{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.7868712544441223, "class": 0 } ], "prob": 0.78687125, "class": 0, "models": [ { "m": "az", "prob": 0.78687125, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T16:27:47Z" }, "path": "2026-04-23_4cad734bdc2bec3aaa5da242079ee91c_elex_wannacry", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "14abc0c137cd2a9967afd2fd5b98f180", "pe.checksum": "0x0001b6ce", "pe.timestamp": 1070662757, "hash.authenti": "d5751a6eb2fac4b67b310bbb0ccf176bc7fad8e0a7cf052b25904e36b7fbfc8f", "hash.rich_header": "5d83115565dc4492f39672b39703c2b5c64fe7a53d4c44a55d3fced623bc13b7", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.resource_types[4]": "RT_MANIFEST", "pe.rich_header.xor_key": "0xf572e82b", "pe.manifest.description": "Fügen Sie hier die Anwendungsbeschreibung ein", "pe.data_directories[0].rva": 53248, "pe.data_directories[1].rva": 36864, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 100, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 3464, "pe.version_info.company_name": "X\u0018\u0001FileDescription", "pe.version_info.file_version": "1, 0, 0, 1", "pe.version_info.product_name": "Anwendung finditpro", "pe.version_info.internal_name": "finditpro", "pe.rich_header_compids[0].count": 1, "pe.rich_header_compids[1].count": 6, "pe.rich_header_compids[2].count": 1, "pe.rich_header_compids[3].count": 11, "pe.rich_header_compids[4].count": 2, "pe.rich_header_compids[5].count": 3, "pe.rich_header_compids[6].count": 3, "pe.rich_header_compids[7].count": 152, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 4, "pe.version_info.legal_copyright": "Copyright (C) 2003", "pe.version_info.product_version": "1, 0, 0, 1", "binary.top_complex_unnamed[0].cc": 16, "binary.top_complex_unnamed[1].cc": 10, "binary.top_complex_unnamed[2].cc": 9, "binary.top_complex_unnamed[3].cc": 9, "binary.top_complex_unnamed[4].cc": 3, "binary.top_complex_unnamed[5].cc": 2, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.rich_header_compids[0].compid": 793723, "pe.rich_header_compids[10].count": 1, "pe.rich_header_compids[11].count": 2, "pe.rich_header_compids[1].compid": 6097027, "pe.rich_header_compids[2].compid": 924803, "pe.rich_header_compids[3].compid": 663407, "pe.rich_header_compids[4].compid": 270191, "pe.rich_header_compids[5].compid": 729465, "pe.rich_header_compids[6].compid": 270713, "pe.rich_header_compids[7].compid": 65536, "pe.rich_header_compids[8].compid": 3154772, "pe.rich_header_compids[9].compid": 3220308, "pe.version_info.file_description": "MFC-Anwendung finditpro", "pe.version_info.legal_trademarks": "D\u000e\u0001OriginalFilename", "binary.top_complex_unnamed[0].bbs": 30, "binary.top_complex_unnamed[1].bbs": 14, "binary.top_complex_unnamed[2].bbs": 17, "binary.top_complex_unnamed[3].bbs": 17, "binary.top_complex_unnamed[4].bbs": 6, "binary.top_complex_unnamed[5].bbs": 4, "pe.rich_header_compids[10].compid": 394951, "pe.rich_header_compids[11].compid": 2761315, "pe.rich_header_compids[7].product": "Unknown", "pe.version_info.original_filename": "finditpro.EXE", "binary.top_complex_unnamed[0].addr": "0x401860", "binary.top_complex_unnamed[0].size": 1239, "binary.top_complex_unnamed[1].addr": "0x401740", "binary.top_complex_unnamed[1].size": 130, "binary.top_complex_unnamed[2].addr": "0x402143", "binary.top_complex_unnamed[2].size": 579, "binary.top_complex_unnamed[3].addr": "0x402390", "binary.top_complex_unnamed[3].size": 579, "binary.top_complex_unnamed[4].addr": "0x4020d0", "binary.top_complex_unnamed[4].size": 115, "binary.top_complex_unnamed[5].addr": "0x4017d0", "binary.top_complex_unnamed[5].size": 