{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 }, { "id": 1, "prob": 0.9380587339401245, "class": 0 }, { "id": 2, "prob": 0.9815003871917725, "class": 1 }, { "id": 3, "prob": 0.9815003871917725, "class": 1 }, { "id": 4, "prob": 0.9815003871917725, "class": 1 }, { "id": 5, "prob": 0.9815003871917725, "class": 1 }, { "id": 6, "prob": 0.9815003871917725, "class": 1 }, { "id": 7, "prob": 0.9815003871917725, "class": 1 }, { "id": 8, "prob": 0.9815003871917725, "class": 1 }, { "id": 9, "prob": 0.9815003871917725, "class": 1 }, { "id": 10, "prob": 0.9815003871917725, "class": 1 }, { "id": 11, "prob": 0.9815003871917725, "class": 1 }, { "id": 12, "prob": 0.9815003871917725, "class": 1 }, { "id": 13, "prob": 0.9815003871917725, "class": 1 }, { "id": 14, "prob": 0.9481639862060547, "class": 0 }, { "id": 15, "prob": 0.9815003871917725, "class": 1 }, { "id": 16, "prob": 0.9815003871917725, "class": 1 }, { "id": 17, "prob": 0.9815003871917725, "class": 1 }, { "id": 18, "prob": 0.9815003871917725, "class": 1 }, { "id": 19, "prob": 0.9815003871917725, "class": 1 }, { "id": 20, "prob": 0.9430945515632629, "class": 0 }, { "id": 21, "prob": 0.9504092931747437, "class": 0 }, { "id": 22, "prob": 0.9422329664230347, "class": 0 }, { "id": 23, "prob": 0.9548199772834778, "class": 0 }, { "id": 24, "prob": 0.9815003871917725, "class": 1 }, { "id": 25, "prob": 0.9815003871917725, "class": 1 }, { "id": 26, "prob": 0.9416834115982056, "class": 0 }, { "id": 27, "prob": 0.9365535378456116, "class": 0 }, { "id": 28, "prob": 0.9354109168052673, "class": 0 }, { "id": 29, "prob": 0.9815003871917725, "class": 1 }, { "id": 30, "prob": 0.9369715452194214, "class": 0 }, { "id": 31, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.95482, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T18:36:53Z" }, "path": "64301", "raw": { "v": "4", "fs": [ { "f": "K₂O₁₄(As₁₅C₁₂Er₁₀SCo₄Dy₂I₁₀PrAl₃Ca₂EuLa₂P₄Xe)H₉(Db₇F₉Os₉Po₆U₂Cm₂CrDsMg)Md₅(Bi₆Pa₂Pt)", "x": 222, "id": 0, "is": [ "InitCommonControlsEx", "SHAutoComplete", "ReadFile", "GetFileAttributesW", "SetFileAttributesW", "FindNextFileW", "GetFullPathNameW", "GetModuleFileNameW", "FindResourceW", "GetModuleHandleW", "FreeLibrary", "GetProcAddress", "LoadLibraryW", "GetCurrentProcessId", "GetLocaleInfoW", "GetNumberFormatW", "ExpandEnvironmentStringsW", "WaitForSingleObject", "DosDateTimeToFileTime", "GetDateFormatW", "GetTimeFormatW", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "GetExitCodeProcess", "GetTempPathW", "MoveFileExW", "Sleep", "UnmapViewOfFile", "MapViewOfFile", "GetCommandLineW", "CreateFileMappingW", "GetTickCount", "SetEnvironmentVariableW", "OpenFileMappingW", "CreateThread", "EnterCriticalSection", "LeaveCriticalSection", "GetProcessAffinityMask", "ReleaseSemaphore", "ResetEvent", "DeleteCriticalSection", "SetEvent", "SetThreadPriority", "InitializeCriticalSection", "CreateEventW", "CreateSemaphoreW", "SystemTimeToFileTime", "GetSystemTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "FindFirstFileW", "GetFileType", "WriteConsoleW", "GetConsoleOutputCP", "WriteConsoleA", "SetStdHandle", "GetLocaleInfoA", "GetStringTypeW", "GetStringTypeA", "InitializeCriticalSectionAndSpinCount", "LoadLibraryA", "GetConsoleMode", "GetConsoleCP", "QueryPerformanceCounter", "SetHandleCount", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "LCMapStringW", "LCMapStringA", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "ExitProcess", "HeapSize", "RtlCaptureContext", "RtlVirtualUnwind", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "TerminateProcess", "HeapCreate", "HeapSetInformation", "FlsAlloc", "GetCurrentThreadId", "FlsFree", "FlsSetValue", "FlsGetValue", "DecodePointer", "EncodePointer", "GetStartupInfoA", "GetCommandLineA", "HeapAlloc", "RtlPcToFileHeader", "RaiseException", "SetEndOfFile", "SetFilePointer", "GetStdHandle", "WriteFile", "FlushFileBuffers", "GetLongPathNameW", "MoveFileW", "GetShortPathNameW", "CreateDirectoryW", "RemoveDirectoryW", "SetCurrentDirectoryW", "DeleteFileW", "FindClose", "CreateFileW", "DeviceIoControl", "SetFileTime", "GetCurrentProcess", "CloseHandle", "CreateHardLinkW", "SetLastError", "GetLastError", "GetCurrentDirectoryW", "CreateFileA", "GlobalAlloc", "GetSystemTimeAsFileTime", "HeapReAlloc", "HeapFree", "RtlUnwindEx", "RtlLookupFunctionEntry", "EnableWindow", "GetDlgItem", "ShowWindow", "MessageBoxW", "FindWindowExW", "GetParent", "MapWindowPoints", "CreateWindowExW", "UpdateWindow", "LoadCursorW", "RegisterClassExW", "DefWindowProcW", "DestroyWindow", "CopyRect", "IsWindow", "CharUpperW", "OemToCharBuffA", "LoadBitmapW", "SetWindowLongPtrW", "PostMessageW", "GetSysColor", "SetForegroundWindow", "WaitForInputIdle", "IsWindowVisible", "DialogBoxParamW", "DestroyIcon", "SetFocus", "GetClassNameW", "SendDlgItemMessageW", "GetDlgItemTextW", "EndDialog", "SetDlgItemTextW", "wvsprintfW", "SendMessageW", "GetDC", "ReleaseDC", "PeekMessageW", "GetMessageW", "TranslateMessage", "DispatchMessageW", "LoadStringW", "GetWindowRect", "GetClientRect", "GetWindowLongPtrW", "SetWindowPos", "GetWindowTextW", "SetWindowTextW", "GetSystemMetrics", "GetWindow", "GetWindowLongW", "SetWindowLongW", "LoadIconW", "GetDeviceCaps", "CreateCompatibleDC", "GetObjectW", "CreateCompatibleBitmap", "SelectObject", "StretchBlt", "DeleteDC", "DeleteObject", "RegOpenKeyExW", "RegQueryValueExW", "RegCreateKeyExW", "RegSetValueExW", "RegCloseKey", "SetFileSecurityW", "OpenProcessToken", "LookupPrivilegeValueW", "AdjustTokenPrivileges", "SHBrowseForFolderW", "ShellExecuteExW", "SHGetSpecialFolderLocation", "SHFileOperationW", "SHGetPathFromIDListW", "SHGetMalloc", "SHChangeNotify", "SHGetFileInfoW", "CLSIDFromString", "CoCreateInstance", "OleInitialize", "OleUninitialize", "CreateStreamOnHGlobal", "ORDINAL 8" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\SFX\\setup\\build\\sfxrar64\\Release\\sfxrar.pdb", "rsrc_size": 26112.0, "subsystem": 2.0, "timestamp": 1368556024.0, "icon_count": 2.0, "image_base": 5368709120.0, "rsrc_entropy": 6.69, "entry_section": ".text", "size_of_image": 397312.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2013.0, "characteristics": 35.0, "entry_point_rva": 137036.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1368556024.0, "import_dll_count": 9.0, "manifest_present": true, "computed_checksum": 1949704.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556024.0, "debug_timestamp_min": 1368556024.0, "dll_characteristics": 33024.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 174080.0, "file_size": 1936478.0, "entry_point": 137036.0, "has_overlay": true, "code_entropy": 6.46, "data_entropy": 4.23, "import_count": 213.0, "overlay_size": 1688158.0, "string_count": 1333.0, "overlay_ratio": 0.87, "section_count": 5.0, "avg_complexity": 14.0, "function_count": 696.0, "import_density": 1.25, "max_complexity": 14.0, "string_density": 7.84, "overall_entropy": 5.17, "overlay_entropy": 8.0, "avg_basic_blocks": 31.0, "avg_section_size": 49459.2, "dependency_count": 9.0, "entropy_variance": 1.58, "function_density": 4.09, "avg_function_size": 494.0, "avg_string_length": 13.11, "complexity_per_kb": 0.08, "max_string_length": 255.0, "wide_string_count": 119.0, "writable_sections": 1.0, "avg_string_entropy": 2.67, "code_to_data_ratio": 2.38, "data_to_file_ratio": 0.0, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.09, "total_basic_blocks": 31.0, "embedded_file_count": 1.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 18.54, "debug_reference_count": 1.0, "largest_section_ratio": 0.09, "sentence_string_count": 114.0, "sentence_string_ratio": 0.09, "embedded_archive_count": 1.0, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 2123, "WATAUAVAWH" ], [ 3377, "UVWH" ], [ 4732, "@UVWATAUAVAW" ], [ 7896, "t$ WATAUAVAW" ], [ 16782, "UVWATAUAVAWH" ], [ 19109, "x ATAUAVH" ], [ 19503, "WATAU" ], [ 20163, "WATAUH" ], [ 21112, "t$ WATAUAVAWH" ], [ 22373, "{ ATAUAVH" ], [ 22824, "L$ VWATAUAWH" ], [ 24501, "x ATAUAVAWH" ], [ 28685, "x AUAVAWH" ], [ 29482, "VWATAUAV" ], [ 30025, "VWATH" ], [ 36285, "x ATAUAV" ], [ 37851, "VWAUH" ], [ 38672, "@SUVWATAUAVH" ], [ 39873, "UVWATAUAVAW" ], [ 44848, "f92t" ], [ 46294, "f99u" ], [ 46816, "/tYH" ], [ 52365, "C E3" ], [ 55201, "x ATAVAWH" ], [ 58097, "p WATAUAVAWH" ], [ 76320, "xxxxwwww" ], [ 76999, "SUVWATAUAVAWH" ], [ 78478, "gfffffffI" ], [ 95902, "VWATAUAVH" ], [ 100243, "WATAWH" ], [ 101504, "@SUVWATAUAVAWH" ], [ 109665, "U E3" ], [ 113616, "F0E3" ], [ 114671, "ATAUAVH" ], [ 121184, "C8E3" ], [ 122701, "p WATAUH" ], [ 123133, "x ATAUAWH" ], [ 129667, "SVWATH" ], [ 135524, "8MOC" ], [ 135611, "SVWATAUAVAWH" ], [ 136312, "@SWATAUAVAWH" ], [ 139815, "WATAVH" ], [ 149193, "UVWATAUH" ], [ 151272, "@UATAUAVAWH" ], [ 157930, "\\$ UVWATAUAVAW" ], [ 162835, "AUAVAWH" ], [ 164014, "L$ UATAUAVAWH" ], [ 165572, "@USVWATAUAVAWH" ], [ 166190, "M0H3" ], [ 177200, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 178200, "wide", "SeRestorePrivilege" ], [ 178240, "wide", "SeSecurityPrivilege" ], [ 178440, "wide", "SeCreateSymbolicLinkPrivilege" ], [ 178808, "wide", "%.*ls(%u)%ls" ], [ 178880, "wide", "rtmp%d" ], [ 178896, "YNANRC" ], [ 178992, "bad allocation" ], [ 179016, "wide", "__rar_" ], [ 179128, "wide", ".rar" ], [ 179272, "wide", "*messages***" ], [ 179304, "*messages***" ], [ 179360, "CryptUnprotectMemory" ], [ 179384, "CryptProtectMemory" ], [ 179408, "wide", "Crypt32.dll" ], [ 179432, "wide", "CryptUnprotectMemory failed" ], [ 179488, "wide", "CryptProtectMemory failed" ], [ 179568, "wide", "RENAMEDLG" ], [ 179592, "wide", "GETPASSWORD1" ], [ 179632, "wide", "Software\\WinRAR SFX" ], [ 179672, "wide", "STATIC" ], [ 179704, "wide", "%s %s %s" ], [ 179728, "wide", "REPLACEFILEDLG" ], [ 179808, "wide", ".exe" ], [ 179824, "wide", "Install" ], [ 179840, "wide", ".inf" ], [ 179896, "wide", ".lnk" ], [ 179912, "wide", "%s%s%d" ], [ 179928, "wide", "%s.%d.tmp" ], [ 179952, "wide", "\u003cbr\u003e" ], [ 179968, "wide", "ProgramFilesDir" ], [ 180000, "wide", "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 180096, "wide", "Delete" ], [ 180112, "wide", "Text" ], [ 180128, "wide", "Title" ], [ 180144, "wide", "Path" ], [ 180160, "wide", "Silent" ], [ 180176, "wide", "Overwrite" ], [ 180200, "wide", "Setup" ], [ 180216, "wide", "TempMode" ], [ 180240, "wide", "License" ], [ 180256, "wide", "Presetup" ], [ 180280, "wide", "Shortcut" ], [ 180304, "wide", "SavePath" ], [ 180328, "wide", "Update" ], [ 180344, "wide", "SetupCode" ], [ 180408, "wide", "LICENSEDLG" ], [ 180496, "wide", "winrarsfxmappingfile.tmp" ], [ 180552, "wide", "runas" ], [ 180568, "wide", "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" ], [ 180632, "wide", "__tmp_rar_sfx_access_check_%u" ], [ 180696, "wide", "STARTDLG" ], [ 180720, "wide", "sfxname" ], [ 181008, "SetDllDirectoryW" ], [ 181032, "wide", "kernel32" ], [ 181056, "wide", "CreateThread failed" ], [ 181104, "wide", "WaitForMultipleObjects error %d, GetLastError %d" ], [ 181216, "wide", "Thread pool initialization failed." ], [ 182032, "wide", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e" ], [ 182144, "wide", "\u003c/html\u003e" ], [ 182160, "wide", "utf-8\"\u003e\u003c/head\u003e" ], [ 182192, "wide", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=" ], [ 182328, "wide", "\u003chtml\u003e" ], [ 182344, "wide", "\u003c/style\u003e" ], [ 182368, "wide", "\u003cstyle\u003e" ], [ 182384, "wide", "\u003c/p\u003e" ], [ 182400, "wide", "about:blank" ], [ 182424, "wide", "Shell.Explorer" ], [ 182456, "wide", "RarHtmlClassName" ], [ 182496, "wide", "EDIT" ], [ 182512, "wide", "riched20.dll" ], [ 182544, "wide", "riched32.dll" ], [ 183048, "Unknown exception" ], [ 183104, "bad exception" ], [ 183120, "CorExitProcess" ], [ 183136, "wide", "mscoree.dll" ], [ 183184, "wide", "UTF-16LE" ], [ 183208, "wide", "UNICODE" ], [ 183224, "runtime error" ], [ 183248, "TLOSS error" ], [ 183264, "SING error" ], [ 183280, "DOMAIN error" ], [ 183296, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 183303, "An application has made an attempt to load the C runtime library incorrectly." ], [ 183381, "Please contact the application's support team for more information." ], [ 183456, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 183463, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 183543, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 183704, "R6032\r\n- not enough space for locale information" ], [ 183711, "- not enough space for locale information" ], [ 183760, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 183767, "- Attempt to initialize the CRT more than once." ], [ 183815, "This indicates a bug in your application." ], [ 183864, "R6030\r\n- CRT not initialized" ], [ 183871, "- CRT not initialized" ], [ 183896, "R6028\r\n- unable to initialize heap" ], [ 183903, "- unable to initialize heap" ], [ 183936, "R6027\r\n- not enough space for lowio initialization" ], [ 183943, "- not enough space for lowio initialization" ], [ 183992, "R6026\r\n- not enough space for stdio initialization" ], [ 183999, "- not enough space for stdio initialization" ], [ 184048, "R6025\r\n- pure virtual function call" ], [ 184055, "- pure virtual function call" ], [ 184088, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 184095, "- not enough space for _onexit/atexit table" ], [ 184144, "R6019\r\n- unable to open console device" ], [ 184151, "- unable to open console device" ], [ 184192, "R6018\r\n- unexpected heap error" ], [ 184199, "- unexpected heap error" ], [ 184232, "R6017\r\n- unexpected multithread lock error" ], [ 184239, "- unexpected multithread lock error" ], [ 184280, "R6016\r\n- not enough space for thread data" ], [ 184287, "- not enough space for thread data" ], [ 184336, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 184338, "This application has requested the Runtime to terminate it in an unusual way." ], [ 184488, "R6009\r\n- not enough space for environment" ], [ 184495, "- not enough space for environment" ], [ 184536, "R6008\r\n- not enough space for arguments" ], [ 184543, "- not enough space for arguments" ], [ 184584, "R6002\r\n- floating point support not loaded" ], [ 184591, "- floating point support not loaded" ], [ 184632, "Microsoft Visual C++ Runtime Library" ], [ 184680, "\u003cprogram name unknown\u003e" ], [ 184704, "Runtime Error!\n\nProgram:" ], [ 184767, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 185040, "wide", "(null)" ], [ 185056, "(null)" ], [ 185113, "700WP" ], [ 185129, "`h````" ], [ 185214, "700PP" ], [ 185264, "Complete Object Locator'" ], [ 185296, "Class Hierarchy Descriptor'" ], [ 185328, "Base Class Array'" ], [ 185352, "Base Class Descriptor at (" ], [ 185384, "Type Descriptor'" ], [ 185408, "`local static thread guard'" ], [ 185440, "`managed vector copy constructor iterator'" ], [ 185488, "`vector vbase copy constructor iterator'" ], [ 185536, "`vector copy constructor iterator'" ], [ 185576, "`dynamic atexit destructor for '" ], [ 185616, "`dynamic initializer for '" ], [ 185648, "`eh vector vbase copy constructor iterator'" ], [ 185696, "`eh vector copy constructor iterator'" ], [ 185736, "`managed vector destructor iterator'" ], [ 185776, "`managed vector constructor iterator'" ], [ 185816, "`placement delete[] closure'" ], [ 185848, "`placement delete closure'" ], [ 185880, "`omni callsig'" ], [ 185896, "delete[]" ], [ 185920, "`local vftable constructor closure'" ], [ 185960, "`local vftable'" ], [ 185992, "`udt returning'" ], [ 186008, "`copy constructor closure'" ], [ 186040, "`eh vector vbase constructor iterator'" ], [ 186080, "`eh vector destructor iterator'" ], [ 186112, "`eh vector constructor iterator'" ], [ 186152, "`virtual displacement map'" ], [ 186184, "`vector vbase constructor iterator'" ], [ 186224, "`vector destructor iterator'" ], [ 186256, "`vector constructor iterator'" ], [ 186288, "`scalar deleting destructor'" ], [ 186320, "`default constructor closure'" ], [ 186352, "`vector deleting destructor'" ], [ 186384, "`vbase destructor'" ], [ 186424, "`local static guard'" ], [ 186624, "operator" ], [ 186664, "delete" ], [ 186680, "__unaligned" ], [ 186696, "__restrict" ], [ 186720, "__clrcall" ], [ 186736, "__fastcall" ], [ 186752, "__thiscall" ], [ 186768, "__stdcall" ], [ 186784, "__pascal" ], [ 186800, "__cdecl" ], [ 187600, "GetProcessWindowStation" ], [ 187624, "GetUserObjectInformationA" ], [ 187656, "GetLastActivePopup" ], [ 187680, "GetActiveWindow" ], [ 187696, "MessageBoxA" ], [ 187712, "USER32.DLL" ], [ 188498, "wide", "h(((( H" ], [ 189184, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 189568, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 189808, "dddd, MMMM dd, yyyy" ], [ 189832, "MM/dd/yy" ], [ 189856, "December" ], [ 189872, "November" ], [ 189888, "October" ], [ 189896, "September" ], [ 189908, "August" ], [ 189916, "July" ], [ 189924, "June" ], [ 189932, "April" ], [ 189940, "March" ], [ 189952, "February" ], [ 189968, "January" ], [ 190024, "Saturday" ], [ 190036, "Friday" ], [ 190048, "Thursday" ], [ 190064, "Wednesday" ], [ 190080, "Tuesday" ] ], "sz": 1936478, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 1.0, "d": "Self-extracting archive (RAR)", "e": [ "archive_type:rar" ], "i": "file/archive/self-extracting/rar", "l": 3 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetFileSize", "CreateFileW", "ReadFile", "GetModuleFileNameA", "CreateFileA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "COM class factory export", "e": [ "DllGetClassObject" ], "i": "metadata/binary/symbols::export-dll-get-class-object", "l": 1 }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "66 41 fd 45 74" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy image list", "e": [ "ImageList_Destroy" ], "i": "micro-behaviors/ui/controls/widget::image-list-destroy", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "a": "T1105", "c": 0.9399999976158142, "d": "Embedded stage screen capture APIs", "e": [ "CreateDIBSection" ], "i": "objectives/command-and-control/dropper/staging/signed-bundle::embedded-stage-screen-capture", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "c": 0.949999988079071, "d": "ANSI GUI probe API cluster", "e": [ "GetLastActivePopup", "GetActiveWindow", "MessageBoxA" ], "i": "well-known/malware/trojan/elex/test-loader::ansi-gui-probe-cluster", "l": 3 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1057", "d": "Browser app chrome", "e": [ "chrome.exe" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-chrome-firefox", "l": 2, "m": "E1592" }, { "a": "T1115", "c": 0.800000011920929, "d": "Clipboard read and write APIs", "e": [ "GetClipboardData", "SetClipboardData" ], "i": "objectives/credential-access/clipboard/crypto::clipboard-rw", "l": 1, "m": "E1510" }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "c": 0.8500000238418579, "d": ".NET Clipboard class reference (WinForms)", "e": [ "Clipboard" ], "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "l": 3 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "c": 1.0, "d": "Derived string condition", "e": [ "cannot recover data" ], "i": "objectives/impact/ransom/encrypt/threat-text::inline__data-loss-threat__any_3", "l": 1 }, { "a": "T1562.001", "d": "Sophos reference", "e": [ "Sophos Anti-Virus", "SOFTWARE\\Sophos\\SweepNT" ], "i": "objectives/impact/degrade/edr::sophos-name", "l": 1 }, { "c": 0.9200000166893005, "d": "External IPv4 endpoint in data section", "e": [ "162.223.45.153:50" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-data-literal", "l": 1 }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Registry blob wipe API", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 3, "m": "F0007" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 5344.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "MAPI message send call", "e": [ "MAPISendMail" ], "i": "objectives/collection/email-harvest::mapi-send-mail", "l": 3 }, { "c": 0.8500000238418579, "d": "AppID registry word", "e": [ "AppID" ], "i": "objectives/persistence/system/registry/com::appid-word", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 145.