{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8344548940658569, "class": 0 } ], "prob": 0.8344549, "class": 0, "models": [ { "m": "az", "prob": 0.8344549, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:01:15Z" }, "path": "20817", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₄Si)", "k": { "pe.timestamp": 1301422829, "hash.authenti": "fc27ee81fe4801ef8dbea9096901e6067a7ca35edcbb649fdfaba8a493d885b7", "hash.rich_header": "a02c09945858f68ac69517b4d2c1b735c048d5e4429d68c1bb1be7c9e93f48ed", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.rich_header.xor_key": "0x093a3479", "pe.inflated_sections[0]": ".text", "pe.data_directories[0].rva": 20768, "pe.data_directories[1].rva": 40960, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 100, "pe.rich_header_compids[0].count": 1, "pe.rich_header_compids[1].count": 3, "pe.rich_header_compids[2].count": 11, "pe.rich_header_compids[3].count": 2, "pe.rich_header_compids[4].count": 7, "pe.rich_header_compids[5].count": 68, "pe.rich_header_compids[6].count": 4, "pe.rich_header_compids[7].count": 1, "binary.top_complex_unnamed[0].cc": 17, "pe.rich_header_compids[0].compid": 793723, "pe.rich_header_compids[1].compid": 924803, "pe.rich_header_compids[2].compid": 663407, "pe.rich_header_compids[3].compid": 270191, "pe.rich_header_compids[4].compid": 6098883, "pe.rich_header_compids[5].compid": 65536, "pe.rich_header_compids[6].compid": 729064, "pe.rich_header_compids[7].compid": 394951, "binary.top_complex_unnamed[0].bbs": 26, "pe.rich_header_compids[5].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x40a071", "binary.top_complex_unnamed[0].size": 712, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.section_characteristics[4].name": ".dat6", "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 3, "pe.rich_header.entries[2].use_count": 11, "pe.rich_header.entries[3].use_count": 2, "pe.rich_header.entries[4].use_count": 7, "pe.rich_header.entries[5].use_count": 68, "pe.rich_header.entries[6].use_count": 4, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[0].product_id": 12, "pe.rich_header.entries[1].product_id": 14, "pe.rich_header.entries[2].product_id": 10, "pe.rich_header.entries[3].product_id": 4, "pe.rich_header.entries[4].product_id": 93, "pe.rich_header.entries[5].product_id": 1, "pe.rich_header.entries[6].product_id": 11, "pe.rich_header.entries[7].product_id": 6, "pe.rich_header.entries[0].build_number": 7291, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 7299, "pe.rich_header.entries[1].product_name": "Export_VC2003", "pe.rich_header.entries[2].build_number": 8047, "pe.rich_header.entries[2].product_name": "Linker_v6", "pe.rich_header.entries[3].build_number": 8047, "pe.rich_header.entries[3].product_name": "Linker_VS_v6_or_earlier", "pe.rich_header.entries[4].build_number": 4035, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[6].build_number": 8168, "pe.rich_header.entries[6].product_name": "Cvt_Omf", "pe.rich_header.entries[7].build_number": 1735, "pe.rich_header.entries[7].product_name": "Cvt_Pgo_VS_v6_or_earlier", "pe.section_characteristics[0].raw_size": 2048, "pe.section_characteristics[4].raw_size": 18944, "pe.section_characteristics[0].virtual_size": 14133, "pe.section_characteristics[1].virtual_size": 1414, "pe.section_characteristics[2].virtual_size": 1084, "pe.section_characteristics[3].virtual_size": 11888, "pe.section_characteristics[4].virtual_size": 20480, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 20480, "pe.section_characteristics[2].virtual_address": 