{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9935870170593262,
        "class": 1
      }
    ],
    "prob": 0.993587,
    "class": 1,
    "oprob": 0.6795654,
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.993587,
      0.99945134
    ],
    "analyzed_at": "2026-04-27T00:11:32Z"
  },
  "path": "virussign.com_4b8e9d768ff7eddde7be3c74d6921790.vir",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₃(Al₂As₂C₃)H(Db)Md(Bi₃)",
        "x": 123,
        "id": 0,
        "ms": {
          "binary": {
            "code_size": 2560.0,
            "file_size": 31232.0,
            "wx_sections": 2.0,
            "string_count": 83.0,
            "section_count": 2.0,
            "string_density": 33.2,
            "overall_entropy": 6.36,
            "avg_section_size": 1280.0,
            "avg_string_length": 16.86,
            "max_string_length": 62.0,
            "writable_sections": 2.0,
            "avg_string_entropy": 3.12,
            "code_section_ratio": 1.0,
            "executable_sections": 2.0,
            "section_name_entropy": 2.41,
            "string_length_stddev": 13.46,
            "largest_section_ratio": 0.08,
            "sentence_string_count": 39.0,
            "sentence_string_ratio": 0.47,
            "function_analysis_depth": 2.0,
            "has_malformed_structure": true,
            "normalized_section_count": 0.13,
            "nonstandard_section_name_count": 4.0
          }
        },
        "ss": [
          [
            21884,
            "XZRP"
          ],
          [
            28676,
            "E.K. Ream/Dr Dobb's Editor - IBM PC enhancement: Mar. 10, 1984"
          ],
          [
            28739,
            "Modified by Alan D. Howard"
          ],
          [
            28778,
            "main: no mode"
          ],
          [
            28803,
            "edit: search"
          ],
          [
            28816,
            "insert"
          ],
          [
            28823,
            "Insert: kill"
          ],
          [
            28836,
            "Insert: search"
          ],
          [
            28851,
            "marked buff top"
          ],
          [
            28867,
            "marked buff end"
          ],
          [
            28883,
            "buffer picked"
          ],
          [
            28897,
            "Scroll down"
          ],
          [
            28916,
            "Scroll up"
          ],
          [
            28935,
            "bad line number"
          ],
          [
            28951,
            "append"
          ],
          [
            28958,
            "change"
          ],
          [
            28965,
            "clear"
          ],
          [
            28971,
            "count"
          ],
          [
            28977,
            "delete"
          ],
          [
            28993,
            "pattern not found"
          ],
          [
            29016,
            "open"
          ],
          [
            29021,
            "load"
          ],
          [
            29026,
            "name"
          ],
          [
            29031,
            "write"
          ],
          [
            29037,
            "rename"
          ],
          [
            29044,
            "delname"
          ],
          [
            29052,
            "closewrite"
          ],
          [
            29063,
            "showtab"
          ],
          [
            29071,
            "hidetab"
          ],
          [
            29079,
            "closeread"
          ],
          [
            29094,
            "open \u003cf/n\u003e | name \u003cf/n\u003e | rename \u003cf/n\u003e | delname \u003cf/n\u003e"
          ],
          [
            29149,
            "load \u003cf/n\u003e | append \u003cf/n\u003e | rest | read \u003cn\u003e | write \u003cn\u003e | save"
          ],
          [
            29212,
            "extract [\u003cf t\u003e] | closeread | closewrite"
          ],
          [
            29310,
            "find | search [\u003cf t\u003e] | change [\u003cf t\u003e] | list [\u003cf t\u003e]"
          ],
          [
            29364,
            "tabs \u003cn\u003e | showtab | hidetab | help | dos | g \u003cn\u003e | count \u003cn\u003e"
          ],
          [
            29426,
            "save"
          ],
          [
            29431,
            "read"
          ],
          [
            29436,
            "move"
          ],
          [
            29446,
            "search"
          ],
          [
            29463,
            "extract"
          ],
          [
            29471,
            "command not found"
          ],
          [
            29493,
            "no file argument"
          ],
          [
            29512,
            "file not found"
          ],
          [
            29527,
            "line truncated"
          ],
          [
            29542,
            "search mask ?"
          ],
          [
            29557,
            "change mask ?"
          ],
          [
            29572,
            "buffer cleared"
          ],
          [
            29587,
            "deleted lines saved in pick buffer"
          ],
          [
            29622,
            "file not opened"
          ],
          [
            29638,
            "read file still open"
          ],
          [
            29693,
            "no read file"
          ],
          [
            29734,
            "buffer not saved. clear?"
          ],
          [
            29805,
            "no write file - call name"
          ],
          [
            29831,
            "write file open"
          ],
          [
            29849,
            "disk file exists"
          ],
          [
            29931,
            "Buffer not saved.  Proceed  ?"
