{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.5646388, "class": 0 }, { "m": "az/pe", "prob": 0.0041841003, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T02:22:19Z" }, "path": "e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 3, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 643272.0, "entropy": 7.78, "size_bytes": 643272.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 1.0 } }, "s": [ [ 504, "u8", "CODE" ], [ 584, "u8", ".rsrc" ], [ 623, "u8", "@.itext" ], [ 1260, "u8", "kernel32.dll" ], [ 1280, "u8", "GetModuleHandleA" ], [ 1299, "u8", "user32.dll" ], [ 1317, "u8", "MessageBoxW" ], [ 1330, "u8", "advapi32.dll" ], [ 1350, "u8", "RegQueryValueW" ], [ 1367, "u8", "comctl32.dll" ], [ 1387, "u8", "InitCommonControlsEx" ], [ 1410, "u8", "shell32.dll" ], [ 1428, "u8", "SHGetIconOverlayIndexA" ], [ 1453, "u8", "mscoree.dll" ], [ 1626, "wide", "ERCOV" ], [ 1682, "wide", "QT_RU" ], [ 1738, "wide", "QT_SK" ], [ 1794, "wide", "QT_UK" ], [ 1850, "wide", "VMITE" ], [ 1890, "wide", "FOVDATA" ], [ 2946, "u8", "zOsniS`\\XYQNJ_:87YgebU" ], [ 27116, "u8", "HEAxQMHo^YTegb\\_xrkW" ], [ 27347, "u8", "/4448sstD" ], [ 27676, "u8", "LHDwRNJo\\WRglga]wqkX" ], [ 27781, "u8", "~xV{vpYupj\\njd_fb]d`\\Wg[WSjURNnPLIrKHDuHEBwDB?{31/s" ], [ 28240, "u8", "MIEuRNJoWSOk`\\Wfd_Zegc]cie_cgc^efb\\fb]Xi\\XSnWSOqQNJuKHDzFC?" ], [ 28443, "u8", "vGGHE" ], [ 28963, "u8", "lCCC2" ], [ 83855, "u8", "IHDR" ], [ 83881, "u8", "IDATx" ], [ 84414, "u8", "Ibmy" ], [ 86093, "u8", "wMjz" ], [ 87201, "u8", "-MP H0" ], [ 88366, "u8", "/nVx" ], [ 89737, "u8", ". almA" ], [ 90706, "u8", "/tVn" ], [ 92620, "u8", "oVni9" ], [ 92893, "u8", "tMbj" ], [ 94238, "u8", "oDys" ], [ 94381, "u8", "sbxPc" ], [ 94884, "u8", "DPJAJ" ], [ 96025, "u8", "xPjqu" ], [ 98285, "u8", "/lcX" ], [ 104648, "u8", "SFPW" ], [ 106154, "u8", "cwUq" ], [ 108196, "u8", "uMWPE" ], [ 110173, "u8", "D4PI" ], [ 112796, "u8", "iFeq" ], [ 114956, "u8", "IQ_7" ], [ 115222, "u8", "ZEnBp" ], [ 116141, "u8", "80DJ" ], [ 117907, "u8", "xfSkV" ], [ 118490, "u8", "NTuSc" ], [ 118785, "u8", "BlP Jr" ], [ 119048, "u8", "GBAFb" ], [ 120075, "u8", "2Y.-.RN" ], [ 120300, "u8", "lLOuM" ], [ 120765, "u8", "sUUz4" ], [ 121557, "u8", "DUUP" ], [ 122008, "u8", "PollT" ], [ 122039, "u8", "X3sEDc" ], [ 122059, "u8", "LVDB" ], [ 122559, "u8", "IkEZk" ], [ 122728, "u8", "Tvuc" ], [ 123217, "u8", "o8SKBwsR" ], [ 123598, "u8", "UYQY" ], [ 124052, "u8", "u][r" ], [ 124090, "u8", "IUUM" ], [ 125047, "u8", "Lmnn" ], [ 125999, "u8", "IEND" ], [ 126098, "wide", "IDI_MAIN" ], [ 126246, "wide", "PROTOCOL-V3" ], [ 126379, "u8", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e" ], [ 126436, "u8", "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e\u003cassemblyIdentity version=\"1.0.0.0\" name=\"Installer\" ty" ], [ 131524, "u8", "U \u003cxewk" ], [ 132460, "u8", "rrDn" ], [ 132947, "u8", "yqbL9" ], [ 134318, "u8", "KQ2HA" ], [ 134632, "u8", "/3w8Ul[" ], [ 135381, "u8", "8fRQc" ], [ 135536, "u8", "iuit" ], [ 136721, "u8", "GEZY9" ], [ 137531, "u8", "wu83" ], [ 138000, "u8", "o4BACVA" ], [ 139912, "u8", "2wXGq" ], [ 140465, "u8", "HKIel" ], [ 142255, "u8", "Ykqq" ], [ 142967, "u8", "P_9Q" ], [ 143177, "u8", "VELuw" ], [ 144578, "u8", "iYFkT" ], [ 145375, "u8", "mQsa" ], [ 146733, "u8", "YEE_" ], [ 147251, "u8", "YA0cP" ], [ 147520, "u8", "qlVJR" ], [ 148626, "u8", "d0z5" ], [ 149768, "u8", "jc8O2" ], [ 150864, "u8", "byy3L" ], [ 150954, "u8", "XY1Zy" ], [ 153032, "u8", "M5R9" ], [ 