{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9997466206550598,
        "class": 0
      }
    ],
    "prob": 0.9997466,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.99837023,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.9997466,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.9760702,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T00:08:14Z"
  },
  "path": "wmulti_c",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₃(As₉C₃Er₂)H₂(CmOs)Md₄(Bi₆PtSiPa)Th",
        "k": {
          "hash.imp": "d54e430910ab0f58c47febb0239f20f6",
          "pe.timestamp": 1293697320,
          "hash.authenti": "03983b9eb385bbe83c88cd27876c454560ec406a4959c635c2809b7e89583f73",
          "build.target_arch": "x86",
          "pe.linker_version": "2.56",
          "pe.inflated_sections[0]": "UPX2",
          "pe.data_directories[0].rva": 40960,
          "pe.data_directories[0].name": "import",
          "pe.data_directories[0].size": 316,
          "pe.section_characteristics[0].name": "UPX0",
          "pe.section_characteristics[1].name": "UPX1",
          "pe.section_characteristics[2].name": "UPX2",
          "pe.section_characteristics[1].raw_size": 4608,
          "pe.section_characteristics[2].raw_size": 512,
          "pe.section_characteristics[0].virtual_size": 28672,
          "pe.section_characteristics[1].virtual_size": 8192,
          "pe.section_characteristics[2].virtual_size": 4096,
          "pe.section_characteristics[0].virtual_address": 4096,
          "pe.section_characteristics[1].virtual_address": 32768,
          "pe.section_characteristics[2].virtual_address": 40960,
          "pe.section_characteristics[0].characteristics_hex": "e0000080",
          "pe.section_characteristics[1].characteristics_hex": "e0000040",
          "pe.section_characteristics[2].characteristics_hex": "c0000040"
        },
        "x": 117,
        "id": 0,
        "is": [
          "LoadLibraryA",
          "GetProcAddress",
          "VirtualProtect",
          "VirtualAlloc",
          "VirtualFree",
          "ExitProcess",
          "OpenServiceA",
          "iob",
          "bind"
        ],
        "ms": {
          "pe": {
            "entry": 36496.0,
            "machine": 332.0,
            "checksum": 0.0,
            "subsystem": 2.0,
            "timestamp": 1293697320.0,
            "image_base": 4194304.0,
            "entry_section": "UPX1",
            "size_of_image": 45056.0,
            "file_alignment": 512.0,
            "characteristics": 783.0,
            "size_of_headers": 4096.0,
            "export_timestamp": 0.0,
            "import_dll_count": 4.0,
            "computed_checksum": 11155.0,
            "section_alignment": 4096.0,
            "resource_timestamp": 0.0,
            "has_export_timestamp": false,
            "linker_major_version": 2.0,
            "linker_minor_version": 56.0,
            "bss_like_section_count": 1.0,
            "has_resource_timestamp": false,
            "number_of_rva_and_sizes": 16.0,
            "entry_in_writable_section": true,
            "api_hashing_indicator_count": 1.0,
            "max_section_inflation_ratio": 8.0,
            "entry_in_nonstandard_section": true
          },
          "file": {
            "size": 5632.0
          },
          "binary": {
            "code_size": 4608.0,
            "func_count": 2.0,
            "code_entropy": 3.65,
            "func_density": 0.44,
            "import_count": 9.0,
            "string_count": 41.0,
            "avg_func_size": 195.5,
            "section_count": 3.0,
            "avg_complexity": 13.0,
            "import_density": 2.0,
            "max_complexity": 25.0,
            "string_density": 9.11,
            "overall_entropy": 3.33,
            "avg_basic_blocks": 23.5,
            "avg_section_size": 1706.67,
            "dependency_count": 4.0,
            "entropy_variance": 3.02,
            "wx_section_count": 2.0,
            "avg_string_length": 10.78,
            "complexity_per_kb": 2.89,
            "max_string_length": 40.0,
            "avg_string_entropy": 2.86,
            "code_to_data_ratio": 9.0,
            "total_basic_blocks": 47.0,
            "func_analysis_depth": 2.0,
            "string_length_stddev": 6.85,
            "largest_section_ratio": 0.82,
            "sentence_string_count": 2.0,
            "sentence_string_ratio": 0.05,
            "writable_section_count": 3.0,
            "behavioral_import_ratio": 0.44,
            "entry_in_writable_region": true,
            "executable_section_count": 2.0,
            "nonstandard_section_count": 3.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            376,
            "UPX0"
          ],
          [
            416,
            "UPX1"
          ],
          [
            456,
            "UPX2"
          ],
          [
            496,
            "3.07"
          ],
          [
            993,
            "WWVS"
          ],
          [
            2062,
            "XOB7"
          ],
          [
            3098,
            "RSMS"
          ],
          [
            3108,
            "Remote Services Manag"
          ],
          [
            3149,
            "libgcj_s."
