{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00015813112,
        "rte": "az",
        "prob": 0.00015813112
      },
      {
        "cls": 0,
        "raw": 0.0023404062,
        "rte": "az/native",
        "prob": 0.0023404062
      },
      {
        "cls": 0,
        "raw": 0.01853615,
        "rte": "az/pe",
        "prob": 0.01853615
      }
    ],
    "prob": 0.00015813112,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00015813112258911133,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T03:03:49Z"
  },
  "path": "ee3ad3d5baad4855bb5a05962d769b54f3c4ada1cc0e1f0c432db7d073d160e1.dll",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000XbVHe4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47",
            "l": 0,
            "n": [
              {
                "c": 3,
                "d": "Packed binary process execution",
                "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution",
                "o": 0,
                "z": 27
              }
            ],
            "x": true
          },
          {
            "b": "00000000000000000000rG3iAs5z)]Op/-1OR8t00cPyXI+KRrEf+Z05B##1Iu=gh5oFeEdzRHo(Ji0+t3CcpuDH4)09907GtW",
            "l": 1008,
            "n": [
              {
                "c": 3,
                "d": "Packed binary context",
                "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context",
                "o": 1024,
                "z": 30
              }
            ],
            "x": true
          },
          {
            "b": "007N)0081300000000]qlU{WZwK{lEwnC/Si@?S*wNPW(o)7L?CThrfkMBe(wNPW(p\u0026ZF:wPI[",
            "l": 2146,
            "n": [
              {
                "c": 2,
                "d": "Close handle",
                "i": "micro-behaviors/process/create/spawn::close-handle-dup",
                "o": 2162,
                "z": 11
              }
            ],
            "x": true
          },
          {
            "b": "m}D^ovrlJVA=M8s000l8m}D^pz!a0bwKZxIwLMVJwKcp@@q//cy?m3@wLEq?wQ1gPY8(!\u0026BAg(gC%IAgZxa",
            "l": 2210,
            "n": [
              {
                "c": 2,
                "d": "Get module file path (ANSI)",
                "i": "micro-behaviors/os/module/load::get-module-filename-ansi",
                "o": 2226,
                "z": 18
              }
            ],
            "x": true
          },
          {
            "b": "BAhhezB1m5yH}K7wO:dTe[w^m0000000000002%n^m:Ju001z\u003c000310000000000",
            "l": 2278,
            "n": [
              {
                "c": 2,
                "d": ".dll extension reference",
                "i": "micro-behaviors/fs/path/extension::dll-dup",
                "o": 2294,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "qErv4pF%QYm0zu@moay{e[Gos08#J=pg3*-r7Fqn0000000000000000000000000",
            "l": 2571,
            "n": [
              {
                "c": 2,
                "d": ".exe extension reference",
                "i": "micro-behaviors/fs/path/extension::exe-dup",
                "o": 2587,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "0000000000000000000001YbgaohxwRzak?:1W\u0026P4L!.N8zSA\u003ccnEbcgbn?f00000000",
            "l": 3056,
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 3072,
                "z": 6
              }
            ],
            "x": true
          }
        ],
        "mol": "O(As)H(Po₂)",
        "sha": "ee3ad3d5baad4855bb5a05962d769b54f3c4ada1cc0e1f0c432db7d073d160e1",
        "fact": {
          "id": "pe",
          "imp": [
            [
              "kernel32",
              "CloseHandle"
            ],
            [
              "kernel32",
              "CreateMutexA"
            ],
            [
              "kernel32",
              "CreateProcessA"
            ],
            [
              "kernel32",
              "GetLastError"
            ],
            [
              "kernel32",
              "GetModuleFileNameA"
            ],
            [
              "kernel32",
              "ReleaseMutex"
            ],
            [
              "kernel32",
              "lstrcpyA"
            ],
            [
              "kernel32",
              "lstrlenA"
            ]
          ],
          "met": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 13738.0,
              "reloc_overhang_bytes": 480.0,
              "reloc_overhang_ratio": 0.94,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 11.0
            },
            "file": {
              "size": 3584.0,
              "entropy": 2.55,
              "size_bytes": 3584.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 3.83,
              "data_entropy": 0.74,
              "string_count": 20.0,
              "overall_entropy": 2.55,
              "entropy_variance": 1.97,
              "avg_string_length": 11.4,
              "max_string_length": 40.0,
              "code_to_data_ratio": 0.67,
              "string_length_stddev": 7.67,
              "largest_section_ratio": 0.29,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 8.0
            },
            "sections": {
              "count": 4.0,
              "code_size": 1024.0,
              "entropy_max": 3.83,
              "entropy_mean": 1.92,
              "name_entropy": 3.1,
              "writable_count": 1.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "sec": [
            [
              ".text",
              1024,
              1024,
              3.83,
              "r-x"
            ],
            [
              ".rdata",
              2048,
              512,
              2.7,
              "r--"
            ],
            [
              ".data",
              2560,
              512,
              0.74,
              "rw-"
            ],
            [
              ".reloc",
              3072,
              512,
              0.42,
              "r--"
            ]
          ],
          "str": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              160,
              "u8",
              "Rich"
            ],
            [
              432,
              "u8",
              ".text"
            ],
            [
              511,
              "u8",
              "@.data"
