{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9313873648643494 } ], "prob": 0.93138736, "models": [ { "m": "az", "prob": 0.93138736, "class": 0 }, { "m": "az/native", "prob": 0.97231835, "class": 0 }, { "m": "az/pe", "prob": 0.42857143, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-02T08:04:43Z" }, "path": "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe", "raw": { "v": "6", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 6118014.0, "checksum_valid": 1.0, "computed_checksum": 6118014.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 6087312.0, "entropy": 5.06, "size_bytes": 6087312.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.06, "overlay_size": 6288.0, "string_count": 9737.0, "overlay_ratio": 0.0, "overall_entropy": 5.06, "overlay_entropy": 7.52, "entropy_variance": 6.14, "avg_string_length": 4.38, "max_string_length": 94.0, "code_to_data_ratio": 1.0, "string_length_stddev": 3.36, "largest_section_ratio": 1.0, "sentence_string_count": 8.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 6080000.0, "entropy_max": 5.06, "entropy_mean": 2.58, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 270330, "u8", "% sh" ], [ 6064168, "u8", "BSJB" ], [ 6066593, "u8", "Microsoft.VisualStudio.Shell.15.0" ], [ 6066627, "u8", "\u003cModule\u003e" ], [ 6066636, "u8", "Microsoft.VisualStudio.Debugger.InteropA" ], [ 6066677, "u8", "System.IO" ], [ 6066690, "u8", "System.Xml.Schema" ], [ 6066708, "u8", "XmlSchema" ], [ 6066718, "u8", "mscorlib" ], [ 6066732, "u8", "Eacefafadc" ], [ 6066743, "u8", "Microsoft.VisualBasic" ], [ 6066768, "u8", "Read" ], [ 6066773, "u8", "Thread" ], [ 6066780, "u8", "Load" ], [ 6066785, "u8", "FileContentNotSupported" ], [ 6066809, "u8", "getuid" ], [ 6066816, "u8", "Microsoft.Build.Tasks.Xsd" ], [ 6066842, "u8", "ExceptionTrace" ], [ 6066857, "u8", "FxTrace" ], [ 6066865, "u8", "GetService" ], [ 6066876, "u8", "get_ErrorMessageBoxSource" ], [ 6066902, "u8", "FileMode" ], [ 6066911, "u8", "Invoke" ], [ 6066918, "u8", "IDisposable" ], [ 6066930, "u8", "RuntimeTypeHandle" ], [ 6066948, "u8", "GetTypeFromHandle" ], [ 6066966, "u8", "System.Runtime" ], [ 6066981, "u8", "WriteLine" ], [ 6066991, "u8", "Combine" ], [ 6066999, "u8", "Microsoft.VisualStudio.Debugger.Engine" ], [ 6067038, "u8", "Type" ], [ 6067043, "u8", "FileShare" ], [ 6067053, "u8", "MethodBase" ], [ 6067064, "u8", "Dispose" ], [ 6067072, "u8", "Create" ], [ 6067079, "u8", "Write" ], [ 6067085, "u8", "Byte" ], [ 6067090, "u8", "GetObjectValue" ], [ 6067105, "u8", "GetHostValue" ], [ 6067118, "u8", "SetHostValue" ], [ 6067131, "u8", "Live" ], [ 6067136, "u8", "Eacefafadc.exe" ], [ 6067151, "u8", "Randomize" ], [ 6067161, "u8", "HasFlag" ], [ 6067169, "u8", "System.Threading" ], [ 6067186, "u8", "GetString" ], [ 6067196, "u8", "Debug" ], [ 6067202, "u8", "VBMath" ], [ 6067209, "u8", "Path" ], [ 6067214, "u8", "DkmRunningProcessInfoPropertyMask" ], [ 6067248, "u8", "XsdBuildTask" ], [ 6067261, "u8", "Microsoft.VisualStudio.Shell" ], [ 6067290, "u8", "IVsUIShell" ], [ 6067301, "u8", "System.Xml" ], [ 6067312, "u8", "FileStream" ], [ 6067323, "u8", "System" ], [ 6067330, "u8", "Enum" ], [ 6067335, "u8", "Boolean" ], [ 6067343, "u8", "AppDomain" ], [ 6067353, "u8", "GetDomain" ], [ 6067363, "u8", "Join" ], [ 6067368, "u8", "Application" ], [ 6067380, "u8", "get_SystemInformation" ], [ 6067402, "u8", "DkmSystemInformation" ], [ 6067423, "u8", "System.Reflection" ], [ 6067441, "u8", "get_Connection" ], [ 6067456, "u8", "DkmTransportConnection" ], [ 6067479, "u8", "get_Exception" ], [ 6067493, "u8", "NotSupportedException" ], [ 