The file is not an executable file The MZ signature is missing The size of the file is suspicious The file-ratio of the overlay is suspicious The size of the optional-header is suspicious The size of the file-header is suspicious The size of the certificate is suspicious The file has been post-processed The content of the certificate is suspicious The file is Self-Extractable (SFX) The file references a certificate The compiler time stamp is outside of the Certificate time stamp The rich-header has been tampered (checksum is invalid) The file contains a rich-header The file is managed The file references the Reflective DLL Injection technique The file is bound to other library(ies) The file is Code-less The file exposes thread-local-storage (TLS) callback(s) The entry-point is located in a section that is not executable The file checksum is invalid The entry-point is outside the file The certificate has expired The file contains a digital Certificate The file contains a Manifest The file export table contains gap(s) The description of a library has not been found The file uses Control Flow Guard (CFG) as software security defense The file will be copied and run from to the system swap if started from the Network The file will be copied and run from to the system swap if started from a removable Media The file runs in the Visual Basic Virtual Machine (VBVM) The file is a Device Driver The file opts for Data Execution Prevention (DEP) as software security defense The file opts for Address Space Layout Randomization (ASLR) as software security defense The file uses Structured Exception Handling (SEH) The file opts for Stack Buffer Overrun Detection (GS) as software security defense The file opts for Code Integrity (CI) a software security defense The file is isolation aware but should not be isolated The file references Safe Structured Exception Handling (SafeSEH) The file registers Exception handler(s) The offset of the dos-header is suspicious The file is scored by virustotal The file has been compiled with Delphi The file is detected by the prefered engine The file is not detected by the prefered engine The file references MITRE Technique(s) The file references MITRE Tactics(s) The offset of the file-header is suspicious The file references debug symbols The file contains a virtualized section The GUID of the debug symbols is suspicious The path of the debug symbols is suspicious The age of the debug symbols is suspicious The format of the debug symbols is suspicious The value of 'pointer-symbol-table' is suspicious The value of 'number-of-symbols' is suspicious The value of 'size-of-code' is suspicious The value of 'base-of-code' is suspicious The value of 'base-of-data' is suspicious The value of 'FileAlignment' is suspicious The value of 'SizeOfImage' is suspicious The value of 'SizeOfHeaders' is suspicious The count of directories is suspicious The address of the entry-point is suspicious The file-ratio of the section(s) has been determined The file-ratio of the section(s) is high The file-ratio of the resource(s) is high The last section is executable The first section is writable The location of the entry-point is suspicious The file signature has been found The file contains resource(s) The file references resources in several languages The file contains resource(s) in a language tagged as blacklist The file contains an invalid resource The manifest does not contain trust information The manifest identity has been found The size of a resource is suspicious The file contains a blacklist section The count of executable section(s) is suspicious The file references an unknown resource The file exports function(s) The file exports anonymous function(s) The file exports forwarded function(s) The file exports decorated function(s) The file exports duplicated function(s) The file exports blacklist function(s) The dos-stub message is unusual The dos-stub message is missing The file imports deprecated function(s) The file imports anonymous function(s) The file imports forwarded function(s) The file imports decorated function(s) The count of imports is suspicious The file imports symbol(s) tagged as blacklist The file references a string with a suspicious size The file references whitelist string(s) The file references library(ies) tagged as blacklist The dos-stub is missing The file imports undocumented function(s) The file subsystem is unknown The file subsystem has been found A directory is missing A directory is invalid The directories table is empty The time-stamp of a directory is suspicious The time-stamp of the compiler is suspicious The file execution privilege has been found The file requests User Interface Privilege Isolation (UIPI) The original name of the file has been found The file references string(s) tagged as blacklist The count of strings is suspicious The file references a URL pattern The file score is not available The count of libraries is suspicious The size of the version resource is suspicious The file supports OLE Self-Registration The file contains another file The file is target for a specific machine The file intents to execute with UAC auto-elevation The file contains another file The size of the dos-header is suspicious The size of the dos-stub is suspicious The hash of a resource is well-known The count of section(s) is suspicious The file is self-extractable with IEXPRESS The file references Regex pattern(s) The file contains unreadable section(s) The file references Windows built-in privilege(s) The file signature is tagged as blacklist The file signature of the overlay is blacklist The file signature of a resource is blacklist The file contains self-modifying executable section(s) The file references a group of hint The file references a group of API The file references keyboard keys like a Keylogger The file references file extensions like a Ransomware | Wiper The file references passwords like a Brute-forcer The file contains a shared section The file contains writable and executable section(s) The file contains nameless section(s) The file contains several executable sections The file references antidebug function(s)