{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998840093612671, "class": 1 } ], "prob": 0.999884, "class": 1, "oprob": 0.999884, "models": [ { "m": "az", "prob": 0.9965352, "class": 0 }, { "m": "az/native", "prob": 0.999884, "class": 0 }, { "m": "az/pe", "prob": 0.99954236, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T03:33:45Z" }, "path": "35062", "raw": { "v": "4", "fs": [ { "f": "O₃(As₂CP)H₂(HfPo)Md₃(Bi₅HeSi)", "k": { "hash.imp": "933ba211aa36a2f64dbda4e0e8f82f1e", "pe.timestamp": 1111223072, "hash.authenti": "542418971c9b85f91e83b557fab0c79b74f92d97a7bcd880d250fa01fb321cfb", "debug.pdb_path": "r:\\lib\\Optimize\\AddInMgr.pdb", "pe.codeview.age": 1, "hash.rich_header": "96f55ee87cde2e277117432b4956f2c70b0854e4130da4bec9e4d4ef392f9394", "pe.codeview.guid": "D8CAFBF6-8C84-4872-93F7-89CBF58DBDA8", "build.target_arch": "x86", "pe.linker_version": "7.10", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.rich_header.xor_key": "0x67b522bf", "pe.debug_entries[0].size": 53, "pe.debug_entries[0].type": "codeview", "pe.version_info.comments": "\u003e\u000f\u0001CompanyName", "pe.data_directories[0].rva": 27392, "pe.data_directories[1].rva": 36864, "pe.data_directories[2].rva": 21552, "pe.data_directories[3].rva": 20480, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 200, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 23456, "pe.data_directories[2].name": "debug", "pe.data_directories[2].size": 28, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 1064, "pe.debug_directory_types[0]": 2, "pe.version_info.company_name": "Autodesk, Inc.", "pe.version_info.file_version": "10, 0, 0, 21112", "pe.version_info.product_name": "Autodesk, Inc. AddInMgr", "pe.debug_entries[0].timestamp": 1111223072, "pe.version_info.internal_name": "AddInMgr", "pe.version_info.private_build": "P\u0018\u0001ProductName", "pe.version_info.special_build": "D", "pe.rich_header_compids[0].count": 2, "pe.rich_header_compids[1].count": 8, "pe.rich_header_compids[2].count": 3, "pe.rich_header_compids[3].count": 14, "pe.rich_header_compids[4].count": 32, "pe.rich_header_compids[5].count": 9, "pe.rich_header_compids[6].count": 328, "pe.rich_header_compids[7].count": 1, "pe.rich_header_compids[8].count": 12, "pe.rich_header_compids[9].count": 1, "pe.version_info.legal_copyright": "Copyright © 2001", "pe.version_info.product_version": "1, 0, 0, 1", "binary.top_complex_unnamed[0].cc": 160, "binary.top_complex_unnamed[1].cc": 18, "binary.top_complex_unnamed[2].cc": 15, "binary.top_complex_unnamed[3].cc": 8, "binary.top_complex_unnamed[4].cc": 4, "binary.top_complex_unnamed[5].cc": 4, "binary.top_complex_unnamed[6].cc": 3, "pe.rich_header_compids[0].compid": 6096915, "pe.rich_header_compids[10].count": 1, "pe.rich_header_compids[1].compid": 6097027, "pe.rich_header_compids[2].compid": 986117, "pe.rich_header_compids[3].compid": 6228997, "pe.rich_header_compids[4].compid": 2564395, "pe.rich_header_compids[5].compid": 6097925, "pe.rich_header_compids[6].compid": 65536, "pe.rich_header_compids[8].compid": 6294533, "pe.rich_header_compids[9].compid": 6163436, "pe.version_info.file_description": "FW", "pe.version_info.legal_trademarks": "B\r\u0001OriginalFilename", "binary.top_complex_unnamed[0].bbs": 76, "binary.top_complex_unnamed[1].bbs": 31, "binary.top_complex_unnamed[2].bbs": 24, "binary.top_complex_unnamed[3].bbs": 11, "binary.top_complex_unnamed[4].bbs": 6, "binary.top_complex_unnamed[5].bbs": 5, "binary.top_complex_unnamed[6].bbs": 6, "pe.rich_header_compids[10].compid": 5901317, "pe.rich_header_compids[6].product": "Unknown", "pe.rich_header_compids[7].product": "Unknown", "pe.version_info.original_filename": "AddInMgr.exe", "binary.top_complex_unnamed[0].addr": "0x4040e0", "binary.top_complex_unnamed[0].size": 1284, "binary.top_complex_unnamed[1].addr": "0x401a90", "binary.top_complex_unnamed[1].size": 914, "binary.top_complex_unnamed[2].addr": "0x404760", "binary.top_complex_unnamed[2].size": 