{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000048160553,
        "rte": "az",
        "prob": 0.000048160553
      },
      {
        "cls": 0,
        "raw": 0.0011226038,
        "rte": "az/native",
        "prob": 0.0011226038
      },
      {
        "cls": 0,
        "raw": 0.0037832956,
        "rte": "az/pe",
        "prob": 0.0037832956
      }
    ],
    "prob": 0.000048160553,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000048160552978515625,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-14T06:45:31Z"
  },
  "path": "2026-09-13_4873419fd2d7be882d2348cb12d2b1a9_elex_wannacry",
  "raw": {
    "v": "8",
    "rev": "c7f7e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000{Y7o]4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000@D1HlXF1F)XF1F)XF1F)*yrc3Zy{a%iU88EXdXw(!^.x",
            "ln": 0
          },
          {
            "b": "0000000000000000000000000000000000000000I]0Bli59U#.\u0026P$wKDtM=r/uIi7YTKo{cZei0DXSG\u003eZ9\u003cv0e5h)I]G8u1osKB-@OdOkMFY-KDtM=KDtM=F:t]f0050DbS]av1owG5p?/$",
            "ln": 992
          },
          {
            "b": "0000000000000000000000000000000000000000000000000000000000620@@r3aohy(4GDFeh#\u0026@e000000000000000000310rr91pYHGC00000000000000000031wDhYgxAe3.000",
            "ln": 23520
          }
        ],
        "mol": "Md(Bi)",
        "sha": "d257d97ae5e409c10a5e9f9894cc98395cb8f8e90bd17fbef199250e4e9af16c",
        "path": "2026-09-13_4873419fd2d7be882d2348cb12d2b1a9_elex_wannacry",
        "risk": 1,
        "size": 26536,
        "type": "pe",
        "facts": {
          "imp": [
            [
              "kernel32",
              "VirtualFree"
            ],
            [
              "kernel32",
              "VirtualAlloc"
            ],
            [
              "kernel32",
              "GetLastError"
            ],
            [
              "kernel32",
              "CreateMutexA"
            ],
            [
              "kernel32",
              "ExitProcess"
            ],
            [
              "kernel32",
              "GetProcAddress"
            ],
            [
              "kernel32",
              "LoadLibraryExA"
            ],
            [
              "kernel32",
              "GetModuleHandleA"
            ],
            [
              "kernel32",
              "VirtualProtect"
            ],
            [
              "kernel32",
              "GetModuleFileNameA"
            ],
            [
              "user32",
              "MessageBoxA"
            ]
          ],
          "sec": [
            [
              ".data",
              1024,
              12800,
              4.16,
              "rwx"
            ],
            [
              ".pdata",
              13824,
              4096,
              7.93,
              "rwx"
            ],
            [
              ".ex_cod",
              17920,
              5632,
              6.4,
              "rwx"
            ],
            [
              ".rsrc",
              23552,
              2048,
              2.32,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0,
              "timestamp": 1300161967,
              "image_size": 40284,
              "has_overlay": 1,
              "overlay_end": 26536,
              "headers_size": 1024,
              "overlay_size": 936,
              "checksum_valid": 0,
              "file_alignment": 512,
              "overlay_offset": 25600,
              "overlay_padding": 936,
              "checksum_stripped": 1,
              "computed_checksum": 78227,
              "headers_size_ratio": 0.04,
              "prose_section_count": 0,
              "bss_like_section_count": 0,
              "section_overflow_count": 0,
              "misaligned_section_count": 0,
              "entry_in_writable_section": 1,
              "declared_data_directory_count": 2,
              "executable_prose_section_count": 0,
              "directory_section_mismatch_count": 0
            },
            "file": {
              "size": 26536,
              "entropy": 5.57
            },
            "binary": {
              "is_pie": 0,
              "has_overlay": 1,
              "code_entropy": 6.4,
              "data_entropy": 5.07,
              "overlay_size": 936,
              "string_count": 89,
              "overlay_ratio": 0.04,
              "overlay_entropy": 4.27,
              "entropy_variance": 4.57,
              "avg_string_length": 15.64,
              "max_string_length": 316,
              "peak_region_bytes": 3072,
              "code_to_data_ratio": 0.25,
              "peak_region_entropy": 7.86,
              "string_length_stddev": 34.72,
              "largest_section_ratio": 0.48,
              "sentence_string_count": 3,
              "sentence_string_ratio": 0.03,
              "high_entropy_string_count": 0
            },
            "imports": {
              "count": 11
            },
            "sections": {
              "count": 4,
              "code_size": 5632,
              "entropy_max": 7.93,
              "entropy_mean": 5.2,
              "name_entropy": 3.36,
              "writable_count": 3,
              "executable_count": 1,
              "nonstandard_count": 1,
              "executable_writable_count": 1
            },
            "dependencies": {
              "count": 2
            }
          }
        },
        "traits": [
          {
            "id": "metadata/binary/section/metrics::pe-entry-in-writable-section",
            "conf": 0.95,
            "crit": 3,
            "desc": "PE entry point in writable section",
            "spans": [
              [
                0,
                35
              ]
            ]
          }
        ]
      }
    ]
  }
}