{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000081419945, "rte": "az", "prob": 0.000081419945 }, { "cls": 0, "raw": 0.0013182759, "rte": "az/native", "prob": 0.0013182759 }, { "cls": 0, "raw": 0.07371142, "rte": "az/pe", "prob": 0.07371142 } ], "prob": 0.000081419945, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0000814199447631836, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T06:15:45Z" }, "path": "69533", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003cgkeC4Cc3z/2EO00000oMauIoLE%RvrcSV00000m}D^sA=kCNwmPZ(B8}rYrD8wRyEiqmCwg@ckM", "l": 0, "n": [ { "c": 3, "d": "Very few sections (merged/stripped)", "i": "metadata/binary/metrics/structural::few-sections", "o": 0, "z": 21 } ], "x": true }, { "b": "00000000000000000000+/[qP+\u0026]ri007l!+/[qPrG3i{(}vDX08({1JLhZ$%nPS[0002e+/[qP]q/]2TBJ8(0lmKjtR!RB:3)u{gE7", "l": 4080, "n": [ { "c": 3, "d": "Writable and executable section (W^X violation)", "i": "metadata/hardening/memory::wx-section", "o": 4096, "z": 34 } ], "x": true }, { "b": "yHF\u0026fzGGCAvpR02z/4dqe[Gos00000000000bcE@A5]T9yHF\u0026fzGGCAvpR02z/4dp", "l": 12495, "n": [ { "c": 2, "d": ".exe extension reference", "i": "micro-behaviors/fs/path/extension::exe-dup", "o": 12511, "z": 4 } ], "x": true }, { "b": "00000000000000000000gYNKRj]+P-nb@U\u003cso5v4vGlAey5!nmCMm:AFb/PIKn]pYPA1", "l": 20836, "n": [ { "c": 2, "d": "String copy (unsafe)", "i": "micro-behaviors/data/string/library::strcpy", "o": 20852, "z": 6 } ], "x": true }, { "b": "pdm\u0026jga\u003e%*oAn1cwO2/Xm}D^vD2[7sza58UwN/?2A^o}Js7#LvCX7v+0cz7608lx)lSc(ol}*nOB98CjAcRA", "l": 28679, "n": [ { "c": 2, "d": "GetSystemDirectory API string", "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "o": 28695, "z": 19 } ], "x": true }, { "b": "0qGzR098]\u003co\u00261Ipl}*nOrz(HUz*c8nz^^fQz:[CSwKcp@00000f:v{*2l$Fs2l$Fs2l$Fs2l$Fs2nv:S3jl", "l": 28952, "n": [ { "c": 3, "d": "URLDownloadToFile API name as string", "i": "micro-behaviors/communications/http/get::url-download-to-file-str", "o": 28968, "z": 18 } ], "x": true }, { "b": "00000000000000000000w[*QH88hQQtI)(M.$FAX7n[FZx6yMeMD3u\u003cklsb/aiaE?Tq5OWxq.\u003c[SpYR5M^0Ynjrz$[{Jjo{", "l": 32752, "n": [ { "c": 3, "d": "Writable and executable section (W^X violation)", "i": "metadata/hardening/memory::wx-section", "o": 32768, "z": 28 } ], "x": true }, { "b": "0000000000002.(rZP+:e[w^m007vEB98CjAcRA-+Mq\u003ccA:@K1000Jfkr*[*sWt\u003eI", "l": 65566, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 65582, "z": 4 } ], "x": true } ], "mol": "H(Cm)Md(He)", "sha": "eb9fb87dea12eb9ae2d4ac9c3f33db6edcdd838a0696748742585e5c110676b8", "fact": { "id": "pe", "imp": [ [ "msvcrt", "strcpy" ], [ "msvcrt", "strcat" ], [ "msvcrt", "??2@YAPAXI@Z" ], [ "msvcrt", "chkesp" ], [ "msvcrt", "exit" ], [ "msvcrt", "XcptFilter" ], [ "msvcrt", "exit" ], [ "msvcrt", "p___initenv" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "initterm" ], [ "msvcrt", "setusermatherr" ], [ "msvcrt", "adjust_fdiv" ], [ "msvcrt", "p__commode" ], [ "msvcrt", "p__fmode" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "except_handler3" ], [ "msvcrt", "controlfp" ], [ "msvcrt", "dllonexit" ], [ "msvcrt", "onexit" ] ], "met": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "overlay_padding": 3584.0, "checksum_stripped": 1.0, "computed_checksum": 135151.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "entry_in_writable_section": 1.0 }, "file": { "size": 69632.0, "entropy": 1.88, "size_bytes": 69632.0 }, "binary": { "is_pie": 0.0, "code_entropy": 1.77, "data_entropy": 0.59, "string_count": 56.0, "overall_entropy": 1.88, "entropy_variance": 0.36, "avg_string_length": 16.41, "max_string_length": 27.0, "code_to_data_ratio": 0.94, "string_length_stddev": 8.33, "largest_section_ratio": 0.47, "sentence_string_count": 0.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 19.0 }, "sections": { "count": 3.0, "code_size": 61440.0, "entropy_max": 2.06, "entropy_mean": 1.37, "name_entropy": 3.5, "writable_count": 3.0, "executable_count": 2.0, "nonstandard_count": 3.0, "executable_writable_count": 2.