248, "binary.top_complex_unnamed[3].addr": "0x4035fe", "binary.top_complex_unnamed[3].size": 153, "binary.top_complex_unnamed[4].addr": "0x403fa6", "binary.top_complex_unnamed[4].size": 102, "binary.top_complex_unnamed[5].addr": "0x404980", "binary.top_complex_unnamed[5].size": 61, "binary.top_complex_unnamed[6].addr": "0x40359f", "binary.top_complex_unnamed[6].size": 95, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.section_characteristics[4].name": ".ifc\u0007", "pe.rich_header.entries[0].use_count": 2, "pe.rich_header.entries[1].use_count": 8, "pe.rich_header.entries[2].use_count": 3, "pe.rich_header.entries[3].use_count": 14, "pe.rich_header.entries[4].use_count": 32, "pe.rich_header.entries[5].use_count": 9, "pe.rich_header.entries[6].use_count": 328, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[8].use_count": 12, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 93, "pe.rich_header.entries[10].use_count": 1, "pe.rich_header.entries[1].product_id": 93, "pe.rich_header.entries[2].product_id": 15, "pe.rich_header.entries[3].product_id": 95, "pe.rich_header.entries[4].product_id": 39, "pe.rich_header.entries[5].product_id": 93, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[8].product_id": 96, "pe.rich_header.entries[9].product_id": 94, "pe.rich_header.entries[10].product_id": 90, "pe.rich_header.entries[0].build_number": 2067, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 2179, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 3077, "pe.rich_header.entries[2].product_name": "Imp_VC2003", "pe.rich_header.entries[3].build_number": 3077, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 8491, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 3077, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 3077, "pe.rich_header.entries[8].product_name": "unknown", "pe.rich_header.entries[9].build_number": 3052, "pe.rich_header.entries[9].product_name": "unknown", "pe.section_characteristics[0].raw_size": 16384, "pe.section_characteristics[1].raw_size": 10240, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[3].raw_size": 23552, "pe.section_characteristics[4].raw_size": 1536, "pe.rich_header.entries[10].build_number": 3077, "pe.rich_header.entries[10].product_name": "C_VS2005_LTCG", "pe.section_characteristics[0].virtual_size": 16212, "pe.section_characteristics[1].virtual_size": 9752, "pe.section_characteristics[2].virtual_size": 496, "pe.section_characteristics[3].virtual_size": 23456, "pe.section_characteristics[4].virtual_size": 4096, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 20480, "pe.section_characteristics[2].virtual_address": 32768, "pe.section_characteristics[3].virtual_address": 36864, "pe.section_characteristics[4].virtual_address": 61440, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "e0000020" }, "x": 117, "id": 0, "is": [ "?StringDeallocate@UTx@@YAXPAX@Z", "?GetCompiledHtmlPath@UTxUtil@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$UTxStringAllocator@G@@@std@@XZ", "ORDINAL 2725", "ORDINAL 2829", "ORDINAL 4301", "ORDINAL 2708", "ORDINAL 2832", "ORDINAL 2534", "ORDINAL 2640", "ORDINAL 2527", "ORDINAL 3712", "ORDINAL 3713", "ORDINAL 3703", "ORDINAL 2638", "ORDINAL 3943", "ORDINAL 4475", "ORDINAL 4255", "ORDINAL 3327", "ORDINAL 757", "ORDINAL 762", "ORDINAL 2011", "ORDINAL 1049", "ORDINAL 3645", "ORDINAL 3483", "ORDINAL 3635", "ORDINAL 4094", "ORDINAL 2085", "ORDINAL 3238", "ORDINAL 1946", "ORDINAL 1274", "ORDINAL 2365", "ORDINAL 2366", "ORDINAL 1894", "ORDINAL 2086", "ORDINAL 5911", "ORDINAL 1611", "ORDINAL 1608", "ORDINAL 3940", "ORDINAL 1393", "ORDINAL 4234", "ORDINAL 5148", "ORDINAL 1899", "ORDINAL 5067", "ORDINAL 6271", "ORDINAL 4179", "ORDINAL 5210", "ORDINAL 3397", "ORDINAL 4716", "ORDINAL 4276", "ORDINAL 1591", "ORDINAL 5956", "ORDINAL 920", "ORDINAL 925", "ORDINAL 929", "ORDINAL 927", "ORDINAL 931", "ORDINAL 2404", "ORDINAL 2388", "ORDINAL 2407", "ORDINAL 2402", "ORDINAL 2379", "ORDINAL 2381", "ORDINAL 