{ "ml": { "v": "7", "eng": "2.9.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00022200744, "rte": "az", "prob": 0.00022200744 }, { "cls": 0, "raw": 0.0034828782, "rte": "az/native", "prob": 0.0034828782 }, { "cls": 0, "raw": 0.026019195, "rte": "az/pe", "prob": 0.026019195 } ], "prob": 0.00022200744, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00022200743842404336, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-13T05:28:03Z" }, "path": "Firefox Setup 153.2.0esr.exe", "raw": { "v": "8", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000[bJB*4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000GfAgh:6Q}f:6Q}f:6Q}fOhSCdo\u003cZ0-pDgrl!N7At", "ln": 0 }, { "b": "ve$lDx-GZ+z2!RSeDx${x-J2JeDx?(wDliuBPuBZx-JkPC(Pz@A@ZE=A@ZpZwDlMEw=M@NzuaeDBo31PzVBUPA@W=(yYDf\u0026eDvH9eDvE8000000000000000wDl@PBo0()z2!RSeDx${x-J2JeDxU*Bo3B-A@Y+KASvV\u003ewb{rzve$9zzVBzIvGprDCMoq}yYDf\u0026eDvH9eDvE80000", "ln": 188832 }, { "b": "0000000000000000000000000000002lj-70001H1onA40001H2(\u003c@90001H0000000000\u0026opsz000000000000000]63kR00000:M-\u003cc000000o%T^000004^Bb@00000bi/mg00000hTgwA00000mcT\u003cO00000r{x+!00000wA\u003cl%00000A{r-b00000GZ5Tt00000L\u003cetJ00000R0n3Z00000U\u003c8q\u003c00000YY]O000000!ANbo000000000000000WGfruwO=fKCX7xcBy^)=r@+C+lUG[GrD8[*A-SkvHYZN?z*bn%zE^Wf0049yq!p5Lx(mE1Ct8{)xhAX\u003cr@?y:m}D^zx(mE1Ct8{)x8", "ln": 250640 } ], "mol": "Md₂(BiSi₂)", "sha": "cc4c2c1a2f2009aa7fb523a11ad367aba081d9ac61ba0821c8a7a84af72f3be6", "path": "Firefox Setup 153.2.0esr.exe", "risk": 3, "size": 84153560, "type": "pe", "facts": { "imp": [ [ "kernel32", "VirtualFree" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "GetSystemDirectoryW" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "CreateEventW" ], [ "kernel32", "GetLastError" ], [ "kernel32", "SetEvent" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "ResetEvent" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "LoadLibraryW" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "FormatMessageW" ], [ "kernel32", "LocalFree" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "SetFileTime" ], [ "kernel32", "SetFileAttributesW" ], [ "kernel32", "RemoveDirectoryW" ], [ "kernel32", "CreateDirectoryW" ], [ "kernel32", "DeleteFileW" ], [ "kernel32", "SetLastError" ], [ "kernel32", "SetCurrentDirectoryW" ], [ "kernel32", "GetCurrentDirectoryW" ], [ "kernel32", "GetTempPathW" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "FindClose" ], [ "kernel32", "FindFirstFileW" ], [ "kernel32", "FindNextFileW" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetFileAttributesW" ], [ "kernel32", "GetFileSize" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "ReadFile" ], [ "kernel32", "WriteFile" ], [ "kernel32", "SetEndOfFile" ], [ "kernel32", "GetProcessAffinityMask" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "GetSystemInfo" ], [ "kernel32", "GlobalMemoryStatusEx" ], [ "kernel32", "GetFileInformationByHandle" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "WaitForMultipleObjects" ], [ "kernel32", "Sleep" ], [ "kernel32", "CreateFileMappingW" ], [ "kernel32", "MapViewOfFile" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "CreateProcessW" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "InitializeSListHead" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "GetStartupInfoW" ], [ "kernel32", "RtlUnwindEx" ], [ "kernel32", "RtlLookupFunctionEntry" ], [ "kernel32", "RtlPcToFileHeader" ], [ "kernel32", "RaiseException" ], [ "kernel32", "FlsAlloc" ], [ "kernel32", "FlsGetValue" ], [ "kernel32", "FlsSetValue" ], [ "kernel32", "FlsFree" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "InitializeCriticalSectionEx" ], [ "kernel32", "CreateThread" ], [ "kernel32", "ExitThread" ], [ "kernel32", "FreeLibraryAndExitThread" ], [ "kernel32", "GetModuleHandleExW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "HeapFree" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "InitializeCriticalSectionAndSpinCount" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsFree" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "FindFirstFileExW" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "GetFileType" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "HeapSize" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "GetConsoleCP" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "SetFilePointerEx" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "VirtualProtect" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "LoadLibraryExA" ], [ "shell32", "ShellExecuteExW" ], [ "oleaut32", "ORDINAL 7" ], [ "oleaut32", "ORDINAL 4" ], [ "oleaut32", "ORDINAL 9" ], [ "user32", "CharUpperW" ], [ "user32", "LoadIconW" ], [ "user32", "ShowWindow" ], [ "user32", "SetWindowLongPtrW" ], [ "user32", "GetWindowLongPtrW" ], [ "user32", "GetDlgItem" ], [ "user32", "DialogBoxParamW" ], [ "user32", "LoadStringW" ], [ "user32", "MessageBoxW" ], [ "user32", "SetWindowTextW" ], [ "user32", "SendMessageW" ], [ "user32", "PostMessageW" ], [ "user32", "SetTimer" ], [ "user32", "KillTimer" ], [ "user32", "EndDialog" ], [ "user32", "DestroyWindow" ] ], "sec": [ [ ".text", 1024, 181760, 6.42, "r-x" ], [ ".rdata", 182784, 71680, 3.98, "r--" ], [ ".data", 254464, 6656, 3.66, "rw-" ], [ ".pdata", 261120, 6656, 5.34, "r--" ], [ ".rsrc", 267776, 65024, 7.5, "r--" ], [ ".reloc", 332800, 3072, 5.44, "r--" ] ], "metrics": { "pe": { "has_cfg": 1, "checksum": 84181939, "timestamp": 1569262090, "icon_count": 2, "image_size": 360448, "has_overlay": 1, "overlay_end": 84139848, "has_manifest": 1, "headers_size": 1024, "overlay_size": 83803976, "checksum_valid": 0, "file_alignment": 512, "overlay_offset": 335872, "resource_count": 6, "cert_table_size": 13712, "overlay_padding": 83803976, "has_version_info": 1, "computed_checksum": 84183414, "delay_import_count": 20, "headers_size_ratio": 0, "prose_section_count": 0, "reloc_overhang_bytes": 16, "reloc_overhang_ratio": 0.01, "bss_like_section_count": 0, "section_overflow_count": 0, "signature_expired_days": -117.77, "misaligned_section_count": 0, "version.identity_entropy": 3.37, "base_relocation_block_count": 10, "base_relocation_entry_count": 1483, "declared_data_directory_count": 9, "version.identity_symbol_ratio": 0, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 84153560, "entropy": 8 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 6.42, "data_entropy": 3.66, "overlay_size": 83817688, "string_count": 70010, "overlay_ratio": 1, "overlay_entropy": 8, "entropy_variance": 1.75, "avg_string_length": 4.85, "max_string_length": 168, "peak_region_bytes": 83851264, "code_to_data_ratio": 0.96, "peak_region_entropy": 7.87, "string_length_stddev": 2.18, "largest_section_ratio": 0, "sentence_string_count": 62, "sentence_string_ratio": 0, "high_entropy_string_count": 2 }, "imports": { "count": 129 }, "sections": { "count": 6, "code_size": 181760, "entropy_max": 7.5, "entropy_mean": 5.39, "name_entropy": 3.24, "writable_count": 1, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "ident": { "name": { "value": "7zSD.sfx", "source": "pe.version.original_filename", "verified": false }, "trust": "ca_signed", "signer": { "issuer": "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\\, Inc.,C=US", "source": "pe.signatures[0]", "subject": "CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=San Francisco,ST=California,C=US", "signed_at": "2026-08-26T17:19:38Z", "common_name": "Mozilla Corporation", "organization": "Mozilla Corporation" }, "project": { "value": "Firefox", "source": "pe.version.product_name", "verified": false }, "version": { "value": "18.05", "source": "pe.version.file_version", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "6bfc0ae7ad878d4dbf9e9ec9d09535b0c65b083acd5d58a71c1e883323bb52b3" }, "organization": { "value": "Mozilla Corporation", "source": "pe.signatures[0]", "verified": true } }, "traits": [ { "id": "metadata/signed/unknown::mozilla-corporation", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Mozilla Corporation" }, { "id": "metadata/signed/leaf::mozilla-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Mozilla Corporation" }, { "id": "metadata/binary/anomaly/signing::signed-pe-large-noncertificate-overlay", "conf": 0.9, "crit": 3, "desc": "Signed PE has large non-certificate overlay", "spans": [ [ 0, 32 ] ] } ] } ] } }