{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.97402596,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.6589404,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T18:16:22Z"
  },
  "path": "dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(Cm)Md₂(Bk)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 0.0,
              "icon_count": 2.0,
              "has_manifest": 1.0,
              "checksum_valid": 0.0,
              "resource_count": 4.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 182235.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 179712.0,
              "entropy": 5.19,
              "size_bytes": 179712.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 5.73,
              "string_count": 779.0,
              "entropy_variance": 6.33,
              "avg_string_length": 20.03,
              "max_string_length": 3349.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 160.27,
              "largest_section_ratio": 0.91,
              "sentence_string_count": 8.0,
              "sentence_string_ratio": 0.01,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 14848.0,
              "entropy_max": 5.73,
              "entropy_mean": 3.59,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              3064,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              3221,
              "u8",
              "PADPADP"
            ],
            [
              3232,
              "u8",
              "BSJB"
            ],
            [
              5073,
              "u8",
              "C03o9431c816D2sNf3b3bU1fdPaCfd25LVA430"
            ],
            [
              5112,
              "u8",
              "Db7116ahT239983oj21bHa7d549TuAL790"
            ],
            [
              5154,
              "u8",
              "ToInt32"
            ],
            [
              5162,
              "u8",
              "38dKW4b1d9fJ8b5b18ef798n06dpIfa914bWP25v17lbHvC92"
            ],
            [
              5212,
              "u8",
              "F680fm7w97B1La6u343"
            ],
            [
              5232,
              "u8",
              "1bfEj9bak43ddX9VF87F964h3"
            ],
            [
              5258,
              "u8",
              "E9ddcoC3Odb6sczSCd3f990fy48696Jh568G6f14"
            ],
            [
              5299,
              "u8",
              "F5889Vf70a2M99Wdc2pdr5"
            ],
            [
              5322,
              "u8",
              "B3s33431Ad44cn7p83Pb6"
            ],
            [
              5344,
              "u8",
              "D618D9fc3u1cfRc199PQm1L96he76uvie3eu31ap4q6"
            ],
            [
              5388,
              "u8",
              "B5Aaf988q795N7"
            ],
            [
              5403,
              "u8",
              "F37d3126cfl2C15f3a86n7U4of7i2H5fnd69u451E3b7"
            ],
            [
              5448,
              "u8",
              "Yl2w1778dD1cvbfIbF41b1Wb1ba1b9ej7"
            ],
            [
              5482,
              "u8",
              "Bq7X82bBf62Rz7d9f3b0ata47H73UdZpget9Tcd4d66fD59"
            ],
            [
              5542,
              "u8",
              "get_4DGy99bSe49ef5Gf16b5cd2BN6fWjFbP835tGo9"
            ],
            [
              5586,
              "u8",
              "set_4DGy99bSe49ef5Gf16b5cd2BN6fWjFbP835tGo9"
            ],
            [
              5630,
              "u8",
              "MfR1aBaw5zC"
            ],
            [
              5642,
              "u8",
              "Db04ff177JncaaF43b7LbBe8c1a1Lc7d4lbU21H"
            ],
            [
              5682,
              "u8",
              "V986kv1d8l7Radbzsl279fN"
            ],
            [
              5706,
              "u8",
              "G00dlJa671d29GaQ021c9c0pU419fcfc12O"
            ],
            [
              5742,
              "u8",
              "CRYPT_OID_INFO"
            ],
            [
              5757,
              "u8",
              "System.IO"
            ],
            [
              5767,
              "u8",
              "9236J2baa559c346d85O5f3aaf162TndTcc2Q"
            ],
            [
              5805,
              "u8",
              "IAQ8Lj9bu6fXb5cBd995Y25NA86NC1S"
            ],
            [
              5837,
              "u8",
              "F7Pl3bs499v49U"
            ],
            [
              5852,
              "u8",
              "D6cfCU7sKOv8b938df704bpZb41tfE2c7a1O136E6o61dU"
            ],
            [
              5899,
              "u8",
              "7gk47V8Wb2cpaCD4aW"
            ],
            [
              5918,
              "u8",
              "Dl13a2cb28fhi937cYaeLcRL9a59V876RcW"
            ],
            [
              5954,
              "u8",
              "Dd9tEj7d9fTJ197HB1v92h1d435v65q7fd6Da"
            ],
            [
              5992,
              "u8",
              "Xe4929Oa3sutqJi829c89b9faV762c9ocB33VNa"
            ],
            [
              6032,
              "u8",
              "Aaa06f7379b8937zcZa"
            ],
            [
              6052,
              "u8",
              "mscorlib"
            ],
            [
              6061,
              "u8",
              "get_8B4AfWf1Oub"
            ],
            [
              6077,
              "u8",
              "set_8B4AfWf1Oub"
            ],
            [
              6093,
              "u8",
