{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.18284264, "rte": "az", "prob": 0.18284264 }, { "cls": 0, "raw": 0.19223866, "rte": "az/native", "prob": 0.19223866 }, { "cls": 0, "raw": 0.5879337, "rte": "az/pe", "prob": 0.5879337 } ], "prob": 0.18284264, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.18284264206886292, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T03:02:10Z" }, "path": "ccb9fd4873fc3c3a390f2ae7e3d04fb8b8431ead88f1ebeba681d92678e7c9e3.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtg{A8b1(0000000000?#A/V3JQRn0pRuo00", "l": 0, "n": [ { "c": 3, "d": "PE binary has trailing overlay data", "i": "metadata/binary/layout::has-overlay", "o": 0, "z": 25 } ], "x": true }, { "b": "0171{00000zX\u0026xN3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "l": 2610668, "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 2610684, "z": 4 } ], "x": true }, { "b": "000000000Yo(BM+y?k^gq*ACawO\u003c4\u003epxjssB97#ge(#+8wn=Wke\u003e][/x\u003c?0UB7ocey?WtUmQ{1wv}oaUvp:4X08mfqA=l2qw]]Uax(!A9y^IMKx\u003e4cxxMvV)wb]qwvpPv7wmLWYwPRoUx(4uPz!9zVlui", "l": 2611950, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 2611997, "z": 8 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 2611966, "z": 9 }, { "c": 2, "d": "Visual Basic runtime reference", "i": "metadata/lang/compiler/managed::visual-basic-runtime", "o": 2612019, "z": 21 } ], "x": true }, { "b": "y\u0026%p?mQ{1wv}oaUvp:4Xe[Gos08^lywn=s0DsW7PD2[7sz7X!3A+eV\u0026x(mL-m}D^v", "l": 2612184, "n": [ { "c": 2, "d": ".exe extension reference", "i": "micro-behaviors/fs/path/extension::exe-dup", "o": 2612200, "z": 4 } ], "x": true }, { "b": "wPI^jA:@W407y)IvqG#+q*ACawO\u003c53x(mE1Cxkxaz/PYo08^@SBzkP6nm=QRwPz?(lVl^VA=Rk4wPRoWx\u003eqHc", "l": 2612651, "n": [ { "c": 2, "d": "Windows Forms UI framework", "i": "metadata/lang/compiler/managed::winforms-ui", "o": 2612667, "z": 20 } ], "x": true }, { "b": "AZ+j:o\u003c}:N0bV^!z/PA2e[w^m000000rjtBav2]b0000000000000000000000000", "l": 2617589, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 2617605, "z": 4 } ], "x": true }, { "b": "00000000000000000000001zE3\u0026*nc5i*c{000000000000000000000000000000000", "l": 2617840, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 2617856, "z": 6 } ], "x": true } ], "idn": { "trust": "self_signed", "signer": { "issuer": "C=US,L=New York,OU=Dfadffcacfffbbdbfaf,O=Fbeceafeeeffdabcec,CN=Cfdacacd", "source": "pe.signatures[0]", "subject": "C=US,L=New York,OU=Dfadffcacfffbbdbfaf,O=Fbeceafeeeffdabcec,CN=Cfdacacd", "common_name": "Cfdacacd", "organization": "Fbeceafeeeffdabcec" }, "unique_ids": { "authenticode_thumbprint_sha256": "021085e92de249d996db53ed9972f772e34e9a1be2f85102c71a40590c325c9c" }, "organization": { "value": "Fbeceafeeeffdabcec", "source": "pe.signatures[0]", "verified": true } }, "mol": "Md₂(BiSi₂)", "sha": "ccb9fd4873fc3c3a390f2ae7e3d04fb8b8431ead88f1ebeba681d92678e7c9e3", "fact": { "id": "pe", "imp": [ [ "mscoree", "CorExeMain" ] ], "met": { "pe": { "checksum": 2654457.0, "checksum_valid": 1.0, "cert_table_size": 6272.0, "computed_checksum": 2654457.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 2624640.0, "entropy": 4.92, "size_bytes": 2624640.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 4.91, "overlay_size": 6272.0, "string_count": 133.0, "overlay_ratio": 0.0, "overall_entropy": 4.92, "overlay_entropy": 7.51, "entropy_variance": 5.84, "avg_string_length": 17.92, "max_string_length": 66.0, "code_to_data_ratio": 1.0, "string_length_stddev": 13.16, "largest_section_ratio": 1.0, "sentence_string_count": 8.