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ "Unpacker", 4096, 28672, 1.45, "rwx" ], [ "By", 32768, 32768, 2.06, "rwx" ], [ ".snaker", 65536, 4096, 0.59, "rw-" ] ], "str": [ [ 0, "u8", "MZLoveboom" ], [ 16, "u8", "LoadLibraryA" ], [ 32, "u8", "GetProcAddress" ], [ 48, "u8", "UpackByDwing@" ], [ 312, "u8", "Unpacker" ], [ 392, "u8", ".snaker" ], [ 4177, "u8", "xHHHX" ], [ 4316, "u8", "T44,004440\\ttPL8" ], [ 12488, "u8", "http://ka.inte1ad.com/c.exe" ], [ 12524, "u8", "http://ka.inte1ad.com/b.exe" ], [ 12560, "u8", "http://ka.inte1ad.com/a.exe" ], [ 12596, "u8", "http://jq.inte1ad.com/c.exe" ], [ 12632, "u8", "http://jq.inte1ad.com/b.exe" ], [ 12668, "u8", "http://jq.inte1ad.com/a.exe" ], [ 12704, "u8", "http://in.inte1ad.com/c.exe" ], [ 12740, "u8", "http://in.inte1ad.com/b.exe" ], [ 12776, "u8", "http://in.inte1ad.com/a.exe" ], [ 12812, "u8", "http://ge.inte1ad.com/c.exe" ], [ 12848, "u8", "http://ge.inte1ad.com/b.exe" ], [ 12884, "u8", "http://ge.inte1ad.com/a.exe" ], [ 12920, "u8", "http://fo.inte1ad.com/c.exe" ], [ 12956, "u8", "http://fo.inte1ad.com/b.exe" ], [ 12992, "u8", "http://fo.inte1ad.com/a.exe" ], [ 13028, "u8", "http://23yad.com/c.exe" ], [ 13056, "u8", "http://23yad.com/b.exe" ], [ 13084, "u8", "http://23yad.com/a.exe" ], [ 13112, "u8", "http://ex.inte1ad.com/c.exe" ], [ 13148, "u8", "http://ex.inte1ad.com/b.exe" ], [ 13184, "u8", "http://ex.inte1ad.com/a.exe" ], [ 28676, "u8", "KERNEL32.DLL" ], [ 28689, "u8", "Sleep" ], [ 28695, "u8", "GetSystemDirectoryA" ], [ 28715, "u8", "WinExec" ], [ 28728, "u8", "MSVCRT.DLL" ], [ 28746, "u8", "strcat" ], [ 28753, "u8", "??2@YAPAXI@Z" ], [ 28766, "u8", "_chkesp" ], [ 28780, "u8", "_XcptFilter" ], [ 28792, "u8", "exit" ], [ 28797, "u8", "__p___initenv" ], [ 28811, "u8", "__getmainargs" ], [ 28825, "u8", "_initterm" ], [ 28835, "u8", "__setusermatherr" ], [ 28852, "u8", "_adjust_fdiv" ], [ 28865, "u8", "__p__commode" ], [ 28878, "u8", "__p__fmode" ], [ 28889, "u8", "__set_app_type" ], [ 28904, "u8", "_except_handler3" ], [ 28921, "u8", "_controlfp" ], [ 28932, "u8", "__dllonexit" ], [ 28944, "u8", "_onexit" ], [ 28957, "u8", "URLMON.DLL" ], [ 28968, "u8", "URLDownloadToFileA" ], [ 33456, "u8", "gaAz" ], [ 33801, "u8", "D98S" ], [ 65576, "u8", "MSVCRT.dll" ] ], "val": { "file.stem": "69533", "pe.imphash": "ab8409e77d60fcc9916fa314c9c9728c", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 4096, "file.basename": "69533", "pe.image_base": 4194304, "pe.image_size": 69632, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 5020, "pe.headers_size": 512, "pe.entry_section": "Unpacker", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "03eb1ebf1d81d6bf899325e038767cc056117875", "pe.image_hash.sha256": "9cf1542b832cecd17d967ed99f09cfbbb60862946953e55d1b5bde27b5c1434d", "pe.image_hash.sha384": "0e1b0cff1649d4eadd0817d323818ba7cf9acb2a998c5de94b0eddfd21d8c737b8597deeb171bbae6737eba6d961d883", "pe.image_hash.sha512": "87848606d526abce726d70cc9681d88fbb865cbd9935c4d163bbbf39f89fb3860280c4af4390de9f84688c544058a7aa119bedef45e6b83ab54094cffcee7d84", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 270, "pe.linker_minor_version": 57, "pe.data_directories[0].rva": 65536, "pe.data_directories[1].rva": 72, "pe.number_of_rva_and_sizes": 16, "pe.coff.symbol_table_offset": 8, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 20, "pe.data_directories[1].name": "base_relocation", "pe.data_directories[1].size": 8, "pe.coff.dos_header_pe_pointer": 64 } }, "find": [ { "id": "micro-behaviors/communications/http/get::url-download-to-file-str", "atk": "T1071.001", "conf": 0.8999999761581421, "crit": 3, "desc": "URLDownloadToFile API name as string" }, { "id": "metadata/binary/metrics/structural::few-sections", "conf": 0.6000000238418579, "crit": 3, "desc": "Very few sections (merged/stripped)" }, { "id": "metadata/hardening/memory::wx-section", "conf": 1.0, "crit": 3, "desc": "Writable and executable section (W^X violation)" } ], "path": "69533", "risk": 3, "size": 69632, "type": "pe" } ] } }