            ],
            [
              552,
              "u8",
              ".reloc"
            ],
            [
              1027,
              "u8",
              "VWQSR"
            ],
            [
              1169,
              "u8",
              "SRVWQ"
            ],
            [
              2162,
              "u8",
              "CloseHandle"
            ],
            [
              2176,
              "u8",
              "CreateMutexA"
            ],
            [
              2192,
              "u8",
              "CreateProcessA"
            ],
            [
              2210,
              "u8",
              "GetLastError"
            ],
            [
              2226,
              "u8",
              "GetModuleFileNameA"
            ],
            [
              2248,
              "u8",
              "ReleaseMutex"
            ],
            [
              2264,
              "u8",
              "lstrcpyA"
            ],
            [
              2276,
              "u8",
              "lstrlenA"
            ],
            [
              2286,
              "u8",
              "kernel32.dll"
            ],
            [
              2344,
              "u8",
              "runner.dll"
            ],
            [
              2560,
              "u8",
              "\\/INTEL_CEDR_STORE"
            ],
            [
              2579,
              "u8",
              "DwMHEUsA.exe"
            ],
            [
              2592,
              "u8",
              "TION_PATH%"
            ]
          ],
          "val": {
            "file.stem": "ee3ad3d5baad4855bb5a05962d769b54f3c4ada1cc0e1f0c432db7d073d160e1",
            "pe.imphash": "b6f391375d741ab65301de3824d105be",
            "pe.machine": "i386",
            "pe.rich.key": 3127662106,
            "pe.rich.hash": "f3231f9c6e25d4359044b4ea56ed564e",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1288815443,
            "file.basename": "ee3ad3d5baad4855bb5a05962d769b54f3c4ada1cc0e1f0c432db7d073d160e1.dll",
            "pe.image_base": 268435456,
            "pe.image_size": 20480,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 4484,
            "pe.headers_size": 1024,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "cca8c116bcf6817738594e4f5417cba299a798f7",
            "pe.export_timestamp": 1288815443,
            "pe.image_hash.sha256": "2cd81dc85f698a6ca22cc154c60897c00f5c83a893e41d863f2babb38cdaed03",
            "pe.image_hash.sha384": "edd7c77928babe5d623e8d832c3bf5369c1533fed8add2878c01b0c3d42f21a72347e2fc8d5fd97ddeb85721ea489d48",
            "pe.image_hash.sha512": "06c66969c3c2baeae08bde2b6967e39ddef9102d06f2b9bf1bf02f8a5c8f65bdd6428a58b141574f325a899f873c4bc29a18b394acbabb30386a6f715496262f",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8462,
            "pe.linker_major_version": 5,
            "pe.linker_minor_version": 12,
            "build.toolchain.compiler": "msvc",
            "pe.data_directories[0].rva": 8448,
            "pe.data_directories[1].rva": 8228,
            "pe.data_directories[2].rva": 16384,
            "pe.data_directories[3].rva": 8192,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "export",
            "pe.data_directories[0].size": 51,
            "pe.data_directories[1].name": "import",
            "pe.data_directories[1].size": 40,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 32,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 36,
            "pe.rich.entries[0].build_id": 18,
            "pe.rich.entries[1].build_id": 19,
            "pe.rich.entries[0].use_count": 1,
            "pe.rich.entries[1].use_count": 12,
            "pe.coff.dos_header_pe_pointer": 184,
            "pe.rich.entries[0].product_id": 8444,
            "pe.rich.entries[1].product_id": 8078,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 11,
            "pe.base_relocations.padding_count": 1
          }
        },
        "find": [
          {
            "id": "objectives/anti-static/pack/upx::no-compression-grade-section",
            "atk": "T1027.002",
            "mbc": "F0001.008",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "No section reaches compression-grade entropy"
          },
          {
            "id": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PE has under ten imports"
          },
          {
            "id": "micro-behaviors/process/create/spawn::create-process-a",
            "atk": "T1106",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "Create process (ANSI)"
          },
          {
            "id": "micro-behaviors/process/sync/mutex::create-mutex",
            "mbc": "C0042",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "CreateMutex API call"
          },
          {
            "id": "micro-behaviors/os/exception/error-handling::get-last-error",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "Get system error code"
          },
          {
            "id": "objectives/anti-static/pack/section-anomaly::reloc-overhang-ratio-high",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Reloc section mostly non-relocation bytes"
          },
          {
            "id": "micro-behaviors/process/create/shell/invoke::win-createprocess",
            "atk": "T1059.003",
            "mbc": "E1059.003",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Creates new process via Windows API"
          },
          {
            "id": "micro-behaviors/process/sync/mutex::mutex-api",
            "mbc": "C0042",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Mutex creation/access API"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Packed binary context"
          },
          {
            "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell command execution capability detected"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Binary process execution capability"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Packed binary process execution"
          }
        ],
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-11/ee3ad3d5baad4855bb5a05962d769b54f3c4ada1cc0e1f0c432db7d073d160e1.dll",
        "risk": 3,
        "size": 3584,
        "type": "pe"
      }
    ]
  }
}