{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T05:46:00Z" }, "path": "ff3d0f1ce12aea08f1f4b396f4c77d234bb0cb6b9908c5be3c7be3a6db8bf962.exe", "raw": { "v": "5", "fs": [ { "f": "Md(Bi₃)", "x": 5, "ff": { "i": [ [ "kernel32", "LoadLibraryA" ], [ "kernel32", "GetProcAddress" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_overlay": 1.0, "overlay_end": 17929.0, "overlay_size": 365.0, "checksum_valid": 0.0, "overlay_offset": 17564.0, "resource_count": 4.0, "overlay_padding": 365.0, "checksum_stripped": 1.0, "computed_checksum": 40802.0, "dos_stub_modified": 1.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 4.0 }, "file": { "size": 17929.0, "entropy": 7.19, "size_bytes": 17929.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 7.73, "data_entropy": 2.88, "overlay_size": 365.0, "string_count": 218.0, "overlay_ratio": 0.02, "overlay_entropy": 6.57, "entropy_variance": 5.36, "avg_string_length": 7.24, "max_string_length": 73.0, "code_to_data_ratio": 0.57, "string_length_stddev": 9.4, "largest_section_ratio": 0.52, "sentence_string_count": 5.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 2.0 }, "sections": { "count": 4.0, "code_size": 4096.0, "entropy_max": 7.86, "entropy_mean": 6.16, "name_entropy": 2.5, "writable_count": 2.0, "executable_count": 2.0, "nonstandard_count": 4.0, "executable_writable_count": 1.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 80, "u8", "This program must be run under Win32\r\n$7" ], [ 504, "u8", "UPX0" ], [ 544, "u8", "UPX1" ], [ 584, "u8", "UPX2" ], [ 663, "u8", "@$Id: UPX 0.72 Copyright (C) 1996-1999 Laszlo Molnar \u0026 Markus Oberhumer $" ], [ 738, "u8", "$Id: NRV 0.61 Copyright (C) 1996-1999 Markus F.X.J. Oberhumer $" ], [ 803, "u8", "$License: NRV for UPX is distributed under special license $" ], [ 1196, "u8", "kernel32.dll" ], [ 1210, "u8", "LoadLibraryA" ], [ 1224, "u8", "GetProcAddress" ], [ 1254, "u8", "user32.dll" ], [ 1292, "u8", "shell32.dll" ], [ 1304, "u8", "comdlg32.dll" ], [ 1838, "wide", "MAINICON" ], [ 6343, "u8", "PGRZ" ], [ 9614, "u8", "R @ZHP" ], [ 10162, "u8", "I012345" ], [ 10173, "u8", "6789ABCDEF" ], [ 10268, "u8", "8TLA" ], [ 10495, "u8", "XZYHt" ], [ 12093, "u8", "File Name:" ], [ 12143, "u8", "Ready" ], [ 12164, "u8", "SHC2" ], [ 12235, "u8", "to p=ch" ], [ 12961, "u8", "ErrorS" ], [ 12974, "u8", "hv09" ], [ 13017, "u8", "PJcess" ], [ 13039, "u8", "ion w" ], [ 13059, "u8", "hi'point.'" ], [ 13102, "u8", "sQ y$y" ], [ 13567, "u8", "/veR" ], [ 13658, "u8", "fuEy" ], [ 13668, "u8", "7NOT" ], [ 13964, "u8", "FurRuWm" ], [ 14565, "u8", "Q rd" ], [ 15343, "u8", "Qkkbal" ], [ 16323, "u8", "ZwMuks" ], [ 16573, "u8", "MMGI" ], [ 16672, "u8", "icalSe" ], [ 16684, "u8", "Leav" ], [ 16715, "u8", "Free" ], [ 16725, "u8", "lloca" ], [ 16737, "u8", "OTlsS" ], [ 16753, "u8", "Modu" ], [ 16759, "u8", "Hand" ], [ 16777, "u8", "Last" ], [ 16787, "u8", "Comm0Lin" ], [ 16820, "u8", "RtlUnwi" ], [ 16836, "u8", "aiseExce" ], [ 17028, "u8", "uDrsQu" ], [ 17564, "u8", "@._P-DATA_.@" ], [ 17650, "u8", "LYBJ" ], [ 17728, "u8", "rgm`%kb(lgjea !\u003e?" ], [ 17746, "u8", "lcjhqi={gkbe}k}ciR{{a{vqu4xsp" ], [ 17776, "u8", "L{#tdab\u0026'$ ivwt?)(" ], [ 17795, "u8", "~}%khalye{vg;uxu6xisrzlX" ], [ 17849, "u8", "17.5=+589;0Dzwakun" ] ], "v": { "file.stem": "ff3d0f1ce12aea08f1f4b396f4c77d234bb0cb6b9908c5be3c7be3a6db8bf962", "pe.imphash": "87bed5a7cba00c7e1f4015f1bdae2183", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 708992537, "binary.packer": "upx", "file.basename": "ff3d0f1ce12aea08f1f4b396f4c77d234bb0cb6b9908c5be3c7be3a6db8bf962.exe", "pe.image_base": 4194304, "pe.image_size": 77824, "pe.machine_id": 332, "pe.os_version": "1.0", "pe.entry_point": 61440, "pe.headers_size": 