              "VP2o4d6cf1818a1E6f9H9893aac6nI98N6c"
            ],
            [
              6129,
              "u8",
              "4VWb133rh5cex3j98I6Oafbip784dd9m81pyf790f8309c"
            ],
            [
              6176,
              "u8",
              "System.Collections.Generic"
            ],
            [
              6203,
              "u8",
              "Microsoft.VisualBasic"
            ],
            [
              6225,
              "u8",
              "DO92W9Ao1e43ccd2V2ibF8BbbBNcV3bb4R4c8Z372c78pc"
            ],
            [
              6272,
              "u8",
              "387b7e1fbc7W477e9A3m1s4T6qY7Xcd3dpc"
            ],
            [
              6308,
              "u8",
              "AlgId"
            ],
            [
              6314,
              "u8",
              "get_P0e60EwK9V299yXir89aY3d9rd9a5b588x682Jd"
            ],
            [
              6358,
              "u8",
              "Thread"
            ],
            [
              6369,
              "u8",
              "Versioned"
            ],
            [
              6379,
              "u8",
              "Synchronized"
            ],
            [
              6392,
              "u8",
              "Append"
            ],
            [
              6399,
              "u8",
              "CompareMethod"
            ],
            [
              6413,
              "u8",
              "F6367bfCaT3041ba7b59683U1943Q3fH1Ra9aRe"
            ],
            [
              6453,
              "u8",
              "Replace"
            ],
            [
              6461,
              "u8",
              "IDisposable"
            ],
            [
              6473,
              "u8",
              "RuntimeTypeHandle"
            ],
            [
              6491,
              "u8",
              "GetTypeFromHandle"
            ],
            [
              6509,
              "u8",
              "File"
            ],
            [
              6514,
              "u8",
              "CallByName"
            ],
            [
              6525,
              "u8",
              "CallType"
            ],
            [
              6534,
              "u8",
              "CryptOidInfoKeyType"
            ],
            [
              6554,
              "u8",
              "PtrToStructure"
            ],
            [
              6569,
              "u8",
              "Capture"
            ],
            [
              6577,
              "u8",
              "ApplicationSettingsBase"
            ],
            [
              6601,
              "u8",
              "Dispose"
            ],
            [
              6609,
              "u8",
              "EditorBrowsableState"
            ],
            [
              6630,
              "u8",
              "CompilerGeneratedAttribute"
            ],
            [
              6657,
              "u8",
              "GeneratedCodeAttribute"
            ],
            [
              6680,
              "u8",
              "DebuggerNonUserCodeAttribute"
            ],
            [
              6709,
              "u8",
              "EditorBrowsableAttribute"
            ],
            [
              6734,
              "u8",
              "DefaultSettingValueAttribute"
            ],
            [
              6763,
              "u8",
              "UserScopedSettingAttribute"
            ],
            [
              6790,
              "u8",
              "ParamArrayAttribute"
            ],
            [
              6810,
              "u8",
              "get_Value"
            ],
            [
              6820,
              "u8",
              "value"
            ],
            [
              6826,
              "u8",
              "Save"
            ],
            [
              6831,
              "u8",
              "MfR1aBaw5zC.exe"
            ],
            [
              6847,
              "u8",
              "Ta2L5m5979M2R7V15EwQ3779hb1GaGANv0ff"
            ],
            [
              6884,
              "u8",
              "System.Threading"
            ],
            [
              6901,
              "u8",
              "System.Security.Cryptography.Encoding"
            ],
            [
              6939,
              "u8",
              "DownloadString"
            ],
            [
              6954,
              "u8",
              "ToString"
            ],
            [
              6963,
              "u8",
              "Bbw7dNtbf48DRd670j4351793fe93s8dI4blz8VUh"
            ],
            [
              7005,
              "u8",
              "Match"
            ],
            [
              7011,
              "u8",
              "GetFolderPath"
            ],
            [
              7025,
              "u8",
              "get_Length"
            ],
            [
              7036,
              "u8",
              "StringToCoTaskMemUni"
            ],
            [
              7057,
              "u8",
              "StringToCoTaskMemAnsi"
            ],
            [
              7079,
              "u8",
              "1K59f7f126Ca1169b15e80b8bNK3N49Do7451fj"
            ],
            [
              7119,
              "u8",
              "WaitCallback"
            ],
            [
              7132,
              "u8",
              "SendOrPostCallback"
            ],
            [
              7151,
              "u8",
              "Marshal"
