{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9994513392448425,
        "class": 2
      }
    ],
    "prob": 0.99945134,
    "class": 2,
    "oprob": 0.7359809,
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.993587,
      0.99945134
    ],
    "analyzed_at": "2026-04-28T13:50:01Z"
  },
  "path": "virussign.com_66150d5199d7fc91f195ee9d4669f790.vir",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₃(As₈C₄I)H₃(DsFDb)Md₃(Bi₆Pt)",
        "x": 128,
        "id": 0,
        "is": [
          "CIcos",
          "adj_fptan",
          "vbaVarMove",
          "vbaFreeVar",
          "ORDINAL 588",
          "vbaFreeVarList",
          "vbaEnd",
          "adj_fdiv_m64",
          "vbaFreeObjList",
          "adj_fprem1",
          "vbaStrCat",
          "vbaSetSystemError",
          "vbaHresultCheckObj",
          "adj_fdiv_m32",
          "vbaAryDestruct",
          "ORDINAL 593",
          "ORDINAL 594",
          "vbaOnError",
          "vbaObjSet",
          "adj_fdiv_m16i",
          "adj_fdivr_m16i",
          "CIsin",
          "vbaChkstk",
          "vbaFileClose",
          "EVENT_SINK_AddRef",
          "vbaGenerateBoundsError",
          "vbaPutOwner3",
          "DllFunctionCall",
          "adj_fpatan",
          "vbaRedim",
          "vbaStrR8",
          "EVENT_SINK_Release",
          "ORDINAL 600",
          "vbaUI1I2",
          "CIsqrt",
          "EVENT_SINK_QueryInterface",
          "vbaExceptHandler",
          "adj_fprem",
          "adj_fdivr_m64",
          "vbaFPException",
          "vbaGetOwner3",
          "vbaUbound",
          "vbaStrVarVal",
          "vbaVarCat",
          "CIlog",
          "vbaErrorOverflow",
          "vbaFileOpen",
          "vbaNew2",
          "ORDINAL 570",
          "vbaR8Str",
          "adj_fdiv_m32i",
          "adj_fdivr_m32i",
          "vbaFreeStrList",
          "adj_fdivr_m32",
          "adj_fdiv_r",
          "ORDINAL 100",
          "vbaI4Var",
          "vbaVarMod",
          "CIatan",
          "vbaStrMove",
          "allmul",
          "CItan",
          "vbaFPInt",
          "vbaUI1Var",
          "CIexp",
          "vbaFreeStr",
          "vbaFreeObj"
        ],
        "ms": {
          "pe": {
            "machine": 332.0,
            "checksum": 513757.0,
            "rsrc_size": 294912.0,
            "subsystem": 2.0,
            "timestamp": 1547944320.0,
            "icon_count": 2.0,
            "image_base": 4194304.0,
            "rsrc_entropy": 2.48,
            "entry_section": ".text",
            "size_of_image": 479232.0,
            "timestamp_day": 20.0,
            "file_alignment": 4096.0,
            "resource_count": 3.0,
            "timestamp_year": 2019.0,
            "characteristics": 53007.0,
            "entry_point_rva": 5076.0,
            "size_of_headers": 4096.0,
            "timestamp_month": 1.0,
            "checksum_present": true,
            "export_timestamp": 0.0,
            "import_dll_count": 1.0,
            "checksum_mismatch": true,
            "computed_checksum": 519015.0,
            "section_alignment": 4096.0,
            "unusual_alignment": true,
            "number_of_sections": 3.0,
            "resource_timestamp": 1547904896.0,
            "rich_header_present": true,
            "linker_major_version": 6.0,
            "version_info_present": true,
            "resource_timestamp_day": 19.0,
            "resource_timestamp_year": 2019.0,
            "export_timestamp_present": false,
            "resource_timestamp_month": 1.0,
            "resource_timestamp_present": true
          },
          "binary": {
            "file_size": 479385.0,
            "entry_point": 5076.0,
            "import_count": 67.0,
            "string_count": 243.0,
            "section_count": 3.0,
            "overall_entropy": 3.35,
            "avg_section_size": 158378.67,
            "dependency_count": 1.0,
            "entropy_variance": 3.15,
            "avg_string_length": 17.53,
            "max_string_length": 467.0,
            "wide_string_count": 19.0,
            "avg_string_entropy": 2.84,
            "data_to_file_ratio": 0.01,
            "entry_point_is_rva": true,
            "rsrc_to_file_ratio": 0.62,
            "text_to_file_ratio": 0.37,
            "high_entropy_regions": 1.0,
            "string_length_stddev": 50.71,
            "largest_section_ratio": 0.62,
            "sentence_string_count": 14.0,
            "sentence_string_ratio": 0.06
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            432,
            ".text"
          ],
          [
            472,
            ".data"
          ],
          [
            512,
            ".rsrc"
          ],
          [
            568,
            "MSVBVM60.DLL"
          ],
          [
            5248,
            "Unicorn"
          ],
          [
            5421,
            "Adobe Photoshop CC 2018 (Windows)"
          ],
          [
            5455,
            "2019:01:07 19:44:27"
          ],
          [
            5618,
            "Adobe_CM"
          ],
          [
            5633,
            "Adobe"
          ],
          [
            5912,
            "b34r"
          ],
          [
            6534,
            "Blqm"
          ],
          [
            8568,
            "3b5q"
          ],
          [
            9227,
            "\\Photoshop 3.0"
          ],
          [
            9242,
            "8BIM"
          ],
          [
            9297,
            "N8BIM"
          ],
          [
            9324,
            "printOutput"
          ],
          [
            9343,
            "PstSbool"
          ],
          [
            9356,
            "Inteenum"