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{B41DB860-64E4-11D2-9906-E49FADC173CA}", "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Drop and execute file from Temp directory", "e": [ "ShellExecuteA", "CreateProcessA", "GetTempPathA", "WriteFile" ], "i": "objectives/command-and-control/dropper/staging::temp-file-execution", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "Uninstall.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "45", "4d", "45", "45", "4d", "4d", "49", "46", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "54 01 02 10", "48 01 02 10", "78 01 02 10", "78 01 02 10", "70 01 02 10", "78 01 02 10", "78 01 02 10", "78 01 02 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "WinRAR.exe" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindFirstFileA", "FindNextFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoW", "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "a": "T1129", "c": 0.9399999976158142, "d": "Self copy append and relaunch", "e": [ "CreateFileA", "CreateProcessW", "GetModuleFileNameW", "DeleteFileW", "GetTickCount", "GetModuleFileNameA", "CopyFileW", "CreateFileW", "SetFilePointer", "WriteFile" ], "i": "objectives/command-and-control/dropper/execution/loader::self-copy-relaunch-loader", "l": 2, "m": "B0030" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "Uninstall.exe" ], "i": "objectives/evasion/masquerade/file::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.949999988079071, "d": "WinRAR SFX start dialog", "e": [ "STARTDLG" ], "i": "metadata/binary/installer/sfx::dialog-start", "l": 1 }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "RarExt32.dll" ], "i": "objectives/evasion/masquerade/dll::dll-basename", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1029.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableW" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 212992)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-pe-resource-section", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "explorer.exe" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 36.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Raise process priority class", "e": [ "SetPriorityClass" ], "i": "micro-behaviors/process/thread/priority::set-priority-class", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (CreatePropertySheetPageW, DestroyPropertySheetPage, ORDINAL 8)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindFirstFileW", "FindClose", "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "ExitProcess", "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessW" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has many functions", "e": [ "binary.function_count = 2923.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-function-count", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "rarext.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 2.79" ], "i": "objectives/anti-static/obfuscation/binary-metrics::dominant-section", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetSystemMetrics", "GetDiskFreeSpaceExW", "GetDiskFreeSpaceW", "GetTickCount" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "11.48.25.38:3890" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "OpenClipboard", "Clipboard", "GetClipboardData", "RegisterClipboardFormatW", "SetClipboardData", "OleSetClipboard", "GetClipboardData", "SetClipboardData", "EmptyClipboard", "CloseClipboard" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateDirectoryW, GetVersionExW, GetModuleFileNameW, GetCurrentDirectoryW, GetLocaleInfoW, ... +97 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.9200000166893005, "d": "Shell drag query API", "e": [ "DragQueryFileW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-drag-query-file", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "runas privilege elevation string", "e": [ "runas" ], "i": "micro-behaviors/os/privilege/elevation::runas-string", "l": 3 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 2 }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2860.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.70" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "OpenClipboard", "EmptyClipboard", "CloseClipboard", "GetClipboardData", "RegisterClipboardFormatW", "SetClipboardData", "OleSetClipboard", "Clipboard" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "RegisterClassExW", "CreateWindowExW", "GetMessageW", "DispatchMessageW", "DefWindowProcW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1 }, { "a": "T1562.001", "d": "Norton reference", "e": [ "Norton AntiVirus" ], "i": "objectives/impact/degrade/edr::norton-name", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.23" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.800000011920929, "d": "Accesses ComSpec environment variable", "e": [ "COMSPEC" ], "i": "micro-behaviors/os/env/vars::comspec-env-var", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 1305088.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.78" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI window capture with screen context", "e": [ "GetDC", "GetWindowTextW", "CreateCompatibleBitmap", "BitBlt", "GetForegroundWindow", "CreateCompatibleDC", "GetWindowTextLengthW", "GetDesktopWindow" ], "i": "objectives/collection/screenshot/capture::gdi-window-capture", "l": 2, "m": "C0014" }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "Extracting files to %s folder$Extracting files to temporary folder", "Unknown encryption method in %s$The specified password is incorrect." ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "Encrypt", "encrypt", "encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 2 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 212992.00" ], "i": "well-known/malware/trojan/shellobject::xll-large-rsrc-section", "l": 1 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.800000011920929, "d": "bzip2 string", "e": [ "BZIP2" ], "i": "micro-behaviors/data/compress/library::bzip2-string", "l": 1 }, { "a": "T1204", "c": 0.699999988079071, "d": "References being infected", "e": [ "infected" ], "i": "micro-behaviors/data/text/malware::infected-marker", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 377.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1204", "c": 0.699999988079071, "d": "Virus reference", "e": [ "Virus", "Virus", "Virus", "Virus", "Virus", "virus", "Virus", "Virus", "Virus", "virus" ], "i": "micro-behaviors/data/text/malware::virus-marker", "l": 2 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-getpixel", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_function_size = 44004.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExW", "RegOpenKeyExW", "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload::zip-magic", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, ReleaseStgMedium)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 212992.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script::cmd-exe-dup", "l": 1 }, { "c": 0.9399999976158142, "d": "HEAP_CREATE_ENABLE_EXECUTE flag (0x40000)", "e": [ "B9 00 00 04 00" ], "i": "micro-behaviors/mem/alloc/heap::heap-create-enable-execute-flag", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Multi-browser process target roster", "e": [ "iexplore", "opera.exe", "chrome.exe" ], "i": "objectives/discovery/host/browser::browser-process-roster", "l": 3 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.699999988079071, "d": "Create image list", "e": [ "ImageList_Create" ], "i": "micro-behaviors/ui/controls/widget::image-list-create", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.75, "d": "Clear clipboard contents", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetDeviceCaps, GetObjectW, CreateCompatibleDC, GetPixel, SetPixel, ... +13 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Standalone SHA256 hash string in binary", "e": [ "70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434", "a538f494a2afdb0ca5c008d34100dc71cb684672c0c511da8d95d38642fc2360" ], "i": "objectives/anti-static/obfuscation/string::embedded-sha256-token", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.699999988079071, "d": "Compare file modification times", "e": [ "CompareFileTime" ], "i": "micro-behaviors/fs/sync/fsync::compare-file-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Randomized executable name string", "e": [ "ace32loader.exe" ], "i": "objectives/anti-static/obfuscation/string::randomized-exe-name", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001" }, { "c": 0.8500000238418579, "d": "Peek message (Unicode)", "e": [ "PeekMessageW" ], "i": "micro-behaviors/os/message/queue::peek-message-w", "l": 2 }, { "a": "T1573", "c": 1.0, "d": "RC4 XOR decrypt loop pattern", "e": [ "00 f8" ], "i": "micro-behaviors/crypto/symmetric/stream::rc4-xor-loop", "l": 1, "m": "C0027" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556027.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 377.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "c": 0.8399999737739563, "d": "Right string trimming", "e": [ "right" ], "i": "micro-behaviors/process/create/shell/lang::right-string-call", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1552.004", "d": "Generic key extension", "e": [ ".key" ], "i": "objectives/collection/file-targeting/filter::key-extension", "l": 1, "m": "B0024" }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password is set", "Password matching this label" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "d": "Usage: label in binary strings", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 8)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "FindFirstFileW", "CreateFileA", "SetFileTime", "CreateFileW", "GetModuleFileNameW", "GetModuleFileNameA", "WriteFile" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "d": ".exe extension reference", "e": [ ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceA", "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.699999988079071, "d": "Add item to menu", "e": [ "AppendMenuW" ], "i": "micro-behaviors/ui/menu/popup::append-menu", "l": 2 }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcW" ], "i": "micro-behaviors/ui/window/manage::call-window-proc", "l": 2 }, { "a": "T1562.001", "c": 0.9800000190734863, "d": "AMSI scan buffer memory patch bytes (E_INVALIDARG)", "e": [ "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3" ], "i": "objectives/evasion/anti-av/platform::amsi-memory-patch-hex-bytes", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform::ntdll-dll-str", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA", "SystemParametersInfoW" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 0.800000011920929, "d": "Query current foreground window", "e": [ "GetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::get-foreground-window", "l": 2 }, { "c": 0.8500000238418579, "d": "Open named file mapping", "e": [ "OpenFileMappingA" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-a", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "94 a0 41 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 0.949999988079071, "d": "links UxTheme.dll (IsAppThemed, IsThemeActive)", "e": [ "UxTheme.dll" ], "i": "metadata/dylib::uxtheme/dll", "l": 2 }, { "c": 1.0, "d": "scanner word", "e": [ "Scanner", "scanner", "scanner", "scanner", "scanner", "scanner" ], "i": "objectives/impact/infect/marker::scanner-word", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "GetModuleFileNameW", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 1.0, "d": "virus word", "e": [ "Virus", "Virus", "Virus", "Virus", "Virus", "virus", "Virus", "Virus", "Virus", "virus" ], "i": "objectives/impact/infect/marker::virus-word", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2860.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.800000011920929, "d": "Write data to clipboard", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "l": 2 }, { "c": 0.75, "d": "Read data from clipboard", "e": [ "GetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::get-clipboard-data", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/command-and-control/backdoor/binary::plaintext-sleep-command-token", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "Display folder browse dialog", "e": [ "SHBrowseForFolderW" ], "i": "micro-behaviors/fs/shell-ops/commands::browse-for-folder", "l": 3 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Acquire cryptographic service provider context", "e": [ "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library::crypt-acquire-context", "l": 2, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "a": "T1562.001", "c": 0.800000011920929, "d": "EDR/Antivirus product name reference", "e": [ "McAfee VirusScan", "Software\\KasperskyLab\\AVP%d\\environment", "Kaspersky Anti-Virus", "SOFTWARE\\Sophos\\SweepNT", "Sophos Anti-Virus", "Norton AntiVirus", "SOFTWARE\\KasperskyLab\\Components\\101", "SOFTWARE\\KasperskyLab\\SetupFolders" ], "i": "objectives/impact/degrade/edr::edr-product-name", "l": 3 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1113", "c": 0.9399999976158142, "d": "Windows GDI active window capture primitives", "e": [ "CreateCompatibleBitmap", "BitBlt", "GetDC", "GetDesktopWindow", "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-window-capture-primitives", "l": 2, "m": "C0014" }, { "a": "T1036", "c": 0.8199999928474426, "d": "System tray icon manipulation", "e": [ "Shell_NotifyIconW" ], "i": "micro-behaviors/ui/window/notify::shell-notify-icon", "l": 3 }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "SuspendThread API reference", "e": [ "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime::suspend-thread", "l": 3 }, { "c": 0.9700000286102295, "d": "WinRAR self-extractor footprint", "e": [ "Software\\WinRAR SFX", "STARTDLG" ], "i": "metadata/binary/installer/sfx::winrar-sfx-footprint", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with many wide strings", "e": [ "binary.wide_string_count = 1739.00" ], "i": "objectives/anti-static/obfuscation/payload/section::heavy-wide-string-corpus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1029.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage::get-window-thread-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "winrar", "WinRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.800000011920929, "d": "Notify shell of file changes", "e": [ "SHChangeNotify" ], "i": "micro-behaviors/ui/window/notify::shell-change-notify", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "WinRAR.REV\\shell\\open\\command", "WinRAR\\shell\\open\\command", "WinRAR.ZIP\\shell\\open\\command", "Use \"Settings...\" command from the WinRAR \"Options\" menu for further customization." ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "a": "T1055.012", "c": 0.6000000238418579, "d": "ResumeThread call", "e": [ "ResumeThread" ], "i": "objectives/evasion/process/injection/hollowing::resume-thread", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2860.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "Data before JAR/ZIP header", "e": [ "50 4B 03 04", "50 4B 03 04" ], "i": "objectives/anti-static/polyglot/format::jar-polyglot-prefix", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "CreateFileW", "ReadFile", "DeviceIoControl", "CreateFileA" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 1.0, "d": "GetEnvironmentVariableW import", "e": [ "GetEnvironmentVariableW" ], "i": "well-known/malware/trojan/hijack-gen::get-environment-variable-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegOpenKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (C_specific_handler, beginthreadex, memset, memcmp, purecall, ... +11 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 1.0, "d": "Compatibility alias", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex-a", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.9399999976158142, "d": "Browser process targeting via snapshot", "e": [ "opera.exe", "chrome.exe", "iexplore" ], "i": "objectives/discovery/host/browser::browser-process-targeting", "l": 3 }, { "a": "T1562.001", "d": "Kaspersky reference", "e": [ "SOFTWARE\\KasperskyLab\\SetupFolders", "Kaspersky Anti-Virus", "Software\\KasperskyLab\\AVP%d\\environment", "SOFTWARE\\KasperskyLab\\Components\\101" ], "i": "objectives/impact/degrade/edr::kaspersky-name", "l": 1 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1027.002", "c": 0.800000011920929, "d": "Entry point in non-standard section", "e": [ "AUTO (size: 60928, entropy: 6.65, perms: r-x)" ], "i": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section", "l": 1, "m": "F0001" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.90" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b9", "b8", "b8", "b9", "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 2.79" ], "i": "metadata/binary/metrics::section-exceeds-file-size", "l": 1 }, { "c": 0.75, "d": "RAR extract instruction", "e": [ "extract contents of RAR" ], "i": "objectives/lateral-movement/social-engineering/lures::extract-rar-archive", "l": 1 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.9300000071525574, "d": "Storm iexplore target name", "e": [ "iexplore.exe" ], "i": "well-known/malware/trojan/elex/storm::storm-iexplore-name", "l": 1 }, { "c": 0.8600000143051147, "d": "Extremely large average function size", "e": [ "binary.avg_function_size = 44004.00" ], "i": "metadata/binary/metrics::giant-average-function", "l": 1 }, { "a": "T1112", "c": 0.6499999761581421, "d": "Windows runas verb token", "e": [ "runas" ], "i": "objectives/impact/degrade/system::runas-verb-token", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 2 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz", "xz", "xz", "xz" ], "i": "micro-behaviors/dylib/library::xz-ref", "l": 2 }, { "c": 1.0, "d": ".bat extension", "e": [ ".bat" ], "i": "objectives/command-and-control/dropper/builder::bat-ext", "l": 1 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "SetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-setpixel", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to thread (Unicode)", "e": [ "PostThreadMessageW" ], "i": "micro-behaviors/os/message/queue::post-thread-message-w", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "COMBOBOX", "LMNOOOOOOPA", "BCDEFGHIJK", "UUUUUUPU" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueW", "OpenProcessToken", "AdjustTokenPrivileges" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get file information and icon", "e": [ "SHGetFileInfoW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-file-info", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query volume information", "e": [ "GetVolumeInformationA" ], "i": "micro-behaviors/fs/enumerate/volume::get-volume-info", "l": 3 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "d": "password keyword", "e": [ "Passwords" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory compare", "e": [ "memcmp" ], "i": "micro-behaviors/mem/c-runtime/functions::memcmp", "l": 2 }, { "c": 0.699999988079071, "d": "Find window by class/title", "e": [ "FindWindowExW" ], "i": "micro-behaviors/ui/window/manage::find-window-ex", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ ".lnk" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "c": 0.949999988079071, "d": "COM unload export present", "e": [ "DllCanUnloadNow" ], "i": "metadata/binary/symbols::export-dll-can-unload-now", "l": 1 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 1.0, "d": "Call to GetDriveTypeA by raw bytes", "e": [ "GetDriveTypeA" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type-raw", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "binary.file_size = 1305088.00" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 150", "e": [ "ORDINAL 150" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-150", "l": 1, "m": "B0025" }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp", ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.75, "d": "Query active window title length", "e": [ "GetWindowTextLengthW" ], "i": "micro-behaviors/ui/window/manage::get-window-text-length", "l": 2 }, { "a": "T1083", "c": 0.8799999952316284, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives-text", "l": 3, "m": "E1083" }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.949999988079071, "d": "links USER32.dll (OemToCharA, CharUpperW, CharLowerW, OemToCharBuffA, LoadStringW, ... +27 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8500000238418579, "d": "runas elevation verb", "e": [ "runas" ], "i": "objectives/privilege-escalation/token-manipulation::runas-word", "l": 1 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll mouse cursor position", "e": [ "GetCursorPos" ], "i": "micro-behaviors/hardware/input/keyboard::get-cursor-pos", "l": 2, "m": "E1056.001" }, { "c": 0.8999999761581421, "d": "RAR member contains shell script", "e": [ ".bat" ], "i": "micro-behaviors/data/archive/rar::shell-script-member-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 377.