            ],
            [
              7159,
              "u8",
              "System.ComponentModel"
            ],
            [
              7181,
              "u8",
              "ThreadPool"
            ],
            [
              7192,
              "u8",
              "FreeCoTaskMem"
            ],
            [
              7206,
              "u8",
              "get_Item"
            ],
            [
              7215,
              "u8",
              "QueueUserWorkItem"
            ],
            [
              7233,
              "u8",
              "System"
            ],
            [
              7240,
              "u8",
              "Boolean"
            ],
            [
              7248,
              "u8",
              "System.Configuration"
            ],
            [
              7269,
              "u8",
              "System.Globalization"
            ],
            [
              7290,
              "u8",
              "System.Reflection"
            ],
            [
              7308,
              "u8",
              "MatchCollection"
            ],
            [
              7324,
              "u8",
              "FormCollection"
            ],
            [
              7339,
              "u8",
              "GroupCollection"
            ],
            [
              7355,
              "u8",
              "WebHeaderCollection"
            ],
            [
              7375,
              "u8",
              "NotSupportedException"
            ],
            [
              7397,
              "u8",
              "IndexOutOfRangeException"
            ],
            [
              7422,
              "u8",
              "AggregateException"
            ],
            [
              7441,
              "u8",
              "CultureInfo"
            ],
            [
              7453,
              "u8",
              "Zero"
            ],
            [
              7458,
              "u8",
              "Internal.NativeCrypto"
            ],
            [
              7480,
              "u8",
              "Sleep"
            ],
            [
              7486,
              "u8",
              "OidGroup"
            ],
            [
              7495,
              "u8",
              "Char"
            ],
            [
              7500,
              "u8",
              "StringBuilder"
            ],
            [
              7514,
              "u8",
              "SpecialFolder"
            ],
            [
              7528,
              "u8",
              "ResourceManager"
            ],
            [
              7544,
              "u8",
              "System.CodeDom.Compiler"
            ],
            [
              7568,
              "u8",
              "IEnumerator"
            ],
            [
              7580,
              "u8",
              "GetEnumerator"
            ],
            [
              7594,
              "u8",
              ".ctor"
            ],
            [
              7600,
              "u8",
              ".cctor"
            ],
            [
              7607,
              "u8",
              "IntPtr"
            ],
            [
              7614,
              "u8",
              "System.Diagnostics"
            ],
            [
              7633,
              "u8",
              "System.Runtime.InteropServices"
            ],
            [
              7664,
              "u8",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            [
              7703,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              7735,
              "u8",
              "System.Resources"
            ],
            [
              7752,
              "u8",
              "83n1c4fwEa9.Properties.Resources.resources"
            ],
            [
              7795,
              "u8",
              "Matches"
            ],
            [
              7803,
              "u8",
              "System.Security.Cryptography.X509Certificates"
            ],
            [
              7849,
              "u8",
              "Strings"
            ],
            [
              7857,
              "u8",
              "System.Threading.Tasks"
            ],
            [
              7880,
              "u8",
              "Equals"
            ],
            [
              7887,
              "u8",
              "System.Windows.Forms"
            ],
            [
              7908,
              "u8",
              "System.Text.RegularExpressions"
            ],
            [
              7939,
              "u8",
              "System.Collections"
            ],
            [
              7958,
              "u8",
              "StringSplitOptions"
            ],
            [
              7977,
              "u8",
              "get_Groups"
            ],
            [
              7988,
              "u8",
              "get_Chars"
            ],
            [
              7998,
              "u8",
              "get_Headers"
            ],
            [
              8010,
              "u8",
              "Exists"
            ],
            [
              8017,
              "u8",
              "Concat"
            ],
            [
              8024,
              "u8",
              "Object"
            ],
            [
              8031,
              "u8",
              "System.Net"
            ],
            [
              8042,