          ],
          [
            9368,
            "Inte"
          ],
          [
            9376,
            "Clrm"
          ],
          [
            9384,
            "printSixteenBitbool"
          ],
          [
            9408,
            "printerNameTEXT"
          ],
          [
            9433,
            "printProofSetupObjc"
          ],
          [
            9483,
            "proofSetup"
          ],
          [
            9502,
            "Bltnenum"
          ],
          [
            9513,
            "builtinProof"
          ],
          [
            9529,
            "proofCMYK"
          ],
          [
            9566,
            "printOutputOptions"
          ],
          [
            9592,
            "Cptnbool"
          ],
          [
            9605,
            "Clbrbool"
          ],
          [
            9618,
            "RgsMbool"
          ],
          [
            9644,
            "CntCbool"
          ],
          [
            9657,
            "Lblsbool"
          ],
          [
            9670,
            "Ngtvbool"
          ],
          [
            9683,
            "EmlDbool"
          ],
          [
            9696,
            "Intrbool"
          ],
          [
            9709,
            "BckgObjc"
          ],
          [
            9727,
            "RGBC"
          ],
          [
            9799,
            "BrdTUntF#Rlt"
          ],
          [
            9823,
            "Bld UntF#Rlt"
          ],
          [
            9847,
            "RsltUntF#Pxl@b"
          ],
          [
            9871,
            "vectorDatabool"
          ],
          [
            9890,
            "PgPsenum"
          ],
          [
            9918,
            "LeftUntF#Rlt"
          ],
          [
            9942,
            "Top UntF#Rlt"
          ],
          [
            9966,
            "Scl UntF#Prc@Y"
          ],
          [
            9990,
            "cropWhenPrintingbool"
          ],
          [
            10015,
            "cropRectBottomlong"
          ],
          [
            10041,
            "cropRectLeftlong"
          ],
          [
            10064,
            "cropRectRightlong"
          ],
          [
            10090,
            "cropRectToplong"
          ],
          [
            10677,
            "null"
          ],
          [
            10689,
            "boundsObjc"
          ],
          [
            10721,
            "Top long"
          ],
          [
            10737,
            "Leftlong"
          ],
          [
            10753,
            "Btomlong"
          ],
          [
            10769,
            "Rghtlong"
          ],
          [
            10785,
            "slicesVlLs"
          ],
          [
            10799,
            "Objc"
          ],
          [
            10813,
            "slice"
          ],
          [
            10826,
            "sliceIDlong"
          ],
          [
            10845,
            "groupIDlong"
          ],
          [
            10864,
            "originenum"
          ],
          [
            10877,
            "ESliceOrigin"
          ],
          [
            10893,
            "autoGenerated"
          ],
          [
            10911,
            "Typeenum"
          ],
          [
            10922,
            "ESliceType"
          ],
          [
            11041,
            "urlTEXT"
          ],
          [
            11058,
            "nullTEXT"
          ],
          [
            11076,
            "MsgeTEXT"
          ],
          [
            11094,
            "altTagTEXT"
          ],
          [
            11114,
            "cellTextIsHTMLbool"
          ],
          [
            11137,
            "cellTextTEXT"
          ],
          [
            11158,
            "horzAlignenum"
          ],
          [
            11176,
            "ESliceHorzAlign"
          ],
          [
            11195,
            "default"
          ],
          [
            11205,
            "vertAlignenum"
          ],
          [
            11223,
            "ESliceVertAlign"
          ],
          [
            11253,
            "bgColorTypeenum"
          ],
          [
            11272,
            "ESliceBGColorType"
          ],
          [
            11293,
            "None"
          ],
          [
            11300,
            "topOutsetlong"
          ],
          [
            11321,
            "leftOutsetlong"
          ],
          [
            11343,
            "bottomOutsetlong"
          ],
          [
            11368,
            "rightOutsetlong"
          ],
          [
            15102,
            "wide",
            "Adobe Photoshop"
          ],
          [
            15170,
            "wide",
            "C 2018"
          ],
          [
            15209,
            "zhttp://ns.adobe.com/xap/1.0/"
          ],
          [
            15239,
            "\u003c?xpacket begin=\""
          ],
          [
            15259,
            "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?\u003e \u003cx:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:"
          ],
          [
            15492,
            "out=\"\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmlns:dc=\"http://purl.org/dc/elements/1.1/\" xmlns:photoshop=\"http://ns.adobe.com"
          ],
          [
            15951,
            "tadataDate=\"2019-01-07T"
          ],
          [
            15975,
            "9:44:27+08:00\" dc:format=\"image/jpeg\" photoshop:ColorMode=\"3\" photoshop:ICCProfile=\"sRGB IEC61966-2.1\" xmpMM:InstanceID=\"xmp.iid"
          ],