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.800000011920929, "d": "Standalone SHA256 hash string in binary", "e": [ "70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434", "a538f494a2afdb0ca5c008d34100dc71cb684672c0c511da8d95d38642fc2360" ], "i": "metadata/binary/anomaly::embedded-sha256-token", "l": 3 }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "d": ".bat extension reference", "e": [ ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "a": "T1036.005", "c": 0.9599999785423279, "d": "Unsigned PE claims WinRAR version identity", "e": [ "WinRAR archiver", "Copyright © Alexander Roshal 1993-2013", "Alexander Roshal" ], "i": "objectives/evasion/masquerade/version-resource::fake-winrar-version-resource", "l": 4 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "78 01 02 10", "48 01 02 10", "70 01 02 10", "54 01 02 10", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathW", "MoveFileExW" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI DIB section creation for BMP capture", "e": [ "CreateDIBSection" ], "i": "micro-behaviors/hardware/display/screen::create-dib-section", "l": 2, "m": "C0014" }, { "d": "PATH environment variable", "e": [ "PATH" ], "i": "micro-behaviors/os/env/vars::path-var", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 2.79" ], "i": "objectives/anti-static/obfuscation/payload::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.699999988079071, "d": "GetConsoleScreenBufferInfo API", "e": [ "GetConsoleScreenBufferInfo" ], "i": "micro-behaviors/os/sysinfo/console::console-screen-buffer-info", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 237568.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 165.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1567", "c": 1.0, "d": "Recursive sync transfer flags", "e": [ "--recursive" ], "i": "objectives/exfiltration/cloud/sync-tool::sync-recursive-flags", "l": 1 }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "DestroyPropertySheetPage", "CreatePropertySheetPageW", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "GetModuleFileNameW", "GetCurrentDirectoryW", "GetCurrentProcessId", "SystemTimeToFileTime", "FileTimeToSystemTime", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.7799999713897705, "d": "Register custom clipboard format", "e": [ "RegisterClipboardFormatW" ], "i": "micro-behaviors/os/clipboard/access::register-clipboard-format-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyA" ], "i": "micro-behaviors/os/registry/access::reg-create-key-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\RarExt\\build\\32\\Release\\rarext.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "c": 0.8500000238418579, "d": "Semaphore coordination with wait logic", "e": [ "WaitForMultipleObjects", "CreateSemaphoreW", "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::coordinated-semaphore-wait", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 141.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.6600000262260437, "d": "Copy files", "e": [ "CopyFileW" ], "i": "micro-behaviors/fs/file/copy::copyfile-w", "l": 3 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-file-operation", "l": 3 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 76.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage::enum-windows", "l": 2 }, { "a": "T1057", "d": "Browser app opera", "e": [ "opera.exe" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-opera-brave", "l": 2, "m": "E1592" }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "UnmapViewOfFile", "GetModuleFileNameW", "WriteFile", "ShellExecuteExW", "GetModuleFileNameA" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 0.8399999737739563, "d": "Split string reconstruction", "e": [ "split" ], "i": "micro-behaviors/process/create/shell/lang::split-string-call", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "binary.import_count = 419.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "a": "T1059.003", "c": 0.8999999761581421, "d": "ShellExecuteExA ANSI extended API", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/system::shell-execute-ex-a", "l": 3, "m": "E1059.003" }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1057", "d": "Browser app safari", "e": [ "safari.exe" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-safari", "l": 2, "m": "E1592" }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "08 00 bd 37", "03 00 01 04", "08 00 10 99", "04 00 b0 d8", "0a 00 60 0c" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteExW, DragQueryFileW, SHGetPathFromIDListW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": ".cab extension used as infection backup", "e": [ ".cab" ], "i": "micro-behaviors/fs/file/copy::cab-extension-infection", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Modify PE resources via UpdateResourceW", "e": [ "UpdateResourceW" ], "i": "micro-behaviors/fs/file/write::update-resource-w", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Has file operation capabilities", "e": [ "FindFirstFileW", "MoveFileExW" ], "i": "objectives/impact/ransom/file-operations::has-file-operations", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 377.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 1305088.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "a": "T1083", "c": 0.8600000143051147, "d": "Drive context switching via cwd APIs", "e": [ "GetDriveTypeA", "GetCurrentDirectoryA", "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::drive-context-switching", "l": 3 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "SUVWATAUAWH", "SUVWATAUAVAW", "SVWATAUAVAWH", "WATAUAVAWH", "VWATAUAVH", "SUVWATAUAVH", "UVWATAUAVAW", "VWATAUAVAW", "CreateMutexW", "WATAUAVAW", "UVWATAUH", "VWATAUAW", "VWATAVAWH", "RENAMEDLG", "UVWATAUAVAWH", "VWATAUAV" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Enumerate child windows", "e": [ "EnumChildWindows" ], "i": "micro-behaviors/ui/window/manage::enum-child-windows-import", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "a": "T1497.003", "c": 0.9100000262260437, "d": "Timer-gated key polling anti-analysis", "e": [ "KillTimer", "GetProcAddress", "SetTimer", "GetKeyState" ], "i": "objectives/anti-analysis/timing/evasion::ui-timer-keypoll-gate", "l": 2, "m": "B0003.003" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "Sleep", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.75, "d": "Find window by class/title (Wide)", "e": [ "FindWindowW" ], "i": "micro-behaviors/ui/window/manage::find-window-w-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegCreateKeyExW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "a": "T1091", "c": 0.8600000143051147, "d": "VB6 disk free space check GetDiskFreeSpaceExW", "e": [ "GetDiskFreeSpaceExW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-disk-free-space", "l": 1, "m": "B0017" }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Avast service reference (binaries)", "e": [ "Avast.exe" ], "i": "objectives/impact/degrade/edr::avast-service-bin", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives", "l": 3, "m": "E1083" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "WinRAR archiver FileDescription string", "e": [ "WinRAR archiver" ], "i": "objectives/evasion/masquerade/version-resource::winrar-archiver-filedesc", "l": 1 }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.25.19:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1529", "c": 0.9399999976158142, "d": "Privilege-enabled reboot API use", "e": [ "LookupPrivilegeValueW", "AdjustTokenPrivileges", "ExitWindowsEx", "SeShutdownPrivilege" ], "i": "objectives/impact/system/shutdown::shutdown-privilege-reboot-api", "l": 3, "m": "B0029" }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Split Protect API fragment", "e": [ "Protect" ], "i": "objectives/evasion/process/injection::split-protect-api-fragment", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "NtCurrentProcess handle (-1) for NT API call", "e": [ "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::nt-current-process-handle", "l": 1, "m": "F0004" }, { "c": 0.75, "d": "Open clipboard access", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.800000011920929, "d": "Commit PE resource modifications", "e": [ "EndUpdateResourceW" ], "i": "micro-behaviors/data/embedded/payload::end-update-resource-w", "l": 3 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Generate cryptographic random bytes", "e": [ "CryptGenRandom" ], "i": "micro-behaviors/os/random/generator::crypt-gen-random", "l": 2, "m": "C0027" }, { "c": 0.949999988079071, "d": "Enumerate resource names (callback trigger)", "e": [ "EnumResourceNamesW" ], "i": "micro-behaviors/os/callback/enum::enum-resource-names", "l": 3 }, { "c": 0.699999988079071, "d": "Add masked image", "e": [ "ImageList_AddMasked" ], "i": "micro-behaviors/ui/controls/widget::image-list-add-masked", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteW)", "e": [ "ShellExecuteW" ], "i": "micro-behaviors/process/create/exec::shell-execute", "l": 3 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is enabled", "e": [ "IsWindowEnabled" ], "i": "micro-behaviors/ui/window/manage::is-window-enabled", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat", ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 551.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "Open SFX archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "c": 0.9800000190734863, "d": "WinRAR SFX registry key", "e": [ "Software\\WinRAR SFX" ], "i": "metadata/binary/installer/sfx::registry-key", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 178176.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.30000001192092896, "d": "lzma compression reference", "e": [ "LZMA" ], "i": "micro-behaviors/dylib/library::lzma-ref", "l": 2 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.699999988079071, "d": "Create modeless dialog", "e": [ "CreateDialogParamW" ], "i": "micro-behaviors/ui/dialog/prompt::create-dialog-param", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window (Unicode)", "e": [ "PostMessageW" ], "i": "micro-behaviors/os/message/queue::post-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.8199999928474426, "d": "LLM secret data target", "e": [ "secret" ], "i": "micro-behaviors/data/text/llm::llm-secret-target", "l": 1 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "16.48.1.28:5298", "20.48.140.107:6322" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.6499999761581421, "d": "Close clipboard", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Initialize COM apartment model", "e": [ "CoInitializeEx" ], "i": "micro-behaviors/os/com/invoke::co-initialize-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cbr\u003e", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e", "\u003c/html\u003e", "utf-8\"\u003e\u003c/head\u003e", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=", "\u003chtml\u003e", "\u003c/style\u003e", "\u003cstyle\u003e", "\u003c/p\u003e", "E\u003cul\u003e\u003cli\u003ePress \u003cb\u003eInstall\u003c/b\u003e button to start extraction.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003eE\u003cul\u003e\u003cli\u003ePress \u003cb\u003eExtract\u003c/b\u003e ...", "manually.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003e8\u003cli\u003eIf the destination folder does not exist, it will be", "2created automatically before extraction.\u003c/li\u003e\u003c/ul\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "MoveToEx" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with low average complexity", "e": [ "binary.file_size = 1305088.00", "binary.function_count = 2923.00", "binary.string_count = 2860.00", "binary.overall_entropy = 4.73", "binary.avg_complexity = 14.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-binary-low-average-complexity", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "a": "T1036.005", "c": 0.800000011920929, "d": "explorer.exe process name", "e": [ "explorer.exe" ], "i": "objectives/evasion/masquerade/process::explorer-name", "l": 1, "m": "F0004" }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "FillConsoleOutputAttribute junk API import", "e": [ "FillConsoleOutputAttribute" ], "i": "objectives/anti-static/obfuscation/imports::fill-console-output-attribute-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.90" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (SHAutoComplete)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "d": ".msi extension reference", "e": [ ".msi" ], "i": "micro-behaviors/fs/path/extension::msi", "l": 2 }, { "c": 0.949999988079071, "d": "links COMDLG32.dll (GetOpenFileNameW, CommDlgExtendedError, GetSaveFileNameW)", "e": [ "COMDLG32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "a": "T1562.001", "d": "McAfee reference", "e": [ "McAfee VirusScan" ], "i": "objectives/impact/degrade/edr::mcafee-name", "l": 1 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll virtual key state", "e": [ "GetKeyState" ], "i": "micro-behaviors/hardware/input/keyboard::get-key-state", "l": 2, "m": "E1056.001" }, { "a": "T1010", "c": 0.8500000238418579, "d": "Process discovery via window enumeration", "e": [ "GetWindowThreadProcessId", "GetWindowTextW", "EnumWindows", "EnumChildWindows" ], "i": "objectives/discovery/process/window::window-process-discovery", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.04" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "a": "T1543.003", "c": 0.8600000143051147, "d": "Services registry key fragment", "e": [ "SYSTEM\\CurrentControlSet\\Services\\avgntflt" ], "i": "objectives/persistence/system/service/install::service-registry-key-fragment", "l": 1, "m": "B0011.003" }, { "a": "T1057", "d": "Browser app iexplore", "e": [ "iexplore" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-iexplore", "l": 3, "m": "E1592" }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.overall_entropy = 4.55", "binary.function_count = 1029.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "c": 0.8999999761581421, "d": "Release cryptographic context", "e": [ "CryptReleaseContext" ], "i": "micro-behaviors/crypto/library::crypt-release-context", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.64)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.7200000286102295, "d": "WININIT rename section marker", "e": [ "Rename" ], "i": "micro-behaviors/fs/config/system::wininit-rename-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsSetValue", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "binary.sentence_string_ratio = 0.37", "binary.import_count = 120.00", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "binary.function_count = 381.00" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "a": "T1566", "c": 0.8500000238418579, "d": "Cordova config allows external domain origin", "e": [ "http://www.rarlab.com/" ], "i": "objectives/credential-access/phishing/workflow::cordova-external-origin", "l": 1 }, { "c": 1.0, "d": "RAR v4 archive magic", "e": [ "52 61 72 21 1A 07 00" ], "i": "metadata/file/magic::rar-v4", "l": 2 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Windows executable filename in bytecode", "e": [ "Rar.exe" ], "i": "objectives/command-and-control/dropper/delivery/download::windows-exe-temp-staging", "l": 1, "m": "E1105" }, { "c": 0.6000000238418579, "d": "LICENSE file reference", "e": [ "LICENSE" ], "i": "metadata/package/license::license-upper", "l": 2 }, { "c": 0.9599999785423279, "d": "PE overlay exceeds 1 MiB", "e": [ "binary.overlay_size = 1688158.00" ], "i": "metadata/binary/layout::overlay-over-1mb", "l": 2 }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "jb\fwZ" ], "i": "micro-behaviors/crypto/symmetric/xor::asm-loop-control-transfer", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.09" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.9599999785423279, "d": "Overlay size at least 1 MiB", "e": [ "binary.overlay_size = 1688158.00" ], "i": "metadata/binary/layout::large-overlay-1mb", "l": 2 }, { "c": 0.8799999952316284, "d": "High entropy resource section (encrypted payload)", "e": [ "pe.rsrc_entropy = 6.69" ], "i": "well-known/malware/trojan/shellobject::xll-high-rsrc-entropy", "l": 1 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.87" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 1688158.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 2 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 1688158.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded external IPv4 address", "e": [ "23.22.3.2" ], "i": "micro-behaviors/communications/ip::encoded-external-ipv4-binary", "l": 2 }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.87" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1027.009", "c": 0.699999988079071, "d": "Large overlay relative to file", "e": [ "binary.overlay_ratio = 0.87" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay", "l": 2, "m": "B0032" }, { "a": "T1105", "c": 0.9599999785423279, "d": "Large overlay bundle component", "e": [ "binary.overlay_size = 1688158.00" ], "i": "objectives/command-and-control/dropper/execution/installer::large-overlay-bundle", "l": 1, "m": "B0022" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 1688158.