{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.00003473957258393057
      }
    ],
    "prob": 0.000034739573,
    "models": [
      {
        "m": "az",
        "raw": 0.000034739573,
        "prob": 0.000034739573,
        "class": 0
      },
      {
        "m": "az/native",
        "raw": 0.00043570995,
        "prob": 0.00043570995,
        "class": 0
      },
      {
        "m": "az/pe",
        "raw": 0.0037016869,
        "prob": 0.0037016869,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T11:42:22Z"
  },
  "path": "mdxu.exe",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "H(Ds)",
        "x": 3,
        "ff": {
          "i": [
            [
              "kernel32",
              "ExitProcess"
            ],
            [
              "kernel32",
              "FreeLibrary"
            ],
            [
              "kernel32",
              "GetProcAddress"
            ],
            [
              "kernel32",
              "LoadLibraryW"
            ],
            [
              "kernel32",
              "LocalAlloc"
            ],
            [
              "kernel32",
              "LocalFree"
            ],
            [
              "kernel32",
              "lstrcatW"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 60846.0,
              "checksum_valid": 1.0,
              "computed_checksum": 60846.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0
            },
            "file": {
              "size": 4096.0,
              "entropy": 4.11,
              "size_bytes": 4096.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 4.57,
              "data_entropy": 2.2,
              "string_count": 67.0,
              "overall_entropy": 4.11,
              "entropy_variance": 0.93,
              "avg_string_length": 23.97,
              "max_string_length": 50.0,
              "code_to_data_ratio": 0.75,
              "string_length_stddev": 11.62,
              "largest_section_ratio": 0.38,
              "sentence_string_count": 5.0,
              "sentence_string_ratio": 0.07,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 7.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 1536.0,
              "entropy_max": 4.57,
              "entropy_mean": 3.4,
              "name_entropy": 2.75,
              "writable_count": 1.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              454,
              "u8",
              "0@.idata"
            ],
            [
              2048,
              "wide",
              "mscoree.dll"
            ],
            [
              2072,
              "u8",
              "LoadLibraryShim"
            ],
            [
              2086,
              "wide",
              "mfusion.dll"
            ],
            [
              2110,
              "u8",
              "CreateAssemblyCache"
            ],
            [
              2128,
              "wide",
              "e{75339C8C-B4BA-463B-BAC7-975FCA2F89D9}"
            ],
            [
              2208,
              "wide",
              "DirectX for Managed Code"
            ],
            [
              2258,
              "wide",
              ", Culture=neutral, PublicKeyToken=31bf3856ad364e35"
            ],
            [
              2360,
              "wide",
              "Microsoft.DirectX"
            ],
            [
              2438,
              "wide",
              ".AudioVideoPlayback, Version=1.0.2902.0"
            ],
            [
              2518,
              "wide",
              ".Diagnostics, Version=1.0.2902.0"
            ],
            [
              2584,
              "wide",
              ".Direct3D, Version=1.0.2902.0"
            ],
            [
              2644,
              "wide",
              ".DirectDraw, Version=1.0.2902.0"
            ],
            [
              2708,
              "wide",
              ".DirectInput, Version=1.0.2902.0"
            ],
            [
              2774,
              "wide",
              ".DirectPlay, Version=1.0.2902.0"
            ],
            [
              2838,
              "wide",
              ".DirectSound, Version=1.0.2902.0"
            ],
            [
              2904,
              "wide",
              ".Direct3DX, Version=1.0.2902.0"
            ],
            [
              2966,
              "wide",
              ".Direct3DX, Version=1.0.2903.0"
            ],
            [
              3028,
              "wide",
              ".Direct3DX, Version=1.0.2904.0"
            ],
            [
              3090,
              "wide",
              ".Direct3DX, Version=1.0.2905.0"
            ],
            [
              3152,
              "wide",
              ".Direct3DX, Version=1.0.2906.0"
            ],
            [
              3214,
              "wide",
              ".Direct3DX, Version=1.0.2907.0"
            ],
            [
              3276,
              "wide",
              ".Direct3DX, Version=1.0.2908.0"
            ],
            [
              3338,
              "wide",
              ".Direct3DX, Version=1.0.2909.0"
            ],
            [
              3400,
              "wide",
              ".Direct3DX, Version=1.0.2910.0"
            ],
            [
              3462,
              "wide",
              ".Direct3DX, Version=1.0.2911.0"
            ],
            [
              3690,
              "u8",
              "ExitProcess"
            ],
            [
              3704,
              "u8",
              "FreeLibrary"
            ],
            [
              3718,
              "u8",
              "GetProcAddress"
            ],
            [
              3736,
              "u8",
              "LoadLibraryW"
            ],
            [
              3752,
              "u8",
              "LocalAlloc"
            ],
            [
              3766,
              "u8",
              "LocalFree"
            ],
            [
              3778,
              "u8",
              "lstrcatW"
            ],
            [
              3816,
              "u8",
              "KERNEL32.dll"
            ]
          ],
          "v": {
            "file.stem": "mdxu",
            "pe.imphash": "a1a2447457aed61f4eedc6072f339c65",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1641191299,
            "file.basename": "mdxu.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 16384,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 4096,
            "pe.headers_size": 512,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "5c3ef4411a677d32a3b13b4becca1eeb82676d05",
            "pe.image_hash.sha256": "99a1ab27934191b9ff572684b8e342e85d2078dd0bfc0625b08e2955be494362",