42, "pe.manifest.assembly_identity.name": "Microsoft.Windows.avg2003", "pe.manifest.assembly_identity.type": "win32", "pe.section_characteristics[0].name": "UPX0", "pe.section_characteristics[1].name": "UPX1", "pe.section_characteristics[2].name": ".rsrc", "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 6, "pe.rich_header.entries[2].use_count": 1, "pe.rich_header.entries[3].use_count": 11, "pe.rich_header.entries[4].use_count": 2, "pe.rich_header.entries[5].use_count": 3, "pe.rich_header.entries[6].use_count": 3, "pe.rich_header.entries[7].use_count": 152, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 4, "pe.manifest.dependencies[0].language": "*", "pe.rich_header.entries[0].product_id": 12, "pe.rich_header.entries[10].use_count": 1, "pe.rich_header.entries[11].use_count": 2, "pe.rich_header.entries[1].product_id": 93, "pe.rich_header.entries[2].product_id": 14, "pe.rich_header.entries[3].product_id": 10, "pe.rich_header.entries[4].product_id": 4, "pe.rich_header.entries[5].product_id": 11, "pe.rich_header.entries[6].product_id": 4, "pe.rich_header.entries[7].product_id": 1, "pe.rich_header.entries[8].product_id": 48, "pe.rich_header.entries[9].product_id": 49, "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.rich_header.entries[10].product_id": 6, "pe.rich_header.entries[11].product_id": 42, "pe.rich_header.entries[0].build_number": 7291, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 2179, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 7299, "pe.rich_header.entries[2].product_name": "Export_VC2003", "pe.rich_header.entries[3].build_number": 8047, "pe.rich_header.entries[3].product_name": "Linker_v6", "pe.rich_header.entries[4].build_number": 8047, "pe.rich_header.entries[4].product_name": "Linker_VS_v6_or_earlier", "pe.rich_header.entries[5].build_number": 8569, "pe.rich_header.entries[5].product_name": "Cvt_Omf", "pe.rich_header.entries[6].build_number": 8569, "pe.rich_header.entries[6].product_name": "Linker_VS_v6_or_earlier", "pe.rich_header.entries[7].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[8].build_number": 9044, "pe.rich_header.entries[8].product_name": "unknown", "pe.rich_header.entries[9].build_number": 9044, "pe.rich_header.entries[9].product_name": "unknown", "pe.section_characteristics[0].raw_size": 24576, "pe.section_characteristics[1].raw_size": 8192, "pe.section_characteristics[2].raw_size": 73728, "pe.rich_header.entries[10].build_number": 1735, "pe.rich_header.entries[10].product_name": "Cvt_Pgo_VS_v6_or_earlier", "pe.rich_header.entries[11].build_number": 8803, "pe.rich_header.entries[11].product_name": "unknown", "pe.section_characteristics[0].virtual_size": 24576, "pe.section_characteristics[1].virtual_size": 8192, "pe.section_characteristics[2].virtual_size": 73728, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 28672, "pe.section_characteristics[2].virtual_address": 36864, "pe.section_characteristics[0].characteristics_hex": "e0000080", "pe.section_characteristics[1].characteristics_hex": "e0000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.manifest.dependencies[0].processor_architecture": "X86", "pe.manifest.assembly_identity.processor_architecture": "X86" }, "x": 6, "id": 0, "is": [ "GetModuleHandleA", "GetStartupInfoA", "CreateFontA", "ORDINAL 4078", "ORDINAL 1775", "ORDINAL 4407", "ORDINAL 5241", "ORDINAL 2385", "ORDINAL 5163", "ORDINAL 6374", "ORDINAL 4353", "ORDINAL 5280", "ORDINAL 3798", "ORDINAL 4837", "ORDINAL 4441", "ORDINAL 2648", "ORDINAL 2055", "ORDINAL 6376", "ORDINAL 3749", "ORDINAL 5065", "ORDINAL 1727", "ORDINAL 5261", "ORDINAL 2446", "ORDINAL 2124", "ORDINAL 5277", "ORDINAL 2982", "ORDINAL 3147", "ORDINAL 3259", "ORDINAL 4465", "ORDINAL 3136", "ORDINAL 3262", "ORDINAL 2985", "ORDINAL 3081", "ORDINAL 2976", "ORDINAL 3830", "ORDINAL 3831", "ORDINAL 3825", "ORDINAL 3079", "ORDINAL 4080", "ORDINAL 4627", "ORDINAL 4425", "ORDINAL 3597", "ORDINAL 324", "ORDINAL 