<wildfire> 
    <version>2.0</version> 
    <file_info> 
        <malware>yes</malware> 
        <sha1>828f02e6ca4bcf6c30264137f758fbe20dd866db</sha1> 
        <filetype>PE</filetype> 
        <sha256>ca007e3b395688f5f3062729978dcdbadc90d9c3501d9a89c139d11c58d2a15e</sha256> 
        <md5>04f4f1c83f1e69b1f055202964536f13</md5> 
        <size>796268</size> 
    </file_info> 
<task_info> 
<report> 
  <version>3.0</version> 
  <platform>204</platform> 
  <software>PE Static Analyzer</software> 
  <sha256>ca007e3b395688f5f3062729978dcdbadc90d9c3501d9a89c139d11c58d2a15e</sha256> 
  <md5>04f4f1c83f1e69b1f055202964536f13</md5> 
  <malware>no</malware> 
  <summary> 
    <entry details="Entropy is a measurement of the randomness in data. Overlays with high entropy indicate encoded or encrypted data." id="3030" score="0.0">Contains overlay data with high entropy</entry> 
    <entry details="Sections with a large discrepancy between raw and virtual sizes may indicate a packed or obfuscated PE file." id="3013" score="0.0">Contains sections with size discrepancies</entry> 
    <entry details="Thread-local storage (TLS) is normally used to manage data in multithreaded applications. However, it can also allow execution of code outside of the expected entry point of a PE file." id="3019" score="0.0">Contains a TLS section</entry> 
    <entry details="The PE file checksum is required for drivers, boot-time DLLs, and other DLLs loaded into secure system processes. Malware often ignores this value or sets it to zero." id="3015" score="0.0">Contains an invalid checksum</entry> 
    <entry details="Overlay data is extra data appended to the end of a PE image. Many legitimate files, including all files that are digitally signed, contain overlay data. However, malware often uses overlays to embed encoded or encrypted data as well." id="3029" score="0.0">Contains overlay data</entry> 
    <entry details="Standard section names are defined by the compiler. Non-standard section names may indicate a packed or obfuscated PE file." id="3003" score="0.0">Contains non-standard section names</entry> 
    <entry details="Sections with zero size indicate a packed or obfuscated PE file." id="3036" score="0.0">Contains sections with zero size</entry> 
  </summary> 
</report> 
<!-- TRUNCATED RESPONSE --> 
</task_info> 
</wildfire> 

    {
        "success": true,
        "result": {
           "analysis_time": "2020-04-22:42:30Z",
           "url_type": "original",
           "report": "<MAEC report>"
        <size>796268</size> 
    }
}