          ],
          [
            3166,
            "_Jv_RegisterClasses"
          ],
          [
            3203,
            "runtime/p)udo-re"
          ],
          [
            3223,
            "loc.c"
          ],
          [
            3229,
            "VirtualQuIy (addr,"
          ],
          [
            3255,
            "sizeof(b))G"
          ],
          [
            3286,
            "/config/i386"
          ],
          [
            3299,
            "ygming-sha"
          ],
          [
            3312,
            "omd-datap0]\u0026 \"Couldo"
          ],
          [
            3340,
            "trieve na"
          ],
          [
            3359,
            "CT 6"
          ],
          [
            3415,
            "LIBC"
          ],
          [
            3423,
            "YGMING-EH-TDM1-SJLJ"
          ],
          [
            3634,
            "AddAtomACreatePro"
          ],
          [
            3658,
            "Exit"
          ],
          [
            3727,
            "Sta5pInfomoA"
          ],
          [
            3753,
            "iryfSuRent"
          ],
          [
            3775,
            "ption"
          ],
          [
            3908,
            "fmnzo/"
          ],
          [
            4059,
            "shutdow"
          ],
          [
            4589,
            "XPTPSW"
          ],
          [
            5272,
            "KERNEL32.DLL"
          ],
          [
            5285,
            "ADVAPI32.DLL"
          ],
          [
            5298,
            "msvcrt.dll"
          ],
          [
            5309,
            "WS2_32.DLL"
          ],
          [
            5322,
            "LoadLibraryA"
          ],
          [
            5336,
            "GetProcAddress"
          ],
          [
            5352,
            "VirtualProtect"
          ],
          [
            5368,
            "VirtualAlloc"
          ],
          [
            5382,
            "VirtualFree"
          ],
          [
            5396,
            "ExitProcess"
          ],
          [
            5410,
            "OpenServiceA"
          ]
        ],
        "sz": 5632,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is packed with UPX",
            "i": "anti-static/packer/upx",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "UPX decompression failed: IO error: No such file or directory (os error 2)",
            "i": "anti-static/packer/upx/decompression-failed",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Detects privilege escalation tool",
            "e": [
              "/config/i386",
              "shutdow",
              "AddAtomACreatePro"
            ],
            "i": "third_party/SigBase/B374K/Back/Connect",
            "l": 5
          },
          {
            "a": "T1543.003",
            "c": 0.9300000071525574,
            "d": "Program can open Windows services",
            "e": [
              "OpenServiceA"
            ],
            "i": "micro-behaviors/os/service/control::open-service-import",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Suspicious combination of imported APIs",
            "e": [
              "pe.api_hashing_indicator_count = 1.00"
            ],
            "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "UPX0 section name",
            "e": [
              "UPX0"
            ],
            "i": "metadata/binary/section/names::upx0-section-name",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.33"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny PE stub footprint",
            "e": [
              "wmulti_c"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-pe-footprint",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Winsock bind import",
            "e": [
              "bind"
            ],
            "i": "micro-behaviors/communications/socket/init::bind-api",
            "l": 3
          },
          {
            "c": 0.7599999904632568,
            "d": "PE entry in nonstandard section",
            "e": [
              "pe.entry_in_nonstandard_section = 1.00"
            ],
            "i": "metadata/binary/section/metrics::pe-nonstandard-entry",
            "l": 1
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "Allocate virtual memory",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "UPX section naming marker",
            "e": [
              "UPX2",
              "UPX1",
              "UPX0"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1222.001",
            "c": 0.949999988079071,
            "d": "Modify memory page protection",
            "e": [
              "VirtualProtect"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-protect",
            "l": 2,
            "m": "C0021"
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 9.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 0.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "a": "T1027.002",
            "c": 0.800000011920929,
            "d": "Entry point in non-standard section",
            "e": [
              "UPX1 (size: 4608, entropy: 7.30, perms: rwx)"
            ],
            "i": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section",
            "l": 1,
            "m": "F0001"
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Inflated PE data section",
            "e": [
              "pe.max_section_inflation_ratio = 8.00"
            ],
            "i": "metadata/binary/section/metrics::inflated-data-section",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 4.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Small string table footprint",
            "e": [
              "binary.string_count = 41.00"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "wmulti_c"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Exit current process",
            "e": [
              "ExitProcess"
            ],
            "i": "micro-behaviors/process/terminate/kill::exit-process",
            "l": 2
          },
          {
            "c": 0.8799999952316284,
            "d": "Sparse function count stub",
            "e": [
              "binary.func_count = 2.00"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::sparse-function-stub",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 45056.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "UPX1 section name",
            "e": [
              "UPX1"
            ],
            "i": "metadata/binary/section/names::upx1-section-name",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE compile timestamp far in future",
            "e": [
              "pe.timestamp = 1293697320.00"
            ],