          [
            16352,
            "Evt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"2018-12-02T15:50:06+08:00\" stEvt:softwareAgent=\"Adobe "
          ],
          [
            16538,
            "\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85f-119c665623ef\" stEvt:when=\"2018-12-02T16:02:59+08:00\" stEvt:softwareAgent=\"Ad"
          ],
          [
            19580,
            "\u003c?xpacket end=\"w\"?\u003e"
          ],
          [
            19684,
            "XICC_PROFILE"
          ],
          [
            19712,
            "mntrRGB XYZ"
          ],
          [
            19736,
            "acspMSFT"
          ],
          [
            19748,
            "IEC sRGB"
          ],
          [
            19843,
            "3desc"
          ],
          [
            19940,
            "vued"
          ],
          [
            19952,
            "view"
          ],
          [
            19976,
            "meas"
          ],
          [
            20035,
            "text"
          ],
          [
            20044,
            "Copyright (c) 1998 Hewlett-Packard Company"
          ],
          [
            20100,
            "sRGB IEC61966-2.1"
          ],
          [
            20308,
            "IEC http://www.iec.ch"
          ],
          [
            20419,
            ".IEC 61966-2.1 Default RGB colour space - sRGB"
          ],
          [
            20476,
            ".IEC 61966-2.Y Default RGB colour space - sRGB"
          ],
          [
            20555,
            ",Reference Viewing Condition in IEC61966-2.1"
          ],
          [
            20780,
            "CRT curv"
          ],
          [
            23153,
            "DTsEF7Gc(UVW"
          ],
          [
            23186,
            "u*9:HIJXYZghijvwxyz"
          ],
          [
            30234,
            "VMI_"
          ],
          [
            30701,
            "BIYS"
          ],
          [
            30724,
            "JVWP"
          ],
          [
            32184,
            "%euWFWGP"
          ],
          [
            35348,
            "9555"
          ],
          [
            48493,
            "/ysw"
          ],
          [
            55713,
            "Noqf"
          ],
          [
            56636,
            "CUO42"
          ],
          [
            56750,
            "xa7 4"
          ],
          [
            59264,
            "KOCCGM"
          ],
          [
            59272,
            "MIGI"
          ],
          [
            63314,
            "Rwwu"
          ],
          [
            63717,
            "MQMT"
          ],
          [
            67958,
            "t8e6"
          ],
          [
            68919,
            "a7tx"
          ],
          [
            69651,
            "YYYI"
          ],
          [
            74106,
            "Wfiv"
          ],
          [
            76522,
            "KA43"
          ],
          [
            77100,
            "MSUA"
          ],
          [
            78622,
            "3G4R"
          ],
          [
            78877,
            "Yeii"
          ],
          [
            91848,
            "ar2a"
          ],
          [
            91881,
            "7WFS"
          ],
          [
            92697,
            "DAQN"
          ],
          [
            94691,
            "p3x7"
          ],
          [
            96294,
            "]M[%v_g"
          ],
          [
            97335,
            "KQEY"
          ],
          [
            99621,
            "KQN9"
          ],
          [
            103625,
            "UMQV"
          ],
          [
            105209,
            "i2xe"
          ],
          [
            105509,
            "T8LF"
          ],
          [
            106032,
            "BMQO"
          ],
          [
            106584,
            "BKIB"
          ],
          [
            109704,
            "Ocdv"
          ],
          [
            113948,
            "URSR"
          ],
          [
            115617,
            "VQPSMY]44tt"
          ],
          [
            117343,
            "PC_M4"
          ],
          [
            118288,
            "OKWN"
          ],
          [
            118293,
            "IMYK2"
          ],
          [
            125183,
            "Scki"
          ],
          [
            133602,
            "s4pe0"
          ],
          [
            133693,
            "HVJ2"
          ],
          [
            136032,
            "6OWB"
          ],
          [
            136150,
            "AMOSMR"
          ],
          [
            138350,
            "XYIR"
          ],
          [
            139830,
            "74PC-]%5FN"
          ],
          [
            141992,
            "UC_O"
          ],
          [
            142818,
            "/Zmz"
          ],
          [
            145206,
            "j2\u003eG"
          ],
          [
            146222,
            "Wfbi"
          ],
          [
            147347,
            "QUEA"
          ],
          [
            148616,
            "PFEEA"
          ],
          [
            151120,
            "PARA"
          ],
          [
            151996,
            "IMCGO"
          ],
          [
            153371,
            "KJBC"
          ],
          [
            156014,
            "SUL1"
          ],
          [
            156734,
            "5RK4R"
          ],
          [
            157588,
            "U5CU"
          ],
          [
            158084,
            "Gqjv"
          ],
          [
            162123,
            "xur0z"
          ],
          [