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Large PE with four standard sections", "e": [ "WinRAR.exe", "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::large-four-section-pe", "l": 3 }, { "c": 0.75, "d": "Worker threads with synchronization", "e": [ "VirtualAlloc", "RtlCaptureContext", "CreateThread" ], "i": "micro-behaviors/process/threading/async::worker-pool-comp", "l": 2 }, { "c": 0.800000011920929, "d": "Thread synchronization via message queue", "e": [ "PeekMessageA", "CreateThread" ], "i": "micro-behaviors/process/threading/async::thread-message-sync", "l": 2 }, { "a": "T1070.004", "c": 0.949999988079071, "d": "Launches COMSPEC to delete own short path", "e": [ "COMSPEC", "ShellExecuteExA", "GetModuleFileNameW", "GetShortPathNameW", "GetModuleFileNameA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::comspec-shortpath-self-delete", "l": 4, "m": "F0007" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1497.001", "c": 0.75, "d": "Console environment detection checks", "e": [ "WriteConsoleW", "GetConsoleScreenBufferInfo" ], "i": "objectives/anti-analysis/environment-detect/runtime::console-environment-detection", "l": 1, "m": "B0001" }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI screen capture via DIB section (BMP format)", "e": [ "CreateDIBSection", "BitBlt" ], "i": "objectives/collection/screenshot/capture::gdi-dib-capture", "l": 2, "m": "C0014" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Large high-entropy overlay", "e": [ "binary.overlay_size = 1688158.00", "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-entropy-overlay", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "High-entropy overlay with large resource section", "e": [ "binary.overlay_entropy = 8.00", "binary.has_overlay = 1.00", ".rsrc (size: 212992)", "binary.overall_entropy = 4.90" ], "i": "objectives/anti-static/obfuscation/binary-metrics::highly-entropic-overlay-large-rsrc-low-entropy", "l": 3 }, { "a": "T1105", "c": 0.9399999976158142, "d": "Elevated COM dropper profile with anti-analysis", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator", "GetDesktopWindow", "CoCreateInstance", "IsDebuggerPresent", "CreateProcessW", "OleInitialize" ], "i": "objectives/command-and-control/dropper/execution/masquerade-loader::elevated-com-dropper-profile", "l": 4, "m": "B0024" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "ReadFile", "GetModuleFileNameA", "CreateFileA", "CreateFileW", "binary.has_overlay = 1.00", "GetFileSize" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 3, "m": "B0032" }, { "a": "T1105", "c": 0.949999988079071, "d": "Temp staged file copy with shell handoff", "e": [ "GetTempPathW", "MoveFileW", "GetModuleFileNameW", "ShellExecuteA", "CopyFileW", "GetModuleFileNameA", "MoveFileExW" ], "i": "objectives/command-and-control/dropper/execution/loader::temp-copy-shell-handoff", "l": 4, "m": "B0024" }, { "c": 0.8999999761581421, "d": "PE DLL uses EXE filename", "e": [ "binary.export_count = 0.00", "Uninstall.exe", "pe.characteristics = 8226.00" ], "i": "objectives/evasion/masquerade/file::pe-dll-named-exe", "l": 2 }, { "c": 0.8999999761581421, "d": "Trojanized system utility or hardware monitor dropper", "e": [ "binary.has_overlay = 1.00", "winrar", "WinRAR" ], "i": "objectives/supply-chain/trojanized/application/monitor::trojanized-system-utility-dropper", "l": 4 }, { "a": "T1027.009", "c": 0.8799999952316284, "d": "PE reads own overlay to extract encrypted payload", "e": [ "binary.overlay_ratio = 0.87", "binary.overlay_size = 1688158.00", "GetFileSize", "CreateFileA", "binary.has_overlay = 1.00", "binary.overlay_entropy = 8.00", "GetModuleFileNameA", "CreateFileW", "ReadFile" ], "i": "objectives/anti-static/obfuscation/payload/self-read::pe-overlay-self-extractor", "l": 4, "m": "B0032" } ], "sha": "03ccdc44982eb7cc3b64951c8ae287c5f79ee4edb8d61b0b084eeca84011264e", "path": "64301", "type": "pe" }, { "f": "KO₇(Er₈AlAs₇C₂Co₂I₃P₃)H₇(F₄OsPo₃CmDbDsMg)Md₃(Bi₃Pa)", "x": 53, "dp": 1, "id": 1, "is": [ "CreateDirectoryW", "FindClose", "FindNextFileW", "FindFirstFileW", "GetModuleFileNameW", "GetVersionExW", "GetCurrentDirectoryW", "FindResourceW", "FreeLibrary", "ExpandEnvironmentStringsW", "LoadLibraryW", "LoadLibraryExW", "GetProcAddress", "GetCurrentProcessId", "GetModuleHandleW", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "CopyFileW", "GetEnvironmentVariableW", "CreateProcessW", "GetTempPathW", "MoveFileExW", "RemoveDirectoryW", "SetCurrentDirectoryW", "Sleep", "GetCommandLineW", "GetShortPathNameW", "GetLocaleInfoA", "GetStringTypeW", "GetStringTypeA", "WriteConsoleW", "GetConsoleOutputCP", "WriteConsoleA", "SetStdHandle", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "GetTickCount", "QueryPerformanceCounter", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "DeleteCriticalSection", "SetHandleCount", "LCMapStringW", "LCMapStringA", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "GetConsoleMode", "GetConsoleCP", "ExitProcess", "HeapSize", "FlsAlloc", "GetCurrentThreadId", "FlsFree", "FlsSetValue", "FlsGetValue", "HeapCreate", "DeleteFileW", "MoveFileW", "SetFileAttributesW", "GetFileAttributesW", "ReadFile", "GetFileType", "SetEndOfFile", "SetFilePointer", "GetStdHandle", "FlushFileBuffers", "WriteFile", "CloseHandle", "CreateFileW", "SetLastError", "GetLastError", "CreateFileA", "GetProcessHeap", "HeapSetInformation", "RtlCaptureContext", "RtlLookupFunctionEntry", "RtlVirtualUnwind", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "DecodePointer", "EncodePointer", "LeaveCriticalSection", "EnterCriticalSection", "RaiseException", "RtlPcToFileHeader", "HeapFree", "HeapReAlloc", "HeapAlloc", "GetSystemTimeAsFileTime", "GetCommandLineA", "GetStartupInfoA", "TerminateProcess", "GetCurrentProcess", "RtlUnwindEx", "GetWindowLongPtrW", "EnableWindow", "GetDlgItem", "ShowWindow", "GetDC", "ReleaseDC", "LoadIconW", "SetForegroundWindow", "GetSysColor", "MessageBoxW", "SendDlgItemMessageW", "SetDlgItemTextW", "CharUpperW", "LoadStringW", "GetWindowRect", "GetClientRect", "SetWindowPos", "GetWindowTextW", "SetWindowTextW", "GetSystemMetrics", "GetWindow", "GetClassNameW", "GetWindowLongW", "SetWindowLongW", "DialogBoxParamW", "EndDialog", "CheckDlgButton", "IsDlgButtonChecked", "GetParent", "SendMessageW", "InvalidateRect", "CreateFontW", "DeleteObject", "GetDeviceCaps", "RegSetValueExW", "RegCreateKeyExW", "RegDeleteValueW", "RegEnumKeyExW", "RegDeleteKeyW", "RegOpenKeyExW", "RegQueryValueExW", "RegCloseKey", "ShellExecuteW", "SHChangeNotify", "SHFileOperationW", "SHGetMalloc", "SHGetSpecialFolderLocation", "SHGetPathFromIDListW", "CoCreateInstance", "OleInitialize", "OleUninitialize" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\uninstall\\build\\uninstall64\\Release\\uninstall.pdb", "rsrc_size": 25088.0, "subsystem": 2.0, "timestamp": 1368556034.0, "icon_count": 2.0, "image_base": 5368709120.0, "rsrc_entropy": 5.15, "entry_section": ".text", "size_of_image": 188416.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2013.0, "characteristics": 34.0, "entry_point_rva": 42236.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 6.0, "manifest_present": true, "computed_checksum": 157860.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556034.0, "debug_timestamp_min": 1368556034.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 9.0, "version_info_present": true, "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 79872.0, "file_size": 142336.0, "entry_point": 42236.0, "code_entropy": 6.35, "data_entropy": 3.96, "import_count": 153.0, "string_count": 635.0, "section_count": 6.0, "avg_complexity": 14.0, "function_count": 322.0, "import_density": 1.96, "max_complexity": 14.0, "string_density": 8.14, "overall_entropy": 4.37, "avg_basic_blocks": 31.0, "avg_section_size": 23552.0, "dependency_count": 6.0, "entropy_variance": 1.42, "function_density": 4.13, "avg_function_size": 494.0, "avg_string_length": 20.99, "complexity_per_kb": 0.18, "max_string_length": 265.0, "wide_string_count": 229.0, "writable_sections": 1.0, "avg_string_entropy": 3.19, "code_to_data_ratio": 1.3, "data_to_file_ratio": 0.04, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.18, "text_to_file_ratio": 0.56, "total_basic_blocks": 31.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 25.36, "debug_reference_count": 1.0, "largest_section_ratio": 0.56, "sentence_string_count": 117.0, "sentence_string_ratio": 0.18, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 695, "@.reloc" ], [ 2160, "@SUVWATAUAV" ], [ 3277, "x ATAUAVH" ], [ 8635, "WATAUH" ], [ 8946, "VWATAUAWH" ], [ 9435, "WATAUAVAWH" ], [ 9861, "UVWATAUAVAW" ], [ 11938, "WATAUAVAW" ], [ 15728, "f93t" ], [ 15786, "f99u" ], [ 16118, "/tYH" ], [ 16369, "C E3" ], [ 16393, "UVWH" ], [ 20678, "\\$ UVWATAUAVAW" ], [ 25919, "WATAU" ], [ 32027, "ATAUAVH" ], [ 33144, "t$ WATAUAVAWH" ], [ 40829, "UVWATAUAVAWH" ], [ 49439, "AUAVAWH" ], [ 53465, "UVWATAUH" ], [ 55544, "@UATAUAVAWH" ], [ 69705, "VWATH" ], [ 70806, "VWATAUAVH" ], [ 71734, "L$ UATAUAVAWH" ], [ 73516, "@USVWATAUAVAWH" ], [ 74134, "M0H3" ], [ 74361, "SUVWATAUAVAWH" ], [ 74824, "D09A" ], [ 75952, "D19K" ], [ 77921, "x ATAUAWH" ], [ 82416, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 82520, "bad allocation" ], [ 82544, "wide", ".z.taz" ], [ 82560, "wide", ".iso" ], [ 82576, "wide", ".jar" ], [ 82632, "wide", ".uue.xxe.uu" ], [ 82656, "wide", ".gz.tgz" ], [ 82672, "wide", ".tar" ], [ 82696, "wide", ".ace" ], [ 82712, "wide", ".lzh.lha" ], [ 82736, "wide", ".arj" ], [ 82752, "wide", ".cab" ], [ 82768, "wide", ".zip" ], [ 82784, "wide", ".rar" ], [ 82800, "wide", "MenuIcons" ], [ 82824, "wide", "CascadedMenu" ], [ 82856, "wide", "ShellExt" ], [ 82880, "wide", "Setup" ], [ 82896, "wide", "Programs" ], [ 82920, "wide", "StartMenu" ], [ 82944, "wide", "Desktop" ], [ 82960, "wide", "Setup\\Links" ], [ 83352, "wide", "Path" ], [ 83368, "wide", "Software\\WinRAR" ], [ 83400, "wide", "exe64" ], [ 83424, "wide", "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WinRAR.exe" ], [ 83560, "wide", "WinRAR.exe" ], [ 83584, "wide", "Directory\\shellex\\DragDropHandlers\\%s" ], [ 83664, "wide", "Directory\\shellex\\ContextMenuHandlers\\%s" ], [ 83760, "wide", "Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved" ], [ 83896, "wide", "WinRAR shell extension" ], [ 83952, "wide", "Drive\\shellex\\DragDropHandlers\\%s" ], [ 84032, "wide", "Folder\\shellex\\DragDropHandlers\\%s" ], [ 84112, "wide", "Folder\\shellex\\ContextMenuHandlers\\%s" ], [ 84192, "wide", "*\\shellex\\ContextMenuHandlers\\%s" ], [ 84264, "wide", "WinRAR.ZIP\\shellex\\DropHandler" ], [ 84328, "wide", "WinRAR\\shellex\\DropHandler" ], [ 84384, "wide", "exefile\\shellex\\PropertySheetHandlers\\%s" ], [ 84480, "wide", "WinRAR.ZIP\\shellex\\PropertySheetHandlers\\%s" ], [ 84576, "wide", "WinRAR.ZIP\\shellex\\ContextMenuHandlers\\%s" ], [ 84672, "wide", "WinRAR\\shellex\\PropertySheetHandlers\\%s" ], [ 84752, "wide", "WinRAR\\shellex\\ContextMenuHandlers\\%s" ], [ 84832, "wide", "ThreadingModel" ], [ 84864, "wide", "Apartment" ], [ 84888, "wide", "CLSID\\%s\\InProcServer32" ], [ 84976, "wide", "WinRAR.ZIP" ], [ 85000, "wide", "Setup\\MenuItems" ], [ 85032, "wide", "SETUPCONTEXTITEMS" ], [ 85072, "wide", "HELPContextItems" ], [ 85128, "wide", "ExtrHere" ], [ 85152, "wide", "Extr" ], [ 85168, "wide", "ExtrSep" ], [ 85184, "wide", "OpenSFX" ], [ 85232, "wide", "EmailArc" ], [ 85256, "wide", "EmailOpt" ], [ 85280, "wide", "Test" ], [ 85296, "wide", "Convert" ], [ 85312, "wide", "SFXLocal" ], [ 85336, "wide", "SFXNetwork" ], [ 85360, "wide", "SFXOther" ], [ 85408, "wide", ".lzh" ], [ 85432, "wide", ".uue" ], [ 85472, "wide", "Software\\WinRAR\\Capabilities\\FileAssociations" ], [ 85568, "wide", "ApplicationDescription" ], [ 85616, "wide", "Software\\WinRAR\\Capabilities" ], [ 85680, "wide", "Software\\RegisteredApplications" ], [ 85744, "wide", "rarext.dll" ], [ 85776, "wide", "{B41DB860-64E4-11D2-9906-E49FADC173CA}" ], [ 85856, "wide", "rarext32.dll" ], [ 85888, "wide", "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" ], [ 85992, "wide", ".lnk" ], [ 86008, "wide", "WinRAR.lnk" ], [ 86032, "wide", "WinRAR.chm" ], [ 86056, "wide", "Rar.txt" ], [ 86072, "wide", "WhatsNew.txt" ], [ 86112, "wide", "zipnew.dat" ], [ 86136, "wide", "rarnew.dat" ], [ 86176, "wide", "ShellNew" ], [ 86200, "wide", "Content" ], [ 86216, "wide", "Type" ], [ 86232, "wide", "Exist" ], [ 86248, "wide", "NullFile" ], [ 86272, "wide", "FileName" ], [ 86296, "wide", "Content Type" ], [ 86328, "wide", "%s\\ShellNew" ], [ 86352, "wide", "WinRAR.REV\\DefaultIcon" ], [ 86400, "wide", "WinRAR.REV\\shell\\open\\command" ], [ 86464, "wide", ".rev" ], [ 86480, "wide", "WinRAR.REV" ], [ 86504, "wide", "WinRAR.ZIP\\DefaultIcon" ], [ 86552, "wide", "WinRAR.ZIP\\shell\\open\\command" ], [ 86616, "wide", "WinRAR\\DefaultIcon" ], [ 86656, "wide", "WinRAR\\shell\\open\\command" ], [ 86800, "wide", "%d.%02d" ], [ 86824, "wide", "AppData" ], [ 86840, "wide", "Software\\WinRAR\\Paths" ], [ 86928, "wide", "Software\\WinRAR%s%s" ], [ 86968, "wide", "*messages***" ], [ 87000, "*messages***" ], [ 87056, "wide", "COMBOBOX" ], [ 87080, "wide", "LanguageFolder" ], [ 87112, "wide", "Software\\WinRAR\\General" ], [ 87160, "wide", "rarlng.dll" ], [ 87184, "SetDllDirectoryW" ], [ 87208, "wide", "kernel32" ], [ 87232, "wide", "rarreg.key" ], [ 87256, "wide", "order.htm" ], [ 87280, "wide", "license.txt" ], [ 87304, "wide", "open" ], [ 87320, "wide", "DONEDLG" ], [ 87336, "wide", "Interface\\Misc" ], [ 87368, "wide", "RemShown" ], [ 87392, "wide", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WinRAR.exe" ], [ 87520, "wide", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinRAR archiver" ], [ 87656, "wide", "rarreg.txt" ], [ 87680, "wide", "sfxname" ], [ 87696, "wide", "WinRAR\\RarExt64.dll.0.tmp" ], [ 87760, "wide", "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 87848, "wide", "ProgramFilesDir (x86)" ], [ 87896, "wide", "rarext64.dll" ], [ 87928, "wide", "exe32" ], [ 87944, "wide", "Publisher" ], [ 87968, "wide", "win.rar GmbH" ], [ 88000, "wide", "Language" ], [ 88024, "wide", "NoRepair" ], [ 88048, "wide", "NoModify" ], [ 88072, "wide", "InstallLocation" ], [ 88104, "wide", "DisplayIcon" ], [ 88128, "wide", "UninstallString" ], [ 88160, "wide", "VersionMinor" ], [ 88192, "wide", "VersionMajor" ], [ 88224, "wide", "DisplayVersion" ], [ 88280, "wide", "DisplayName" ], [ 88304, "wide", "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WinRAR archiver" ], [ 88440, "wide", "%s /c \"%s\"" ], [ 88464, "wide", "COMSPEC" ], [ 88680, "wide", "\"%s\" /wait" ], [ 88712, "wide", "Uninstall_Rar.Bat" ], [ 88752, "wide", "%s.%d.tmp" ], [ 88776, "wide", "Uninstall.lst" ], [ 88816, "wide", "winrar.gid" ], [ 88840, "wide", "winrar.fts" ], [ 88888, "wide", "SETUPDLG" ], [ 88912, "wide", "HELPIntegrationSettings" ], [ 88968, "wide", "warning" ], [ 88984, "wide", "wait" ], [ 89008, "wide", "setup" ], [ 89048, "wide", "MS Shell Dlg" ], [ 89080, "wide", "RARICON" ], [ 89096, "wide", "riched32.dll" ], [ 89128, "wide", "uninstall.lng" ], [ 89160, "wide", "%s::/html/%s.htm" ], [ 89200, "wide", "winrar.chm" ], [ 89240, "wide", "hhctrl.ocx" ], [ 89311, "Fcsm" ], [ 89432, "wide", "UTF-16LE" ], [ 89456, "wide", "UNICODE" ], [ 89472, "CorExitProcess" ], [ 89488, "wide", "mscoree.dll" ], [ 89512, "wide", "(null)" ], [ 89528, "(null)" ], [ 89577, "700WP" ], [ 89593, "`h````" ], [ 89632, "runtime error" ], [ 89656, "TLOSS error" ], [ 89672, "SING error" ], [ 89688, "DOMAIN error" ], [ 89712, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 89719, "An application has made an attempt to load the C runtime library incorrectly." ], [ 89797, "Please contact the application's support team for more information." ], [ 89872, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 89879, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 89959, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 90120, "R6032\r\n- not enough space for locale information" ], [ 90127, "- not enough space for locale information" ], [ 90176, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 90183, "- Attempt to initialize the CRT more than once." ], [ 90231, "This indicates a bug in your application." ], [ 90280, "R6030\r\n- CRT not initialized" ], [ 90287, "- CRT not initialized" ], [ 90312, "R6028\r\n- unable to initialize heap" ], [ 90319, "- unable to initialize heap" ], [ 90352, "R6027\r\n- not enough space for lowio initialization" ], [ 90359, "- not enough space for lowio initialization" ], [ 90408, "R6026\r\n- not enough space for stdio initialization" ], [ 90415, "- not enough space for stdio initialization" ], [ 90464, "R6025\r\n- pure virtual function call" ], [ 90471, "- pure virtual function call" ], [ 90504, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 90511, "- not enough space for _onexit/atexit table" ], [ 90560, "R6019\r\n- unable to open console device" ], [ 90567, "- unable to open console device" ], [ 90608, "R6018\r\n- unexpected heap error" ], [ 90615, "- unexpected heap error" ], [ 90648, "R6017\r\n- unexpected multithread lock error" ], [ 90655, "- unexpected multithread lock error" ], [ 90696, "R6016\r\n- not enough space for thread data" ], [ 90703, "- not enough space for thread data" ], [ 90752, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 90754, "This application has requested the Runtime to terminate it in an unusual way." ], [ 90904, "R6009\r\n- not enough space for environment" ], [ 90911, "- not enough space for environment" ], [ 90952, "R6008\r\n- not enough space for arguments" ], [ 90959, "- not enough space for arguments" ], [ 91000, "R6002\r\n- floating point support not loaded" ], [ 91007, "- floating point support not loaded" ], [ 91048, "Microsoft Visual C++ Runtime Library" ], [ 91096, "\u003cprogram name unknown\u003e" ], [ 91120, "Runtime Error!\n\nProgram:" ], [ 91183, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 91456, "Complete Object Locator'" ], [ 91488, "Class Hierarchy Descriptor'" ], [ 91520, "Base Class Array'" ], [ 91544, "Base Class Descriptor at (" ], [ 91576, "Type Descriptor'" ], [ 91600, "`local static thread guard'" ], [ 91632, "`managed vector copy constructor iterator'" ], [ 91680, "`vector vbase copy constructor iterator'" ], [ 91728, "`vector copy constructor iterator'" ], [ 91768, "`dynamic atexit destructor for '" ] ], "sz": 142336, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 322.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-file-operation", "l": 3 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat", ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "Add \u0026to \u003carchive name\u003e", "Compress to \u003carchive name\u003e and email" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 153.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 153.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp", ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\uninstall\\build\\uninstall64\\Release\\uninstall.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "GetEnvironmentVariableW import", "e": [ "GetEnvironmentVariableW" ], "i": "well-known/malware/trojan/hijack-gen::get-environment-variable-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556034.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1552.004", "d": "Generic key extension", "e": [ ".key" ], "i": "objectives/collection/file-targeting/filter::key-extension", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 153.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "WinRAR.REV\\shell\\open\\command", "WinRAR\\shell\\open\\command", "WinRAR.ZIP\\shell\\open\\command", "Use \"Settings...\" command from the WinRAR \"Options\" menu for further customization." ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.19" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ "WinRAR.lnk", ".lnk" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "uninstall.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 229.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "c": 0.800000011920929, "d": "Notify shell of file changes", "e": [ "SHChangeNotify" ], "i": "micro-behaviors/ui/window/notify::shell-change-notify", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "WinRAR archiver FileDescription string", "e": [ "WinRAR archiver" ], "i": "objectives/evasion/masquerade/version-resource::winrar-archiver-filedesc", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 142336.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 635.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.37" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b9", "b8", "b8", "b9", "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 153.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.25.19:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 153.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 153.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessW" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteW)", "e": [ "ShellExecuteW" ], "i": "micro-behaviors/process/create/exec::shell-execute", "l": 3 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.35)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "VWATAUAWH", "WATAUAVAWH", "UVWATAUAVAW", "WATAUAVAW", "UVWATAUAVAWH", "UVWATAUH", "VWATAUAVH", "COMBOBOX", "SETUPDLG", "UUUUUUPU" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Accesses ComSpec environment variable", "e": [ "COMSPEC" ], "i": "micro-behaviors/os/env/vars::comspec-env-var", "l": 2 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 188416.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "Uninstall.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 322.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 153.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 322.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 153.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.949999988079071, "d": ".cab extension used as infection backup", "e": [ ".cab" ], "i": "micro-behaviors/fs/file/copy::cab-extension-infection", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.37" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "Uninstall.exe" ], "i": "objectives/evasion/masquerade/file::basename-is-exe", "l": 1 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{B41DB860-64E4-11D2-9906-E49FADC173CA}", "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 322.