<wildfire> 
    <version>2.0</version> 
    <file_info> 
        <malware>yes</malware> 
        <sha1>828f02e6ca4bcf6c30264137f758fbe20dd866db</sha1> 
        <filetype>PE</filetype> 
        <sha256>ca007e3b395688f5f3062729978dcdbadc90d9c3501d9a89c139d11c58d2a15e</sha256> 
        <md5>04f4f1c83f1e69b1f055202964536f13</md5> 
        <size>796268</size> 
    </file_info> 
<task_info> 
<report> 
  <version>3.0</version> 
  <platform>204</platform> 
  <software>PE Static Analyzer</software> 
  <sha256>ca007e3b395688f5f3062729978dcdbadc90d9c3501d9a89c139d11c58d2a15e</sha256> 
  <md5>04f4f1c83f1e69b1f055202964536f13</md5> 
  <malware>no</malware> 
  <summary> 
    <entry details="Entropy is a measurement of the randomness in data. Overlays with high entropy indicate encoded or encrypted data." id="3030" score="0.0">Contains overlay data with high entropy</entry> 
    <entry details="Sections with a large discrepancy between raw and virtual sizes may indicate a packed or obfuscated PE file." id="3013" score="0.0">Contains sections with size discrepancies</entry> 
    <entry details="Thread-local storage (TLS) is normally used to manage data in multithreaded applications. However, it can also allow execution of code outside of the expected entry point of a PE file." id="3019" score="0.0">Contains a TLS section</entry> 
    <entry details="The PE file checksum is required for drivers, boot-time DLLs, and other DLLs loaded into secure system processes. Malware often ignores this value or sets it to zero." id="3015" score="0.0">Contains an invalid checksum</entry> 
    <entry details="Overlay data is extra data appended to the end of a PE image. Many legitimate files, including all files that are digitally signed, contain overlay data. However, malware often uses overlays to embed encoded or encrypted data as well." id="3029" score="0.0">Contains overlay data</entry> 
    <entry details="Standard section names are defined by the compiler. Non-standard section names may indicate a packed or obfuscated PE file." id="3003" score="0.0">Contains non-standard section names</entry> 
    <entry details="Sections with zero size indicate a packed or obfuscated PE file." id="3036" score="0.0">Contains sections with zero size</entry> 
  </summary> 
</report> 
<!-- TRUNCATED RESPONSE --> 
</task_info> 
</wildfire> 

{ "success": true, "result": {
    "detection_reasons": [],
    "iocs": [],
    "maec_packages": [
        {
            "id": "package--f4dc11a8-b803-437c-5f1f-de0a08ea5fe7",
            "maec_objects": [
                {
                    "analysis_metadata": [
                        {
                            "analysis_type": "static",
                            "conclusion": "no detection",
                            "is_automated": true,
                            "tool_refs": [
                                "1"
                            ]
                        }
                    ],
                    "dynamic_features": {
                        "action_refs": [
                            "malware-action--cf4acb1f-d613-4ff3-472a-c877418c3e15"
                        ],
                        "behavior_refs": [
                            "behavior--3a7cd04f-b867-4c06-e97e-911df668b4aa",
                            "behavior--832fc6d9-d0d7-44ef-84d7-95015187f56f",
                            "behavior--688b7e60-b8f3-482a-f40c-b43121b9fe7d",
                            "behavior--574cc6a8-2334-4abf-f11c-54c92e5749a6"
                        ]
                    },
                    "id": "malware-instance--bdae93df-8bb1-4521-696a-593eee2574fb",
                    "instance_object_refs": [
                        "0"
                    ],
                    "type": "malware-instance"
                },
                {
                    "description": "PDF contains an URI.",
                    "id": "behavior--3a7cd04f-b867-4c06-e97e-911df668b4aa",
                    "name": "pdf_sa_uri",
                    "type": "behavior"
                },
                {
                    "description": "PDF has only one page.",
                    "id": "behavior--832fc6d9-d0d7-44ef-84d7-95015187f56f",
                    "name": "pdf_sa_onepage",
                    "type": "behavior"
                },
                {
                    "description": "PDF document contains an canonicalized object key of Action",
                    "id": "behavior--688b7e60-b8f3-482a-f40c-b43121b9fe7d",
                    "name": "pdf_ko_action",
                    "type": "behavior"
                },
                {
                    "description": "The action of containing network artifacts.",
                    "id": "malware-action--cf4acb1f-d613-4ff3-472a-c877418c3e15",
                    "name": "network-artifacts",
                    "output_object_refs": [
                        "4",
                        "2",
                        "3"
                    ],
                    "type": "malware-action"
                },
                {
                    "action_refs": [
                        "malware-action--cf4acb1f-d613-4ff3-472a-c877418c3e15"
                    ],
                    "description": "File contains one or more URL/domain name/IP address",
                    "id": "behavior--574cc6a8-2334-4abf-f11c-54c92e5749a6",
                    "name": "sa_url",
                    "type": "behavior"
                }
            ],
            "observable_objects": {
                "0": {
                    "hashes": {
                        "MD5": "3b695ce4b733069a1b8671c4e9ebe247",
                        "SHA-1": "25fec390b4419edd0a08784bcb8960143443b347",
                        "SHA-256": "ac1f40162a2435537171dbe29feaf3b75ce0d12c86db411259914ad75e689266"
                    },
                    "type": "file",
                    "x-wf-file-type": "pdf"
                },
                "1": {
                    "name": "PDF Static Analyzer",
                    "type": "software"
                },
                "2": {
                    "type": "url",
                    "value": "2.2.2.2/"
                },
                "3": {
                    "type": "url",
                    "value": "portal-beta1.wildfire.paloaltonetworks.com/report/box/7521c97f1705211618f8db072b6d0d0e5c28d0d727ecde12344745974d07e068/25887678581"
                },
                "4": {
                    "type": "url",
                    "value": "2.2.2.2:1234/"
                }
            },
            "schema_version": "5.0",
            "type": "package"
        }
    ],
    "primary_malware_instances": {
        "package--f4dc11a8-b803-437c-5f1f-de0a08ea5fe7": "malware-instance--bdae93df-8bb1-4521-696a-593eee2574fb"
    },
    "sa_package": "package--f4dc11a8-b803-437c-5f1f-de0a08ea5fe7",
    "schema_version": "1.0",
    "sha256": "ac1f40162a2435537171dbe29feaf3b75ce0d12c86db411259914ad75e689266",
    "type": "wf-report",
    "verdict": "no detection"
} }
}

    {
        "success": true,
        "result": {
           "analysis_time": "2020-04-22:42:30Z",
           "url_type": "original",
           "report": "<MAEC report>"
        <size>796268</size> 
    }
}