            162720,
            "XZ9H"
          ],
          [
            165194,
            "SUMCOQ"
          ],
          [
            168292,
            "MS Sans Serif"
          ],
          [
            168420,
            "VB5!6\u0026vb6chs.dll"
          ],
          [
            168540,
            "Kawaii-Unicorn"
          ],
          [
            170256,
            "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB"
          ],
          [
            170400,
            "Form"
          ],
          [
            170444,
            "user32"
          ],
          [
            170456,
            "SetLayeredWindowAttributes"
          ],
          [
            170540,
            "GetWindowLongA"
          ],
          [
            170612,
            "SetWindowLongA"
          ],
          [
            170768,
            "wide",
            ".exe"
          ],
          [
            170888,
            "wide",
            "cmd /c rename \""
          ],
          [
            170944,
            "wide",
            ".die"
          ],
          [
            170956,
            "VBA6.DLL"
          ],
          [
            170968,
            "__vbaEnd"
          ],
          [
            171004,
            "__vbaFreeVarList"
          ],
          [
            171064,
            "__vbaErrorOverflow"
          ],
          [
            171084,
            "__vbaAryDestruct"
          ],
          [
            171104,
            "__vbaPutOwner3"
          ],
          [
            171120,
            "__vbaFreeObj"
          ],
          [
            171136,
            "__vbaFreeStr"
          ],
          [
            171176,
            "__vbaGenerateBoundsError"
          ],
          [
            171216,
            "__vbaUbound"
          ],
          [
            171228,
            "__vbaFPInt"
          ],
          [
            171240,
            "__vbaVarMove"
          ],
          [
            171256,
            "__vbaFileClose"
          ],
          [
            171272,
            "__vbaGetOwner3"
          ],
          [
            171288,
            "__vbaRedim"
          ],
          [
            171300,
            "__vbaFreeObjList"
          ],
          [
            171352,
            "__vbaStrMove"
          ],
          [
            171368,
            "__vbaFileOpen"
          ],
          [
            171384,
            "__vbaFreeVar"
          ],
          [
            171412,
            "__vbaSetSystemError"
          ],
          [
            171432,
            "__vbaHresultCheckObj"
          ],
          [
            171456,
            "__vbaOnError"
          ],
          [
            176630,
            "_adj_fptan"
          ],
          [
            176744,
            "_adj_fprem1"
          ],
          [
            176930,
            "__vbaChkstk"
          ],
          [
            176962,
            "EVENT_SINK_AddRef"
          ],
          [
            177028,
            "DllFunctionCall"
          ],
          [
            177046,
            "_adj_fpatan"
          ],
          [
            177088,
            "EVENT_SINK_Release"
          ],
          [
            177124,
            "_CIsqrt"
          ],
          [
            177134,
            "EVENT_SINK_QueryInterface"
          ],
          [
            177162,
            "__vbaExceptHandler"
          ],
          [
            177184,
            "_adj_fprem"
          ],
          [
            177198,
            "_adj_fdivr_m64"
          ],
          [
            177216,
            "__vbaFPException"
          ],
          [
            177410,
            "__vbaFreeStrList"
          ],
          [
            177430,
            "_adj_fdivr_m32"
          ],
          [
            177448,
            "_adj_fdiv_r"
          ],
          [
            177490,
            "_CIatan"
          ],
          [
            177516,
            "_allmul"
          ],
          [
            477130,
            "wide",
            "VS_VERSION_INFO"
          ],
          [
            477222,
            "wide",
            "StringFileInfo"
          ],
          [
            477282,
            "wide",
            "CompanyName"
          ],
          [
            477308,
            "wide",
            "UEFI"
          ],
          [
            477326,
            "wide",
            "ProductName"
          ],
          [
            477352,
            "wide",
            "Kawaii-Unicorn"
          ],
          [
            477390,
            "wide",
            "FileVersion"
          ],
          [
            477416,
            "wide",
            "1.00"
          ],
          [
            477434,
            "wide",
            "ProductVersion"
          ],
          [
            477482,
            "wide",
            "InternalName"
          ],
          [
            477546,
            "wide",
            "OriginalFilename"
          ],
          [
            477580,
            "wide",
            "Kawaii-Unicorn.exe"
          ],
          [
            477626,
            "wide",
            "VarFileInfo"
          ],
          [
            477658,
            "wide",
            "Translation"
          ]
        ],
        "sz": 479385,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "PE section headers declare sizes beyond end of file",
            "i": "metadata/binary/anomaly::inflated-section-headers",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 3
          },
          {
            "c": 0.9300000071525574,
            "d": "VB6 runtime file open helper",
            "e": [