2399", "ORDINAL 2169", "ORDINAL 2163", "ORDINAL 1513", "ORDINAL 6273", "ORDINAL 3796", "ORDINAL 6275", "ORDINAL 3339", "ORDINAL 4961", "ORDINAL 1353", "ORDINAL 5171", "ORDINAL 1955", "ORDINAL 5196", "ORDINAL 2856", "ORDINAL 2985", "ORDINAL 4480", "ORDINAL 2531", "ORDINAL 760", "ORDINAL 572", "ORDINAL 741", "ORDINAL 2077", "ORDINAL 4226", "ORDINAL 3158", "ORDINAL 587", "ORDINAL 1545", "ORDINAL 4238", "ORDINAL 3189", "ORDINAL 620", "ORDINAL 2083", "ORDINAL 1632", "ORDINAL 1562", "ORDINAL 4232", "ORDINAL 2952", "ORDINAL 3224", "ORDINAL 658", "ORDINAL 5178", "ORDINAL 4206", "ORDINAL 4729", "ORDINAL 4884", "ORDINAL 4574", "ORDINAL 1662", "ORDINAL 1661", "ORDINAL 5908", "ORDINAL 1392", "ORDINAL 5199", "ORDINAL 4256", "ORDINAL 3176", "ORDINAL 605", "ORDINAL 354", "ORDINAL 1785", "ORDINAL 4119", "ORDINAL 5609", "ORDINAL 2155", "ORDINAL 2651", "ORDINAL 4347", "ORDINAL 4743", "ORDINAL 709", "ORDINAL 501", "ORDINAL 1386", "ORDINAL 2867", "ORDINAL 2860", "ORDINAL 6140", "ORDINAL 5829", "ORDINAL 5867", "ORDINAL 4320", "ORDINAL 2009", "ORDINAL 1007", "ORDINAL 5096", "ORDINAL 566", "ORDINAL 577", "ORDINAL 283", "ORDINAL 287", "ORDINAL 1110", "ORDINAL 1118", "ORDINAL 1582", "ORDINAL 5231", "ORDINAL 5229", "ORDINAL 2384", "ORDINAL 1198", "ORDINAL 2392", "ORDINAL 2390", "ORDINAL 2386", "ORDINAL 2409", "ORDINAL 2397", "ORDINAL 1647", "ORDINAL 1646", "ORDINAL 1590", "ORDINAL 1536", "ORDINAL 1058", "ORDINAL 1542", "ORDINAL 4026", "ORDINAL 293", "ORDINAL 2460", "ORDINAL 6063", "ORDINAL 5869", "ORDINAL 3869", "ORDINAL 5562", "ORDINAL 5209", "ORDINAL 5226", "ORDINAL 4562", "ORDINAL 3942", "ORDINAL 2239", "ORDINAL 5222", "ORDINAL 5220", "ORDINAL 2925", "ORDINAL 1911", "ORDINAL 3826", "ORDINAL 5378", "ORDINAL 6215", "ORDINAL 3800", "ORDINAL 5579", "ORDINAL 2054", "ORDINAL 6274", "ORDINAL 3795", "ORDINAL 6272", "ORDINAL 4008", "ORDINAL 4032", "ORDINAL 764", "ORDINAL 1079", "ORDINAL 3677", "ORDINAL 3311", "ORDINAL 2394", "??0exception@@QAE@ABV0@@Z", "CxxThrowException", "p__commode", "??0exception@@QAE@XZ", "??1exception@@UAE@XZ", "memset", "except_handler3", "free", "security_error_handler", "??1type_info@@UAE@XZ", "dllonexit", "onexit", "c_exit", "exit", "XcptFilter", "cexit", "exit", "wcmdln", "amsg_exit", "wgetmainargs", "initterm", "setusermatherr", "adjust_fdiv", "controlfp", "?terminate@@YAXXZ", "set_app_type", "p__fmode", "CxxFrameHandler", "LoadLibraryA", "GetProcAddress", "LoadLibraryA", "InitializeCriticalSection", "DeleteCriticalSection", "GetModuleHandleA", "GetStartupInfoW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentThreadId", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "ExitProcess", "lstrlenW", "GetVersionExA", "SystemParametersInfoW", "GetSystemMetrics", "LoadIconW", "EnableWindow", "GetDesktopWindow", "GetFocus", "GetClientRect", "GetWindowRect", "IsIconic", "GetSystemMenu", "SendMessageW", "AppendMenuW", "CreatePopupMenu", "DrawIcon", "RegQueryValueExA", "RegCloseKey", "RegOpenKeyExA", "CoInitialize", "CoCreateInstance", "CLSIDFromProgID", "CoUninitialize", "ORDINAL 6", "ORDINAL 202", "ORDINAL 201", "ORDINAL 8", "ORDINAL 9", "ORDINAL 12", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z" ], "ms": { "pe": { "entry": 61440.0, "machine": 332.0, "checksum": 0.0, "pdb_path": "r:\\lib\\Optimize\\AddInMgr.pdb", "rsrc_size": 23552.0, "subsystem": 2.0, "timestamp": 1111223072.0, "icon_count": 2.0, "image_base": 4194304.0, "codeview_age": 1.0, "rsrc_entropy": 6.25, "codeview_guid": "D8CAFBF6-8C84-4872-93F7-89CBF58DBDA8", "entry_section": ".ifc\u0007", "size_of_image": 65536.0, "file_alignment": 512.0, "resource_count": 4.0, "resource_types": [ "RT_ICON", "RT_DIALOG", "RT_GROUP_ICON", "RT_VERSION" ], "characteristics": 271.0, "has_rich_header": true, "overlay_padding": 176088.0, "size_of_headers": 1024.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 9.0, "computed_checksum": 263755.