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 2617344.0, "entropy_max": 4.91, "entropy_mean": 2.5, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 512, 2617344, 4.91, "r-x" ], [ ".reloc", 2617856, 512, 0.08, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 268012, "u8", "% sh" ], [ 2610684, "u8", "BSJB" ], [ 2611957, "u8", "\u003cModule\u003e" ], [ 2611966, "u8", "System.IO" ], [ 2611976, "u8", "System.Windows.Media" ], [ 2611997, "u8", "mscorlib" ], [ 2612006, "u8", "Fcefcddaaefc" ], [ 2612019, "u8", "Microsoft.VisualBasic" ], [ 2612041, "u8", "Thread" ], [ 2612048, "u8", "Load" ], [ 2612057, "u8", "set_TileMode" ], [ 2612070, "u8", "BrushMappingMode" ], [ 2612087, "u8", "Invoke" ], [ 2612094, "u8", "WriteLine" ], [ 2612104, "u8", "Combine" ], [ 2612112, "u8", "PresentationCore" ], [ 2612129, "u8", "MethodBase" ], [ 2612140, "u8", "WindowsBase" ], [ 2612152, "u8", "get_White" ], [ 2612162, "u8", "Write" ], [ 2612168, "u8", "Byte" ], [ 2612173, "u8", "GetObjectValue" ], [ 2612188, "u8", "Fcefcddaaefc.exe" ], [ 2612205, "u8", "Randomize" ], [ 2612215, "u8", "System.Threading" ], [ 2612232, "u8", "GetString" ], [ 2612242, "u8", "GeometryDrawing" ], [ 2612258, "u8", "Debug" ], [ 2612264, "u8", "set_Brush" ], [ 2612274, "u8", "TileBrush" ], [ 2612284, "u8", "DrawingBrush" ], [ 2612297, "u8", "SolidColorBrush" ], [ 2612313, "u8", "VBMath" ], [ 2612320, "u8", "Path" ], [ 2612325, "u8", "System" ], [ 2612332, "u8", "get_Children" ], [ 2612345, "u8", "AppDomain" ], [ 2612355, "u8", "GetDomain" ], [ 2612365, "u8", "Join" ], [ 2612370, "u8", "Application" ], [ 2612382, "u8", "System.Reflection" ], [ 2612400, "u8", "DrawingCollection" ], [ 2612418, "u8", "GeometryCollection" ], [ 2612437, "u8", "MissingManifestResourceException" ], [ 2612470, "u8", "StringComparison" ], [ 2612487, "u8", "MethodInfo" ], [ 2612498, "u8", "DrawingGroup" ], [ 2612511, "u8", "GeometryGroup" ], [ 2612525, "u8", "ResourceManager" ], [ 2612541, "u8", "IMessageFilter" ], [ 2612556, "u8", "AddMessageFilter" ], [ 2612573, "u8", "Color" ], [ 2612579, "u8", ".ctor" ], [ 2612585, "u8", ".cctor" ], [ 2612592, "u8", "System.Diagnostics" ], [ 2612611, "u8", "System.Runtime.CompilerServices" ], [ 2612643, "u8", "System.Resources" ], [ 2612660, "u8", "Equals" ], [ 2612667, "u8", "System.Windows.Forms" ], [ 2612688, "u8", "RuntimeHelpers" ], [ 2612703, "u8", "Colors" ], [ 2612710, "u8", "set_ViewportUnits" ], [ 2612728, "u8", "DoEvents" ], [ 2612737, "u8", "System.Windows" ], [ 2612752, "u8", "Concat" ], [ 2612759, "u8", "Format" ], [ 2612766, "u8", "Rect" ], [ 2612771, "u8", "Object" ], [ 2612778, "u8", "get_EntryPoint" ], [ 2612793, "u8", "set_Viewport" ], [ 2612806, "u8", "get_Gray" ], [ 2612815, "u8", "Assembly" ], [ 2612824, "u8", "set_Geometry" ], [ 2612837, "u8", "RectangleGeometry" ], [ 2615916, "u8", "e765ee41-dece-4337-8bee-d098076410a2" ], [ 2615990, "u8", "bbae0a05-364d-485b-b33d-7efedb8c654c" ], [ 2616064, "u8", "0b8a4827-4cb6-4064-9993-a0a9c5e0fbcf" ], [ 2616196, "u8", "991ad547-1df6-4086-8af4-d20f6202d4a9" ], [ 2616270, "u8", "743c72c4-c377-4434-a78c-85dcfbdfc574" ], [ 2616344, "u8", "dce48951-4c3d-40e5-8b5d-fdc0a334f4d3" ], [ 2616418, "u8", "f1d7421b-7948-430d-95aa-ae10d20670b1" ], [ 2616492, "u8", "9e12f64b-1035-46e2-a325-cba4430a3aac" ], [ 2616566, "u8", "1838f258-bcc0-4a2a-a155-3e7e38d73e57" ], [ 2616640, "u8", "51b21183-2b99-4070-8a7f-d48ba9b9e141" ], [ 2617598, "u8", "mscoree.dll" ], [ 2618434, "u8", "N0L0" ], [ 2618500, "u8", "V1OL" ], [ 2618576, "u8", "Cfdacacd1" ], [ 2618595, "u8", "Fbeceafeeeffdabcec1" ], [ 2618624, "u8", "Dfadffcacfffbbdbfaf1" ], [ 2618679, "u8", "201214113721Z" ], [ 2618694, "u8", "211214113721Z0n1" ], [ 2618982, "u8", "C0A0" ], [ 2619823, "u8", "20201214113722Z" ], [ 2619871, "u8", "Greater Manchester1" ], [ 2619900, "u8", "Salford1" ], [ 2619918, "u8", "Sectigo Limited1,0*" ], [ 2619943, "u8", "#Sectigo RSA Time Stamping Signer #2" ], [ 2620103, "u8", "Sectigo Limited1%0#" ], [ 2620129, "u8", "Sectigo RSA Time Stamping CA0" ], [ 2620176, "u8", "320122235959Z0" ], [ 2620288, "u8", "#Sectigo RSA Time Stamping Signer #20" ], [ 2620807, "u8", "vIhb" ], [ 2621008, "u8", "90705" ], [ 2621043, "u8", "https://sectigo.com/CPS0D" ], [ 2621084, "u8", "3http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" ], [ 