6067515, "u8", "MissingManifestResourceException" ], [ 6067548, "u8", "ArgumentNullException" ], [ 6067570, "u8", "StringComparison" ], [ 6067587, "u8", "MethodInfo" ], [ 6067598, "u8", "SetErrorInfo" ], [ 6067611, "u8", "ReportErrorInfo" ], [ 6067627, "u8", "DkmRunningProcessInfo" ], [ 6067649, "u8", "GetRunningProcessInfo" ], [ 6067671, "u8", "Microsoft.VisualStudio.Debugger.Interop" ], [ 6067711, "u8", "XmlReader" ], [ 6067721, "u8", "ServiceProvider" ], [ 6067737, "u8", "get_GlobalProvider" ], [ 6067756, "u8", "System.Resources.ResourceManager" ], [ 6067789, "u8", "Microsoft.VisualStudio.Debugger" ], [ 6067821, "u8", "ValidationEventHandler" ], [ 6067844, "u8", "IMessageFilter" ], [ 6067859, "u8", "AddMessageFilter" ], [ 6067876, "u8", "AsError" ], [ 6067884, "u8", ".ctor" ], [ 6067890, "u8", ".cctor" ], [ 6067897, "u8", "System.Diagnostics" ], [ 6067916, "u8", "System.Runtime.CompilerServices" ], [ 6067948, "u8", "IEEHostServices" ], [ 6067964, "u8", "System.Resources" ], [ 6067981, "u8", "get_Flags" ], [ 6067991, "u8", "DkmSystemInformationFlags" ], [ 6068017, "u8", "DkmTransportConnectionFlags" ], [ 6068045, "u8", "DkmRunningProcessFlags" ], [ 6068068, "u8", "XmlReaderSettings" ], [ 6068086, "u8", "System.ServiceModel.Internals" ], [ 6068116, "u8", "Equals" ], [ 6068123, "u8", "System.Windows.Forms" ], [ 6068144, "u8", "RuntimeHelpers" ], [ 6068159, "u8", "FileAccess" ], [ 6068170, "u8", "DkmProcess" ], [ 6068181, "u8", "DoEvents" ], [ 6068190, "u8", "Concat" ], [ 6068197, "u8", "Format" ], [ 6068204, "u8", "Object" ], [ 6068211, "u8", "IsStartElement" ], [ 6068226, "u8", "get_EntryPoint" ], [ 6068241, "u8", "get_LivePart" ], [ 6068254, "u8", "Microsoft.VisualStudio.Debugger.DefaultPort" ], [ 6068298, "u8", "ClrCustomVisualizerVSHost" ], [ 6068324, "u8", "Assembly" ], [ 6068333, "u8", "Empty" ], [ 6078330, "u8", "46be6462-ddd7-467c-b178-ce725c2af11d" ], [ 6078404, "u8", "4591b411-c98b-4d0f-8def-3a815e0d1655" ], [ 6078478, "u8", "d408d1cd-708b-4290-8d50-f5e3a7878d6f" ], [ 6078552, "u8", "ba2064c2-24aa-43a7-894c-ed218aa436e0" ], [ 6078626, "u8", "22f450cc-38a7-457c-bb52-75c9d7344cad" ], [ 6080046, "u8", "mscoree.dll" ], [ 6081090, "u8", "N0L0" ], [ 6081233, "u8", "Eabcebdfbef1" ], [ 6081255, "u8", "Eedebacaadbcfa1#0!" ], [ 6081280, "u8", "Eebfdababecfcbccaebbcffcad1" ], [ 6081342, "u8", "201214174223Z" ], [ 6081357, "u8", "211214174223Z0t1" ], [ 6081651, "u8", "C0A0" ], [ 6082499, "u8", "20201214174224Z" ], [ 6082547, "u8", "Greater Manchester1" ], [ 6082576, "u8", "Salford1" ], [ 6082594, "u8", "Sectigo Limited1,0*" ], [ 6082619, "u8", "#Sectigo RSA Time Stamping Signer #2" ], [ 6082779, "u8", "Sectigo Limited1%0#" ], [ 6082805, "u8", "Sectigo RSA Time Stamping CA0" ], [ 6082852, "u8", "320122235959Z0" ], [ 6082964, "u8", "#Sectigo RSA Time Stamping Signer #20" ], [ 6083483, "u8", "vIhb" ], [ 6083684, "u8", "90705" ], [ 6083719, "u8", "https://sectigo.com/CPS0D" ], [ 6083760, "u8", "3http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" ], [ 6083841, "u8", "3http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" ], [ 6083907, "u8", "http://ocsp.sectigo.com0" ], [ 6084003, "u8", "WUpKN" ], [ 6084535, "u8", "New Jersey1" ], [ 6084556, "u8", "Jersey City1" ], [ 6084578, "u8", "The USERTRUST Network1.0," ], [ 6084609, "u8", "%USERTrust RSA Certification Authority0" ], [ 6084651, "u8", "190502000000Z" ], [ 6085512, "u8", "I0G0E" ], [ 6085522, "u8", "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" ], [ 6085615, "u8", "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" ], [ 6085681, "u8", "http://ocsp.usertrust.com0" ], [ 6085884, "u8", "mAmg" ], [ 