825", "ORDINAL 641", "ORDINAL 4234", "ORDINAL 4853", "ORDINAL 4710", "ORDINAL 4673", "ORDINAL 4274", "ORDINAL 6375", "ORDINAL 4486", "ORDINAL 2554", "ORDINAL 6052", "ORDINAL 5731", "ORDINAL 3922", "ORDINAL 1089", "ORDINAL 5199", "ORDINAL 2396", "ORDINAL 3346", "ORDINAL 5300", "ORDINAL 5302", "ORDINAL 2725", "ORDINAL 4079", "ORDINAL 4698", "ORDINAL 5307", "ORDINAL 5289", "ORDINAL 5714", "ORDINAL 4622", "ORDINAL 4424", "ORDINAL 3738", "ORDINAL 561", "ORDINAL 815", "ORDINAL 797", "ORDINAL 656", "ORDINAL 2621", "ORDINAL 1134", "ORDINAL 2586", "ORDINAL 4405", "ORDINAL 3723", "ORDINAL 6055", "ORDINAL 1776", "ORDINAL 5290", "ORDINAL 3402", "ORDINAL 3610", "ORDINAL 1146", "ORDINAL 1168", "ORDINAL 567", "ORDINAL 2302", "ORDINAL 2863", "ORDINAL 2118", "ORDINAL 2379", "ORDINAL 755", "ORDINAL 470", "ORDINAL 1138", "ORDINAL 800", "ORDINAL 2915", "ORDINAL 540", "ORDINAL 3495", "ORDINAL 5572", "ORDINAL 3089", "ORDINAL 4476", "ORDINAL 1105", "ORDINAL 2514", "ORDINAL 4998", "ORDINAL 4376", "ORDINAL 2512", "ORDINAL 5265", "ORDINAL 1576", "onexit", "exit", "XcptFilter", "exit", "acmdln", "getmainargs", "initterm", "setusermatherr", "adjust_fdiv", "p__commode", "p__fmode", "set_app_type", "except_handler3", "controlfp", "mbscmp", "clock", "sprintf", "setmbcp", "ultoa", "CxxFrameHandler", "dllonexit", "SetWindowTextA", "SetFocus", "GetDlgItem", "SendMessageA", "DrawIcon", "GetClientRect", "GetSystemMetrics", "IsIconic", "MessageBoxIndirectA", "IsDlgButtonChecked", "GetWindowTextA", "EnumChildWindows", "SendMessageTimeoutA", "GetClassNameA", "GetWindowLongA", "EnumWindows", "AppendMenuA", "CheckDlgButton", "LoadIconA", "EnableWindow", "GetSystemMenu" ], "ms": { "pe": { "entry": 10384.0, "machine": 332.0, "checksum": 112334.0, "rsrc_size": 73728.0, "subsystem": 2.0, "timestamp": 1070662757.0, "icon_count": 2.0, "image_base": 4194304.0, "has_checksum": true, "has_manifest": true, "rsrc_entropy": 0.5, "entry_section": "UPX0", "size_of_image": 110592.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 5.0, "resource_types": [ "RT_ICON", "RT_DIALOG", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST" ], "characteristics": 271.0, "has_rich_header": true, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 5.0, "computed_checksum": 112334.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "manifest_version_mismatch": true, "entry_in_nonstandard_section": true }, "file": { "size": 110592.0 }, "binary": { "code_size": 32768.0, "func_count": 9.0, "code_entropy": 4.69, "func_density": 0.28, "import_count": 151.0, "string_count": 180.0, "avg_func_size": 394.11, "section_count": 3.0, "avg_complexity": 7.11, "import_density": 4.72, "max_complexity": 16.0, "string_density": 5.63, "overall_entropy": 3.29, "avg_basic_blocks": 12.67, "avg_section_size": 35498.67, "dependency_count": 5.0, "entropy_variance": 2.32, "wx_section_count": 2.0, "avg_string_length": 17.34, "complexity_per_kb": 0.22, "max_string_length": 427.0, "wide_string_count": 23.0, "avg_string_entropy": 3.2, "code_to_data_ratio": 0.44, "rsrc_to_file_ratio": 0.67, "total_basic_blocks": 114.0, "func_analysis_depth": 2.0, "string_length_stddev": 34.06, "largest_section_ratio": 0.67, "sentence_string_count": 22.0, "sentence_string_ratio": 0.12, "writable_section_count": 3.0, "entry_in_writable_region": true, "executable_section_count": 2.0, "nonstandard_section_count": 2.0 } }, "ss": [ [ 48, "xor", "Keymaker for(Vinor" ], [ 77, "!This program cannot be run in DOS mode." ], [ 116, "xor", "ehtgEker forO" ], [ 512, "UPX0" ], [ 552, "UPX1" ], [ 592, ".rsrc" ], [ 984, "xor", "Key\\OYQru67S,^kd." ], [ 987, "1.24" ], [ 2519, "F3RC" ], [ 4058, "DHLP" ], [ 4994, "SUVW" ], [ 10675, "XPVSS" ], [ 12267, "xor", "Keymaker for Winamp Pj" ], [ 12980, "xor", "Keymaker for" ], [ 