{
  "ml": {
    "v": "7",
    "eng": "2.11.0-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00002604723,
        "rte": "az",
        "prob": 0.00002604723
      },
      {
        "cls": 0,
        "raw": 0.0017058253,
        "rte": "az/native",
        "prob": 0.0017058253
      },
      {
        "cls": 0,
        "raw": 0.0017657479,
        "rte": "az/pe",
        "prob": 0.0017657479
      }
    ],
    "prob": 0.00002604723,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000026047229766845703,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-17T17:07:54Z"
  },
  "path": "Virus.Hijack_Backdoor.Hangup.B_281_2.vir",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "sha": "f564a697b074e0d76835dbd4f54a1f6fe570fbedaa760f759db11025bf4eef58",
        "path": "Virus.Hijack_Backdoor.Hangup.B_281_2.vir",
        "size": 15728,
        "type": "pe",
        "facts": {
          "imp": [
            [
              "kernel32",
              "Sleep"
            ],
            [
              "kernel32",
              "CreateProcessA"
            ],
            [
              "kernel32",
              "GetTempFileNameA"
            ],
            [
              "kernel32",
              "GetModuleFileNameA"
            ],
            [
              "kernel32",
              "CloseHandle"
            ],
            [
              "kernel32",
              "GetTempPathA"
            ],
            [
              "kernel32",
              "GetSystemTimeAsFileTime"
            ],
            [
              "kernel32",
              "GetCurrentProcessId"
            ],
            [
              "kernel32",
              "GetCurrentThreadId"
            ],
            [
              "kernel32",
              "GetTickCount"
            ],
            [
              "kernel32",
              "QueryPerformanceCounter"
            ],
            [
              "kernel32",
              "DecodePointer"
            ],
            [
              "kernel32",
              "IsDebuggerPresent"
            ],
            [
              "kernel32",
              "SetUnhandledExceptionFilter"
            ],
            [
              "kernel32",
              "UnhandledExceptionFilter"
            ],
            [
              "kernel32",
              "GetCurrentProcess"
            ],
            [
              "kernel32",
              "TerminateProcess"
            ],
            [
              "kernel32",
              "EncodePointer"
            ],
            [
              "kernel32",
              "InterlockedCompareExchange"
            ],
            [
              "kernel32",
              "InterlockedExchange"
            ],
            [
              "kernel32",
              "HeapSetInformation"
            ],
            [
              "shell32",
              "ShellExecuteA"
            ],
            [
              "ws2_32",
              "ORDINAL 11"
            ],
            [
              "ws2_32",
              "ORDINAL 111"
            ],
            [
              "ws2_32",
              "ORDINAL 9"
            ],
            [
              "ws2_32",
              "ORDINAL 115"
            ],
            [
              "ws2_32",
              "ORDINAL 16"
            ],
            [
              "ws2_32",
              "ORDINAL 23"
            ],
            [
              "ws2_32",
              "ORDINAL 19"
            ],
            [
              "ws2_32",
              "ORDINAL 4"
            ],
            [
              "ws2_32",
              "ORDINAL 116"
            ],
            [
              "msvcr100",
              "printf"
            ],
            [
              "msvcr100",
              "fopen"
            ],
            [
              "msvcr100",
              "fread"
            ],
            [
              "msvcr100",
              "rand"
            ],
            [
              "msvcr100",
              "srand"
            ],
            [
              "msvcr100",
              "fwrite"
            ],
            [
              "msvcr100",
              "ftell"
            ],
            [
              "msvcr100",
              "fseek"
            ],
            [
              "msvcr100",
              "fclose"
            ],
            [
              "msvcr100",
              "time64"
            ],
            [
              "msvcr100",
              "snprintf"
            ],
            [
              "msvcr100",
              "amsg_exit"
            ],
            [
              "msvcr100",
              "getmainargs"
            ],
            [
              "msvcr100",
              "cexit"
            ],
            [
              "msvcr100",
              "exit"
            ],
            [
              "msvcr100",
              "XcptFilter"
            ],
            [
              "msvcr100",
              "exit"
            ],
            [
              "msvcr100",
              "initenv"
            ],
            [
              "msvcr100",