6086351, "u8", "Sectigo RSA Time Stamping CA" ], [ 6086724, "u8", "%USERTrust RSA Certification Authority" ], [ 6086891, "u8", "Pycf" ], [ 6087029, "u8", "fCjh" ] ], "v": { "file.stem": "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1607967743, "file.basename": "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe", "pe.image_base": 4194304, "pe.image_size": 6103040, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 6087742, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 6288, "pe.image_hash.sha1": "3fd88b745dfd514668c40e93c60743e88731ac64", "pe.image_hash.sha256": "0cb0fda25539fbf82bbb2d6cbe8b70bdb86ce623dd606304aa22d8f51c97a82d", "pe.image_hash.sha384": "de2a8727c7541bd68057b59caf3d6d5c0d7974a2dafbe345faeade7c67e31153629ad84f0f34ea3dcec5978a0368be3e", "pe.image_hash.sha512": "378a77880b47f80ecd35c2a99139f4ae309d769f84608036c3033bbfb55f6dd40c1543dc564ff1f23d0b4c3416fdf9f0cc85223beee7727e7fbd2505d5f05a88", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=Eebfdababecfcbccaebbcffcad,O=Eedebacaadbcfa,CN=Eabcebdfbef", "pe.signatures[0].serial": "00e9329f5af5950b05e008ad1667ff74ba", "pe.signatures[0].subject": "C=US,L=New York,OU=Eebfdababecfcbccaebbcffcad,O=Eedebacaadbcfa,CN=Eabcebdfbef", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 6087652, "pe.data_directories[1].rva": 6081024, "pe.data_directories[2].rva": 6094848, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-12-14T17:42:23Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 6288, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-12-14T17:42:23Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "e3362e125d3fbd6d0e40c4896c7d0d596ff8ad43", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "0cb0fda25539fbf82bbb2d6cbe8b70bdb86ce623dd606304aa22d8f51c97a82d", "pe.signatures[0].thumbprint_sha256": "26bc5077cbbd789d9142dd77eb4eb5741aa77a04402c4a9211e51d62bb462e2d", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 6080000, 5.06, "r-x" ], [ ".reloc", 6080512, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 6087312, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Eabcebdfbef", "e": [ "Eabcebdfbef" ], "i": "metadata/signed/unknown::eabcebdfbef", "l": 2 }, { "c": 1.0, "d": "Signed by Eedebacaadbcfa", "e": [ "Eedebacaadbcfa" ], "i": "metadata/signed/leaf::eedebacaadbcfa", "l": 3 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "1cd7" ] }, { "c": 0.8199999928474426, "d": "AppDomain GetDomain token", "e": [ "GetDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-getdomain-token", "l": 1, "el": [ "5c9499" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "5cc62e" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1, "el": [ "5c948f" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringComparison", "GetString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "5c9572", "5c93f2" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 1.0, "d": "References System.ServiceModel namespace", "e": [ "System.ServiceModel.Internals" ], "i": "micro-behaviors/communications/ipc/wcf::dotnet-system-servicemodel", "l": 1, "el": [ "5c9776" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "5c93c0" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "Assembly entry point resolution", "e": [ "get_EntryPoint" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-entrypoint", "l": 1, "el": [ "5c9802" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "5c979b" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "5c9237" ] }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1.0," ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "5cd7e2" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "5c979b" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.6000000238418579, "d": "MethodBase class reference", "e": [ "MethodBase" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-methodbase-token", "l": 1, "el": [ "5c936d" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "SetHostValue", "GetObjectValue", "GetHostValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "5c93ae", "5c9392", "5c93a1" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "143e" ] }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.06" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 9737.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1, "el": [ "5c92df" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "5c91f5" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "get_Connection", "DkmTransportConnection", "DkmTransportConnectionFlags" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012", "el": [ "5c94f1", "5c9500", "5c9731" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 9737.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "5cc62e" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "5c921e" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 9737.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.7200000286102295, "d": "Path combination helper token", "e": [ "Combine" ], "i": "micro-behaviors/fs/temp/directory::path-combine-token", "l": 1, "el": [ "5c932f" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "bfe" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "a": "T1546.012", "c": 0.8999999761581421, "d": "IFEO Debugger registry value", "e": [ "Debugger" ], "i": "objectives/persistence/login/ifeo/debugger::ifeo-debugger-value", "l": 1, "m": "F0012", "el": [ "5c91cc" ] }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload/compression::gzip-magic", "l": 2, "el": [ "594a75" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 9737.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "5c925c" ] }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "4591b411-c98b-4d0f-8def-3a815e0d1655", "d408d1cd-708b-4290-8d50-f5e3a7878d6f", "46be6462-ddd7-467c-b178-ce725c2af11d", "22f450cc-38a7-457c-bb52-75c9d7344cad", "ba2064c2-24aa-43a7-894c-ed218aa436e0" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030", "el": [ "5cbfc4", "5cc00e", "5cbf7a", "5cc0a2", "5cc058" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "System.Resources.ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "5c962c" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "5c96b9" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "5c94df" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "5c93c0" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 9737.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "5c962c" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetRunningProcessInfo", "ValidationEventHandler", "DkmRunningProcessFlags", "DkmTransportConnectionFlags", "SectigoRSATimeStampingCA", "NotSupportedException", "MissingManifestResourceException", "DkmRunningProcessInfoPropertyMask", "DkmSystemInformation", "DkmTransportConnection", "ArgumentNullException", "FileContentNotSupported", "DkmRunningProcessInfo", "ClrCustomVisualizerVSHost", "DkmSystemInformationFlags" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "5c95c1", "5c966d", "5c974d", "5c9731", "5cd4b0", "5c9525", "5c953b", "5c940e", "5c94ca", "5c9500", "5c955c", "5c9261", "5c95ab", "5c984a", "5c9717" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11", "path": "02520a277c94450cc2f969e332af38eb0558c403191842030a9690f49951ec11.exe", "type": "pe" } ], "tv": "ed903" } }