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableW" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Registry blob wipe API", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 3, "m": "F0007" }, { "c": 0.6600000262260437, "d": "Copy files", "e": [ "CopyFileW" ], "i": "micro-behaviors/fs/file/copy::copyfile-w", "l": 3 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "11.48.25.38:3890" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "70 3b 01 00", "e2 3a 01 00", "c3 3a 01 00", "83 38 01 00", "22 36 01 00", "f3 34 01 00", "bc 34 01 00", "4e 25 01 00", "00 e2 00 00", "d8 dd 00 00", "01 35 00 00", "b4 32 00 00", "55 1d 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "ApplicationDescription", "RegisteredApplications", "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetModuleFileNameW", "GetCurrentDirectoryW", "GetCurrentProcessId", "WideCharToMultiByte", "MultiByteToWideChar", "GetEnvironmentVariableW", "SetCurrentDirectoryW", "GetSystemTimeAsFileTime", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links USER32.dll (GetWindowLongPtrW, EnableWindow, GetDlgItem, ShowWindow, GetDC, ... +26 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (CreateFontW, DeleteObject, GetDeviceCaps)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegSetValueExW, RegCreateKeyExW, RegDeleteValueW, RegEnumKeyExW, RegDeleteKeyW, ... +3 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateDirectoryW, FindClose, FindNextFileW, FindFirstFileW, GetModuleFileNameW, ... +97 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteW, SHChangeNotify, SHFileOperationW, SHGetMalloc, SHGetSpecialFolderLocation, ... +1 more)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, OleInitialize, OleUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.800000011920929, "d": "Has file operation capabilities", "e": [ "MoveFileExW", "FindFirstFileW" ], "i": "objectives/impact/ransom/file-operations::has-file-operations", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1129", "c": 0.9399999976158142, "d": "Self copy append and relaunch", "e": [ "CreateFileA", "CreateProcessW", "GetModuleFileNameW", "DeleteFileW", "GetTickCount", "GetModuleFileNameA", "CopyFileW", "CreateFileW", "SetFilePointer", "WriteFile" ], "i": "objectives/command-and-control/dropper/execution/loader::self-copy-relaunch-loader", "l": 2, "m": "B0030" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathW", "MoveFileExW" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "VS_VERSION_INFO", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "f3 34 01 00", "b4 32 00 00", "d8 dd 00 00", "83 38 01 00", "00 e2 00 00", "bc 34 01 00", "GetTickCount", "e2 3a 01 00", "01 35 00 00", "70 3b 01 00", "c3 3a 01 00", "55 1d 00 00", "22 36 01 00", "4e 25 01 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindClose", "FindNextFileW", "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 153.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsSetValue", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExW", "RegOpenKeyExW", "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1036.005", "c": 0.9599999785423279, "d": "Unsigned PE claims WinRAR version identity", "e": [ "WinRAR archiver", "Copyright © Alexander Roshal 1993-2013", "Alexander Roshal" ], "i": "objectives/evasion/masquerade/version-resource::fake-winrar-version-resource", "l": 4 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindNextFileW", "FindFirstFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "532ee4a9dc950909b454ca68a74af03247ac4f142a812c51e19ea15c74c9aad0", "path": "64301!!Uninstall.exe", "type": "pe" }, { "f": "KO₇(PrAl₂As₈C₂Er₇IXe)H₈(F₂Os₂Po₃CmCrDb₂DsMg)Md₃(Bi₄Pa)", "x": 12, "dp": 1, "id": 2, "is": [ "GetModuleHandleA", "CreateFileA", "CreateFileW", "SetFilePointer", "WriteFile", "CreateHardLinkA", "GetFullPathNameA", "GetFileAttributesA", "SetCurrentDirectoryA", "GetProcAddress", "GetFileSize", "ReadFile", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "GetSystemTimeAsFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "SetFileTime", "CreateDirectoryA", "GetCurrentProcess", "GetLastError", "GetCurrentDirectoryA", "CloseHandle", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "DeleteFileW", "HeapFree", "DeleteFileA", "HeapAlloc", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "SetLastError", "FlsAlloc", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "SetHandleCount", "GetStdHandle", "GetStartupInfoA", "DeleteCriticalSection", "RtlUnwindEx", "InitializeCriticalSectionAndSpinCount", "Sleep", "HeapSetInformation", "HeapCreate", "HeapDestroy", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "FlushFileBuffers", "GetModuleHandleW", "ExitProcess", "GetModuleFileNameA", "MultiByteToWideChar", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "HeapReAlloc", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "LoadLibraryA", "HeapSize", "SetEndOfFile", "GetProcessHeap", "LookupPrivilegeValueA", "AdjustTokenPrivileges", "OpenProcessToken" ], "ms": { "pe": { "machine": 34404.0, "checksum": 122479.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\bzip2\\build\\64\\Release\\bz2.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368556004.0, "image_base": 6442450944.0, "rsrc_entropy": 4.59, "entry_section": ".text", "size_of_image": 135168.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 31996.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368556004.0, "import_dll_count": 2.0, "manifest_present": true, "computed_checksum": 122479.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556004.0, "debug_timestamp_min": 1368556004.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 67584.0, "file_size": 93696.0, "entry_point": 31996.0, "code_entropy": 6.42, "data_entropy": 4.17, "export_count": 5.0, "import_count": 92.0, "string_count": 255.0, "section_count": 6.0, "avg_complexity": 6.29, "function_count": 238.0, "import_density": 1.39, "max_complexity": 16.0, "string_density": 3.86, "overall_entropy": 4.25, "avg_basic_blocks": 10.29, "avg_section_size": 15445.33, "dependency_count": 2.0, "entropy_variance": 1.56, "function_density": 3.61, "avg_function_size": 161.29, "avg_string_length": 23.36, "complexity_per_kb": 0.1, "max_string_length": 417.0, "wide_string_count": 21.0, "writable_sections": 1.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 2.69, "data_to_file_ratio": 0.08, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.72, "total_basic_blocks": 72.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 36.02, "debug_reference_count": 1.0, "largest_section_ratio": 0.72, "sentence_string_count": 47.0, "sentence_string_ratio": 0.18, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 695, "@.reloc" ], [ 3282, "VWATAUAV" ], [ 3810, "UVWATAU" ], [ 5270, "VWAT" ], [ 6513, "UVWH" ], [ 7732, "t$ WATAUAVAW" ], [ 9204, "t$ WATAUAVAWE3" ], [ 11952, "t$ WATAUAVAWH" ], [ 18365, "D9K4" ], [ 22127, "AUAVAWH" ], [ 24498, "WATAUH" ], [ 27502, "\\$ UVWATAUAVAWH" ], [ 29957, "UVWATAUH" ], [ 34743, "WATAUAVAWH" ], [ 39822, "\\$ UVWATAUAVAW" ], [ 42025, "VWATH" ], [ 42302, "VWATAUAWH" ], [ 44665, "SUVWATAUAVAWH" ], [ 45128, "D09A" ], [ 46256, "D19K" ], [ 47421, "x ATAUAVH" ], [ 49352, "@UATAUAVAWH" ], [ 50850, "L$ UATAUAVAWH" ], [ 54743, "UVWATAUAVAWH" ], [ 61927, "ATAUAVH" ], [ 63018, "VWATAUAVH" ], [ 63816, "@USVWATAUAVAWH" ], [ 64434, "M0H3" ], [ 65105, "x ATAUAWH" ], [ 69504, "SeCreateSymbolicLinkPrivilege" ], [ 69536, "CreateSymbolicLinkA" ], [ 69560, "kernel32.dll" ], [ 69576, "wide", ".out" ], [ 69592, "wide", ".tar" ], [ 69624, "wide", ".tbz" ], [ 69640, "wide", "tar.bz2" ], [ 69664, "bz2|bz|tbz|tbz2" ], [ 69700, "BZIP2" ], [ 69736, "'sparse file'" ], [ 69752, "././@LongLink" ], [ 69839, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 69960, "wide", "UTF-16LE" ], [ 69984, "wide", "UNICODE" ], [ 70032, "UTF-16LE" ], [ 70048, "UNICODE" ], [ 70056, "CorExitProcess" ], [ 70072, "wide", "mscoree.dll" ], [ 70096, "runtime error" ], [ 70120, "TLOSS error" ], [ 70136, "SING error" ], [ 70152, "DOMAIN error" ], [ 70176, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 70183, "An application has made an attempt to load the C runtime library incorrectly." ], [ 70261, "Please contact the application's support team for more information." ], [ 70336, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 70343, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 70423, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 70584, "R6032\r\n- not enough space for locale information" ], [ 70591, "- not enough space for locale information" ], [ 70640, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 70647, "- Attempt to initialize the CRT more than once." ], [ 70695, "This indicates a bug in your application." ], [ 70744, "R6030\r\n- CRT not initialized" ], [ 70751, "- CRT not initialized" ], [ 70776, "R6028\r\n- unable to initialize heap" ], [ 70783, "- unable to initialize heap" ], [ 70816, "R6027\r\n- not enough space for lowio initialization" ], [ 70823, "- not enough space for lowio initialization" ], [ 70872, "R6026\r\n- not enough space for stdio initialization" ], [ 70879, "- not enough space for stdio initialization" ], [ 70928, "R6025\r\n- pure virtual function call" ], [ 70935, "- pure virtual function call" ], [ 70968, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 70975, "- not enough space for _onexit/atexit table" ], [ 71024, "R6019\r\n- unable to open console device" ], [ 71031, "- unable to open console device" ], [ 71072, "R6018\r\n- unexpected heap error" ], [ 71079, "- unexpected heap error" ], [ 71112, "R6017\r\n- unexpected multithread lock error" ], [ 71119, "- unexpected multithread lock error" ], [ 71160, "R6016\r\n- not enough space for thread data" ], [ 71167, "- not enough space for thread data" ], [ 71216, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 71218, "This application has requested the Runtime to terminate it in an unusual way." ], [ 71368, "R6009\r\n- not enough space for environment" ], [ 71375, "- not enough space for environment" ], [ 71416, "R6008\r\n- not enough space for arguments" ], [ 71423, "- not enough space for arguments" ], [ 71464, "R6002\r\n- floating point support not loaded" ], [ 71471, "- floating point support not loaded" ], [ 71512, "Microsoft Visual C++ Runtime Library" ], [ 71560, "\u003cprogram name unknown\u003e" ], [ 71584, "Runtime Error!\n\nProgram:" ], [ 72562, "wide", "h(((( H" ], [ 73248, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 73632, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 73872, "dddd, MMMM dd, yyyy" ], [ 73896, "MM/dd/yy" ], [ 73920, "December" ], [ 73936, "November" ], [ 73952, "October" ], [ 73960, "September" ], [ 73972, "August" ], [ 73980, "July" ], [ 73988, "June" ], [ 73996, "April" ], [ 74004, "March" ], [ 74016, "February" ], [ 74032, "January" ], [ 74088, "Saturday" ], [ 74100, "Friday" ], [ 74112, "Thursday" ], [ 74128, "Wednesday" ], [ 74144, "Tuesday" ], [ 74152, "Monday" ], [ 74160, "Sunday" ], [ 74200, "GetProcessWindowStation" ], [ 74224, "GetUserObjectInformationA" ], [ 74256, "GetLastActivePopup" ], [ 74280, "GetActiveWindow" ], [ 74296, "MessageBoxA" ], [ 74312, "USER32.DLL" ], [ 74328, "SunMonTueWedThuFriSat" ], [ 74352, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 74400, "RSDS" ], [ 74424, "d:\\Projects\\WinRAR\\FormatSrc\\bzip2\\build\\64\\Release\\bz2.pdb" ], [ 76822, "10.48.1.10:3634" ], [ 78314, "CloseHandle" ], [ 78328, "GetLastError" ], [ 78344, "GetCurrentProcess" ], [ 78364, "GetProcAddress" ], [ 78382, "GetModuleHandleA" ], [ 78402, "CreateFileA" ], [ 78416, "CreateFileW" ], [ 78430, "SetFilePointer" ], [ 78448, "WriteFile" ], [ 78460, "CreateHardLinkA" ], [ 78478, "GetFullPathNameA" ], [ 78498, "GetFileAttributesA" ], [ 78520, "SetCurrentDirectoryA" ], [ 78544, "GetCurrentDirectoryA" ], [ 78568, "GetFileSize" ], [ 78582, "ReadFile" ], [ 78594, "FileTimeToDosDateTime" ], [ 78618, "FileTimeToLocalFileTime" ], [ 78644, "GetSystemTimeAsFileTime" ], [ 78670, "LocalFileTimeToFileTime" ], [ 78696, "DosDateTimeToFileTime" ], [ 78720, "SetFileTime" ], [ 78734, "CreateDirectoryA" ], [ 78752, "KERNEL32.dll" ], [ 78768, "AdjustTokenPrivileges" ], [ 78792, "LookupPrivilegeValueA" ], [ 78816, "OpenProcessToken" ], [ 78834, "ADVAPI32.dll" ], [ 78850, "SetStdHandle" ], [ 78866, "EnterCriticalSection" ], [ 78890, "LeaveCriticalSection" ], [ 78914, "GetFileType" ], [ 78928, "DeleteFileW" ], [ 78942, "HeapFree" ], [ 78954, "DeleteFileA" ], [ 78968, "HeapAlloc" ], [ 78980, "GetCurrentThreadId" ], [ 79002, "FlsSetValue" ], [ 79016, "GetCommandLineA" ], [ 79034, "GetCPInfo" ], [ 79056, "GetOEMCP" ], [ 79068, "IsValidCodePage" ], [ 79086, "EncodePointer" ], [ 79102, "DecodePointer" ], [ 79118, "FlsGetValue" ], [ 79132, "FlsFree" ], [ 79142, "SetLastError" ], [ 79158, "FlsAlloc" ], [ 79170, "TerminateProcess" ], [ 79190, "UnhandledExceptionFilter" ], [ 79218, "SetUnhandledExceptionFilter" ], [ 79248, "IsDebuggerPresent" ], [ 79268, "RtlVirtualUnwind" ], [ 79288, "RtlLookupFunctionEntry" ], [ 79314, "RtlCaptureContext" ], [ 79334, "SetHandleCount" ], [ 79352, "GetStdHandle" ], [ 79368, "GetStartupInfoA" ], [ 79386, "DeleteCriticalSection" ], [ 79410, "RtlUnwindEx" ], [ 79424, "InitializeCriticalSectionAndSpinCount" ], [ 79464, "Sleep" ], [ 79472, "HeapSetInformation" ], [ 79494, "HeapCreate" ], [ 79508, "HeapDestroy" ], [ 79522, "WideCharToMultiByte" ], [ 79544, "GetConsoleCP" ], [ 79560, "GetConsoleMode" ], [ 79578, "FlushFileBuffers" ], [ 79598, "GetModuleHandleW" ], [ 79618, "ExitProcess" ], [ 79632, "GetModuleFileNameA" ], [ 79654, "MultiByteToWideChar" ], [ 79676, "FreeEnvironmentStringsA" ], [ 79702, "GetEnvironmentStrings" ], [ 79726, "FreeEnvironmentStringsW" ], [ 79752, "GetEnvironmentStringsW" ], [ 79778, "QueryPerformanceCounter" ], [ 79804, "GetTickCount" ], [ 79820, "GetCurrentProcessId" ], [ 79842, "LCMapStringA" ], [ 79858, "LCMapStringW" ], [ 79874, "GetStringTypeA" ], [ 79892, "GetStringTypeW" ], [ 79910, "GetLocaleInfoA" ], [ 79928, "HeapReAlloc" ], [ 79942, "WriteConsoleA" ], [ 79958, "GetConsoleOutputCP" ], [ 79980, "WriteConsoleW" ], [ 79996, "LoadLibraryA" ], [ 80012, "HeapSize" ], [ 80024, "SetEndOfFile" ], [ 80040, "GetProcessHeap" ], [ 80162, "Close" ], [ 80168, "Extract" ], [ 80176, "GetListItem" ], [ 80188, "Open" ], [ 80193, "Prepare" ], [ 82445, "162.223.45.153:50" ], [ 82814, "abcdefghijklmnopqrstuvwxyz" ], [ 82846, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 91302, "wide", "VS_VERSION_INFO" ], [ 91394, "wide", "StringFileInfo" ], [ 91454, "wide", "ProductName" ], [ 91502, "wide", "CompanyName" ], [ 91528, "wide", "Alexander Roshal" ], [ 91570, "wide", "FileDescription" ], [ 91604, "wide", "BZ2 format support" ], [ 91650, "wide", "FileVersion" ], [ 91694, "wide", "InternalName" ], [ 91742, "wide", "LegalCopyright" ], [ 91772, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 91858, "wide", "VarFileInfo" ], [ 91890, "wide", "Translation" ], [ 91920, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 91995, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 92051, "\u003csecurity\u003e" ], [ 92067, "\u003crequestedPrivileges\u003e" ], [ 92096, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 92192, "\u003c/requestedPrivileges\u003e" ], [ 92222, "\u003c/security\u003e" ], [ 92239, "\u003c/trustInfo\u003e" ], [ 92255, "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD" ] ], "sz": 93696, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 238.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "a": "T1573", "c": 1.0, "d": "RC4 XOR decrypt loop pattern", "e": [ "00 f8" ], "i": "micro-behaviors/crypto/symmetric/stream::rc4-xor-loop", "l": 1, "m": "C0027" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\bzip2\\build\\64\\Release\\bz2.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556004.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.29" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "bz2.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 93696.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 255.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.25" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "DosDateTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.10:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 7680)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.42)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "VWATAUAV", "UVWATAUH", "WATAUAVAWH", "VWATAUAWH", "UVWATAUAVAWH", "VWATAUAVH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 135168.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 238.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 238.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.25" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "bzip2 string", "e": [ "BZIP2" ], "i": "micro-behaviors/data/compress/library::bzip2-string", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.9200000166893005, "d": "External IPv4 endpoint in data section", "e": [ "162.223.45.153:50" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-data-literal", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 238.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "ef 89 01 00", "c8 81 01 00", "28 f4 00 00", "45 5f 00 00", "a1 32 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueA" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SetCurrentDirectoryA", "GetCurrentDirectoryA", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "GetSystemTimeAsFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "AdjustTokenPrivileges", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "RtlLookupFunctionEntry", "InitializeCriticalSectionAndSpinCount" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (LookupPrivilegeValueA, AdjustTokenPrivileges, OpenProcessToken)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetModuleHandleA, CreateFileA, CreateFileW, SetFilePointer, WriteFile, ... +84 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "ef 89 01 00", "a1 32 00 00", "28 f4 00 00", "c8 81 01 00", "45 5f 00 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 92.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsSetValue", "FlsAlloc", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetFileSize", "CreateFileW", "ReadFile", "GetModuleFileNameA", "CreateFileA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileW", "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueA", "OpenProcessToken", "AdjustTokenPrivileges" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "IsDebuggerPresent", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "0e812895fd3394b067e28b7c01a8612d68fcc9fdcc858cc3d31c0f447bda7b82", "path": "64301!!Formats/bz2.fmt", "type": "pe" }, { "f": "KO₆(Al₂As₇C₂Er₇IXe)H₆(FPo₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 9, "dp": 1, "id": 3, "is": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "SetFileAttributesA", "CreateDirectoryA", "SetFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "GetLastError", "HeapFree", "HeapAlloc", "RtlLookupFunctionEntry", "RtlUnwindEx", "DeleteFileA", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "RaiseException", "RtlPcToFileHeader", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "SetHandleCount", "GetStdHandle", "GetStartupInfoA", "DeleteCriticalSection", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlCaptureContext", "WriteFile", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "MultiByteToWideChar", "ReadFile", "SetFilePointer", "CloseHandle", "HeapSetInformation", "HeapCreate", "HeapDestroy", "GetModuleHandleW", "Sleep", "GetProcAddress", "ExitProcess", "GetModuleFileNameA", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "SetLastError", "FlsAlloc", "InitializeCriticalSectionAndSpinCount", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "FlushFileBuffers", "CreateFileW", "LoadLibraryA", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "CreateFileA", "HeapReAlloc", "SetEndOfFile", "GetProcessHeap", "HeapSize", "GetLocaleInfoA", "GetStringTypeA", "GetStringTypeW", "LCMapStringA", "LCMapStringW", "OemToCharA" ], "ms": { "pe": { "machine": 34404.0, "checksum": 126973.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\lzh\\build\\64\\Release\\lzh.