              "u8",
              "Split"
            ],
            [
              8048,
              "u8",
              "WebClient"
            ],
            [
              8058,
              "u8",
              "Environment"
            ],
            [
              8070,
              "u8",
              "get_Current"
            ],
            [
              8082,
              "u8",
              "Convert"
            ],
            [
              8090,
              "u8",
              "Post"
            ],
            [
              8095,
              "u8",
              "MoveNext"
            ],
            [
              8104,
              "u8",
              "System.Text"
            ],
            [
              8116,
              "u8",
              "ReadAllText"
            ],
            [
              8128,
              "u8",
              "WriteAllText"
            ],
            [
              8141,
              "u8",
              "SynchronizationContext"
            ],
            [
              8164,
              "u8",
              "get_43F8ZjJaa77enw91FkQr7maxdac4Pk2c8q7j4P7w"
            ],
            [
              8209,
              "u8",
              "7s9je1lP35FaeUc57cx"
            ],
            [
              8229,
              "u8",
              "Regex"
            ],
            [
              8235,
              "u8",
              "System.Security.Cryptography"
            ],
            [
              8264,
              "u8",
              "get_Assembly"
            ],
            [
              8277,
              "u8",
              "op_Inequality"
            ],
            [
              8291,
              "u8",
              "Empty"
            ],
            [
              8302,
              "u8",
              "first.Properties.Resources"
            ],
            [
              8356,
              "u8",
              "8B4AfWf1Oub"
            ],
            [
              8386,
              "u8",
              "TQjUdBPYph"
            ],
            [
              10089,
              "u8",
              "[^\\u0000-\\u007F]+"
            ],
            [
              10143,
              "u8",
              "wUxsx"
            ],
            [
              13893,
              "u8",
              "Ass+++embly"
            ],
            [
              13955,
              "u8",
              "Entr+++yPoint"
            ],
            [
              14183,
              "u8",
              "System.Resources.Tools.StronglyTypedResourceBuilder"
            ],
            [
              14268,
              "u8",
              "Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator"
            ],
            [
              14830,
              "u8",
              "mscoree.dll"
            ],
            [
              23540,
              "u8",
              "000w"
            ],
            [
              71347,
              "u8",
              "5LLLs"
            ],
            [
              76604,
              "xor",
              "UUU5bbb0zzz=\t\t\t:///\u0026444\"444,444/"
            ],
            [
              86035,
              "u8",
              "0RRRu"
            ],
            [
              91783,
              "u8",
              "0OOOt"
            ],
            [
              92055,
              "u8",
              "4222"
            ],
            [
              94355,
              "u8",
              "1443"
            ],
            [
              95887,
              "u8",
              "7444"
            ],
            [
              95999,
              "u8",
              "4uuu"
            ],
            [
              96271,
              "u8",
              "/fff"
            ],
            [
              97531,
              "u8",
              "/LLLr"
            ],
            [
              97803,
              "u8",
              "2NNN"
            ],
            [
              98180,
              "u8",
              "999v"
            ],
            [
              98951,
              "u8",
              "P332"
            ],
            [
              100103,
              "u8",
              "/DDD"
            ],
            [
              101632,
              "u8",
              "5AAA"
            ],
            [
              103279,
              "u8",
              "/IIIp"
            ],
            [
              103551,
              "u8",
              "2UUU"
            ],
            [
              104699,
              "u8",
              "Q555"
            ],
            [
              105195,
              "u8",
              "1VVVy"
            ],
            [
              107380,
              "u8",
              "5BBB"
            ],
            [
              109299,
              "u8",
              "3RQQ"
            ],
            [
              110943,
              "u8",
              "1UUUx"
            ],
            [
              115163,
              "u8",
              ")SSSNjjjj}}}"
            ],
            [
              115563,
              "u8",
              ")---8666K[[[k"
            ],
            [
              116371,
              "u8",
              "#***4WWWPkkkl"
            ],
            [
              117391,
              "u8",
              "k333"
            ],
            [
              117583,
              "u8",
              "$---5XXXQllln"
            ],