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1111223072.0, "debug_timestamp_min": 1111223072.0, "has_export_timestamp": false, "linker_major_version": 7.0, "linker_minor_version": 10.0, "debug_directory_types": [ 2.0 ], "entry_in_last_section": true, "has_resource_timestamp": false, "debug_directory_entries": 1.0, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "debug_timestamp_consistent": true, "api_hashing_indicator_count": 1.0, "debug_timestamp_unique_count": 1.0, "entry_in_nonstandard_section": true, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 229336.0 }, "binary": { "code_size": 17920.0, "func_count": 8.0, "has_overlay": true, "code_entropy": 6.53, "data_entropy": 3.4, "func_density": 0.46, "import_count": 257.0, "overlay_size": 176088.0, "string_count": 327.0, "avg_func_size": 869.25, "overlay_ratio": 0.77, "section_count": 5.0, "avg_complexity": 37.25, "import_density": 14.69, "max_complexity": 160.0, "string_density": 18.69, "overall_entropy": 5.22, "overlay_entropy": 7.94, "avg_basic_blocks": 41.38, "avg_section_size": 10444.8, "dependency_count": 9.0, "entropy_variance": 1.79, "wx_section_count": 1.0, "avg_string_length": 12.65, "complexity_per_kb": 2.13, "max_string_length": 175.0, "wide_string_count": 31.0, "avg_string_entropy": 2.72, "code_to_data_ratio": 0.52, "data_to_file_ratio": 0.0, "rsrc_to_file_ratio": 0.1, "text_to_file_ratio": 0.07, "total_basic_blocks": 331.0, "func_analysis_depth": 2.0, "string_length_stddev": 14.62, "debug_reference_count": 1.0, "largest_section_ratio": 0.1, "sentence_string_count": 9.0, "sentence_string_ratio": 0.03, "writable_section_count": 3.0, "behavioral_import_ratio": 0.01, "entry_in_writable_region": true, "executable_section_count": 2.0, "nonstandard_section_count": 1.0, "high_complexity_func_count": 2.0, "unnamed_complex_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 512, ".text" ], [ 592, ".data" ], [ 632, ".rsrc" ], [ 3197, "QVSUP" ], [ 3231, "RVPQU" ], [ 12819, "XPVWW" ], [ 13567, "TSVW" ], [ 18824, "vector\u003cT\u003e too long" ], [ 18860, "HelpSystem\\Common\\HTML\\addins_ref.htm" ], [ 18904, "wide", "Could Not Process AddIns.\nCheck if you have the compatible Comcat.dll from Microsoft (NOT Version 5.0).\nSee Microsoft's Knowledg" ], [ 19256, "wide", "FwRes.dll" ], [ 19280, "wide", "Could Not Create ApprenticeServer" ], [ 19348, "wide", "Inventor.ApprenticeServer" ], [ 19780, "CAddInMgrListCtrl" ], [ 22192, "invalid vector\u003cT\u003e subscript" ], [ 22224, "hhctrl.ocx" ], [ 22240, "CLSID\\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\\InprocServer32" ], [ 22352, "wide", "NoRemove" ], [ 22372, "wide", "ForceRemove" ], [ 22636, "RSDS" ], [ 22660, "r:\\lib\\Optimize\\AddInMgr.pdb" ], [ 25586, "?StringDeallocate@UTx@@YAXPAX@Z" ], [ 25620, "?GetCompiledHtmlPath@UTxUtil@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$UTxStringAllocator@G@@@std@@XZ" ], [ 25728, "utx.dll" ], [ 25736, "MFC71U.DLL" ], [ 25750, "??1exception@@UAE@XZ" ], [ 25774, "??0exception@@QAE@XZ" ], [ 25798, "__CxxFrameHandler" ], [ 25818, "??0exception@@QAE@ABV0@@Z" ], [ 25846, "_CxxThrowException" ], [ 25868, "memset" ], [ 25878, "_except_handler3" ], [ 25898, "free" ], [ 25906, "__security_error_handler" ], [ 25932, "MSVCR71.dll" ], [ 25946, "??1type_info@@UAE@XZ" ], [ 25970, "__dllonexit" ], [ 25984, "_onexit" ], [ 25994, "_c_exit" ], [ 26012, "_XcptFilter" ], [ 26026, "_cexit" ], [ 26036, "exit" ], [ 26044, "_wcmdln" ], [ 26054, "_amsg_exit" ], [ 26068, "__wgetmainargs" ], [ 26086, "_initterm" ], [ 26098, "__setusermatherr" ], [ 26118, "_adjust_fdiv" ], [ 26134, "__p__commode" ], [ 26150, "__p__fmode" ], [ 26164, "__set_app_type" ], [ 26182, "?terminate@@YAXXZ" ], [ 26202, "_controlfp" ], [ 26216, "GetLastError" ], [ 26232, "GetProcAddress" ], [ 26250, "LoadLibraryA" ], [ 26266, "InitializeCriticalSection" ], [ 26294, "DeleteCriticalSection" ], [ 26318, "ExitProcess" ], [ 26332, "GetModuleHandleA" ], [ 26352, "GetStartupInfoW" ], [ 26370, "QueryPerformanceCounter" ], [ 26396, "GetTickCount" ], [ 