              "initterm"
            ],
            [
              "msvcr100",
              "initterm_e"
            ],
            [
              "msvcr100",
              "configthreadlocale"
            ],
            [
              "msvcr100",
              "setusermatherr"
            ],
            [
              "msvcr100",
              "commode"
            ],
            [
              "msvcr100",
              "fmode"
            ],
            [
              "msvcr100",
              "set_app_type"
            ],
            [
              "msvcr100",
              "crt_debugger_hook"
            ],
            [
              "msvcr100",
              "?terminate@@YAXXZ"
            ],
            [
              "msvcr100",
              "unlock"
            ],
            [
              "msvcr100",
              "dllonexit"
            ],
            [
              "msvcr100",
              "lock"
            ],
            [
              "msvcr100",
              "onexit"
            ],
            [
              "msvcr100",
              "except_handler4_common"
            ],
            [
              "msvcr100",
              "invoke_watson"
            ],
            [
              "msvcr100",
              "controlfp_s"
            ],
            [
              "msvcr100",
              "atoi"
            ],
            [
              "msvcr100",
              "malloc"
            ],
            [
              "msvcr100",
              "memset"
            ]
          ],
          "sec": [
            [
              ".text",
              1024,
              4096,
              6.0,
              "r-x"
            ],
            [
              ".rdata",
              5120,
              3584,
              5.09,
              "r--"
            ],
            [
              ".data",
              8704,
              512,
              0.38,
              "rw-"
            ],
            [
              ".rsrc",
              9216,
              512,
              5.1,
              "r--"
            ],
            [
              ".reloc",
              9728,
              1024,
              4.22,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 54828,
              "timestamp": 1344615267,
              "image_size": 24576,
              "has_overlay": 1,
              "overlay_end": 15728,
              "has_manifest": 1,
              "has_safe_seh": 1,
              "headers_size": 1024,
              "overlay_size": 4976,
              "checksum_valid": 0,
              "file_alignment": 512,
              "overlay_offset": 10752,
              "resource_count": 1,
              "overlay_padding": 4976,
              "computed_checksum": 33076,
              "headers_size_ratio": 0.07,
              "prose_section_count": 0,
              "reloc_overhang_bytes": 496,
              "reloc_overhang_ratio": 0.48,
              "bss_like_section_count": 0,
              "section_overflow_count": 0,
              "misaligned_section_count": 0,
              "base_relocation_block_count": 2,
              "base_relocation_entry_count": 256,
              "declared_data_directory_count": 6,
              "executable_prose_section_count": 0,
              "directory_section_mismatch_count": 0
            },
            "file": {
              "size": 15728,
              "entropy": 6.65
            },
            "binary": {
              "is_pie": 1,
              "has_overlay": 1,
              "code_entropy": 6,
              "data_entropy": 0.38,
              "overlay_size": 4976,
              "string_count": 117,
              "overlay_ratio": 0.32,
              "overlay_entropy": 7.97,
              "entropy_variance": 3.88,
              "avg_string_length": 21.46,
              "max_string_length": 89,
              "peak_region_bytes": 4464,
              "code_to_data_ratio": 0.89,
              "peak_region_entropy": 7.84,
              "string_length_stddev": 18.28,
              "largest_section_ratio": 0.26,
              "sentence_string_count": 35,
              "sentence_string_ratio": 0.3,
              "high_entropy_string_count": 0
            },
            "imports": {
              "count": 68
            },
            "sections": {
              "count": 5,
              "code_size": 4096,
              "entropy_max": 6,
              "entropy_mean": 4.16,
              "name_entropy": 3.21,
              "writable_count": 1,
              "executable_count": 1,
              "nonstandard_count": 0,
              "executable_writable_count": 0
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.binary_as_unknown": 1
            },
            "dependencies": {
              "count": 4
            }
          }
        },
        "ident": {
          "trust": "unsigned",
          "build_path": {
            "value": "C:\\ping_pong\\win_client\\Release\\win_client.pdb",
            "source": "pe.debug.pdb.path",
            "verified": false
          }
        }
      }
    ]
  }
}