            [
              117724,
              "u8",
              "777_UUUO"
            ],
            [
              117987,
              "u8",
              "+///;888Oeeep"
            ],
            [
              118795,
              "u8",
              "%0007ZZZTmmmq"
            ],
            [
              118876,
              "u8",
              "6888"
            ],
            [
              118888,
              "u8",
              "DDD3"
            ],
            [
              119196,
              "u8",
              "-///\u003c888Qjjjs"
            ],
            [
              119263,
              "u8",
              ".jjj"
            ],
            [
              120068,
              "u8",
              "LLL2"
            ],
            [
              123300,
              "u8",
              "777b"
            ],
            [
              124216,
              "u8",
              "777y"
            ],
            [
              125220,
              "u8",
              "999p"
            ],
            [
              127435,
              "u8",
              "5MMM"
            ],
            [
              130964,
              "u8",
              "888m"
            ],
            [
              131743,
              "u8",
              "4WWW"
            ],
            [
              132891,
              "u8",
              "Ehhh"
            ],
            [
              135184,
              "u8",
              "AAAk666"
            ],
            [
              135475,
              "u8",
              "O666"
            ],
            [
              136708,
              "u8",
              "555g"
            ],
            [
              138144,
              "u8",
              "333k"
            ],
            [
              140208,
              "u8",
              "***.666Gsssj"
            ],
            [
              140516,
              "u8",
              ":::2AAAMkkko"
            ],
            [
              140679,
              "u8",
              "l444"
            ],
            [
              140824,
              "u8",
              "2221MMMMcccr"
            ],
            [
              140928,
              "u8",
              "GGGnccck"
            ],
            [
              141744,
              "u8",
              "=== 4443:::Nzzzr"
            ],
            [
              142388,
              "u8",
              "000MMMM8333"
            ],
            [
              143672,
              "u8",
              "333b"
            ],
            [
              143948,
              "u8",
              "111a"
            ],
            [
              147927,
              "u8",
              "F999"
            ],
            [
              148183,
              "u8",
              "8XXW"
            ],
            [
              149459,
              "u8",
              "5jii"
            ],
            [
              150220,
              "u8",
              "///_UUU"
            ],
            [
              150808,
              "u8",
              "999d"
            ],
            [
              151496,
              "u8",
              "000_XXX"
            ],
            [
              152008,
              "u8",
              "5uuu"
            ],
            [
              152084,
              "u8",
              "888c"
            ],
            [
              153360,
              "u8",
              "777c"
            ],
            [
              154048,
              "u8",
              "222aZYY"
            ],
            [
              154636,
              "u8",
              "666b"
            ],
            [
              155324,
              "u8",
              "333aAAA"
            ],
            [
              155583,
              "u8",
              "F000"
            ],
            [
              155839,
              "u8",
              "5333"
            ],
            [
              155912,
              "u8",
              "555b"
            ],
            [
              158559,
              "u8",
              "%EEECmmmo"
            ],
            [
              158835,
              "u8",
              "%GGGDmmmp"
            ],
            [
              159152,
              "u8",
              "777cMMM"
            ],
            [
              160536,
              "u8",
              "SSSv$$$S###8"
            ],
            [
              160960,
              "u8",
              "LLLy///T"
            ],
            [
              162816,
              "u8",
              "888a"
            ],
            [
              163772,
              "u8",
              "666Z"
            ],
            [
              164288,
              "u8",
              "BBBo___"
            ],
            [
              165244,
              "u8",
              "EEElqqq"
            ],
            [
              165439,
              "u8",
              "Kqqq"
            ]
          ],
          "v": {
            "file.stem": "dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 3899310314,
            "file.basename": "dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 196608,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 22526,
            "pe.headers_size": 512,
            "pe.version.type": "app",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "169450b9cfce602bdeaba648ff549dbe90b90654",