26412, "GetCurrentThreadId" ], [ 26434, "GetCurrentProcessId" ], [ 26456, "GetSystemTimeAsFileTime" ], [ 26480, "KERNEL32.dll" ], [ 26496, "DrawIcon" ], [ 26508, "CreatePopupMenu" ], [ 26526, "AppendMenuW" ], [ 26540, "SendMessageW" ], [ 26556, "GetSystemMenu" ], [ 26572, "IsIconic" ], [ 26584, "GetWindowRect" ], [ 26600, "GetClientRect" ], [ 26616, "GetFocus" ], [ 26628, "GetDesktopWindow" ], [ 26648, "EnableWindow" ], [ 26676, "GetSystemMetrics" ], [ 26696, "SystemParametersInfoW" ], [ 26718, "USER32.dll" ], [ 26732, "RegCloseKey" ], [ 26746, "RegQueryValueExA" ], [ 26766, "RegOpenKeyExA" ], [ 26780, "ADVAPI32.dll" ], [ 26796, "CoCreateInstance" ], [ 26816, "CLSIDFromProgID" ], [ 26834, "CoUninitialize" ], [ 26852, "CoInitialize" ], [ 26866, "ole32.dll" ], [ 26876, "OLEAUT32.dll" ], [ 26892, "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ" ], [ 26966, "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z" ], [ 27046, "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z" ], [ 27120, "MSVCP71.dll" ], [ 27134, "lstrlenW" ], [ 27146, "GetVersionExA" ], [ 27688, ".?AVexception@@" ], [ 27712, ".?AVlogic_error@std@@" ], [ 27744, ".?AVlength_error@std@@" ], [ 27776, ".?AVout_of_range@std@@" ], [ 27816, ".?AVtype_info@@" ], [ 28850, "wide", "IDD_ABOUTBOX" ], [ 30337, "klmnop" ], [ 30352, "]^_`abcdefghi\u003ej" ], [ 30369, "QRSTUVWX" ], [ 30385, "DEFGHIJKL" ], [ 30395, "MNOP" ], [ 30401, "*789:;\u003c=\u003e?@ABC" ], [ 30423, "/0123456" ], [ 30678, "O86J90" ], [ 30813, "K92J81" ], [ 30825, "P82M:2K83M:2" ], [ 30975, "mopagf" ], [ 31023, "poqrpo" ], [ 31071, "upqsqp" ], [ 31104, "pppmop" ], [ 31119, "nos_ro" ], [ 31152, "nqooqqopnprr" ], [ 31861, "wwxwwwx" ], [ 33338, "PVejpooooooopmmqL" ], [ 33359, "momjcUV" ], [ 33370, "Sdqv{{{{{{{{y{{x" ], [ 33391, "yywtmbb" ], [ 34106, "Sdovx{{{{x|wyytqs" ], [ 34138, "PWejpmppmmnmonpnmplnmmqoicUQ" ], [ 34170, "PPTV[[Z\\\\]]\\\\\\][[][[^[][WSPP" ], [ 35334, "yM86I:1K83L92L:3" ], [ 35362, "E:2L83I61L75K\u003c3I\u003c.N91" ], [ 35842, "J72wyylnnDGK4897\u003c:\u003cCF" ], [ 36046, "MPN.58165" ], [ 36235, "|zyutvswxdfg" ], [ 36328, "{z~~||wtvnnn@]f" ], [ 36425, "}|yx|zxxehf" ], [ 36778, "Remstx" ], [ 36877, "Jdkpos" ], [ 37785, "hex", "33333333333" ], [ 38361, "37wx" ], [ 38368, "wwwwxwwx" ], [ 38392, "wwwwxwwww" ], [ 38415, "wwwwwwwwwwx" ], [ 40434, "BCFHLLLLLJJJLLLLLLLLLPPPPPPPPLILJPNILPLMHFCB" ], [ 40482, "CHQRUUUUUUZUUUUUUUUUUUUUUUUWWZ" ], [ 40517, "TXWTWRQHC" ], [ 40530, "FPZ]acccdcdddddddddddddddddddc" ], [ 40578, "HR]ellllrlmmmmmmmmmmmmmmmmmmlm" ], [ 40613, "rklpmg]SH" ], [ 40626, "LT]m~v~z~zzzzxxxxxxxxxxxxxxvvv" ], [ 40674, "LUapvvztzzx" ], [ 42072, "zx~~~vxvtty~y\\" ], [ 42114, "LUdmzt~vtxxt" ], [ 42162, "LUcl~~xz~rvv~~xxz" ], [ 42215, "zxxxxxvvvvvvvvvv" ], [ 42258, "PTemtvvvvvvvvvvvvzzzzy" ], [ 42317, "vvxxxxxx~xtxtx~v" ], [ 42354, "HR\\emppmmmmmmmmmmmmpmmmmlpkmilkmmmkmppmqgcSH" ], [ 42402, "EPU\\cddccccc`ccccccdddcceda]cd]ccececcc]]TQF" ], [ 42450, "CGPRTWZWWZZTTTTTTTTTVTXZSVWWUUVVTWZVUUUZSQHD" ], [ 42498, "BCGIJLLJJLJJJJJJJJJLJPLMLLMPLJPLJPLNLPJNIFCB" ], [ 43592, "K92K85M:3K:1M:3" ], [ 44612, "J90S" ], [ 44723, "K83J72L;2I92I93O:2I:1" ], [ 44756, "I93K81J90I85L:3J53L94L94K:1" ], [ 45401, "kkkaaa" ], [ 45542, "pppdddccc" ], [ 45689, "uuujll" ], [ 46130, "yyyYZXqqq" ], [ 46349, "YYY:?\u003e4\u003c\u003c8=\u003c7\u003c?8;@" ], [ 46415, "tvw][Zbbb" ], [ 46782, "{|svturtqonhjjUWX" ], [ 46925, "xw{utvnppppp^^^B]g" ], [ 47066, "{}}{yysvttrqimnYXZ" ], [ 47210, "{}}wyyrttrqsfffOUZ" ], [ 47354, "z}{vxxxvvpsq[XZ\"" ], [ 47498, "z~yyyyytunmo`eh" ], [ 47642, "|y{{yywuubdd5" ], [ 47786, "|||uzxmooaih" ], [ 47927, "|~~z||zxxfeg." ], [ 48314, "[nvdgkpquw|z}" ], [ 48461, "^hhagbnjpvv|zy}v{zlqpzxx" ], [ 48608, "\\cfcccfddgiioqq" ], [ 48755, "bdemkqx{y" ], [ 50518, "wide", "About AddInMgr" ], [ 50550, "wide", "Tahoma" ], [ 50614, "wide", "AddInMgr Version 1.0" ], [ 50682, "wide", "Copyright (C) 2000" ], [ 50766, "wide", "VS_VERSION_INFO" ], [ 