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368555994.0, "image_base": 6442450944.0, "rsrc_entropy": 4.58, "entry_section": ".text", "size_of_image": 143360.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 24528.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368555994.0, "import_dll_count": 2.0, "manifest_present": true, "computed_checksum": 126973.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555994.0, "debug_timestamp_min": 1368555994.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 68096.0, "file_size": 97280.0, "entry_point": 24528.0, "code_entropy": 6.46, "data_entropy": 4.0, "export_count": 5.0, "import_count": 85.0, "string_count": 293.0, "section_count": 6.0, "avg_complexity": 7.83, "function_count": 282.0, "import_density": 1.28, "max_complexity": 16.0, "string_density": 4.41, "overall_entropy": 4.28, "avg_basic_blocks": 13.5, "avg_section_size": 16042.67, "dependency_count": 2.0, "entropy_variance": 1.51, "function_density": 4.24, "avg_function_size": 1756.67, "avg_string_length": 23.64, "complexity_per_kb": 0.12, "max_string_length": 417.0, "wide_string_count": 18.0, "writable_sections": 1.0, "avg_string_entropy": 3.29, "code_to_data_ratio": 2.42, "data_to_file_ratio": 0.06, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.7, "total_basic_blocks": 81.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 33.79, "debug_reference_count": 1.0, "largest_section_ratio": 0.7, "sentence_string_count": 76.0, "sentence_string_ratio": 0.26, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 2184, "t$ WATAUAVAWD" ], [ 3547, "ATAUAVH" ], [ 4025, "UVWATAUAVAW" ], [ 5455, "VWATAUAVH" ], [ 5811, "WATAUAVAWH" ], [ 8871, "l$ VWATAUAWH" ], [ 9828, "@SUVWATAUAVAWH" ], [ 10947, "WATAUH" ], [ 12376, "t$ WATAUAVAWH" ], [ 13074, "\\$ UVWATAUAVAWH" ], [ 15061, "x ATAUAVH" ], [ 18049, "p WATAUH" ], [ 20187, "AUAVAWH" ], [ 24594, "\\$ UVWATAUAVAW" ], [ 27249, "SUVWATAUAVAWH" ], [ 27712, "D09A" ], [ 28840, "D19K" ], [ 34938, "VWATAUAWH" ], [ 36320, "8MOC" ], [ 36407, "SVWATAUAVAWH" ], [ 37108, "@SWATAUAVAWH" ], [ 38618, "UVWATAUAVAWH" ], [ 40611, "WATAVH" ], [ 46885, "VWATH" ], [ 54305, "UVWATAUH" ], [ 60145, "x ATAUAWH" ], [ 62090, "L$ UATAUAVAWH" ], [ 63048, "@UATAUAVAWH" ], [ 65612, "@USVWATAUAVAWH" ], [ 66230, "M0H3" ], [ 70152, "bad allocation" ], [ 70304, "wide", "UTF-16LE" ], [ 70328, "wide", "UNICODE" ], [ 70344, "CorExitProcess" ], [ 70360, "wide", "mscoree.dll" ], [ 70384, "runtime error" ], [ 70408, "TLOSS error" ], [ 70424, "SING error" ], [ 70440, "DOMAIN error" ], [ 70464, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 70471, "An application has made an attempt to load the C runtime library incorrectly." ], [ 70549, "Please contact the application's support team for more information." ], [ 70624, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 70631, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 70711, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 70872, "R6032\r\n- not enough space for locale information" ], [ 70879, "- not enough space for locale information" ], [ 70928, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 70935, "- Attempt to initialize the CRT more than once." ], [ 70983, "This indicates a bug in your application." ], [ 71032, "R6030\r\n- CRT not initialized" ], [ 71039, "- CRT not initialized" ], [ 71064, "R6028\r\n- unable to initialize heap" ], [ 71071, "- unable to initialize heap" ], [ 71104, "R6027\r\n- not enough space for lowio initialization" ], [ 71111, "- not enough space for lowio initialization" ], [ 71160, "R6026\r\n- not enough space for stdio initialization" ], [ 71167, "- not enough space for stdio initialization" ], [ 71216, "R6025\r\n- pure virtual function call" ], [ 71223, "- pure virtual function call" ], [ 71256, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 71263, "- not enough space for _onexit/atexit table" ], [ 71312, "R6019\r\n- unable to open console device" ], [ 71319, "- unable to open console device" ], [ 71360, "R6018\r\n- unexpected heap error" ], [ 71367, "- unexpected heap error" ], [ 71400, "R6017\r\n- unexpected multithread lock error" ], [ 71407, "- unexpected multithread lock error" ], [ 71448, "R6016\r\n- not enough space for thread data" ], [ 71455, "- not enough space for thread data" ], [ 71504, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 71506, "This application has requested the Runtime to terminate it in an unusual way." ], [ 71656, "R6009\r\n- not enough space for environment" ], [ 71663, "- not enough space for environment" ], [ 71704, "R6008\r\n- not enough space for arguments" ], [ 71711, "- not enough space for arguments" ], [ 71752, "R6002\r\n- floating point support not loaded" ], [ 71759, "- floating point support not loaded" ], [ 71800, "Microsoft Visual C++ Runtime Library" ], [ 71848, "\u003cprogram name unknown\u003e" ], [ 71872, "Runtime Error!\n\nProgram:" ], [ 71920, "UTF-16LE" ], [ 71936, "UNICODE" ], [ 71976, "bad exception" ], [ 72160, "GetProcessWindowStation" ], [ 72184, "GetUserObjectInformationA" ], [ 72216, "GetLastActivePopup" ], [ 72240, "GetActiveWindow" ], [ 72256, "MessageBoxA" ], [ 72272, "USER32.DLL" ], [ 72319, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 72448, "Unknown exception" ], [ 72472, "Complete Object Locator'" ], [ 72504, "Class Hierarchy Descriptor'" ], [ 72536, "Base Class Array'" ], [ 72560, "Base Class Descriptor at (" ], [ 72592, "Type Descriptor'" ], [ 72616, "`local static thread guard'" ], [ 72648, "`managed vector copy constructor iterator'" ], [ 72696, "`vector vbase copy constructor iterator'" ], [ 72744, "`vector copy constructor iterator'" ], [ 72784, "`dynamic atexit destructor for '" ], [ 72824, "`dynamic initializer for '" ], [ 72856, "`eh vector vbase copy constructor iterator'" ], [ 72904, "`eh vector copy constructor iterator'" ], [ 72944, "`managed vector destructor iterator'" ], [ 72984, "`managed vector constructor iterator'" ], [ 73024, "`placement delete[] closure'" ], [ 73056, "`placement delete closure'" ], [ 73088, "`omni callsig'" ], [ 73104, "delete[]" ], [ 73128, "`local vftable constructor closure'" ], [ 73168, "`local vftable'" ], [ 73200, "`udt returning'" ], [ 73216, "`copy constructor closure'" ], [ 73248, "`eh vector vbase constructor iterator'" ], [ 73288, "`eh vector destructor iterator'" ], [ 73320, "`eh vector constructor iterator'" ], [ 73360, "`virtual displacement map'" ], [ 73392, "`vector vbase constructor iterator'" ], [ 73432, "`vector destructor iterator'" ], [ 73464, "`vector constructor iterator'" ], [ 73496, "`scalar deleting destructor'" ], [ 73528, "`default constructor closure'" ], [ 73560, "`vector deleting destructor'" ], [ 73592, "`vbase destructor'" ], [ 73632, "`local static guard'" ], [ 73832, "operator" ], [ 73872, "delete" ], [ 73888, "__unaligned" ], [ 73904, "__restrict" ], [ 73928, "__clrcall" ], [ 73944, "__fastcall" ], [ 73960, "__thiscall" ], [ 73976, "__stdcall" ], [ 73992, "__pascal" ], [ 74008, "__cdecl" ], [ 75586, "wide", "h(((( H" ], [ 76272, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 76656, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 76896, "dddd, MMMM dd, yyyy" ], [ 76920, "MM/dd/yy" ], [ 76944, "December" ], [ 76960, "November" ], [ 76976, "October" ], [ 76984, "September" ], [ 76996, "August" ], [ 77004, "July" ], [ 77012, "June" ], [ 77020, "April" ], [ 77028, "March" ], [ 77040, "February" ], [ 77056, "January" ], [ 77112, "Saturday" ], [ 77124, "Friday" ], [ 77136, "Thursday" ], [ 77152, "Wednesday" ], [ 77168, "Tuesday" ], [ 77176, "Monday" ], [ 77184, "Sunday" ], [ 77224, "SunMonTueWedThuFriSat" ], [ 77248, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 77288, "RSDS" ], [ 77312, "d:\\Projects\\WinRAR\\FormatSrc\\lzh\\build\\64\\Release\\lzh.pdb" ], [ 78750, "20.48.16.96:6322" ], [ 81226, "10.48.25.49:3634" ], [ 82434, "LocalFileTimeToFileTime" ], [ 82460, "DosDateTimeToFileTime" ], [ 82484, "SetFileAttributesA" ], [ 82506, "CreateDirectoryA" ], [ 82526, "SetFileTime" ], [ 82540, "FileTimeToDosDateTime" ], [ 82564, "FileTimeToLocalFileTime" ], [ 82588, "KERNEL32.dll" ], [ 82616, "USER32.dll" ], [ 82630, "GetLastError" ], [ 82646, "HeapFree" ], [ 82658, "HeapAlloc" ], [ 82670, "RtlLookupFunctionEntry" ], [ 82696, "RtlUnwindEx" ], [ 82710, "DeleteFileA" ], [ 82724, "SetStdHandle" ], [ 82740, "EnterCriticalSection" ], [ 82764, "LeaveCriticalSection" ], [ 82788, "GetFileType" ], [ 82802, "RaiseException" ], [ 82820, "RtlPcToFileHeader" ], [ 82840, "GetCurrentThreadId" ], [ 82862, "FlsSetValue" ], [ 82876, "GetCommandLineA" ], [ 82894, "SetHandleCount" ], [ 82912, "GetStdHandle" ], [ 82928, "GetStartupInfoA" ], [ 82946, "DeleteCriticalSection" ], [ 82970, "TerminateProcess" ], [ 82990, "GetCurrentProcess" ], [ 83010, "UnhandledExceptionFilter" ], [ 83038, "SetUnhandledExceptionFilter" ], [ 83068, "IsDebuggerPresent" ], [ 83088, "RtlVirtualUnwind" ], [ 83108, "RtlCaptureContext" ], [ 83128, "WriteFile" ], [ 83140, "WideCharToMultiByte" ], [ 83162, "GetConsoleCP" ], [ 83178, "GetConsoleMode" ], [ 83196, "MultiByteToWideChar" ], [ 83218, "ReadFile" ], [ 83230, "SetFilePointer" ], [ 83248, "CloseHandle" ], [ 83262, "HeapSetInformation" ], [ 83284, "HeapCreate" ], [ 83298, "HeapDestroy" ], [ 83312, "GetModuleHandleW" ], [ 83332, "Sleep" ], [ 83340, "GetProcAddress" ], [ 83358, "ExitProcess" ], [ 83372, "GetModuleFileNameA" ], [ 83394, "EncodePointer" ], [ 83410, "DecodePointer" ], [ 83426, "FlsGetValue" ], [ 83440, "FlsFree" ], [ 83450, "SetLastError" ], [ 83466, "FlsAlloc" ], [ 83478, "InitializeCriticalSectionAndSpinCount" ], [ 83518, "FreeEnvironmentStringsA" ], [ 83544, "GetEnvironmentStrings" ], [ 83568, "FreeEnvironmentStringsW" ], [ 83594, "GetEnvironmentStringsW" ], [ 83620, "QueryPerformanceCounter" ], [ 83646, "GetTickCount" ], [ 83662, "GetCurrentProcessId" ], [ 83684, "GetSystemTimeAsFileTime" ], [ 83710, "WriteConsoleA" ], [ 83726, "GetConsoleOutputCP" ], [ 83748, "WriteConsoleW" ], [ 83764, "FlushFileBuffers" ], [ 83784, "CreateFileW" ], [ 83798, "LoadLibraryA" ], [ 83814, "GetCPInfo" ], [ 83836, "GetOEMCP" ], [ 83848, "IsValidCodePage" ], [ 83866, "CreateFileA" ], [ 83880, "HeapReAlloc" ], [ 83894, "SetEndOfFile" ], [ 83910, "GetProcessHeap" ], [ 83928, "HeapSize" ], [ 83940, "GetLocaleInfoA" ], [ 83958, "GetStringTypeA" ], [ 83976, "GetStringTypeW" ] ], "sz": 97280, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 282.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\lzh\\build\\64\\Release\\lzh.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555994.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.70" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.83" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.29" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "lzh.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 97280.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 293.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.28" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b9", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.25.49:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.46)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "UVWATAUAVAW", "VWATAUAVH", "WATAUAVAWH", "VWATAUAWH", "SVWATAUAVAWH", "UVWATAUAVAWH", "UVWATAUH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.26" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 143360.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 282.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 282.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.28" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 282.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "20.48.16.96:6322" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.70" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "RtlLookupFunctionEntry", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "WideCharToMultiByte", "MultiByteToWideChar", "GetModuleFileNameA", "InitializeCriticalSectionAndSpinCount", "GetCurrentProcessId" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (LocalFileTimeToFileTime, DosDateTimeToFileTime, SetFileAttributesA, CreateDirectoryA, SetFileTime, ... +79 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (OemToCharA)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "IsDebuggerPresent", "TerminateProcess" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 85.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsSetValue", "FlsAlloc", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "Sleep", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "19e368c8c054cf69e6434575b2f38e42261d489f5de1f208a1c9817483676890", "path": "64301!!Formats/lzh.fmt", "type": "pe" }, { "f": "KO₅(Al₂As₇C₃Er₆I)H₅(Po₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 8, "dp": 1, "id": 4, "is": [ "CreateFileA", "CreateFileW", "CloseHandle", "GetLastError", "SetFilePointer", "WriteFile", "ReadFile", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "GetSystemTimeAsFileTime", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "SetHandleCount", "GetStdHandle", "GetStartupInfoA", "DeleteCriticalSection", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "RtlUnwindEx", "SetLastError", "InitializeCriticalSectionAndSpinCount", "Sleep", "HeapFree", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "FlsAlloc", "GetModuleHandleW", "GetProcAddress", "ExitProcess", "GetModuleFileNameA", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "HeapSetInformation", "HeapCreate", "HeapDestroy", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "HeapAlloc", "HeapReAlloc", "FlushFileBuffers", "MultiByteToWideChar", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "LoadLibraryA", "HeapSize", "SetEndOfFile", "GetProcessHeap", "GetLocaleInfoA", "GetStringTypeA", "GetStringTypeW", "LCMapStringA", "LCMapStringW" ], "ms": { "pe": { "machine": 34404.0, "checksum": 94714.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\uue\\build\\64\\Release\\uue.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368556002.0, "image_base": 6442450944.0, "rsrc_entropy": 4.58, "entry_section": ".text", "size_of_image": 106496.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 12628.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368556002.0, "import_dll_count": 1.0, "manifest_present": true, "computed_checksum": 94714.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556002.0, "debug_timestamp_min": 1368556002.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 49664.0, "file_size": 72192.0, "entry_point": 12628.0, "code_entropy": 6.38, "data_entropy": 3.83, "export_count": 5.0, "import_count": 76.0, "string_count": 231.0, "section_count": 6.0, "avg_complexity": 12.67, "function_count": 199.0, "import_density": 1.57, "max_complexity": 31.0, "string_density": 4.76, "overall_entropy": 4.06, "avg_basic_blocks": 19.0, "avg_section_size": 11861.33, "dependency_count": 1.0, "entropy_variance": 1.69, "function_density": 4.1, "avg_function_size": 1086.67, "avg_string_length": 24.48, "complexity_per_kb": 0.26, "max_string_length": 417.0, "wide_string_count": 18.0, "writable_sections": 1.0, "avg_string_entropy": 3.27, "code_to_data_ratio": 2.31, "data_to_file_ratio": 0.08, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.69, "total_basic_blocks": 114.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 37.91, "debug_reference_count": 1.0, "largest_section_ratio": 0.69, "sentence_string_count": 47.0, "sentence_string_ratio": 0.2, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 1691, "WATAUH" ], [ 3489, "VUUUL" ], [ 4539, "AUAVAWH" ], [ 6588, "t$ WATAUAVAWH" ], [ 11147, "WATAUAVAWH" ], [ 14978, "\\$ UVWATAUAVAW" ], [ 18766, "VWATAUAWH" ], [ 21689, "x ATAUAVH" ], [ 25141, "VWATH" ], [ 25593, "SUVWATAUAVAWH" ], [ 26056, "D09A" ], [ 27184, "D19K" ], [ 29523, "UVWATAUAVAWH" ], [ 37593, "UVWATAUH" ], [ 38847, "ATAUAVH" ], [ 40450, "VWATAUAVH" ], [ 41773, "x ATAUAWH" ], [ 44402, "L$ UATAUAVAWH" ], [ 45160, "@UATAUAVAWH" ], [ 47932, "@USVWATAUAVAWH" ], [ 48550, "M0H3" ], [ 51472, "`!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_" ], [ 51552, "+-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" ], [ 51624, "egin" ], [ 51632, ".xxe" ], [ 51640, ".uue" ], [ 51648, "xxencode" ], [ 51664, "section" ], [ 51672, "table" ], [ 51688, "begin" ], [ 51752, "wide", "UTF-16LE" ], [ 51776, "wide", "UNICODE" ], [ 51808, "UTF-16LE" ], [ 51824, "UNICODE" ], [ 51832, "CorExitProcess" ], [ 51848, "wide", "mscoree.dll" ], [ 52032, "runtime error" ], [ 52048, "TLOSS error" ], [ 52064, "SING error" ], [ 52080, "DOMAIN error" ], [ 52096, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 52103, "An application has made an attempt to load the C runtime library incorrectly." ], [ 52181, "Please contact the application's support team for more information." ], [ 52256, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 52263, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 52343, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 52504, "R6032\r\n- not enough space for locale information" ], [ 52511, "- not enough space for locale information" ], [ 52560, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 52567, "- Attempt to initialize the CRT more than once." ], [ 52615, "This indicates a bug in your application." ], [ 52664, "R6030\r\n- CRT not initialized" ], [ 52671, "- CRT not initialized" ], [ 52696, "R6028\r\n- unable to initialize heap" ], [ 52703, "- unable to initialize heap" ], [ 52736, "R6027\r\n- not enough space for lowio initialization" ], [ 52743, "- not enough space for lowio initialization" ], [ 52792, "R6026\r\n- not enough space for stdio initialization" ], [ 52799, "- not enough space for stdio initialization" ], [ 52848, "R6025\r\n- pure virtual function call" ], [ 52855, "- pure virtual function call" ], [ 52888, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 52895, "- not enough space for _onexit/atexit table" ], [ 52944, "R6019\r\n- unable to open console device" ], [ 52951, "- unable to open console device" ], [ 52992, "R6018\r\n- unexpected heap error" ], [ 52999, "- unexpected heap error" ], [ 53032, "R6017\r\n- unexpected multithread lock error" ], [ 53039, "- unexpected multithread lock error" ], [ 53080, "R6016\r\n- not enough space for thread data" ], [ 53087, "- not enough space for thread data" ], [ 53136, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 53138, "This application has requested the Runtime to terminate it in an unusual way." ], [ 53288, "R6009\r\n- not enough space for environment" ], [ 53295, "- not enough space for environment" ], [ 53336, "R6008\r\n- not enough space for arguments" ], [ 53343, "- not enough space for arguments" ], [ 53384, "R6002\r\n- floating point support not loaded" ], [ 53391, "- floating point support not loaded" ], [ 53432, "Microsoft Visual C++ Runtime Library" ], [ 53480, "\u003cprogram name unknown\u003e" ], [ 53504, "Runtime Error!