            "pe.image_hash.sha256": "7973480aaf1b3d989299a6499d444079dac1d72703654e3e6e558eeb6dbfa4e4",
            "pe.image_hash.sha384": "65a5da6e94fcba76d0c7a152f0c3529eed9109c1271cb0b5887410fad5ba2be776a213343e8b1dd5ec039c33315a739b",
            "pe.image_hash.sha512": "cd573cae9ee6f423b1aa148dc56472a69e375c8e9b6f8917eb3588c67015715439d7875a67fefcaa186aee2ad56c0c17060d40d1c2bf1be46528374a37ab63db",
            "pe.resource_types[0]": "RT_ICON",
            "pe.resource_types[1]": "RT_GROUP_ICON",
            "pe.resource_types[2]": "RT_VERSION",
            "pe.resource_types[3]": "RT_MANIFEST",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "Copyright ©  2021",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "large_address_aware",
            "pe.manifest.ui_access": "false",
            "pe.characteristics_raw": 34,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "first",
            "pe.linker_major_version": 48,
            "pe.version.file_version": "1.0.0.0",
            "pe.version.product_name": "first",
            "pe.version.internal_name": "first.exe",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.data_directories[0].rva": 22440,
            "pe.data_directories[1].rva": 24576,
            "pe.data_directories[2].rva": 188416,
            "pe.data_directories[3].rva": 8192,
            "pe.data_directories[4].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.version.product_version": "1.0.0.0",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 83,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 163744,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 12,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 8,
            "pe.data_directories[4].name": "clr_runtime_header",
            "pe.data_directories[4].size": 72,
            "pe.version.original_filename": "first.exe",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.base_relocations.padding_count": 1,
            "pe.manifest.assembly_identity.name": "MyApplication.app",
            "pe.manifest.assembly_identity.version": "1.0.0.0",
            "pe.manifest.requested_execution_level": "asInvoker"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              14848,
              5.73,
              "r-x"
            ],
            [
              ".rsrc",
              15360,
              163840,
              4.98,
              "r--"
            ],
            [
              ".reloc",
              179200,
              512,
              0.06,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 179712,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0xca0"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0xca0"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0xbb3"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x39ee"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CodeDom compiler access",
            "e": [
              "System.CodeDom.Compiler"
            ],
            "i": "metadata/lang/compiler/managed::codedom-compiler",
            "l": 2,
            "el": [
              "0x1d78"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "Copyright ©  2021"
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "DownloadString"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5",
            "l": 1,
            "el": [
              "0x1b1b"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 779.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.Security",
              "System.Net",
              "System.IO"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "0x1af5",
              "0x1f5f",
              "0x167d"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": ".NET WPF namespace reference",
            "e": [
              "System.Windows"
            ],
            "i": "well-known/game/mod::wpf-namespace-ref",
            "l": 1,
            "el": [
              "0x1ecf"
            ]
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1,
            "el": [
              "0xbf8"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0x1c7a"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Windows Forms UI framework",
            "e": [
              "System.Windows.Forms"
            ],
            "i": "metadata/lang/compiler/managed::winforms-ui",
            "l": 2,
            "el": [
              "0x1ecf"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": ".NET StringBuilder Append use",
            "e": [
              "StringBuilder"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append",
            "l": 1,
            "m": "C0025",
            "el": [
              "0x1d4c"
            ]
          },
          {
            "c": 0.7799999713897705,
            "d": "Assembly accessor token (get_Assembly)",
            "e": [
              "get_Assembly"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token",
            "l": 1,
            "el": [
              "0x2048"
            ]
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Repeated padding marker string block",
            "e": [
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING",
              "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDING"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker",
            "l": 1,
            "el": [
              "0x2bb93",
              "0x2bb93",
              "0x2bb93",
              "0x2bb93",
              "0x2bb93"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "value",