50858, "wide", "StringFileInfo" ], [ 50918, "wide", "Comments" ], [ 50942, "wide", "CompanyName" ], [ 50968, "wide", "Autodesk, Inc." ], [ 51006, "wide", "FileDescription" ], [ 51054, "wide", "FileVersion" ], [ 51118, "wide", "InternalName" ], [ 51170, "wide", "LegalCopyright" ], [ 51200, "wide", "Copyright © 2001" ], [ 51242, "wide", "LegalTrademarks" ], [ 51282, "wide", "OriginalFilename" ], [ 51316, "wide", "AddInMgr.exe" ], [ 51350, "wide", "PrivateBuild" ], [ 51382, "wide", "ProductName" ], [ 51408, "wide", "Autodesk, Inc. AddInMgr" ], [ 51462, "wide", "ProductVersion" ], [ 51522, "wide", "SpecialBuild" ], [ 51554, "wide", "VarFileInfo" ], [ 51586, "wide", "Translation" ], [ 51900, "_h\\flei2Nmm Blx(Jmx'+Co" ], [ 51944, "Btx Blxfxei Blx6Dis" ], [ 52011, "'oV\\6b3/HOlqfyez)[es-NyX" ], [ 52123, "/Eii" ], [ 55157, "2mus" ], [ 55428, "Qfxyn" ], [ 60251, "uz53" ], [ 60624, "hz26" ], [ 63668, "QHZP" ], [ 65463, "/wtq" ], [ 66905, "2cis" ], [ 67124, "icat" ], [ 69597, "Rflm" ], [ 71264, ".moin" ], [ 71908, "db.k" ], [ 76839, "GXVI" ], [ 77722, "8FXO" ], [ 77769, "J_02" ], [ 78890, "/t99" ], [ 79368, "h 7h" ], [ 84362, "/U3o" ], [ 85560, "5C4F" ], [ 86039, "Hauh" ], [ 86386, "Btxceomc_" ], [ 86489, "ac6t" ], [ 86508, "/0UFY" ], [ 87147, "b2\u003eP3S9" ], [ 88518, "jNN/tCU'ySX2i" ], [ 88558, "jC6vcI[2aIN9" ], [ 89727, "Q2\u003e." ], [ 89734, "3DVB" ], [ 91804, "SF32" ], [ 92852, "Kpkj" ], [ 93200, "/ooP" ], [ 93709, "A9A1" ], [ 96359, "NTMZ" ], [ 98132, "mn.r" ], [ 98683, "4hog" ], [ 98801, "LK28" ], [ 99685, "/l2D" ], [ 104183, "XDW2" ], [ 106852, "QOSK" ], [ 107520, "]O/_[IL" ], [ 109483, "HLG9E" ], [ 109525, "Lqqi" ], [ 110672, "9I5YGXO" ], [ 112630, "ZI3C" ], [ 113948, "DTA8" ], [ 114121, "Ccl_ol" ] ], "sz": 229336, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "35062" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1111223072.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "AddInMgr.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 8.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.72" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage/control::send-message", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage/control::enable-window", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "ADB880A6-D8FF-11CF-9377-00AA003B7A11" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 327.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoW" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.func_count = 8.00" ], "i": "metadata/binary/metrics/structural::few-functions", "l": 3 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "10, 0, 0, 21112" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 257.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 257.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 14.69" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 8.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 7.94" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 257.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.77" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 3 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoW" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 3, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "?GetCompiledHtmlPath@UTxUtil@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$UTxStringAllocator@G@@@std@@XZ", "StringFileInfo", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z", "?StringDeallocate@UTx@@YAXPAX@Z" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 37.25" ], "i": "metadata/binary/metrics/anomaly::high-complexity-marker", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.22" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 257.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.overlay_ratio = 0.77" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080", "l": 1 }, { "d": "PDB path on non-standard drive letter", "e": [ "r:\\lib\\Optimize\\AddInMgr.pdb" ], "i": "metadata/binary/debug::pdb-nonstandard-drive", "l": 3 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "QRSTUVWX", "TXWTWRQHC", "DEFGHIJKL" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 257.