              "vbaFileOpen"
            ],
            "i": "micro-behaviors/fs/file/write::vb6-file-open",
            "l": 2
          },
          {
            "c": 0.9900000095367432,
            "d": "ANSI window style update API",
            "e": [
              "SetWindowLongA"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 0.00"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "Elevated text section entropy",
            "e": [
              ".text (entropy: 7.57)"
            ],
            "i": "metadata/binary/section/metrics::elevated-text-entropy-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 4096)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE Rich header present (MSVC toolchain)",
            "e": [
              "pe.rich_header_present = 1.00"
            ],
            "i": "metadata/binary/resource::rich-header-present",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "OriginalFilename field marker",
            "e": [
              "OriginalFilename"
            ],
            "i": "well-known/malware/worm/ludbaruma::originalfilename-field",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.35"
            ],
            "i": "metadata/binary/metrics::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2
          },
          {
            "c": 0.9980000257492065,
            "d": "Kawaii-Unicorn original filename",
            "e": [
              "Kawaii-Unicorn.exe"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::kawaii-unicorn-original-filename",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.9399999976158142,
            "d": "VB6 runtime DLL reference",
            "e": [
              "MSVBVM60.DLL"
            ],
            "i": "metadata/binary/framework::vb6-runtime-dll",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Zero recovered functions",
            "e": [
              "binary.function_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 243.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.export_timestamp_present = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE header compile timestamp predates 2025",
            "e": [
              "pe.timestamp = 1547944320.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "FileVersion field marker",
            "e": [
              "FileVersion"
            ],
            "i": "well-known/malware/worm/ludbaruma::fileversion-field",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.35"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 479385.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2
          },
          {
            "c": 0.9800000190734863,
            "d": "user32 dynamic dispatch target",
            "e": [
              "user32"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Photoshop XMP creator tool tag",
            "e": [
              "out=\"\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmlns:dc=\"http://purl.org/dc/ele (contains: xmp:CreatorTool=\"Adobe Photoshop CC "
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::photoshop-xmp-creator-tool",
            "l": 4
          },
          {
            "c": 0.9900000095367432,
            "d": ".die extension payload marker",
            "e": [
              ".die"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::die-extension",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 25+ imports",
            "e": [
              "binary.import_count = 67.00"
            ],
            "i": "metadata/binary/metrics::many-imports-25",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols::no-exports",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Layered window opacity API",
            "e": [
              "SetLayeredWindowAttributes"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::layered-window-attributes",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductVersion metadata field",
            "e": [
              "ProductVersion"
            ],
            "i": "metadata/package/versioning::pe-productversion-field",
            "l": 2
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.function_count = 0.00"
            ],
            "i": "metadata/binary/metrics::no-functions",
            "l": 2
          },
          {
            "c": 0.9950000047683716,
            "d": "UTF-16 .die payload marker",
            "e": [
              "2e 00 64 00 69 00 65 00"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::die-extension-utf16",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileVersion metadata field",
            "e": [
              "FileVersion"
            ],
            "i": "metadata/package/versioning::pe-fileversion-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ProductVersion field marker",
            "e": [
              "ProductVersion"
            ],
            "i": "well-known/malware/worm/ludbaruma::productversion-field",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Very few functions for code section size",
            "e": [
              "binary.function_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "Oversized resource section for a DLL",
            "e": [
              "pe.rsrc_size = 294912.00"
            ],
            "i": "well-known/malware/trojan/shellobject::xll-large-rsrc-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PE version resource structure",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "metadata/package/versioning::pe-version-resource",
            "l": 2
          },
          {
            "c": 0.9950000047683716,
            "d": "Adobe Photoshop CC decoy tag",
            "e": [
              "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))",