            "i": "metadata/binary/anomaly/provenance::pe-far-future-timestamp",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "VirtualProtect symbol",
            "e": [
              "VirtualProtect"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym",
            "l": 1
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::no-functions",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.86"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "PE linked with binutils 2.x (MinGW/GCC)",
            "e": [
              "pe.linker_major_version = 2.00"
            ],
            "i": "metadata/lang/compiler/native::linker-binutils-2x",
            "l": 3
          },
          {
            "a": "T1106",
            "c": 0.8999999761581421,
            "d": "FFI GetProcAddress API name",
            "e": [
              "GetProcAddress"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Free virtual memory",
            "e": [
              "VirtualFree"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-free",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Tiny PE by file size",
            "e": [
              "pe.machine = 332.00"
            ],
            "i": "metadata/binary/metrics/size::tiny-pe",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 13.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.33"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE header compile timestamp predates 2025",
            "e": [
              "pe.timestamp = 1293697320.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "LoadLibrary symbol",
            "e": [
              "LoadLibraryA"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.82"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1027.007",
            "c": 0.8600000143051147,
            "d": "PE API hashing indicator present",
            "e": [
              "pe.api_hashing_indicator_count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single",
            "l": 1,
            "m": "B0032.014"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 9.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.9599999785423279,
            "d": "Empty RWX UPX0 decoy section",
            "e": [
              "UPX0 (size: 0, perms: rwx)"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Downgrade standalone UPX packer finding",
            "i": "metadata/binary/framework::upx-packer-downgrade",
            "l": 2
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "VirtualAlloc API string reference",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string",
            "l": 1
          },
          {
            "a": "T1070.006",
            "c": 0.7799999713897705,
            "d": "PE header timestamp after 2030",
            "e": [
              "pe.timestamp = 1293697320.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030",
            "l": 1
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 5632 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "UPX packed section name",
            "e": [
              "UPX0",
              "UPX1",
              "UPX2"
            ],
            "i": "metadata/binary/section/names::upx-section",
            "l": 2,
            "m": "F0001.008"
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.has_export_timestamp = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 0.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "UPX packer marker string",
            "e": [
              "UPX0",
              "UPX1"
            ],
            "i": "objectives/anti-static/pack/detect::upx-marker",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Resolve exports with GetProcAddress",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/os/module/load::get-proc-address-import",
            "l": 2
          },
          {
            "a": "T1543.003",
            "c": 0.8500000238418579,
            "d": "Open existing service handle",
            "e": [
              "OpenServiceA"
            ],
            "i": "micro-behaviors/os/service/control::open-service",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 9.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1620",
            "c": 0.8999999761581421,
            "d": "GetProcAddress loader API string",
            "e": [
              "GetProcAddress"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned-pe-executable",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.82"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "UPX0",
              "UPX1",
              "UPX2"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links WS2_32.DLL (bind)",
            "e": [
              "WS2_32.DLL"
            ],
            "i": "metadata/dylib::ws2_32/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links msvcrt.dll (iob)",
            "e": [
              "msvcrt.dll"
            ],
            "i": "metadata/dylib::msvcrt/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links ADVAPI32.DLL (OpenServiceA)",
            "e": [
              "ADVAPI32.DLL"
            ],
            "i": "metadata/dylib::advapi32/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)",
            "e": [
              "KERNEL32.DLL"
            ],
            "i": "metadata/dylib::kernel32/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "UPX0 and UPX1 section pair",
            "e": [
              "UPX1",
              "UPX0"
            ],
            "i": "well-known/malware/trojan/shellobject/strings::misleading-upx-sections",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "UPX0 and UPX1 section pair",
            "e": [
              "UPX1",
              "UPX0"
            ],
            "i": "metadata/binary/section/names::upx-section-pair",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.75,
            "d": "Minimal PE imports with dynamic loading",
            "e": [
              "LoadLibraryA"
            ],
            "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027.002",
            "c": 0.949999988079071,
            "d": "UPX dynamic loader stub",
            "e": [
              "UPX0",
              "VirtualFree",
              "VirtualAlloc",
              "UPX1",
              "pe.entry_in_nonstandard_section = 1.00",
              "VirtualProtect",
              "binary.func_count = 2.00",
              "GetProcAddress"
            ],
            "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub",
            "l": 3,
            "m": "F0001"
          }
        ],
        "sha": "f0d0fbfb9496552a1060ed394e9bf3174ba9ea749b7fec57a576d21a9b155fd3",
        "path": "wmulti_c",
        "type": "pe"
      }
    ],
    "tv": "bef72"
  }
}