{
  "schema_version": 1,
  "file": {
    "size_bytes": 89526543,
    "sha256": "035097eba52bf471f1148520a27f390ada0f0c8e0613bf8d38636c61c9cb8b76"
  },
  "dos_signature": "MZ",
  "pe_signature": "PE\\0\\0",
  "pe_offset": 216,
  "coff": {
    "machine": 332,
    "machine_hex": "0x014c",
    "machine_name": "I386",
    "number_of_sections": 5,
    "timestamp_raw": 1544912774,
    "optional_header_size": 224,
    "characteristics_hex": "0x010f",
    "symbol_table_file_offset_claim": 0,
    "symbol_count_claim": 0
  },
  "optional_header": {
    "format": "PE32",
    "magic_hex": "0x010b",
    "image_base": 4194304,
    "entry_point_rva": 13199,
    "size_of_image": 1097728,
    "size_of_headers": 1024,
    "section_alignment": 4096,
    "file_alignment": 512,
    "subsystem": 2,
    "number_of_data_directories": 16
  },
  "section_table": {
    "offset": 464,
    "end_exclusive": 664
  },
  "sections": [
    {
      "index": 0,
      "name": ".text",
      "name_bytes_hex": "2e74657874000000",
      "raw_offset": 1024,
      "raw_size": 26624,
      "raw_range": {
        "start": 1024,
        "end_exclusive": 27648
      },
      "virtual_rva": 4096,
      "virtual_size": 26151,
      "virtual_range": {
        "start_rva": 4096,
        "end_rva_exclusive": 30247
      },
      "unrounded_mapped_extent": {
        "start_rva": 4096,
        "end_rva_exclusive": 30720
      },
      "characteristics_hex": "0x60000020"
    },
    {
      "index": 1,
      "name": ".rdata",
      "name_bytes_hex": "2e72646174610000",
      "raw_offset": 27648,
      "raw_size": 5632,
      "raw_range": {
        "start": 27648,
        "end_exclusive": 33280
      },
      "virtual_rva": 32768,
      "virtual_size": 5282,
      "virtual_range": {
        "start_rva": 32768,
        "end_rva_exclusive": 38050
      },
      "unrounded_mapped_extent": {
        "start_rva": 32768,
        "end_rva_exclusive": 38400
      },
      "characteristics_hex": "0x40000040"
    },
    {
      "index": 2,
      "name": ".data",
      "name_bytes_hex": "2e64617461000000",
      "raw_offset": 33280,
      "raw_size": 1536,
      "raw_range": {
        "start": 33280,
        "end_exclusive": 34816
      },
      "virtual_rva": 40960,
      "virtual_size": 462840,
      "virtual_range": {
        "start_rva": 40960,
        "end_rva_exclusive": 503800
      },
      "unrounded_mapped_extent": {
        "start_rva": 40960,
        "end_rva_exclusive": 503800
      },
      "characteristics_hex": "0xc0000040"
    },
    {
      "index": 3,
      "name": ".ndata",
      "name_bytes_hex": "2e6e646174610000",
      "raw_offset": 0,
      "raw_size": 0,
      "raw_range": {
        "start": 0,
        "end_exclusive": 0
      },
      "virtual_rva": 503808,
      "virtual_size": 589824,
      "virtual_range": {
        "start_rva": 503808,
        "end_rva_exclusive": 1093632
      },
      "unrounded_mapped_extent": {
        "start_rva": 503808,
        "end_rva_exclusive": 1093632
      },
      "characteristics_hex": "0xc0000080"
    },
    {
      "index": 4,
      "name": ".rsrc",
      "name_bytes_hex": "2e72737263000000",
      "raw_offset": 34816,
      "raw_size": 3584,
      "raw_range": {
        "start": 34816,
        "end_exclusive": 38400
      },
      "virtual_rva": 1093632,
      "virtual_size": 3320,
      "virtual_range": {
        "start_rva": 1093632,
        "end_rva_exclusive": 1096952
      },
      "unrounded_mapped_extent": {
        "start_rva": 1093632,
        "end_rva_exclusive": 1097216
      },
      "characteristics_hex": "0x40000040"
    }
  ],
  "last_claimed_section_raw_end": 38400,
  "trailing_file_bytes": {
    "offset": 38400,
    "size": 89488143,
    "note": "Bytes after headers and the last nonempty section raw range; may include certificate data, installer data, or other content. Not automatically malicious."
  },
  "security_directory": {
    "declared": true,
    "present": false,
    "file_offset": null,
    "size": 0,
    "end_exclusive": null,
    "address_kind": "file_offset_not_rva",
    "signature_verification": "not_performed",
    "note": "The directory locates claimed certificate bytes; presence does not prove a valid signature or publisher."
  },
  "limitations": [
    "Static metadata only; no execution, disassembly, unpacking, or network access.",
    "SHA-256 identifies the observed bytes; it is not authentication or a malware verdict.",
    "The PE and DOS magic signatures are format markers, not cryptographic signatures.",
    "No Authenticode, certificate-chain, PE-checksum, publisher, or timestamp verification.",
    "Directory contents, COFF symbols, relocations, imports, virtual overlap, and loader compatibility are not validated."
  ],
  "input_kind": "zip_member"
}