24576, "pe.section_characteristics[3].virtual_address": 28672, "pe.section_characteristics[4].virtual_address": 40960, "pe.section_characteristics[0].characteristics_hex": "e00000e0", "pe.section_characteristics[1].characteristics_hex": "e00000e0", "pe.section_characteristics[2].characteristics_hex": "e00000e0", "pe.section_characteristics[3].characteristics_hex": "e00000e0", "pe.section_characteristics[4].characteristics_hex": "e00000e0" }, "x": 5, "id": 0, "is": [ "ORDINAL 49592", "ORDINAL 47141", "ORDINAL 64", "ORDINAL 51595", "ORDINAL 53643", "ORDINAL 656", "ORDINAL 11300", "ORDINAL 62080", "ORDINAL 17942", "ORDINAL 13153", "", "ORDINAL 13300", "ORDINAL 7795", "ORDINAL 43583", "ORDINAL 4943", "ORDINAL 37148", "ORDINAL 2272", "ORDINAL 29440", "ORDINAL 16642", "ORDINAL 35563", "ORDINAL 4166", "ORDINAL 51507", "ORDINAL 59584", "ORDINAL 65535", "ORDINAL 58856", "ORDINAL 29439", "ORDINAL 2368", "ORDINAL 38550", "ORDINAL 13057", "ORDINAL 30089", "ORDINAL 61533", "ORDINAL 60545", "ORDINAL 27143", "ORDINAL 32139", "ORDINAL 387", "ORDINAL 30913", "ORDINAL 33807", "ORDINAL 14518", "ORDINAL 34369", "ORDINAL 20715", "ORDINAL 52315", "ORDINAL 63536", "ORDINAL 480", "ORDINAL 8885", "ORDINAL 58061", "ORDINAL 55841", "ORDINAL 48976", "ORDINAL 45232", "ORDINAL 3161", "ORDINAL 773", "ORDINAL 27847", "ORDINAL 59573", "ORDINAL 2040", "ORDINAL 44172", "ORDINAL 11032", "ORDINAL 57388", "ORDINAL 53605", "ORDINAL 29958", "ORDINAL 34535", "ORDINAL 15520", "ORDINAL 13840", "ORDINAL 60146", "ORDINAL 29445", "ORDINAL 21206", "ORDINAL 15001", "ORDINAL 53720", "ORDINAL 35798", "ORDINAL 3444", "ORDINAL 59763", "ORDINAL 30357", "ORDINAL 15556", "ORDINAL 38369", "ORDINAL 1929", "ORDINAL 26098", "ORDINAL 4329", "ORDINAL 57197", "ORDINAL 39681", "ORDINAL 63529", "ORDINAL 3292", "ORDINAL 13092", "ORDINAL 10431", "ORDINAL 51205", "ORDINAL 36362", "ORDINAL 53641", "ORDINAL 36101", "ORDINAL 37252", "ORDINAL 33586", "ORDINAL 37051", "ORDINAL 9937", "ORDINAL 8323", "ORDINAL 63491", "ORDINAL 35087", "ORDINAL 12647", "ORDINAL 47424", "ORDINAL 19016", "ORDINAL 18825", "ORDINAL 34073", "ORDINAL 5296", "ORDINAL 21374", "ORDINAL 50726", "ORDINAL 1162", "ORDINAL 3737", "ORDINAL 61538", "ORDINAL 38953", "ORDINAL 36647", "ORDINAL 27346", "ORDINAL 63650", "ORDINAL 4510", "ORDINAL 1090", "ORDINAL 5400", "ORDINAL 12572", "ORDINAL 30500", "ORDINAL 13036", "ORDINAL 32310", "ORDINAL 26791", "ORDINAL 27213", "ORDINAL 35078", "ORDINAL 17122", "ORDINAL 34699", "ORDINAL 7374", "ORDINAL 30092", "ORDINAL 1136", "ORDINAL 15844", "ORDINAL 26128", "ORDINAL 1674", "ORDINAL 32874", "ORDINAL 38964", "ORDINAL 61377", "ORDINAL 55179", "ORDINAL 38915", "ORDINAL 12331", "ORDINAL 65154", "ORDINAL 4064", "ORDINAL 1924", "ORDINAL 32004", "ORDINAL 22723", "ORDINAL 39512", "ORDINAL 55471", "ORDINAL 62908", "ORDINAL 2977", "ORDINAL 3265", "ORDINAL 17638", "ORDINAL 24849", "ORDINAL 13940", "ORDINAL 64652", "ORDINAL 16460", "ORDINAL 52400", "ORDINAL 18433", "ORDINAL 11266", "ORDINAL 4456", "ORDINAL 2748", "ORDINAL 15944", "ORDINAL 8089", "ORDINAL 60113", "ORDINAL 25268", "ORDINAL 50549", "ORDINAL 59204", "ORDINAL 34968", "ORDINAL 16267", "ORDINAL 5277", "ORDINAL 11718", "ORDINAL 4178", "ORDINAL 2042", "ORDINAL 30130", "ORDINAL 736", "ORDINAL 25522", "ORDINAL 11394", "ORDINAL 5248", "ORDINAL 30108", "ORDINAL 41460", "ORDINAL 49865" ], "ms": { "pe": { "entry": 4096.0, "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "timestamp": 1301422829.0, "image_base": 4194304.0, "entry_section": ".text", "size_of_image": 61440.0, "file_alignment": 512.0, "resource_count": 1.0, "characteristics": 271.0, "has_rich_header": true, "overlay_padding": 512.0, "size_of_headers": 1024.0, "export_timestamp": 0.0, "import_dll_count": 1.0, "computed_checksum": 64714.