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz" ], "i": "micro-behaviors/dylib/library/family::xz-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "r:\\lib\\Optimize\\AddInMgr.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.53" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Add item to menu", "e": [ "AppendMenuW" ], "i": "micro-behaviors/ui/menu/popup::append-menu", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 257.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 65536.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 257.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "PE entry point in last section", "e": [ "pe.entry_in_last_section = 1.00" ], "i": "metadata/binary/anomaly/format::pe-entry-in-last-section", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 201", "e": [ "ORDINAL 201" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut-ordinal-201", "l": 1, "m": "B0025" }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 202", "e": [ "ORDINAL 202" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut-ordinal-202", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 257.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 176088.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 3 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 257.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage/control::get-window-rect", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8600000143051147, "d": "PE has medium sized overlay", "e": [ "binary.overlay_size = 176088.00" ], "i": "metadata/binary/section/metrics::medium-overlay-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "binary.import_count = 257.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8500000238418579, "d": "Resolve COM class from ProgID", "e": [ "CLSIDFromProgID" ], "i": "micro-behaviors/os/com/object::clsid-from-progid", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 8.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1546.015", "c": 0.8199999928474426, "d": "InprocServer32 registry write", "e": [ "CLSID\\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\\InprocServer32" ], "i": "objectives/persistence/system/registry/com-hijack::inprocserver32-write", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 176088.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetCurrentProcessId", "InitializeCriticalSection", "GetSystemTimeAsFileTime" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.77" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.import_count = 257.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-9--inline-29171", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 1111223072.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8799999952316284, "d": "CLSID registry path manipulation", "e": [ "CLSID\\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}" ], "i": "objectives/persistence/system/registry/com-hijack::clsid-registry-path", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027.009", "c": 0.699999988079071, "d": "Large overlay relative to file", "e": [ "binary.overlay_ratio = 0.77" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay", "l": 2, "m": "B0032" }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/shell/com::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.7200000286102295, "d": "Writable .rdata section permissions", "e": [ ".rdata (perms: rw-)" ], "i": "metadata/binary/section/names::writable-rdata", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".ifc\u0007 (size: 1536, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 7.94" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{ADB880A6-D8FF-11CF-9377-00AA003B7A11}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 3, "m": "C0042" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.import_count = 257.