\n\nProgram:" ], [ 53567, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 53664, "GetProcessWindowStation" ], [ 53688, "GetUserObjectInformationA" ], [ 53720, "GetLastActivePopup" ], [ 53744, "GetActiveWindow" ], [ 53760, "MessageBoxA" ], [ 53776, "USER32.DLL" ], [ 54578, "wide", "h(((( H" ], [ 55264, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 55648, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 55888, "dddd, MMMM dd, yyyy" ], [ 55912, "MM/dd/yy" ], [ 55936, "December" ], [ 55952, "November" ], [ 55968, "October" ], [ 55976, "September" ], [ 55988, "August" ], [ 55996, "July" ], [ 56004, "June" ], [ 56012, "April" ], [ 56020, "March" ], [ 56032, "February" ], [ 56048, "January" ], [ 56104, "Saturday" ], [ 56116, "Friday" ], [ 56128, "Thursday" ], [ 56144, "Wednesday" ], [ 56160, "Tuesday" ], [ 56168, "Monday" ], [ 56176, "Sunday" ], [ 56216, "SunMonTueWedThuFriSat" ], [ 56240, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 56280, "RSDS" ], [ 56304, "d:\\Projects\\WinRAR\\FormatSrc\\uue\\build\\64\\Release\\uue.pdb" ], [ 58738, "10.48.25.49:3634" ], [ 59650, "CreateFileA" ], [ 59664, "CreateFileW" ], [ 59678, "CloseHandle" ], [ 59692, "GetLastError" ], [ 59708, "SetFilePointer" ], [ 59726, "WriteFile" ], [ 59738, "ReadFile" ], [ 59750, "FileTimeToDosDateTime" ], [ 59774, "FileTimeToLocalFileTime" ], [ 59800, "GetSystemTimeAsFileTime" ], [ 59824, "KERNEL32.dll" ], [ 59840, "SetStdHandle" ], [ 59856, "EnterCriticalSection" ], [ 59880, "LeaveCriticalSection" ], [ 59904, "GetFileType" ], [ 59918, "GetCurrentThreadId" ], [ 59940, "FlsSetValue" ], [ 59954, "GetCommandLineA" ], [ 59972, "SetHandleCount" ], [ 59990, "GetStdHandle" ], [ 60006, "GetStartupInfoA" ], [ 60024, "DeleteCriticalSection" ], [ 60048, "TerminateProcess" ], [ 60068, "GetCurrentProcess" ], [ 60088, "UnhandledExceptionFilter" ], [ 60116, "SetUnhandledExceptionFilter" ], [ 60146, "IsDebuggerPresent" ], [ 60166, "RtlVirtualUnwind" ], [ 60186, "RtlLookupFunctionEntry" ], [ 60212, "RtlCaptureContext" ], [ 60232, "RtlUnwindEx" ], [ 60246, "SetLastError" ], [ 60262, "InitializeCriticalSectionAndSpinCount" ], [ 60302, "Sleep" ], [ 60310, "HeapFree" ], [ 60322, "WideCharToMultiByte" ], [ 60344, "GetConsoleCP" ], [ 60360, "GetConsoleMode" ], [ 60378, "EncodePointer" ], [ 60394, "DecodePointer" ], [ 60410, "FlsGetValue" ], [ 60424, "FlsFree" ], [ 60434, "FlsAlloc" ], [ 60446, "GetModuleHandleW" ], [ 60466, "GetProcAddress" ], [ 60484, "ExitProcess" ], [ 60498, "GetModuleFileNameA" ], [ 60520, "FreeEnvironmentStringsA" ], [ 60546, "GetEnvironmentStrings" ], [ 60570, "FreeEnvironmentStringsW" ], [ 60596, "GetEnvironmentStringsW" ], [ 60622, "HeapSetInformation" ], [ 60644, "HeapCreate" ], [ 60658, "HeapDestroy" ], [ 60672, "QueryPerformanceCounter" ], [ 60698, "GetTickCount" ], [ 60714, "GetCurrentProcessId" ], [ 60736, "HeapAlloc" ], [ 60748, "HeapReAlloc" ], [ 60762, "FlushFileBuffers" ], [ 60782, "MultiByteToWideChar" ], [ 60804, "WriteConsoleA" ], [ 60820, "GetConsoleOutputCP" ], [ 60842, "WriteConsoleW" ], [ 60858, "GetCPInfo" ], [ 60880, "GetOEMCP" ], [ 60892, "IsValidCodePage" ], [ 60910, "LoadLibraryA" ], [ 60926, "HeapSize" ], [ 60938, "SetEndOfFile" ], [ 60954, "GetProcessHeap" ], [ 60972, "GetLocaleInfoA" ], [ 60990, "GetStringTypeA" ], [ 61008, "GetStringTypeW" ], [ 61026, "LCMapStringA" ], [ 61042, "LCMapStringW" ], [ 61146, "uue.dll" ], [ 61154, "Close" ], [ 61160, "Extract" ], [ 61168, "GetListItem" ], [ 61180, "Open" ], [ 61185, "Prepare" ], [ 64910, "abcdefghijklmnopqrstuvwxyz" ], [ 64942, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 69798, "wide", "VS_VERSION_INFO" ], [ 69890, "wide", "StringFileInfo" ], [ 69950, "wide", "ProductName" ], [ 69998, "wide", "CompanyName" ], [ 70024, "wide", "Alexander Roshal" ], [ 70066, "wide", "FileDescription" ], [ 70100, "wide", "UUE format support" ], [ 70146, "wide", "FileVersion" ], [ 70190, "wide", "InternalName" ], [ 70216, "wide", "uue.fmt" ], [ 70238, "wide", "LegalCopyright" ], [ 70268, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 70354, "wide", "VarFileInfo" ], [ 70386, "wide", "Translation" ], [ 70416, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 70491, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 70547, "\u003csecurity\u003e" ], [ 70563, "\u003crequestedPrivileges\u003e" ], [ 70592, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 70688, "\u003c/requestedPrivileges\u003e" ], [ 70718, "\u003c/security\u003e" ], [ 70735, "\u003c/trustInfo\u003e" ], [ 70751, "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD" ] ], "sz": 72192, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 199.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\uue\\build\\64\\Release\\uue.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556002.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 12.67" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.27" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "uue.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 72192.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 231.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.06" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.25.49:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.38)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "VWATAUAWH", "UVWATAUAVAWH", "UVWATAUH", "VWATAUAVH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.20" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 106496.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 199.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 199.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.06" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 76.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "GetSystemTimeAsFileTime", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "RtlLookupFunctionEntry", "InitializeCriticalSectionAndSpinCount", "WideCharToMultiByte", "GetModuleFileNameA", "GetCurrentProcessId", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateFileA, CreateFileW, CloseHandle, GetLastError, SetFilePointer, ... +71 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsSetValue", "FlsGetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "973790e300e42486cb3e08898cd912b7682ecddb148bb1ed58b5ddec57d50840", "path": "64301!!Formats/uue.fmt", "type": "pe" }, { "f": "KO₇(PrAl₂As₈C₃Er₇IXe)H₇(F₂Os₂Po₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 12, "dp": 1, "id": 5, "is": [ "SetFilePointer", "WriteFile", "GetCurrentProcess", "GetProcAddress", "GetModuleHandleA", "ReadFile", "CreateHardLinkA", "GetFullPathNameA", "GetFileAttributesA", "GetLastError", "GetCurrentDirectoryA", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "SetFileTime", "CreateDirectoryA", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "GetFileTime", "CloseHandle", "CreateFileW", "SetCurrentDirectoryA", "CreateFileA", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "HeapReAlloc", "HeapFree", "DeleteFileA", "HeapAlloc", "DeleteFileW", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "SetHandleCount", "GetStdHandle", "GetStartupInfoA", "DeleteCriticalSection", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "RtlUnwindEx", "SetLastError", "InitializeCriticalSectionAndSpinCount", "Sleep", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "HeapSetInformation", "HeapCreate", "HeapDestroy", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "FlsAlloc", "GetModuleHandleW", "ExitProcess", "GetModuleFileNameA", "FlushFileBuffers", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "MultiByteToWideChar", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "LoadLibraryA", "HeapSize", "SetEndOfFile", "GetProcessHeap", "LookupPrivilegeValueA", "AdjustTokenPrivileges", "OpenProcessToken" ], "ms": { "pe": { "machine": 34404.0, "checksum": 93652.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\Z\\build\\64\\Release\\z.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368556001.0, "image_base": 6442450944.0, "rsrc_entropy": 4.59, "entry_section": ".text", "size_of_image": 544768.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 19080.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368556001.0, "import_dll_count": 2.0, "manifest_present": true, "computed_checksum": 93652.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556001.0, "debug_timestamp_min": 1368556001.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 54272.0, "file_size": 78848.0, "entry_point": 19080.0, "code_entropy": 6.41, "data_entropy": 3.85, "export_count": 5.0, "import_count": 92.0, "string_count": 250.0, "section_count": 6.0, "avg_complexity": 6.83, "function_count": 221.0, "import_density": 1.74, "max_complexity": 24.0, "string_density": 4.72, "overall_entropy": 3.94, "avg_basic_blocks": 10.67, "avg_section_size": 12970.67, "dependency_count": 2.0, "entropy_variance": 1.88, "function_density": 4.17, "avg_function_size": 44004.0, "avg_string_length": 23.6, "complexity_per_kb": 0.13, "max_string_length": 425.0, "wide_string_count": 20.0, "writable_sections": 1.0, "avg_string_entropy": 3.26, "code_to_data_ratio": 2.3, "data_to_file_ratio": 0.07, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.69, "total_basic_blocks": 128.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 36.66, "debug_reference_count": 1.0, "largest_section_ratio": 0.69, "sentence_string_count": 47.0, "sentence_string_ratio": 0.19, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 211, "\"^]=\"Rich_]=\"" ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 695, "@.reloc" ], [ 2402, "VWATH" ], [ 2950, "VWATAUAV" ], [ 4427, "WATAVH" ], [ 5545, "UVWH" ], [ 6766, "UVWATAU" ], [ 7024, "t$ WATAUAVAW" ], [ 9939, "AUAVAWH" ], [ 11760, "t$ WATAUAVAWH" ], [ 15094, "WATAUH" ], [ 17599, "WATAUAVAWH" ], [ 19438, "\\$ UVWATAUAVAW" ], [ 23705, "UVWATAUH" ], [ 27498, "VWATAUAWH" ], [ 31629, "x ATAUAVH" ], [ 35576, "@UATAUAVAWH" ], [ 37074, "L$ UATAUAVAWH" ], [ 40199, "UVWATAUAVAWH" ], [ 43547, "ATAUAVH" ], [ 44638, "VWATAUAVH" ], [ 48556, "@USVWATAUAVAWH" ], [ 49174, "M0H3" ], [ 49773, "x ATAUAWH" ], [ 50173, "SUVWATAUAVAWH" ], [ 50636, "D09A" ], [ 51764, "D19K" ], [ 56192, "SeCreateSymbolicLinkPrivilege" ], [ 56224, "CreateSymbolicLinkA" ], [ 56248, "kernel32.dll" ], [ 56288, "wide", ".taz" ], [ 56304, "wide", ".tar" ], [ 56320, "'sparse file'" ], [ 56336, "././@LongLink" ], [ 56447, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 56560, "UTF-16LE" ], [ 56576, "UNICODE" ], [ 56584, "CorExitProcess" ], [ 56600, "wide", "mscoree.dll" ], [ 56624, "runtime error" ], [ 56648, "TLOSS error" ], [ 56664, "SING error" ], [ 56680, "DOMAIN error" ], [ 56704, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 56711, "An application has made an attempt to load the C runtime library incorrectly." ], [ 56789, "Please contact the application's support team for more information." ], [ 56864, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 56871, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 56951, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 57112, "R6032\r\n- not enough space for locale information" ], [ 57119, "- not enough space for locale information" ], [ 57168, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 57175, "- Attempt to initialize the CRT more than once." ], [ 57223, "This indicates a bug in your application." ], [ 57272, "R6030\r\n- CRT not initialized" ], [ 57279, "- CRT not initialized" ], [ 57304, "R6028\r\n- unable to initialize heap" ], [ 57311, "- unable to initialize heap" ], [ 57344, "R6027\r\n- not enough space for lowio initialization" ], [ 57351, "- not enough space for lowio initialization" ], [ 57400, "R6026\r\n- not enough space for stdio initialization" ], [ 57407, "- not enough space for stdio initialization" ], [ 57456, "R6025\r\n- pure virtual function call" ], [ 57463, "- pure virtual function call" ], [ 57496, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 57503, "- not enough space for _onexit/atexit table" ], [ 57552, "R6019\r\n- unable to open console device" ], [ 57559, "- unable to open console device" ], [ 57600, "R6018\r\n- unexpected heap error" ], [ 57607, "- unexpected heap error" ], [ 57640, "R6017\r\n- unexpected multithread lock error" ], [ 57647, "- unexpected multithread lock error" ], [ 57688, "R6016\r\n- not enough space for thread data" ], [ 57695, "- not enough space for thread data" ], [ 57744, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 57746, "This application has requested the Runtime to terminate it in an unusual way." ], [ 57896, "R6009\r\n- not enough space for environment" ], [ 57903, "- not enough space for environment" ], [ 57944, "R6008\r\n- not enough space for arguments" ], [ 57951, "- not enough space for arguments" ], [ 57992, "R6002\r\n- floating point support not loaded" ], [ 57999, "- floating point support not loaded" ], [ 58040, "Microsoft Visual C++ Runtime Library" ], [ 58088, "\u003cprogram name unknown\u003e" ], [ 58112, "Runtime Error!\n\nProgram:" ], [ 58168, "wide", "UTF-16LE" ], [ 58192, "wide", "UNICODE" ], [ 59154, "wide", "h(((( H" ], [ 59840, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 60224, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 60464, "dddd, MMMM dd, yyyy" ], [ 60488, "MM/dd/yy" ], [ 60512, "December" ], [ 60528, "November" ], [ 60544, "October" ], [ 60552, "September" ], [ 60564, "August" ], [ 60572, "July" ], [ 60580, "June" ], [ 60588, "April" ], [ 60596, "March" ], [ 60608, "February" ], [ 60624, "January" ], [ 60680, "Saturday" ], [ 60692, "Friday" ], [ 60704, "Thursday" ], [ 60720, "Wednesday" ], [ 60736, "Tuesday" ], [ 60744, "Monday" ], [ 60752, "Sunday" ], [ 60792, "GetProcessWindowStation" ], [ 60816, "GetUserObjectInformationA" ], [ 60848, "GetLastActivePopup" ], [ 60872, "GetActiveWindow" ], [ 60888, "MessageBoxA" ], [ 60904, "USER32.DLL" ], [ 60928, "SunMonTueWedThuFriSat" ], [ 60952, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 60992, "RSDS" ], [ 61016, "d:\\Projects\\WinRAR\\FormatSrc\\Z\\build\\64\\Release\\z.pdb" ], [ 63222, "10.48.1.6:3634" ], [ 64562, "CreateFileA" ], [ 64576, "CreateFileW" ], [ 64590, "CloseHandle" ], [ 64604, "GetLastError" ], [ 64620, "SetFilePointer" ], [ 64638, "WriteFile" ], [ 64650, "GetCurrentProcess" ], [ 64670, "GetProcAddress" ], [ 64688, "GetModuleHandleA" ], [ 64708, "ReadFile" ], [ 64720, "CreateHardLinkA" ], [ 64738, "GetFullPathNameA" ], [ 64758, "GetFileAttributesA" ], [ 64780, "SetCurrentDirectoryA" ], [ 64804, "GetCurrentDirectoryA" ], [ 64828, "LocalFileTimeToFileTime" ], [ 64854, "DosDateTimeToFileTime" ], [ 64878, "SetFileTime" ], [ 64892, "CreateDirectoryA" ], [ 64912, "FileTimeToDosDateTime" ], [ 64936, "FileTimeToLocalFileTime" ], [ 64962, "GetFileTime" ], [ 64974, "KERNEL32.dll" ], [ 64990, "AdjustTokenPrivileges" ], [ 65014, "LookupPrivilegeValueA" ], [ 65038, "OpenProcessToken" ], [ 65056, "ADVAPI32.dll" ], [ 65072, "SetStdHandle" ], [ 65088, "EnterCriticalSection" ], [ 65112, "LeaveCriticalSection" ], [ 65136, "GetFileType" ], [ 65150, "HeapReAlloc" ], [ 65164, "HeapFree" ], [ 65176, "DeleteFileA" ], [ 65190, "HeapAlloc" ], [ 65202, "DeleteFileW" ], [ 65216, "GetCurrentThreadId" ], [ 65238, "FlsSetValue" ], [ 65252, "GetCommandLineA" ], [ 65270, "SetHandleCount" ], [ 65288, "GetStdHandle" ], [ 65304, "GetStartupInfoA" ], [ 65322, "DeleteCriticalSection" ], [ 65346, "TerminateProcess" ], [ 65366, "UnhandledExceptionFilter" ], [ 65394, "SetUnhandledExceptionFilter" ], [ 65424, "IsDebuggerPresent" ], [ 65444, "RtlVirtualUnwind" ], [ 65464, "RtlLookupFunctionEntry" ], [ 65490, "RtlCaptureContext" ], [ 65510, "RtlUnwindEx" ], [ 65524, "SetLastError" ], [ 65540, "InitializeCriticalSectionAndSpinCount" ], [ 65580, "Sleep" ], [ 65588, "WideCharToMultiByte" ], [ 65610, "GetConsoleCP" ], [ 65626, "GetConsoleMode" ], [ 65644, "HeapSetInformation" ], [ 65666, "HeapCreate" ], [ 65680, "HeapDestroy" ], [ 65694, "GetCPInfo" ], [ 65716, "GetOEMCP" ], [ 65728, "IsValidCodePage" ], [ 65746, "EncodePointer" ], [ 65762, "DecodePointer" ], [ 65778, "FlsGetValue" ], [ 65792, "FlsFree" ], [ 65802, "FlsAlloc" ], [ 65814, "GetModuleHandleW" ], [ 65834, "ExitProcess" ], [ 65848, "GetModuleFileNameA" ], [ 65870, "FlushFileBuffers" ], [ 65890, "FreeEnvironmentStringsA" ], [ 65916, "GetEnvironmentStrings" ], [ 65940, "FreeEnvironmentStringsW" ], [ 65966, "GetEnvironmentStringsW" ], [ 65992, "QueryPerformanceCounter" ], [ 66018, "GetTickCount" ], [ 66034, "GetCurrentProcessId" ], [ 66056, "GetSystemTimeAsFileTime" ], [ 66082, "WriteConsoleA" ], [ 66098, "GetConsoleOutputCP" ], [ 66120, "WriteConsoleW" ], [ 66136, "MultiByteToWideChar" ], [ 66158, "LCMapStringA" ], [ 66174, "LCMapStringW" ], [ 66190, "GetStringTypeA" ], [ 66208, "GetStringTypeW" ], [ 66226, "GetLocaleInfoA" ], [ 66244, "LoadLibraryA" ], [ 66260, "HeapSize" ], [ 66272, "SetEndOfFile" ], [ 66288, "GetProcessHeap" ], [ 66394, "z.dll" ], [ 66400, "Close" ], [ 66406, "Extract" ], [ 66414, "GetListItem" ], [ 66426, "Open" ], [ 66431, "Prepare" ], [ 68974, "abcdefghijklmnopqrstuvwxyz" ], [ 69006, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 75430, "wide", "VS_VERSION_INFO" ], [ 75522, "wide", "StringFileInfo" ], [ 75582, "wide", "ProductName" ], [ 75630, "wide", "CompanyName" ], [ 75656, "wide", "Alexander Roshal" ], [ 75698, "wide", "FileDescription" ], [ 75732, "wide", "Z format support" ], [ 75774, "wide", "FileVersion" ], [ 75818, "wide", "InternalName" ], [ 75844, "wide", "z.fmt" ], [ 75862, "wide", "LegalCopyright" ], [ 75892, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 75978, "wide", "VarFileInfo" ], [ 76010, "wide", "Translation" ], [ 76040, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 76115, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 76171, "\u003csecurity\u003e" ], [ 76187, "\u003crequestedPrivileges\u003e" ], [ 76216, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 76312, "\u003c/requestedPrivileges\u003e" ], [ 76342, "\u003c/security\u003e" ], [ 76359, "\u003c/trustInfo\u003e" ], [ 76375, "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD" ] ], "sz": 78848, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 221.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\Z\\build\\64\\Release\\z.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556001.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.83" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.26" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "z.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 78848.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 250.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.94" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "DosDateTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.6:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8600000143051147, "d": "Extremely large average function size", "e": [ "binary.avg_function_size = 44004.00" ], "i": "metadata/binary/metrics::giant-average-function", "l": 1 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.41)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "VWATAUAV", "WATAUAVAWH", "UVWATAUH", "VWATAUAWH", "UVWATAUAVAWH", "VWATAUAVH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 544768.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 221.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_function_size = 44004.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 221.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 92.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.94" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 221.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "bc 4f 03 00", "f4 c6 00 00", "c2 4a 03 00", "c5 5c 00 00", "69 19 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueA" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1195.002", "c": 0.8500000238418579, "d": "Extremely large average function size", "e": [ "binary.avg_function_size = 44004.00" ], "i": "objectives/command-and-control/backdoor/binary::massive-code-blob", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SetCurrentDirectoryA", "GetCurrentDirectoryA", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "AdjustTokenPrivileges", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "RtlLookupFunctionEntry", "InitializeCriticalSectionAndSpinCount", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (LookupPrivilegeValueA, AdjustTokenPrivileges, OpenProcessToken)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (SetFilePointer, WriteFile, GetCurrentProcess, GetProcAddress, GetModuleHandleA, ... +84 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "69 19 00 00", "c2 4a 03 00", "bc 4f 03 00", "c5 5c 00 00", "f4 c6 00 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "IsDebuggerPresent", "TerminateProcess" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 92.