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "ordinal_import_count": 1.0, "bss_like_section_count": 3.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "max_section_inflation_ratio": 6.9 }, "file": { "size": 22528.0 }, "binary": { "code_size": 20992.0, "func_count": 2.0, "has_overlay": true, "code_entropy": 2.88, "func_density": 0.1, "import_count": 171.0, "overlay_size": 512.0, "string_count": 16.0, "avg_func_size": 368.0, "overlay_ratio": 0.02, "section_count": 5.0, "avg_complexity": 9.0, "import_density": 8.34, "max_complexity": 17.0, "string_density": 0.78, "overall_entropy": 2.88, "overlay_entropy": 5.86, "avg_basic_blocks": 13.5, "avg_section_size": 4198.4, "dependency_count": 1.0, "entropy_variance": 3.56, "wx_section_count": 5.0, "avg_string_length": 6.75, "complexity_per_kb": 0.44, "max_string_length": 40.0, "wide_string_count": 1.0, "avg_string_entropy": 2.07, "code_to_data_ratio": 13.67, "text_to_file_ratio": 0.09, "total_basic_blocks": 27.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 8.61, "largest_section_ratio": 0.84, "sentence_string_count": 1.0, "sentence_string_ratio": 0.06, "writable_section_count": 5.0, "entry_in_writable_region": true, "executable_section_count": 5.0, "nonstandard_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 480, ".text" ], [ 520, ".rdata" ], [ 560, ".data" ], [ 600, ".rsrc" ], [ 3098, "wide", "POPUP" ], [ 4297, "9W X" ], [ 5926, "HKSC" ], [ 7997, "o62gi8" ], [ 8385, "F8NV" ], [ 12353, "YD3G" ], [ 13608, "W_N_" ], [ 13861, "i2vo" ], [ 15956, "Prkk" ], [ 21016, "KVF5" ], [ 21386, "Xxnk" ] ], "sz": 22528, "ts": [ { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.43)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 61440.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.88" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "20817" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 171.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 6.90" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 8.34" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.07" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1301422829.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 0.00)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "VB6 binary with very few strings", "e": [ "binary.string_count = 16.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.88" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ ".rdata = 0.0% of total (0 / 22528 bytes)", ".rdata" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 0)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.699999988079071, "d": "PE has multiple BSS-style sections", "e": [ "pe.bss_like_section_count = 3.00" ], "i": "metadata/binary/anomaly/format::pe-bss-like-sections-multiple", "l": 3 }, { "c": 0.7200000286102295, "d": "Writable .rdata section permissions", "e": [ ".rdata (perms: rwx)" ], "i": "metadata/binary/section/names::writable-rdata", "l": 3 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.has_rich_header = 1.00", "binary.import_count = 171.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00", "binary.has_signature = 0.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "ce9b48340fea1a904c39d4dfb65fca03911ae34926a641615a3eca0c07f9fefd", "path": "20817", "type": "pe" } ], "tv": "46790" } }