              "DefaultSettingValueAttribute",
              "get_Value"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0x1aa4",
              "0x1a4e",
              "0x1a9a"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x39ee"
            ]
          },
          {
            "c": 0.75,
            "d": "Runtime interop services",
            "e": [
              "System.Runtime.InteropServices"
            ],
            "i": "metadata/lang/compiler/managed::runtime-interop",
            "l": 2,
            "el": [
              "0x1dd1"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Large PE resource section (\u003e150KB)",
            "e": [
              ".rsrc (size: 163840)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "WebClient"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-4",
            "l": 1,
            "el": [
              "0x1f70"
            ]
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Preserves .exe .gho .bak files",
            "e": [
              ".exe"
            ],
            "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "l": 1,
            "m": "C0047",
            "el": [
              "0x1aaf"
            ]
          },
          {
            "c": 1.0,
            "d": "PE has RT_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]"
            ],
            "i": "metadata/binary/resource::pe-resource-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "c": 0.6499999761581421,
            "d": ".NET Diagnostics namespace token",
            "e": [
              "System.Diagnostics"
            ],
            "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet",
            "l": 1,
            "el": [
              "0x1dbe"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "first"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Manifest is MyApplication template name",
            "e": [
              "MyApplication.app"
            ],
            "i": "metadata/build/manifest::pe-manifest-myapplication-template",
            "l": 3,
            "el": [
              "value:pe.manifest.assembly_identity.name"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "first"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "asInvoker manifest tag in resources",
            "e": [
              "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e"
            ],
            "i": "metadata/binary/resource::asinvoker-resource-manifest-flex",
            "l": 2,
            "el": [
              "0x2bb0d"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "WebClient.DownloadString method",
            "e": [
              "DownloadString"
            ],
            "i": "micro-behaviors/communications/http/client/managed::downloadstring",
            "l": 3,
            "el": [
              "0x1b1b"
            ]
          },
          {
            "c": 1.0,
            "d": "Access to Headers getter",
            "e": [
              "get_Headers"
            ],
            "i": "micro-behaviors/communications/http/server/managed::http-headers-getter",
            "l": 1,
            "el": [
              "0x1f3e"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0x2b922"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0x2b7da"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.91"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "References to worker pools",
            "e": [
              "ThreadPool"
            ],
            "i": "micro-behaviors/process/create/workers::worker-pool",
            "l": 2,
            "el": [
              "0x1c0d"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "requestedExecutionLevel is asInvoker",
            "e": [
              "asInvoker"
            ],
            "i": "metadata/build/manifest::pe-as-invoker",
            "l": 2,
            "el": [
              "value:pe.manifest.requested_execution_level"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=4.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2,
            "el": [
              "0xbf8"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib",
              "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x17a4",
              "0xbf8"
            ]
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 5.73"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "PE has RT_GROUP_ICON in resources list",
            "e": [
              "[RT_ICON, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]"
            ],
            "i": "metadata/binary/resource::pe-resource-group-icon-list",
            "l": 2,
            "el": [
              "value:pe.resource_types"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "VB CallByName late binding",
            "e": [
              "43 61 6C 6C 42 79 4E 61 6D 65"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token",
            "l": 1,
            "el": [
              "0x1972"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "get_Headers"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6",
            "l": 1,
            "el": [
              "0x1f3e"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2,
            "el": [
              "0x2b7b6"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0x2b8e6"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2,
            "el": [
              "0x2b890"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "WCF generated code attribute",