154842, "u8", "3CMC" ], [ 157279, "u8", "Feejt" ], [ 159178, "u8", "5n7Ud.S" ], [ 161668, "u8", "Vzt4yD" ], [ 161900, "u8", "n0ECr" ], [ 162027, "u8", "QNW4" ], [ 162763, "u8", "QfbyS" ], [ 163160, "u8", "QZjhu" ], [ 167552, "u8", "pSRvi" ], [ 167655, "u8", "VIOSIE" ], [ 168359, "u8", "bQsCwu" ], [ 169908, "u8", "/QFrw" ], [ 171496, "u8", "LqpXvX" ], [ 172062, "u8", "8sffK" ], [ 172270, "u8", "18ms" ], [ 175969, "u8", "HYIXa" ], [ 176809, "u8", "Ab TI?vV" ], [ 179649, "u8", "4GKQ" ], [ 180277, "u8", "KcF01" ], [ 180367, "u8", "KSVZ" ], [ 180688, "u8", "n8qo" ], [ 182053, "u8", "GUK3" ], [ 182125, "u8", "u0hxv" ], [ 182619, "u8", "E9UB" ], [ 182987, "u8", "JT6W" ], [ 183035, "u8", "HEJ9" ], [ 185524, "u8", "uJzk" ], [ 186172, "u8", "IFT3" ], [ 186853, "u8", "Q lk" ], [ 188501, "u8", "Whge" ], [ 188581, "u8", "b7ig" ], [ 189966, "u8", "aMBrn" ], [ 191154, "u8", "WyylY" ], [ 191249, "u8", "t04y" ], [ 191555, "u8", "U9tUlw" ], [ 192674, "u8", "ciie" ], [ 192831, "u8", "/XnP" ], [ 193155, "u8", "fZ0FT" ], [ 195602, "u8", "T9skV" ], [ 197274, "u8", "u Bt" ], [ 198123, "u8", "tM p" ], [ 199306, "u8", "HDEO" ], [ 201531, "u8", "GLpCn" ], [ 201662, "u8", "8UUm6" ], [ 202062, "u8", "SiYAv5" ], [ 202620, "u8", "gtENw" ], [ 205414, "u8", "Megxd" ], [ 206968, "u8", "OXBP" ], [ 207106, "u8", "cC lZ" ], [ 207853, "u8", "kLY43" ], [ 208540, "u8", "Mjnr" ], [ 210163, "u8", "I_91" ], [ 211229, "u8", "FPS9p" ], [ 214396, "u8", "7GCvZ" ], [ 214751, "u8", "/Jrv7" ], [ 215566, "u8", "ZLJX" ], [ 218297, "u8", "7J98eN" ], [ 219103, "u8", "x3ho" ], [ 220025, "u8", "/suV" ], [ 220035, "u8", "iah7I" ], [ 221207, "u8", "yKzn" ], [ 221311, "u8", "bHLtV" ], [ 223152, "u8", "X0DFk" ], [ 224583, "u8", "D69D" ], [ 225238, "u8", "BGpSQ" ], [ 226534, "u8", "PU6V" ], [ 227728, "u8", "D9Pfu" ], [ 229342, "u8", "aeiy" ], [ 230659, "u8", "ivKz" ], [ 231754, "u8", "eJ313" ], [ 232486, "u8", "VCJye" ], [ 233638, "u8", "VVFH" ], [ 236366, "u8", "poTm" ], [ 240189, "u8", "ygOu" ], [ 240219, "u8", "bFBmt" ], [ 240923, "u8", "03DP" ], [ 241245, "u8", "VW1O1" ], [ 243181, "u8", "IT9B" ], [ 243751, "u8", "LdMFq" ], [ 248607, "u8", "UVlaV" ], [ 249620, "u8", "bdGo" ], [ 250484, "u8", "NH8H" ], [ 251276, "u8", ".kfa" ], [ 253089, "u8", "G2be9" ], [ 255931, "u8", "XqLkr" ], [ 257268, "u8", "WS9B" ], [ 257898, "u8", "6BSND" ], [ 260565, "u8", "zQEEN" ], [ 260777, "u8", "/R;rgF2" ], [ 262142, "u8", "ot7vT" ], [ 262989, "u8", "flk9S" ], [ 263606, "u8", "xPfp" ], [ 264402, "u8", "2X4O" ], [ 267860, "u8", "89TW0Y" ], [ 268929, "u8", "l2IbaqS" ], [ 269451, "u8", "Z0GH" ], [ 271792, "u8", "qLgr" ], [ 272539, "u8", "ZF93" ], [ 273849, "u8", "D4TU" ], [ 274181, "u8", "GGfSi" ], [ 274227, "u8", "smZs" ], [ 276303, "u8", "TFFrdvq" ], [ 278832, "u8", "GW0I" ], [ 278924, "u8", "Mtte" ], [ 279560, "u8", "WHPW" ], [ 279880, "u8", "O6TD" ], [ 281347, "u8", "bQKUBp" ], [ 281385, "u8", "Xdfn" ], [ 281475, "u8", "7i0c" ], [ 281597, "u8", "wuSm" ], [ 282944, "u8", "Wb8YMn" ], [ 283247, "u8", "imsHI" ], [ 283514, "u8", "mh16" ], [ 284252, "u8", "YfmYh" ], [ 284512, "u8", "3QZP" ], [ 284728, "u8", "awoYo" ], [ 285192, "u8", "vbIq" ], [ 288388, "u8", "8gGJN" ], [ 289699, "u8", "d3ag" ], [ 291692, "u8", "E1SA" ], [ 293102, "u8", "GwtHb" ], [ 295298, "u8", "JCQF" ], [ 296659, "u8", "jh9e" ], [ 297108, "u8", "bgipY" ], [ 299360, "u8", "koBc" ], [ 299477, "u8", "DUQ5" ], [ 300587, "u8", "zgSJz" ], [ 301058, "u8", "NpxTDx" ], [ 302287, "u8", "ole8" ], [ 303095, "u8", "IWoyO" ], [ 