13404, "xor", "Keyma{%rPU/r" ], [ 13515, "xor", "K;_-a3C2 4I2 " ], [ 13543, "xor", "KQ_-aEC2 NI2 " ], [ 13579, "xor", "Ku_-aaC2 bI2 " ], [ 13731, "xor", "K;_-a3C2 4I2 " ], [ 13759, "xor", "KQ_-aEC2 NI2 " ], [ 13795, "xor", "Ku_-aaC2 bI2 " ], [ 13923, "xor", "K;_-a3C2 4I2 " ], [ 13951, "xor", "KQ_-aEC2 NI2 " ], [ 13987, "xor", "Ku_-aaC2 bI2 " ], [ 14176, "xor", "Keymakerߙ" ], [ 16416, "0123456789ABCDEFHJKMNPQRSTUVWXYZ" ], [ 16504, "xor", "kEY2\u003e4:-|9OR" ], [ 16676, "xor", "fHT@L@or fork2" ], [ 16688, "Keymaker for Winamp Pro v5.0\n\nby king_KINK/CORE\n\non November 6th, 2003\n\nProtection: base32, \n\t modified sha1, \n\t some psycho s" ], [ 16718, "by king_KINK/CORE" ], [ 16737, "on November 6th, 2003" ], [ 16760, "Protection: base32," ], [ 16781, "modified sha1," ], [ 16800, "some psycho shit" ], [ 16821, "Daniela, u are the light of my life!!!" ], [ 16860, "Terminal" ], [ 16872, "About..." ], [ 16884, "Copy-paste\nall info to the\nregistration form!" ], [ 16895, "all info to the" ], [ 16911, "registration form!" ], [ 16932, "Enter a name..." ], [ 16944, "xor", "eKWm3.$6yfore9" ], [ 16948, "READY" ], [ 16956, "Enter your name and press generate..." ], [ 17004, "Not found" ], [ 17016, "Serial generated successfully..." ], [ 17056, "Only \u003e 5.0 Key possible for this name..." ], [ 17104, "Time used: %.2f Seconds" ], [ 17143, "xor", "kETMAKER %" ], [ 17152, "Calculating..." ], [ 17172, "Winamp Pro Registration Key Entry" ], [ 17216, "Edit" ], [ 26582, "wide", "Winamp Pro v5.0" ], [ 26620, "wide", "Tahoma" ], [ 26701, "xor", "Keymaker\"d?w `ixacp߯" ], [ 26923, "xor", "Klym1He- Mox " ], [ 26944, "wide", "5.0 Key" ], [ 26948, "xor", "eeImAk.rEf" ], [ 26971, "xor", "Klym11e- Tox " ], [ 27000, "xor", "eeImAk.rEf" ], [ 27038, "wide", "About..." ], [ 27058, "wide", "MS Sans Serif" ], [ 28681, "GetModuleHandleA" ], [ 28699, "GetStartupInfoA" ], [ 28725, "CreateFontA" ], [ 29074, "_onexit" ], [ 29090, "_XcptFilter" ], [ 29103, "exit" ], [ 29109, "_acmdln" ], [ 29118, "__getmainargs" ], [ 29133, "_initterm" ], [ 29144, "__setusermatherr" ], [ 29162, "_adjust_fdiv" ], [ 29176, "__p__commode" ], [ 29190, "__p__fmode" ], [ 29202, "__set_app_type" ], [ 29218, "_except_handler3" ], [ 29236, "_controlfp" ], [ 29248, "_mbscmp" ], [ 29264, "sprintf" ], [ 29273, "_setmbcp" ], [ 29283, "_ultoa" ], [ 29291, "__CxxFrameHandler" ], [ 29310, "__dllonexit" ], [ 29332, "SetWindowTextA" ], [ 29348, "SetFocus" ], [ 29370, "SendMessageA" ], [ 29384, "DrawIcon" ], [ 29394, "GetClientRect" ], [ 29409, "GetSystemMetrics" ], [ 29427, "IsIconic" ], [ 29437, "MessageBoxIndirectA" ], [ 29458, "IsDlgButtonChecked" ], [ 29478, "GetWindowTextA" ], [ 29494, "EnumChildWindows" ], [ 29512, "SendMessageTimeoutA" ], [ 29533, "GetClassNameA" ], [ 29548, "GetWindowLongA" ], [ 29564, "EnumWindows" ], [ 29577, "AppendMenuA" ], [ 29590, "CheckDlgButton" ], [ 29617, "EnableWindow" ], [ 29631, "GetSystemMenu" ], [ 29898, ".text" ], [ 29977, "@.data" ], [ 32132, "SSMP" ], [ 32756, "0123456789ABCDEFHJKMNPQRSTUVWX" ], [ 32893, "Keymaker" ], [ 32909, "Winamp Pro v5.0" ], [ 32935, "g_KINK/CORE" ], [ 32947, "on Novemb36" ], [ 32972, "tecti" ], [ 32994, "modified sha1" ], [ 33012, "some psycho" ], [ 33075, "About" ], [ 33087, "opy-pt" ], [ 33151, "pAss geneDu" ], [ 33522, "3 3e" ], [ 33668, "Font" ], [ 34051, "t_fdiv" ], [ 34063, "zcomoe" ], [ 34080, "type" ], [ 34114, "clock6" ], [ 34281, "Enum" ], [ 37314, "xor", "Keymaker for Winam" ], [ 38344, "xor", "Keymaker for\t~@LNBA1Ruh'A" ], [ 38454, "xor", "bePO\\hxv!BEA" ], [ 38493, "xor", "mLyDuluq0tyd" ], [ 38576, "xor", "bGH\\VZYE#xOj" ], [ 38598, "////11" ], [ 38660, "xor", "kEYwyshz)HOm" ], [ 38700, "//111111" ], [ 38846, "wide", "VS_VERSION_INFO" ], [ 38938, "wide", "StringFileInfo" ], [ 38998, "wide", "CompanyName" ], [ 