::large-rsrc-section",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 0.00)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 13312)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Low average string entropy (dictionary text)",
            "e": [
              "binary.avg_string_entropy = 1.88"
            ],
            "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy",
            "l": 1
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version_info.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.func_count = 7.00"
            ],
            "i": "metadata/binary/metrics/threshold::few-functions-3",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Text section dominates file",
            "e": [
              "binary.text_to_file_ratio = 1.51"
            ],
            "i": "metadata/binary/layout::text-section-dominates-file",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc",
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Average function size over 50KB",
            "e": [
              "binary.avg_func_size = 76847.29"
            ],
            "i": "metadata/binary/metrics/pe-details::extremely-large-avg-function",
            "l": 2
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with single import",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.8999999761581421,
            "d": "Oversized low-entropy PE resources",
            "e": [
              ".rsrc (size: 9445376, entropy: 0.00)"
            ],
            "i": "metadata/binary/resource::oversized-low-entropy-rsrc",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.9200000166893005,
            "d": "Large null-filled PE resources",
            "e": [
              ".rsrc (size: 9445376, entropy: 0.00)"
            ],
            "i": "metadata/binary/resource::large-null-rsrc",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PE code-to-data ratio below 0.08",
            "e": [
              "binary.code_to_data_ratio = 0.05"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::code-data-ratio-below-008",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Five or more PE sections",
            "e": [
              "binary.section_count = 5.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Large low-entropy PE resources",
            "e": [
              ".rsrc (size: 9445376, entropy: 0.00)"
            ],
            "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "Oversized PE resource section",
            "e": [
              ".rsrc (size: 9445376)"
            ],
            "i": "metadata/binary/resource::oversized-rsrc",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "Low function count metric",
            "e": [
              "binary.func_count = 7.00"
            ],
            "i": "metadata/binary/anomaly/format::low-function-count-marker",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Packed loader code-to-data ratio below 0.4",
            "e": [
              "binary.code_to_data_ratio = 0.05"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-low-code-to-data-ratio",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with very few imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 31.35"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 31.35"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Resource-heavy PE with large .rsrc",
            "e": [
              ".rsrc (size: 9445376)"
            ],
            "i": "metadata/binary/resource::resource-heavy-rsrc",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.9599999785423279,
            "d": "Regex component marker",
            "e": [
              "binary.code_to_data_ratio = 0.05"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-0--inline-29196",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.code_to_data_ratio = 0.05"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-0--inline-29187",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 31.35"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          }
        ],
        "sha": "cba4d1e0444724e8dcffc5fdd3464fdd4cb3f3deb576850326641a1f8a33d564",
        "path": "/data/samples/bad/datasets/various/VirusShare/VirusShare_ffce0590465767b7a81655cd6c3f26eb",
        "type": "pe"
      }
    ],
    "tv": "012f9"
  }
}