              "\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85f-119c665623ef\" stEvt:when=\"20 (contains: Adobe Photoshop CC 2018 (Windows))",
              "Evt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"2018-1 (contains: Adobe Photoshop CC 2018 (Windows))",
              "out=\"\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmlns:dc=\"http://purl.org/dc/ele (contains: Adobe Photoshop CC 2018 (Windows))"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::photoshop-cc-decoy",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 20+ imports",
            "e": [
              "binary.import_count = 67.00"
            ],
            "i": "metadata/binary/metrics::many-imports-20",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Low function count metric",
            "e": [
              "binary.function_count = 0.00"
            ],
            "i": "metadata/binary/metrics/markers::low-function-count-marker",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "VB6 __vbaVarCat string concatenation",
            "e": [
              "vbaVarCat"
            ],
            "i": "micro-behaviors/data/string/operations::vb6-string-construction-cat",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Microsoft Visual string",
            "e": [
              "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB"
            ],
            "i": "metadata/lang/compiler/native::ms-visual",
            "l": 2
          },
          {
            "a": "T1027.003",
            "c": 0.9900000095367432,
            "d": "PE checksum mismatch",
            "e": [
              "pe.checksum_mismatch = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png",
            "l": 1,
            "m": "F0001.006"
          },
          {
            "c": 0.9900000095367432,
            "d": "ANSI window style query API",
            "e": [
              "GetWindowLongA"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "MSVBVM60 runtime marker",
            "e": [
              "MSVBVM60.DLL"
            ],
            "i": "well-known/malware/worm/ludbaruma::msvbvm60-runtime",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Embedded cmd rename command",
            "e": [
              "cmd /c rename \""
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::rename-command",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 30+ imports",
            "e": [
              "binary.import_count = 67.00"
            ],
            "i": "metadata/binary/metrics::many-imports-30",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "c": 0.9950000047683716,
            "d": "UTF-16 cmd rename command",
            "e": [
              "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::rename-command-utf16",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "VB6 runtime helper import",
            "e": [
              "__vbaExceptHandler"
            ],
            "i": "metadata/binary/framework::vb6-runtime-core-helper",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 67.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.949999988079071,
            "d": "cmd interpreter marker encoded",
            "e": [
              "cmd /c rename \""
            ],
            "i": "metadata/lang/encoded/wide::shell-interpreter-cmd",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 50+ imports",
            "e": [
              "binary.import_count = 67.00"
            ],
            "i": "metadata/binary/metrics::many-imports-50",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 1.0,
            "d": "Binary contains high-entropy data regions",
            "e": [
              "binary.high_entropy_regions = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.84"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening::no-pie",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 1.00"
            ],
            "i": "metadata/binary/symbols::pe-single-import-dll",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 40+ imports",
            "e": [
              "binary.import_count = 67.00"
            ],
            "i": "metadata/binary/metrics::many-imports-40",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Large PE resource section",
            "e": [
              "pe.rsrc_size = 294912.00"
            ],
            "i": "metadata/binary/framework::large-rsrc-section",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 479232.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "c": 0.9950000047683716,
            "d": "Kawaii-Unicorn version identity",
            "e": [
              "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)",
              "Kawaii-Unicorn (contains: Kawaii-Unicorn)"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::kawaii-unicorn-product",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "CompanyName field marker",
            "e": [
              "CompanyName"
            ],
            "i": "well-known/malware/worm/ludbaruma::companyname-field",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO (contains: VS_VERSION_INFO)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.009",
            "c": 0.9700000286102295,
            "d": "Embedded cmd rename command",
            "e": [
              "cmd /c rename \""
            ],
            "i": "objectives/command-and-control/dropper/binder::cmd-rename-command",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "MSVBVM60 runtime marker",
            "e": [
              "MSVBVM60.DLL"
            ],
            "i": "well-known/malware/trojan/shellobject::msvbvm60-runtime",
            "l": 1
          },
          {
            "c": 0.996999979019165,