2621165, "u8", "3http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" ], [ 2621231, "u8", "http://ocsp.sectigo.com0" ], [ 2621327, "u8", "WUpKN" ], [ 2621859, "u8", "New Jersey1" ], [ 2621880, "u8", "Jersey City1" ], [ 2621902, "u8", "The USERTRUST Network1.0," ], [ 2621933, "u8", "%USERTrust RSA Certification Authority0" ], [ 2621975, "u8", "190502000000Z" ], [ 2622836, "u8", "I0G0E" ], [ 2622846, "u8", "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" ], [ 2622939, "u8", "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" ], [ 2623005, "u8", "http://ocsp.usertrust.com0" ], [ 2623208, "u8", "mAmg" ], [ 2623675, "u8", "Sectigo RSA Time Stamping CA" ], [ 2624048, "u8", "%USERTrust RSA Certification Authority" ], [ 2615916, "wide", "e765ee41-dece-4337-8bee-d098076410a2" ], [ 2615990, "wide", "bbae0a05-364d-485b-b33d-7efedb8c654c" ], [ 2616064, "wide", "0b8a4827-4cb6-4064-9993-a0a9c5e0fbcf" ], [ 2616196, "wide", "991ad547-1df6-4086-8af4-d20f6202d4a9" ], [ 2616270, "wide", "743c72c4-c377-4434-a78c-85dcfbdfc574" ], [ 2616344, "wide", "dce48951-4c3d-40e5-8b5d-fdc0a334f4d3" ], [ 2616418, "wide", "f1d7421b-7948-430d-95aa-ae10d20670b1" ], [ 2616492, "wide", "9e12f64b-1035-46e2-a325-cba4430a3aac" ], [ 2616566, "wide", "1838f258-bcc0-4a2a-a155-3e7e38d73e57" ], [ 2616640, "wide", "51b21183-2b99-4070-8a7f-d48ba9b9e141" ] ], "val": { "file.stem": "ccb9fd4873fc3c3a390f2ae7e3d04fb8b8431ead88f1ebeba681d92678e7c9e3", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1607945840, "file.basename": "ccb9fd4873fc3c3a390f2ae7e3d04fb8b8431ead88f1ebeba681d92678e7c9e3.exe", "pe.image_base": 4194304, "pe.image_size": 2637824, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 2625294, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "d057368fff211660945da8d2c88261cf10748072", "pe.image_hash.sha256": "eac0a2374e91e7d9889033aacea03fd1ecd0d056314f4cd294cc017a7d0b43b5", "pe.image_hash.sha384": "4ae2f6cb17a44083b7219fea136c6001f1dfe850521bbd503f053afa65ca7f8a8e5b6538bd2a1c748998cfe6de6d9bca", "pe.image_hash.sha512": "9a77b21e0bca64675f7b88e720c704a5279a17e8f9a1b0c8d06740087e327b23fb368428ef2e926ebf16b0b1e1b9e443060c012effab99f4f8385e107898a2fd", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=Dfadffcacfffbbdbfaf,O=Fbeceafeeeffdabcec,CN=Cfdacacd", "pe.signatures[0].serial": "1181c6625b5dab3e672f1e2f2dd52035", "pe.signatures[0].subject": "C=US,L=New York,OU=Dfadffcacfffbbdbfaf,O=Fbeceafeeeffdabcec,CN=Cfdacacd", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 2625216, "pe.data_directories[1].rva": 2618368, "pe.data_directories[2].rva": 2629632, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-12-14T11:37:21Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 6272, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-12-14T11:37:21Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "c6262abbb3e2761e0afd28e5692365a012796d5f", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "eac0a2374e91e7d9889033aacea03fd1ecd0d056314f4cd294cc017a7d0b43b5", "pe.signatures[0].thumbprint_sha256": "021085e92de249d996db53ed9972f772e34e9a1be2f85102c71a40590c325c9c", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" } }, "find": [ { "id": "metadata/signed/unknown::cfdacacd", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Cfdacacd" }, { "id": "metadata/signed/leaf::fbeceafeeeffdabcec", "conf": 1.0, "crit": 3, "desc": "Signed by Fbeceafeeeffdabcec" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)" }, { "id": "metadata/binary/layout::has-overlay", "conf": 1.0, "crit": 3, "desc": "PE binary has trailing overlay data" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "metadata/signed/certificate::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" } ], "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-12/ccb9fd4873fc3c3a390f2ae7e3d04fb8b8431ead88f1ebeba681d92678e7c9e3.exe", "risk": 4, "size": 2624640, "type": "pe" } ] } }