          ],
          [
            29962,
            "cancelled"
          ],
          [
            29972,
            "bad argument"
          ],
          [
            30050,
            "new line too long"
          ],
          [
            30068,
            "too many ?'s in change mask"
          ],
          [
            30114,
            "interleaving not permitted"
          ],
          [
            30168,
            "Not picked: no room"
          ],
          [
            30211,
            "no rdfile"
          ],
          [
            30221,
            "no wrtfile"
          ],
          [
            30265,
            "record"
          ],
          [
            30272,
            "end record"
          ],
          [
            30283,
            "replay"
          ],
          [
            30290,
            "record overflow"
          ],
          [
            30306,
            "disk write failed"
          ],
          [
            30342,
            "syspopch() not implemented"
          ],
          [
            30369,
            "no file name"
          ],
          [
            30382,
            "system error:"
          ],
          [
            30405,
            "disk error:"
          ],
          [
            30418,
            "popline:  missing CR"
          ],
          [
            30439,
            "bufup:\tmissing CR"
          ],
          [
            30457,
            "bufup: bufp underflow"
          ],
          [
            30479,
            "bufdn: bufp overflow"
          ],
          [
            30500,
            "line deleted"
          ],
          [
            30514,
            "main buffer is full"
          ],
          [
            30534,
            "Caution: main buffer is full"
          ],
          [
            30563,
            "insufficient room in buffer for copy or move"
          ],
          [
            30608,
            "insufficient room in buffer for put"
          ],
          [
            30713,
            "not enough memory"
          ]
        ],
        "sz": 31232,
        "ts": [
          {
            "a": "T1027",
            "c": 1.0,
            "d": "PE signature corrupted: expected PE\\x00\\x00, got 4D 5A 00 00",
            "e": [
              "PE signature at 0x0: [77, 90, 0, 0]"
            ],
            "i": "objectives/anti-analysis/pe-tampering/pe-signature-corrupted",
            "l": 5,
            "m": "B0001"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "PE header too corrupted to parse: Malformed entity: PE header is malformed (signature 0x5a4d)",
            "e": [
              "Malformed entity: PE header is malformed (signature 0x5a4d)"
            ],
            "i": "objectives/anti-analysis/pe-tampering/corrupted-header",
            "l": 4,
            "m": "B0001"
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols::single-import-raw",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols::no-exports",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny PE single-function stub",
            "e": [
              "binary.function_count = 0.00"
            ],
            "i": "metadata/binary/layout::tiny-single-function-pe",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "binary.section_count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.20000000298023224,
            "d": "command keyword",
            "e": [
              "command not found (contains: command)"
            ],
            "i": "micro-behaviors/data/text/keywords::command-dup",
            "l": 1
          },
          {
            "d": "overflow keyword",
            "e": [
              "record overflow (contains: overflow)",
              "bufdn: bufp overflow (contains: overflow)"
            ],
            "i": "micro-behaviors/data/text/keywords::overflow",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.12"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Binary has many sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.47"
            ],
            "i": "metadata/binary/metrics::rich-sentence-strings-20pct",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening::no-pie",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 31232.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 0.00"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 1.0,
            "d": "Binary has high overall entropy",
            "e": [
              "binary.overall_entropy = 6.36"
            ],
            "i": "objectives/command-and-control/dropper/staging::high-entropy-binary",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Zero recovered functions",
            "e": [
              "binary.function_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1620",
            "c": 0.8199999928474426,
            "d": "RegPhantom compact driver size",
            "e": [
              "virussign.com_4b8e9d768ff7eddde7be3c74d6921790.vir"
            ],
            "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols::pe-imports-max-six",
            "l": 1
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.function_count = 0.00"
            ],
            "i": "metadata/binary/metrics::no-functions",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.699999988079071,
            "d": "PE with single import",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols::single-import-count",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed::unsigned",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE with very few imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols::few-import-count",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "binary.section_count = 2.00"
            ],
            "i": "metadata/binary/metrics::few-sections",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "PE with malformed section layout",
            "e": [
              "binary.has_malformed_structure = 1.00"
            ],
            "i": "metadata/binary/metrics::malformed-pe-structure",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "No imported symbols",
            "e": [
              "binary.import_density = 0.00"
            ],
            "i": "metadata/binary/metrics::no-imports",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Binary lacks resource section entirely",
            "e": [
              "binary.rsrc_to_file_ratio = 0.00"
            ],
            "i": "metadata/binary/resource::no-resources",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed::unsigned-pe-executable",
            "l": 2
          },
          {
            "c": 0.8600000143051147,
            "d": "Low-code PE with no imports",
            "e": [
              "binary.import_density = 0.00",
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-no-import-resource-stub",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file consisting primarily of resources (e.g., .mui, UI localization)",
            "e": [
              "binary.function_count = 0.00",
              "binary.import_density = 0.00",
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::resource-only-dll",
            "l": 2
          }
        ],
        "sha": "e658d8ceafbdd7fbead951a2ea80d804bbb3931f6b1cfa84dd9b206bcf963c91",
        "path": "/data/samples/bad/harvest/virussign/virussign.com_4b8e9d768ff7eddde7be3c74d6921790.vir",
        "type": "pe"
      }
    ],
    "tv": "bf48d"
  }
}