            "e": [
              "GeneratedCodeAttribute"
            ],
            "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute",
            "l": 1,
            "el": [
              "0x1a01"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.product_version"
            ]
          },
          {
            "a": "T1027.003",
            "c": 0.7799999713897705,
            "d": ".NET resource manager reference",
            "e": [
              "ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token",
            "l": 1,
            "m": "F0001.006",
            "el": [
              "0x1d68"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2,
            "el": [
              "0x2b83e"
            ]
          },
          {
            "c": 1.0,
            "d": "PE carries side-by-side assembly manifest",
            "e": [
              "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"MyApplication.app\",\"version\":\"1.0.0.0\""
            ],
            "i": "metadata/build/manifest::pe-has-manifest",
            "l": 2,
            "el": [
              "value:pe.manifest"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Visual Basic runtime reference",
            "e": [
              "Microsoft.VisualBasic",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            "i": "metadata/lang/compiler/managed::visual-basic-runtime",
            "l": 2,
            "el": [
              "0x183b",
              "0x1df0"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x2b6be"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "ToString",
              "StringToCoTaskMemAnsi",
              "DownloadString",
              "StringBuilder",
              "StringSplitOptions",
              "StringFileInfo",
              "StringToCoTaskMemUni",
              "Strings"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x1b2a",
              "0x1b91",
              "0x1b1b",
              "0x1d4c",
              "0x1f16",
              "0x2b75e",
              "0x1b7c",
              "0x1ea9"
            ]
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 4.00"
            ],
            "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.91"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2,
            "el": [
              "0x1aaf"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "ParamArrayAttribute",
              "ApplicationSettingsBase",
              "UserScopedSettingAttribute",
              "AggregateException",
              "DefaultSettingValueAttribute",
              "EditorBrowsableAttribute",
              "CompilerGeneratedAttribute",
              "StronglyTypedResourceBuilder",
              "SettingsSingleFileGenerator",
              "GeneratedCodeAttribute",
              "IndexOutOfRangeException",
              "StringToCoTaskMemUni",
              "StringToCoTaskMemAnsi",
              "NotSupportedException",
              "DebuggerNonUserCodeAttribute",
              "WebHeaderCollection"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1a86",
              "0x19b1",
              "0x1a6b",
              "0x1cfe",
              "0x1a4e",
              "0x1a35",
              "0x19e6",
              "0x3767",
              "0x37bc",
              "0x1a01",
              "0x1ce5",
              "0x1b7c",
              "0x1b91",
              "0x1ccf",
              "0x1a18",
              "0x1cbb"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Large low-entropy PE resources",
            "e": [
              ".rsrc (size: 163840, entropy: 4.98)"
            ],
            "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc",
            "l": 2
          },
          {
            "a": "T1027.009",
            "c": 0.550000011920929,
            "d": ".NET resource manager access",
            "e": [
              "ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager",
            "l": 1,
            "el": [
              "0x1d68"
            ]
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.91"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "c": 1.0,
            "d": "System.Net.WebClient class usage",
            "e": [
              "StringSplitOptions",
              "get_Headers",
              "StringFileInfo",
              "DownloadString",
              "StringToCoTaskMemAnsi",
              "StringBuilder",
              "Strings",
              "StringToCoTaskMemUni",
              "WebClient",
              "ToString"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient",
            "l": 2,
            "el": [
              "0x1f16",
              "0x1f3e",
              "0x2b75e",
              "0x1b1b",
              "0x1b91",
              "0x1d4c",
              "0x1ea9",
              "0x1b7c",
              "0x1f70",
              "0x1b2a"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "1.0.0.0"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: xor",
            "e": [
              "UUU5bbb0zzz=\t\t\t:///\u0026444\"444,444/ \u003cxor\u003e"
            ],
            "i": "metadata/encoded-payload/xor",
            "l": 3,
            "el": [
              "offset:76604"
            ]
          }
        ],
        "sha": "dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-04/dcda7574d5ca6cdca0ee9336b33ef4e63b1a33c96cc1787aa1e42d8a8534c490.exe",
        "type": "pe"
      }
    ],
    "tv": "176d6"
  }
}