1024, "pe.entry_section": "UPX2", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "e9d03fe4c7b6c0114781d91ff305db9dbba37d38", "pe.image_hash.sha256": "4a011bb81cc3271a9844308229c4f3d89c7c13824e00e35df64c86751c7f2d20", "pe.image_hash.sha384": "458bb7cd442ff5bbc84bc67bc696e0135e1ee5245f97d0c27c389b6fead4f5664821882d616e4ddcc19446c1252bed02", "pe.image_hash.sha512": "158d7feb99762748545a7e2226a16cbd49878ff5aa4089fa48231abc9c0d955c9c7f52a540c6a0d9091f20e5edbf759fc4d2826381188b9ecea9e11b1eca98fe", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_STRING", "pe.resource_types[3]": "RT_GROUP_ICON", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "binary.packer_version": "0.72", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.resource_timestamp": 657566722, "pe.characteristics_raw": 33166, "pe.linker_major_version": 2, "pe.linker_minor_version": 25, "pe.data_directories[0].rva": 57344, "pe.data_directories[1].rva": 57660, "pe.data_directories[2].rva": 57640, "pe.data_directories[3].rva": 60016, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 296, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2356, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 20, "pe.data_directories[3].name": "tls", "pe.data_directories[3].size": 32, "pe.coff.dos_header_pe_pointer": 256, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 4, "pe.base_relocations.padding_count": 2 }, "id": "pe", "sc": [ [ "UPX0", 1024, 0, 0.0, "rwx" ], [ "UPX1", 1024, 3072, 2.88, "rw-" ], [ "UPX2", 4096, 4096, 7.73, "r-x" ], [ "UPX3", 8192, 9372, 7.86, "r--" ] ] }, "id": 0, "sz": 17929, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "ff3d0f1ce12aea08f1f4b396f4c77d234bb0cb6b9908c5be3c7be3a6db8bf962.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x297" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x4ac" ] }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "ff3d0f1ce12aea08f1f4b396f4c77d234bb0cb6b9908c5be3c7be3a6db8bf962.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX3", "UPX2", "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 218.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.73" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "PE has RT_DIALOG in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-dialog-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "a": "T1027.002", "c": 0.800000011920929, "d": "Entry point in non-standard section", "e": [ "UPX2 (size: 4096, entropy: 7.73, perms: r-x)" ], "i": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section", "l": 1, "m": "F0001" }, { "c": 0.9200000166893005, "d": "UHARC linker major version", "e": [ "2" ], "i": "metadata/binary/framework::uharc-linker-major", "l": 2, "el": [ "value:pe.linker_major_version" ] }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 2.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x4c8" ] }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0xe0a0" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 2.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "imports.count = 2.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports", "l": 1 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.73" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "imports.count = 2.00" ], "i": "metadata/binary/symbols/imports::few-import-count", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 2.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x4ac" ] }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1, "el": [ "0x220", "0x1f8" ] }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX2", "UPX1", "UPX3" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 2.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "ff3d0f1ce12aea08f1f4b396f4c77d234bb0cb6b9908c5be3c7be3a6db8bf962.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0xe0a4" ] }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX0", "UPX2", "UPX1", "UPX3" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links kernel32 (LoadLibraryA, GetProcAddress)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 2, "m": "B0032", "el": [ "0xe0a0" ] } ], "sha": "ff3d0f1ce12aea08f1f4b396f4c77d234bb0cb6b9908c5be3c7be3a6db8bf962", "path": "ff3d0f1ce12aea08f1f4b396f4c77d234bb0cb6b9908c5be3c7be3a6db8bf962.exe", "type": "pe" } ], "tv": "52045" } }