39030, "wide", "FileDescription" ], [ 39064, "wide", "MFC-Anwendung finditpro" ], [ 39118, "wide", "FileVersion" ], [ 39174, "wide", "InternalName" ], [ 39200, "wide", "finditpro" ], [ 39226, "wide", "LegalCopyright" ], [ 39256, "wide", "Copyright (C) 2003" ], [ 39302, "wide", "LegalTrademarks" ], [ 39342, "wide", "OriginalFilename" ], [ 39376, "wide", "finditpro.EXE" ], [ 39410, "wide", "ProductName" ], [ 39436, "wide", "Anwendung finditpro" ], [ 39482, "wide", "ProductVersion" ], [ 39542, "wide", "VarFileInfo" ], [ 39574, "wide", "Translation" ], [ 39608, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e" ], [ 39665, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 39741, "\u003cassemblyIdentity" ], [ 39761, "version=\"1.0.0.0\"" ], [ 39785, "processorArchitecture=\"X86\"" ], [ 39819, "name=\"Microsoft.Windows.avg2003\"" ], [ 39857, "type=\"win32\"" ], [ 39881, "\u003cdescription\u003eF" ], [ 39897, "gen Sie hier die Anwendungsbeschreibung ein\u003c/description\u003e \r\n\u003cdependency\u003e \r\n \u003cdependentAssembly\u003e \r\n \u003cassemblyIdentity \r" ], [ 39957, "\u003cdependency\u003e" ], [ 39972, "\u003cdependentAssembly\u003e" ], [ 40053, "name=\"Microsoft.Windows.Common-Controls\"" ], [ 40108, "version=\"6.0.0.0\"" ], [ 40182, "publicKeyToken=\"6595b64144ccf1df\"" ], [ 40230, "language=\"*\"" ], [ 40260, "xor", "kEYMAD[R-lOR" ], [ 40270, "\u003c/dependentAssembly\u003e" ], [ 40297, "\u003c/dependency\u003e" ], [ 40313, "\u003c/assembly\u003e" ], [ 40445, "xor", "Keyi!{e~`vof`Ginamp\u003c" ], [ 40491, "xor", "Keyma n##A" ], [ 40496, "KERNEL32.DLL" ], [ 40509, "GDI32.dll" ], [ 40519, "MFC42.DLL" ], [ 40529, "MSVCRT.dll" ], [ 40540, "USER32.dll" ], [ 40552, "LoadLibraryA" ], [ 40566, "GetProcAddress" ], [ 40582, "ExitProcess" ], [ 53361, "xor", "Keymake9e4!7ld[@%!\u003c " ] ], "sz": 110592, "ts": [ { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "MFC-Anwendung finditpro" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright (C) 2003" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Anwendung finditpro" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 151.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 151.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.20" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextA" ], "i": "micro-behaviors/ui/window/manage/control::get-window-text", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 73728.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8199999928474426, "d": "sprintf string formatting API", "e": [ "sprintf" ], "i": "micro-behaviors/fs/path/construct::sprintf-format-api", "l": 2 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 4.72" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 151.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 151.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 180.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.29" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 151.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.11" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "2026-04-23_4cad734bdc2bec3aaa5da242079ee91c_elex_wannacry" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1, 0, 0, 1" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 110592.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 9.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 151.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 151.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 9.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "binary.section_count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 0.800000011920929, "d": "Enumerate child windows", "e": [ "EnumChildWindows" ], "i": "micro-behaviors/ui/window/manage/enumerate::enum-child-windows-import", "l": 2 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.29" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"processor_architecture\":\"X86\",\"public_key_token" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 9.