            "d": "Photoshop XMP history agent",
            "e": [
              "\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85f-119c665623ef\" stEvt:when=\"20 (contains: stEvt:softwareAgent=\"Adobe Photoshop",
              "Evt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"2018-1 (contains: stEvt:softwareAgent=\"Adobe Photoshop"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::photoshop-xmp-history-agent",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "VB6 event sink helper",
            "e": [
              "EVENT_SINK_AddRef",
              "EVENT_SINK_Release",
              "EVENT_SINK_QueryInterface"
            ],
            "i": "metadata/binary/framework::vb6-runtime-event-helper",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "VB6 runtime binary file write",
            "e": [
              "vbaPutOwner3"
            ],
            "i": "micro-behaviors/fs/file/write::vb6-put-owner3",
            "l": 3
          },
          {
            "c": 0.9399999976158142,
            "d": "VB6 DllFunctionCall thunk",
            "e": [
              "DllFunctionCall"
            ],
            "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call",
            "l": 3
          },
          {
            "a": "T1027.009",
            "c": 0.9800000190734863,
            "d": "Dropped .die extension marker",
            "e": [
              ".die"
            ],
            "i": "objectives/command-and-control/dropper/binder::die-extension",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Signed PE checksum mismatch",
            "e": [
              "pe.checksum_mismatch = 1.00"
            ],
            "i": "metadata/binary/layout::signed-pe-checksum-mismatch",
            "l": 1
          },
          {
            "a": "T1489",
            "c": 0.699999988079071,
            "d": "Versioned service stop context",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/impact/services/stop::versioned-service-stop-context",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Low function count metric",
            "e": [
              "binary.function_count = 0.00"
            ],
            "i": "metadata/binary/anomaly::low-function-count-marker",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "SetLayeredWindowAttributes"
            ],
            "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Large low-entropy PE resources",
            "e": [
              ".rsrc (size: 294912, entropy: 2.48)"
            ],
            "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc",
            "l": 2
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.8500000238418579,
            "d": "Large null run in executable (64+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed::unsigned",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/metrics::few-sections",
            "l": 2
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE checksum mismatch (modified binary)",
            "e": [
              "pe.checksum_mismatch = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-mismatch",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Unusual PE section alignment",
            "e": [
              "pe.unusual_alignment = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload::unusual-alignment-pe",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PE code-to-data ratio below 0.08",
            "e": [
              "binary.code_to_data_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::code-data-ratio-below-008",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links MSVBVM60.DLL (CIcos, adj_fptan, vbaVarMove, vbaFreeVar, ORDINAL 588, ... +62 more)",
            "e": [
              "MSVBVM60.DLL"
            ],
            "i": "metadata/dylib::msvbvm60/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Visual Basic 6 application framework",
            "e": [
              "MSVBVM60.DLL",
              "EVENT_SINK_Release",
              "EVENT_SINK_QueryInterface",
              "__vbaExceptHandler",
              "EVENT_SINK_AddRef"
            ],
            "i": "metadata/binary/framework::vb6-application-framework",
            "l": 2
          },
          {
            "c": 0.996999979019165,
            "d": "VB6 hidden window user32 dispatch",
            "e": [
              "GetWindowLongA",
              "SetLayeredWindowAttributes",
              "SetWindowLongA",
              "user32",
              "DllFunctionCall"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::hidden-window-user32-dispatch",
            "l": 4
          },
          {
            "c": 0.949999988079071,
            "d": "VB6 runtime opens and writes file",
            "e": [
              "vbaFileOpen",
              "vbaPutOwner3"
            ],
            "i": "micro-behaviors/fs/file/write::vb6-binary-file-write",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "PE version resource metadata",
            "e": [
              "FileVersion",
              "VS_VERSION_INFO",
              "ProductVersion"
            ],
            "i": "metadata/package/versioning::version-resource-metadata",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "VB6 runtime API dispatch",
            "e": [
              "DllFunctionCall",
              "EVENT_SINK_QueryInterface",
              "EVENT_SINK_AddRef",
              "MSVBVM60.DLL",
              "EVENT_SINK_Release",
              "__vbaExceptHandler"
            ],
            "i": "micro-behaviors/dylib/lookup::vb6-runtime-api-dispatch",
            "l": 3
          },
          {
            "c": 0.9950000047683716,
            "d": "Rename executable extension to .die",