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-3--inline-29165", "l": 1, "m": "B0032" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_section_count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 176088.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (LoadLibraryA, GetProcAddress, LoadLibraryA, InitializeCriticalSection, DeleteCriticalSection, ... +10 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegQueryValueExA, RegCloseKey, RegOpenKeyExA)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCP71.dll (??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z, ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ, ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z)", "e": [ "MSVCP71.dll" ], "i": "metadata/dylib::msvcp71/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (SystemParametersInfoW, GetSystemMetrics, LoadIconW, EnableWindow, GetDesktopWindow, ... +9 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize, CoCreateInstance, CLSIDFromProgID, CoUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MFC71U.DLL (ORDINAL 2725, ORDINAL 2829, ORDINAL 4301, ORDINAL 2708, ORDINAL 2832, ... +177 more)", "e": [ "MFC71U.DLL" ], "i": "metadata/dylib::mfc71u/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links utx.dll (?StringDeallocate@UTx@@YAXPAX@Z, ?GetCompiledHtmlPath@UTxUtil@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$UTxStringAllocator@G@@@std@@XZ)", "e": [ "utx.dll" ], "i": "metadata/dylib::utx/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCR71.dll (??0exception@@QAE@ABV0@@Z, CxxThrowException, p__commode, ??0exception@@QAE@XZ, ??1exception@@UAE@XZ, ... +23 more)", "e": [ "MSVCR71.dll" ], "i": "metadata/dylib::msvcr71/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 6, ORDINAL 202, ORDINAL 201, ORDINAL 8, ORDINAL 9, ... +1 more)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.8500000238418579, "d": "Entry point in last RWX section", "e": [ "pe.entry_in_last_section = 1.00", ".ifc\u0007 (size: 1536, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/payload/section::ep-in-last-section-rwx", "l": 4 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.has_rich_header = 1.00", "binary.import_count = 257.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "c": 1.0, "d": "High complexity but very few functions", "e": [ "binary.avg_complexity = 37.25", "binary.func_count = 8.00" ], "i": "objectives/evasion/decoy/binary::high-complexity-decoy-dll", "l": 2 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "B0030", "c": 0.9300000071525574, "d": "GUID mutex with crypto and network", "e": [ "{ADB880A6-D8FF-11CF-9377-00AA003B7A11}", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z", "??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z", "StringFileInfo", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "?StringDeallocate@UTx@@YAXPAX@Z", "?GetCompiledHtmlPath@UTxUtil@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$UTxStringAllocator@G@@@std@@XZ" ], "i": "objectives/command-and-control/beacon/mutex::mutex-guid-crypto-http-coordination", "l": 4 }, { "c": 0.8500000238418579, "d": "High complexity but very few functions", "e": [ "binary.func_count = 8.00", "binary.avg_complexity = 37.25" ], "i": "metadata/binary/anomaly/format::high-complexity-decoy-dll", "l": 4 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Large high-entropy overlay", "e": [ "binary.overlay_entropy = 7.94", "binary.overlay_size = 176088.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Binary with encrypted overlay payload", "e": [ "binary.overlay_entropy = 7.94", "binary.overlay_size = 176088.00", "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::binary-encrypted-overlay", "l": 4, "m": "B0032" } ], "sha": "00ca6ecd5ffe54f9e8a136fc3efefd70acafd160b61388852fbae2a18b826ee6", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/35062", "type": "pe" } ], "tv": "d376d" } }