303894, "u8", "Te55s" ], [ 304912, "u8", "Avyl" ], [ 304944, "u8", "JNS4" ], [ 305702, "u8", "lsxOJ" ], [ 306543, "u8", "IDZA" ], [ 306570, "u8", "ci92y" ], [ 307288, "u8", "jbBCE" ], [ 308303, "u8", "A75N" ], [ 308929, "u8", "zSpkW" ], [ 308962, "u8", "7RWT" ], [ 309063, "u8", "MGHP" ], [ 309616, "u8", "124g" ], [ 309826, "u8", "AkhbrC" ], [ 310228, "u8", "96YQS" ], [ 310862, "u8", "45YR" ], [ 311629, "u8", "/Ae4CM" ], [ 311683, "u8", "DX0KJ" ], [ 311861, "u8", "5eKsN.q" ], [ 317146, "u8", "c.lk" ], [ 317870, "u8", "4QCN" ], [ 318318, "u8", "coId" ], [ 318342, "u8", "2OMS" ], [ 318570, "u8", "dLye" ], [ 319153, "u8", "fBFTi" ], [ 319569, "u8", "p9op" ], [ 321798, "u8", "UTt3r" ], [ 322233, "u8", "/xb8A" ] ], "v": { "file.stem": "e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 4216109415, "file.basename": "e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a.exe", "pe.image_base": 4194304, "pe.image_size": 1331200, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 1224704, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 6392, "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.linker_major_version": 48, "pe.signatures[0].issuer": "CN=Kingston Fury Beast DDR4 2x16Gb CHK432C16BBK2/32", "pe.signatures[0].serial": "1915297b7eefed83428d642f746ce769", "pe.signatures[0].subject": "CN=Kingston Fury Beast DDR4 2x16Gb CHK432C16BBK2/32", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2032-02-02T15:10:59Z", "pe.signatures[0].not_before": "2022-02-01T15:10:59Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 256, "pe.signatures[0].thumbprint_sha1": "cee505c8e10e56244312bc4ef13c4d5510cc3c95", "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].signature_digest": "b4df269562bdd05280d6b66f4d2498a5166536b051b19577674a03aa729d104d", "pe.signatures[0].thumbprint_sha256": "54a4a1595a08ad8f6cd48efdacfb27b05f285b3da3ab4381dfc03f7b575c136a", "pe.signatures[0].signature_algorithm": "sha1WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 643272, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: Kingston Fury Beast DDR4 2x16Gb CHK432C16BBK2/32", "e": [ "Kingston Fury Beast DDR4 2x16Gb CHK432C16BBK2/32" ], "i": "metadata/signed/unknown::kingston-fury-beast-ddr4-2x16gb-chk432c16bbk2/32", "l": 2 }, { "c": 1.0, "d": "Signed by Kingston Fury Beast DDR4 2x16Gb CHK432C16BBK2/32", "e": [ "Kingston Fury Beast DDR4 2x16Gb CHK432C16BBK2/32" ], "i": "metadata/signed/leaf::kingston-fury-beast-ddr4-2x16gb-chk432c16bbk2/32", "l": 3 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x5ad" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1.0," ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "0x9c61b" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x4ec" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "RegQueryValueW" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x546" ] }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030", "el": [ "0x1ede4" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SectigoRSATimeStampingCA", "InitCommonControlsEx" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x9c2e9", "0x56b" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x4ec" ] }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 643272 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 } ], "sha": "e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-02/e0c75b0d6d1859e2ff916c78cb7fbe3edee3b762cd01fe8af00d6f1de9e9656a.exe", "type": "pe" } ], "tv": "ca5ef" } }