            "e": [
              "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00",
              ".exe",
              "2e 00 64 00 69 00 65 00",
              "cmd /c rename \"",
              ".die"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::rename-to-die",
            "l": 4
          },
          {
            "c": 0.9950000047683716,
            "d": "Renames executable aside to .die",
            "e": [
              "2e 00 64 00 69 00 65 00",
              ".die",
              "Kawaii-Unicorn.exe",
              "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00",
              "Kawaii-Unicorn (contains: Kawaii-Unicorn)",
              "cmd /c rename \"",
              "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)",
              ".exe"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::die-rename-hijack-primitive",
            "l": 4
          },
          {
            "c": 0.9990000128746033,
            "d": "ShellObject VB6 hidden-window hijacker",
            "e": [
              "SetLayeredWindowAttributes",
              "out=\"\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmlns:dc=\"http://purl.org/dc/ele (contains: Adobe Photoshop CC 2018 (Windows))",
              ".exe",
              "Kawaii-Unicorn.exe",
              "2e 00 64 00 69 00 65 00",
              "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00",
              "DllFunctionCall",
              "user32",
              "\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85f-119c665623ef\" stEvt:when=\"20 (contains: Adobe Photoshop CC 2018 (Windows))",
              "SetWindowLongA",
              "Kawaii-Unicorn (contains: Kawaii-Unicorn)",
              "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)",
              "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))",
              "Evt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"2018-1 (contains: Adobe Photoshop CC 2018 (Windows))",
              "cmd /c rename \"",
              ".die"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-hidden-window-hijacker",
            "l": 5
          },
          {
            "c": 0.9990000128746033,
            "d": "Kawaii-Unicorn VB6 dropper cluster",
            "e": [
              ".exe",
              ".die",
              "2e 00 64 00 69 00 65 00",
              "Kawaii-Unicorn.exe",
              "Kawaii-Unicorn (contains: Kawaii-Unicorn)",
              "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)",
              "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00",
              "SetLayeredWindowAttributes",
              "SetWindowLongA",
              "DllFunctionCall",
              "GetWindowLongA",
              "user32",
              "cmd /c rename \""
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-unicorn-dropper",
            "l": 5
          },
          {
            "c": 0.9990000128746033,
            "d": "ShellObject VB6 dispatch hijacker cluster",
            "e": [
              "MSVBVM60.DLL",
              "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))",
              "Evt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"2018-1 (contains: Adobe Photoshop CC 2018 (Windows))",
              "binary.section_count = 3.00",
              ".exe",
              "\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85f-119c665623ef\" stEvt:when=\"20 (contains: Adobe Photoshop CC 2018 (Windows))",
              "2e 00 64 00 69 00 65 00",
              "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)",
              "out=\"\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmlns:dc=\"http://purl.org/dc/ele (contains: Adobe Photoshop CC 2018 (Windows))",
              "DllFunctionCall",
              "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00",
              "cmd /c rename \"",
              ".die",
              "Kawaii-Unicorn (contains: Kawaii-Unicorn)",
              "Kawaii-Unicorn.exe"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-vb6-dispatch-hijacker",
            "l": 5
          },
          {
            "c": 0.9990000128746033,
            "d": "ShellObject VB6 Adobe decoy hijacker",
            "e": [
              "out=\"\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmlns:dc=\"http://purl.org/dc/ele (contains: xmp:CreatorTool=\"Adobe Photoshop CC ",
              "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)",
              "MSVBVM60.DLL",
              "2e 00 64 00 69 00 65 00",
              "Kawaii-Unicorn (contains: Kawaii-Unicorn)",
              ".exe",
              "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))",
              "binary.section_count = 3.00",
              "\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85f-119c665623ef\" stEvt:when=\"20 (contains: Adobe Photoshop CC 2018 (Windows))",
              "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00",
              "DllFunctionCall",
              "Evt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"2018-1 (contains: Adobe Photoshop CC 2018 (Windows))",
              ".die",
              "Kawaii-Unicorn.exe",
              "cmd /c rename \"",
              "out=\"\" xmlns:xmp=\"http://ns.adobe.com/xap/1.0/\" xmlns:dc=\"http://purl.org/dc/ele (contains: Adobe Photoshop CC 2018 (Windows))"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-adobe-hijacker",
            "l": 5
          }
        ],
        "sha": "cbfa6375984833a318d7eeaa69aadcdb4745df3b6c31c8ef2ce735722f532380",
        "path": "virussign.com_66150d5199d7fc91f195ee9d4669f790.vir",
        "type": "pe"
      }
    ],
    "tv": "0b014"
  }
}