            "pe.image_hash.sha384": "3485ac867abf4d48a395ad644215ca998d9c6075e24e0d1392b31f6c2e13c9a2d1a407291b3e41007e3baa5413ddea44",
            "pe.image_hash.sha512": "3562a928c9df1ead49d5dbbe02bdacf41bdcc6068e56d01c2c366730cde472946daf1ab6acb37ae120e18de8425c611c3347fd51f95ef7bdfbdd80ba2ed61cba",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "relocs_stripped",
            "pe.characteristics[1]": "executable_image",
            "pe.characteristics[2]": "32bit_machine",
            "pe.characteristics_raw": 783,
            "pe.linker_major_version": 2,
            "pe.linker_minor_version": 30,
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.data_directories[0].rva": 12288,
            "pe.data_directories[1].rva": 12360,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 248,
            "pe.data_directories[1].name": "iat",
            "pe.data_directories[1].size": 32,
            "pe.coff.dos_header_pe_pointer": 128
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              1536,
              4.57,
              "r-x"
            ],
            [
              ".rdata",
              2048,
              1536,
              3.42,
              "r--"
            ],
            [
              ".idata",
              3584,
              512,
              2.2,
              "rw-"
            ]
          ]
        },
        "id": 0,
        "sz": 4096,
        "ts": [
          {
            "c": 1.0,
            "d": "Windows executable extension",
            "e": [
              "mdxu.exe"
            ],
            "i": "metadata/file/extension::exe",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 7.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Unload dynamic library",
            "e": [
              "FreeLibrary"
            ],
            "i": "micro-behaviors/os/module/load::free-library",
            "l": 2,
            "el": [
              "304c"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 3.42)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Small string table footprint",
            "e": [
              "binary.string_count = 67.00"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 4.11"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "mscoree name reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "metadata/binary/framework::mscoree-name",
            "l": 2,
            "el": [
              "800"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 4.11"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "800"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Filename ends with .exe",
            "e": [
              "mdxu.exe"
            ],
            "i": "metadata/package/files::exe-extension-basename",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "UHARC linker major version",
            "e": [
              "2"
            ],
            "i": "metadata/binary/framework::uharc-linker-major",
            "l": 2,
            "el": [
              "value:pe.linker_major_version"
            ]
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "mdxu.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Local memory deallocation",
            "e": [
              "LocalFree"
            ],
            "i": "micro-behaviors/mem/alloc/heap::local-free",
            "l": 2,
            "el": [
              "305c"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Local memory allocation",
            "e": [
              "LocalAlloc"
            ],
            "i": "micro-behaviors/mem/alloc/heap::local-alloc",
            "l": 2,
            "el": [
              "3058"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "mdxu.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "LoadLibrary symbol",
            "e": [
              "LoadLibraryW"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym",
            "l": 1,
            "el": [
              "3054"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Exit current process",
            "e": [
              "ExitProcess"
            ],
            "i": "micro-behaviors/process/terminate/kill::exit-process",
            "l": 2,
            "el": [
              "3048"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "800"
            ]
          },
          {
            "a": "T1071.001",
            "c": 0.8600000143051147,
            "d": "UUID formatted route segment",
            "e": [
              "75339C8C-B4BA-463B-BAC7-975FCA2F89D9"
            ],
            "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment",
            "l": 1,
            "m": "B0030",
            "el": [
              "850"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny PE stub footprint",
            "e": [
              "mdxu.exe"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-pe-footprint",
            "l": 1
          },
          {
            "a": "T1140",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "CreateAssemblyCache"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2",
            "l": 1,
            "m": "B0023",
            "el": [
              "83e"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "mdxu.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 7.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1,
            "el": [
              "660"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Resolve exports with GetProcAddress",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/os/module/load::get-proc-address-import",
            "l": 2,
            "el": [
              "3050"
            ]
          },
          {
            "a": "T1622",
            "c": 0.8999999761581421,
            "d": "mscoree.dll resolved at runtime",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string",
            "l": 1,
            "el": [
              "800"
            ]
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 7.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1129",
            "c": 0.8799999952316284,
            "d": "Dynamic library loading via LoadLibraryW",
            "e": [
              "LoadLibraryW"
            ],
            "i": "micro-behaviors/dylib/load/runtime::load-library-w",
            "l": 3,
            "el": [
              "3054"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "GUID-formatted token",
            "e": [
              "{75339C8C-B4BA-463B-BAC7-975FCA2F89D9}"
            ],
            "i": "micro-behaviors/process/sync/mutex::guid-mutex",
            "l": 1,
            "m": "C0042",
            "el": [
              "850"
            ]
          }
        ],
        "sha": "dd9e55b86760204404ad3ae83b7a972906779c1d755300a24622a444d6980bf9",
        "path": "mdxu.exe",
        "type": "pe"
      }
    ],
    "tv": "8e9ac"
  }
}