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 151.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1036", "c": 0.949999988079071, "d": "Trademarks holds OriginalFilename name", "e": [ "D\u000e\u0001OriginalFilename" ], "i": "objectives/evasion/masquerade/versioninfo::trademarks-origfile-leak", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.20" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage/enumerate::enum-windows", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 151.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage/control::send-message-a", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1070662757.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8500000238418579, "d": "Links legacy MFC42 runtime", "e": [ "MFC42.DLL" ], "i": "micro-behaviors/dylib/library/legacy::mfc42-ref", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage/control::enable-window", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.func_count = 9.00" ], "i": "metadata/binary/metrics/structural::few-functions", "l": 3 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"assembly_identity\":{\"version\":\"1.0.0.0\",\"processor_architecture\":\"X86\",\"name\":\"Microsoft.Windows.avg2003\",\"type\":\"win32\"},\"des" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "a": "T1106", "c": 0.6000000238418579, "d": "EnumWindows / EnumChildWindows API", "e": [ "EnumWindows", "EnumChildWindows" ], "i": "objectives/evasion/process/injection/callback::enum-windows-callback", "l": 3, "m": "E1106" }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "gen Sie hier die Anwendungsbeschreibung ein\u003c/description\u003e \r\n\u003cdependency\u003e \r\n \u003cdependentAssembly\u003e \r\n \u003cassemblyIdentity \r", "publicKeyToken=\"6595b64144ccf1df\"" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextA" ], "i": "objectives/command-and-control/backdoor/shell/com::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 110592 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 9.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX0 (size: 24576, perms: rwx)", "UPX1 (size: 8192, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "MessageBoxIndirectA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (GetModuleHandleA, GetStartupInfoA)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MFC42.DLL (ORDINAL 4078, ORDINAL 1775, ORDINAL 4407, ORDINAL 5241, ORDINAL 2385, ... +101 more)", "e": [ "MFC42.DLL" ], "i": "metadata/dylib::mfc42/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCRT.dll (onexit, exit, XcptFilter, exit, acmdln, ... +16 more)", "e": [ "MSVCRT.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (SetWindowTextA, SetFocus, GetDlgItem, SendMessageA, DrawIcon, ... +16 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (CreateFontA)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "well-known/malware/trojan/shellobject/strings::misleading-upx-sections", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 151.00", "pe.has_rich_header = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.75, "d": "Legacy rich PE with broad imports", "e": [ "binary.section_count = 3.00", "binary.import_count = 151.00", "pe.has_rich_header = 1.00", "binary.string_count = 180.00", "binary.overall_entropy = 3.29" ], "i": "metadata/binary/layout::rich-imported-low-entropy-layout", "l": 2 } ], "sha": "01fe3ce1ac1a6afcf2cbc0be0f319bcce319c47e4b04824e57efea3980422914", "path": "2026-04-23_4cad734bdc2bec3aaa5da242079ee91c_elex_wannacry", "type": "pe" } ], "tv": "46790" } }