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsSetValue", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameA", "DeleteFileA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueA", "OpenProcessToken", "AdjustTokenPrivileges" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "130cf1b6295b83e01b0e8122dd73d0bd4f4c2071808e6f28a5d275f469ac334a", "path": "64301!!Formats/z.fmt", "type": "pe" }, { "f": "KO₆(Al₂As₇C₂Er₇IXe)H₆(FPo₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 9, "dp": 1, "id": 6, "is": [ "GetFileAttributesA", "SetFileAttributesA", "CloseHandle", "SetFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "CreateFileA", "CreateDirectoryA", "HeapAlloc", "GetLastError", "HeapFree", "DeleteFileA", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "RtlUnwindEx", "EnterCriticalSection", "LeaveCriticalSection", "SetHandleCount", "GetStdHandle", "GetFileType", "GetStartupInfoA", "DeleteCriticalSection", "MultiByteToWideChar", "ReadFile", "WriteFile", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "GetModuleHandleW", "Sleep", "GetProcAddress", "ExitProcess", "GetModuleFileNameA", "HeapSetInformation", "HeapCreate", "HeapDestroy", "SetFilePointer", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "SetLastError", "FlsAlloc", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "InitializeCriticalSectionAndSpinCount", "SetStdHandle", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "FlushFileBuffers", "LoadLibraryA", "CreateFileW", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "HeapReAlloc", "HeapSize", "GetLocaleInfoA", "SetEndOfFile", "GetProcessHeap", "GetStringTypeA", "GetStringTypeW", "LCMapStringA", "LCMapStringW", "OemToCharA" ], "ms": { "pe": { "machine": 34404.0, "checksum": 114765.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\arj\\build\\64\\Release\\arj.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368555991.0, "image_base": 6442450944.0, "rsrc_entropy": 4.58, "entry_section": ".text", "size_of_image": 122880.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 18800.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368555991.0, "import_dll_count": 2.0, "manifest_present": true, "computed_checksum": 114765.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555991.0, "debug_timestamp_min": 1368555991.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 57344.0, "file_size": 80896.0, "entry_point": 18800.0, "code_entropy": 6.44, "data_entropy": 3.87, "export_count": 7.0, "import_count": 82.0, "string_count": 232.0, "section_count": 6.0, "avg_complexity": 7.67, "function_count": 227.0, "import_density": 1.46, "max_complexity": 18.0, "string_density": 4.14, "overall_entropy": 4.1, "avg_basic_blocks": 12.67, "avg_section_size": 13312.0, "dependency_count": 2.0, "entropy_variance": 1.68, "function_density": 4.05, "avg_function_size": 1199.89, "avg_string_length": 24.24, "complexity_per_kb": 0.14, "max_string_length": 417.0, "wide_string_count": 18.0, "writable_sections": 1.0, "avg_string_entropy": 3.28, "code_to_data_ratio": 2.55, "data_to_file_ratio": 0.07, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.71, "total_basic_blocks": 114.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 37.58, "debug_reference_count": 1.0, "largest_section_ratio": 0.71, "sentence_string_count": 47.0, "sentence_string_ratio": 0.2, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 695, "@.reloc" ], [ 1024, "@SUVWATAUAVAWH" ], [ 1465, "f91u" ], [ 4927, "WATAUAVAWH" ], [ 5341, "x ATAUAVH" ], [ 7004, "t$ WATAUAVAWH" ], [ 7073, "D95PP" ], [ 10198, "\\$ UVWATAUAVAWH" ], [ 14190, "WATAUH" ], [ 19013, "SUVWATAUAVAWH" ], [ 19476, "D09A" ], [ 20604, "D19K" ], [ 21850, "\\$ UVWATAUAVAW" ], [ 24255, "AUAVAWH" ], [ 28494, "VWATAUAWH" ], [ 36681, "VWATH" ], [ 37031, "ATAUAVH" ], [ 38122, "VWATAUAVH" ], [ 39371, "UVWATAUAVAWH" ], [ 47441, "UVWATAUH" ], [ 49717, "x ATAUAWH" ], [ 52410, "L$ UATAUAVAWH" ], [ 53168, "@UATAUAVAWH" ], [ 56032, "@USVWATAUAVAWH" ], [ 56650, "M0H3" ], [ 59256, "CorExitProcess" ], [ 59272, "wide", "mscoree.dll" ], [ 59296, "runtime error" ], [ 59320, "TLOSS error" ], [ 59336, "SING error" ], [ 59352, "DOMAIN error" ], [ 59376, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 59383, "An application has made an attempt to load the C runtime library incorrectly." ], [ 59461, "Please contact the application's support team for more information." ], [ 59536, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 59543, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 59623, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 59784, "R6032\r\n- not enough space for locale information" ], [ 59791, "- not enough space for locale information" ], [ 59840, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 59847, "- Attempt to initialize the CRT more than once." ], [ 59895, "This indicates a bug in your application." ], [ 59944, "R6030\r\n- CRT not initialized" ], [ 59951, "- CRT not initialized" ], [ 59976, "R6028\r\n- unable to initialize heap" ], [ 59983, "- unable to initialize heap" ], [ 60016, "R6027\r\n- not enough space for lowio initialization" ], [ 60023, "- not enough space for lowio initialization" ], [ 60072, "R6026\r\n- not enough space for stdio initialization" ], [ 60079, "- not enough space for stdio initialization" ], [ 60128, "R6025\r\n- pure virtual function call" ], [ 60135, "- pure virtual function call" ], [ 60168, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 60175, "- not enough space for _onexit/atexit table" ], [ 60224, "R6019\r\n- unable to open console device" ], [ 60231, "- unable to open console device" ], [ 60272, "R6018\r\n- unexpected heap error" ], [ 60279, "- unexpected heap error" ], [ 60312, "R6017\r\n- unexpected multithread lock error" ], [ 60319, "- unexpected multithread lock error" ], [ 60360, "R6016\r\n- not enough space for thread data" ], [ 60367, "- not enough space for thread data" ], [ 60416, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 60418, "This application has requested the Runtime to terminate it in an unusual way." ], [ 60568, "R6009\r\n- not enough space for environment" ], [ 60575, "- not enough space for environment" ], [ 60616, "R6008\r\n- not enough space for arguments" ], [ 60623, "- not enough space for arguments" ], [ 60664, "R6002\r\n- floating point support not loaded" ], [ 60671, "- floating point support not loaded" ], [ 60712, "Microsoft Visual C++ Runtime Library" ], [ 60760, "\u003cprogram name unknown\u003e" ], [ 60784, "Runtime Error!\n\nProgram:" ], [ 60840, "wide", "UTF-16LE" ], [ 60864, "wide", "UNICODE" ], [ 60896, "UTF-16LE" ], [ 60912, "UNICODE" ], [ 61088, "GetProcessWindowStation" ], [ 61112, "GetUserObjectInformationA" ], [ 61144, "GetLastActivePopup" ], [ 61168, "GetActiveWindow" ], [ 61184, "MessageBoxA" ], [ 61200, "USER32.DLL" ], [ 61247, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 62130, "wide", "h(((( H" ], [ 62816, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 63200, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 63440, "dddd, MMMM dd, yyyy" ], [ 63464, "MM/dd/yy" ], [ 63488, "December" ], [ 63504, "November" ], [ 63520, "October" ], [ 63528, "September" ], [ 63540, "August" ], [ 63548, "July" ], [ 63556, "June" ], [ 63564, "April" ], [ 63572, "March" ], [ 63584, "February" ], [ 63600, "January" ], [ 63656, "Saturday" ], [ 63668, "Friday" ], [ 63680, "Thursday" ], [ 63696, "Wednesday" ], [ 63712, "Tuesday" ], [ 63720, "Monday" ], [ 63728, "Sunday" ], [ 63768, "SunMonTueWedThuFriSat" ], [ 63792, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 63856, "d:\\Projects\\WinRAR\\FormatSrc\\arj\\build\\64\\Release\\arj.pdb" ], [ 66546, "10.48.25.49:3634" ], [ 67538, "GetFileAttributesA" ], [ 67560, "SetFileAttributesA" ], [ 67582, "CloseHandle" ], [ 67596, "SetFileTime" ], [ 67610, "LocalFileTimeToFileTime" ], [ 67636, "DosDateTimeToFileTime" ], [ 67660, "CreateFileA" ], [ 67674, "CreateDirectoryA" ], [ 67692, "KERNEL32.dll" ], [ 67720, "USER32.dll" ], [ 67734, "HeapAlloc" ], [ 67746, "GetLastError" ], [ 67762, "HeapFree" ], [ 67774, "DeleteFileA" ], [ 67788, "GetCurrentThreadId" ], [ 67810, "FlsSetValue" ], [ 67824, "GetCommandLineA" ], [ 67842, "TerminateProcess" ], [ 67862, "GetCurrentProcess" ], [ 67882, "UnhandledExceptionFilter" ], [ 67910, "SetUnhandledExceptionFilter" ], [ 67940, "IsDebuggerPresent" ], [ 67960, "RtlVirtualUnwind" ], [ 67980, "RtlLookupFunctionEntry" ], [ 68006, "RtlCaptureContext" ], [ 68026, "RtlUnwindEx" ], [ 68040, "EnterCriticalSection" ], [ 68064, "LeaveCriticalSection" ], [ 68088, "SetHandleCount" ], [ 68106, "GetStdHandle" ], [ 68122, "GetFileType" ], [ 68136, "GetStartupInfoA" ], [ 68154, "DeleteCriticalSection" ], [ 68178, "MultiByteToWideChar" ], [ 68200, "ReadFile" ], [ 68212, "WriteFile" ], [ 68224, "WideCharToMultiByte" ], [ 68246, "GetConsoleCP" ], [ 68262, "GetConsoleMode" ], [ 68280, "GetModuleHandleW" ], [ 68300, "Sleep" ], [ 68308, "GetProcAddress" ], [ 68326, "ExitProcess" ], [ 68340, "GetModuleFileNameA" ], [ 68362, "HeapSetInformation" ], [ 68384, "HeapCreate" ], [ 68398, "HeapDestroy" ], [ 68412, "SetFilePointer" ], [ 68430, "EncodePointer" ], [ 68446, "DecodePointer" ], [ 68462, "FlsGetValue" ], [ 68476, "FlsFree" ], [ 68486, "SetLastError" ], [ 68502, "FlsAlloc" ], [ 68514, "FreeEnvironmentStringsA" ], [ 68540, "GetEnvironmentStrings" ], [ 68564, "FreeEnvironmentStringsW" ], [ 68590, "GetEnvironmentStringsW" ], [ 68616, "QueryPerformanceCounter" ], [ 68642, "GetTickCount" ], [ 68658, "GetCurrentProcessId" ], [ 68680, "GetSystemTimeAsFileTime" ], [ 68706, "InitializeCriticalSectionAndSpinCount" ], [ 68746, "SetStdHandle" ], [ 68762, "WriteConsoleA" ], [ 68778, "GetConsoleOutputCP" ], [ 68800, "WriteConsoleW" ], [ 68816, "FlushFileBuffers" ], [ 68836, "LoadLibraryA" ], [ 68852, "CreateFileW" ], [ 68866, "GetCPInfo" ], [ 68888, "GetOEMCP" ], [ 68900, "IsValidCodePage" ], [ 68918, "HeapReAlloc" ], [ 68932, "HeapSize" ], [ 68944, "GetLocaleInfoA" ], [ 68962, "SetEndOfFile" ], [ 68978, "GetProcessHeap" ], [ 68996, "GetStringTypeA" ], [ 69014, "GetStringTypeW" ], [ 69032, "LCMapStringA" ], [ 69048, "LCMapStringW" ], [ 69182, "arj.dll" ], [ 69190, "Close" ], [ 69196, "Extract" ], [ 69204, "GetComment" ], [ 69215, "GetListItem" ], [ 69227, "GetNextName" ], [ 69239, "Open" ], [ 69244, "Prepare" ], [ 73246, "abcdefghijklmnopqrstuvwxyz" ], [ 73278, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 78502, "wide", "VS_VERSION_INFO" ], [ 78594, "wide", "StringFileInfo" ], [ 78654, "wide", "ProductName" ], [ 78702, "wide", "CompanyName" ], [ 78728, "wide", "Alexander Roshal" ], [ 78770, "wide", "FileDescription" ], [ 78804, "wide", "ARJ format support" ], [ 78850, "wide", "FileVersion" ], [ 78894, "wide", "InternalName" ], [ 78920, "wide", "arj.fmt" ], [ 78942, "wide", "LegalCopyright" ], [ 78972, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 79058, "wide", "VarFileInfo" ], [ 79090, "wide", "Translation" ], [ 79120, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 79195, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 79251, "\u003csecurity\u003e" ], [ 79267, "\u003crequestedPrivileges\u003e" ], [ 79296, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 79392, "\u003c/requestedPrivileges\u003e" ], [ 79422, "\u003c/security\u003e" ], [ 79439, "\u003c/trustInfo\u003e" ], [ 79455, "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD" ] ], "sz": 80896, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 227.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\arj\\build\\64\\Release\\arj.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555991.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 82.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.67" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.28" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "arj.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 80896.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 232.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.10" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b9", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 82.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.25.49:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 82.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 82.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 7.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.44)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "VWATAUAWH", "VWATAUAVH", "UVWATAUAVAWH", "UVWATAUH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.20" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 122880.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 227.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 82.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 227.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 82.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.10" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 227.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "RtlLookupFunctionEntry", "MultiByteToWideChar", "WideCharToMultiByte", "GetModuleFileNameA", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "InitializeCriticalSectionAndSpinCount" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links USER32.dll (OemToCharA)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetFileAttributesA, SetFileAttributesA, CloseHandle, SetFileTime, LocalFileTimeToFileTime, ... +76 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 82.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsGetValue", "FlsSetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "dba612e38426c21bb577d8696e3d74708dcc9ea80ad9f448ebd56da83bd58ac6", "path": "64301!!Formats/arj.fmt", "type": "pe" }, { "f": "KO₆(C₃Al₂As₇Er₇I₂Xe)H₅(Po₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 9, "dp": 1, "id": 7, "is": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "GetCurrentDirectoryA", "FreeLibrary", "GetProcAddress", "LoadLibraryA", "CloseHandle", "CreateProcessA", "Sleep", "GetTickCount", "UnmapViewOfFile", "GetModuleFileNameA", "MapViewOfFile", "CreateFileMappingA", "GetCurrentProcessId", "SetEndOfFile", "ReadFile", "RaiseException", "RtlPcToFileHeader", "RtlLookupFunctionEntry", "RtlUnwindEx", "GetLastError", "HeapFree", "HeapAlloc", "SetFilePointer", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlCaptureContext", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "SetLastError", "FlsAlloc", "HeapSetInformation", "HeapCreate", "HeapDestroy", "GetModuleHandleW", "ExitProcess", "WriteFile", "GetStdHandle", "SetHandleCount", "GetFileType", "GetStartupInfoA", "DeleteCriticalSection", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetSystemTimeAsFileTime", "GetConsoleCP", "GetConsoleMode", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "InitializeCriticalSectionAndSpinCount", "HeapReAlloc", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "MultiByteToWideChar", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "HeapSize", "CreateFileA", "FlushFileBuffers", "GetProcessHeap", "wsprintfA", "OemToCharA" ], "ms": { "pe": { "machine": 34404.0, "checksum": 127872.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\ace\\build\\64\\Release\\ace.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368555995.0, "image_base": 6442450944.0, "rsrc_entropy": 4.57, "entry_section": ".text", "size_of_image": 131072.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 16292.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368555995.0, "import_dll_count": 2.0, "manifest_present": true, "computed_checksum": 127872.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555995.0, "debug_timestamp_min": 1368555995.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 56320.0, "file_size": 84992.0, "entry_point": 16292.0, "code_entropy": 6.39, "data_entropy": 3.95, "export_count": 7.0, "import_count": 85.0, "string_count": 308.0, "section_count": 6.0, "avg_complexity": 9.48, "function_count": 248.0, "import_density": 1.55, "max_complexity": 37.0, "string_density": 5.6, "overall_entropy": 4.21, "avg_basic_blocks": 14.43, "avg_section_size": 13994.67, "dependency_count": 2.0, "entropy_variance": 1.55, "function_density": 4.51, "avg_function_size": 681.71, "avg_string_length": 22.82, "complexity_per_kb": 0.17, "max_string_length": 417.0, "wide_string_count": 24.0, "writable_sections": 1.0, "avg_string_entropy": 3.26, "code_to_data_ratio": 2.04, "data_to_file_ratio": 0.07, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.66, "total_basic_blocks": 303.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 33.17, "debug_reference_count": 1.0, "largest_section_ratio": 0.66, "sentence_string_count": 76.0, "sentence_string_ratio": 0.25, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 512, ".text" ], [ 591, "@.data" ], [ 632, ".pdata" ], [ 671, "@.rsrc" ], [ 711, "@.reloc" ], [ 2730, "I E3" ], [ 2956, "Q E3" ], [ 5981, "x ATAUAVH" ], [ 6871, "WATAUH" ], [ 9672, "t$ WATAUAVAWH" ], [ 10013, "p WATAUH" ], [ 11754, "WATAUAVAWH" ], [ 14797, "UVWATAUAVAWH" ], [ 19632, "8MOC" ], [ 19719, "SVWATAUAVAWH" ], [ 20420, "@SWATAUAVAWH" ], [ 21011, "ATAUAVH" ], [ 21735, "VWATAUAVH" ], [ 23923, "WATAVH" ], [ 28303, "AUAVAWH" ], [ 32486, "\\$ UVWATAUAVAW" ], [ 36449, "UVWATAUH" ], [ 43912, "@UATAUAVAWH" ], [ 45410, "L$ UATAUAVAWH" ], [ 48485, "VWATH" ], [ 48836, "@USVWATAUAVAWH" ], [ 49454, "M0H3" ], [ 50421, "SUVWATAUAVAWH" ], [ 50884, "D09A" ], [ 52012, "D19K" ], [ 55009, "x ATAUAWH" ], [ 58224, "wide", "Unix" ], [ 58272, "wide", "Primos" ], [ 58288, "wide", "Apple GS" ], [ 58312, "wide", "Atari" ], [ 58328, "wide", "VAX VMS" ], [ 58344, "wide", "Amiga" ], [ 58360, "wide", "Next" ], [ 58376, "ACEExtract" ], [ 58392, "ACETest" ], [ 58400, "ACEList" ], [ 58408, "ACEReadArchiveData" ], [ 58432, "ACEInitDll" ], [ 58448, "Formats\\UnAceV2.Dll" ], [ 58472, "UnAceV2.Dll" ], [ 58496, "Formats\\ace32loader.exe" ], [ 58520, "Ace32LoaderMMF%u%u" ], [ 58672, "bad allocation" ], [ 58880, "wide", "(null)" ], [ 58896, "(null)" ], [ 58953, "700WP" ], [ 58969, "`h````" ], [ 59040, "bad exception" ], [ 59056, "CorExitProcess" ], [ 59072, "wide", "mscoree.dll" ], [ 59096, "runtime error" ], [ 59120, "TLOSS error" ], [ 59136, "SING error" ], [ 59152, "DOMAIN error" ], [ 59168, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 59175, "An application has made an attempt to load the C runtime library incorrectly." ], [ 59253, "Please contact the application's support team for more information." ], [ 59328, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 59335, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 59415, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 59576, "R6032\r\n- not enough space for locale information" ], [ 59583, "- not enough space for locale information" ], [ 59632, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 59639, "- Attempt to initialize the CRT more than once." ], [ 59687, "This indicates a bug in your application." ], [ 59736, "R6030\r\n- CRT not initialized" ], [ 59743, "- CRT not initialized" ], [ 59768, "R6028\r\n- unable to initialize heap" ], [ 59775, "- unable to initialize heap" ], [ 59808, "R6027\r\n- not enough space for lowio initialization" ], [ 59815, "- not enough space for lowio initialization" ], [ 59864, "R6026\r\n- not enough space for stdio initialization" ], [ 59871, "- not enough space for stdio initialization" ], [ 59920, "R6025\r\n- pure virtual function call" ], [ 59927, "- pure virtual function call" ], [ 59960, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 59967, "- not enough space for _onexit/atexit table" ], [ 60016, "R6019\r\n- unable to open console device" ], [ 60023, "- unable to open console device" ], [ 60064, "R6018\r\n- unexpected heap error" ], [ 60071, "- unexpected heap error" ], [ 60104, "R6017\r\n- unexpected multithread lock error" ], [ 60111, "- unexpected multithread lock error" ], [ 60152, "R6016\r\n- not enough space for thread data" ], [ 60159, "- not enough space for thread data" ], [ 60208, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 60210, "This application has requested the Runtime to terminate it in an unusual way." ], [ 60360, "R6009\r\n- not enough space for environment" ], [ 60367, "- not enough space for environment" ], [ 60408, "R6008\r\n- not enough space for arguments" ], [ 60415, "- not enough space for arguments" ], [ 60456, "R6002\r\n- floating point support not loaded" ], [ 60463, "- floating point support not loaded" ], [ 60504, "Microsoft Visual C++ Runtime Library" ], [ 60552, "\u003cprogram name unknown\u003e" ], [ 60576, "Runtime Error!\n\nProgram:" ], [ 60768, "Complete Object Locator'" ], [ 60800, "Class Hierarchy Descriptor'" ], [ 60832, "Base Class Array'" ], [ 60856, "Base Class Descriptor at (" ], [ 60888, "Type Descriptor'" ], [ 60912, "`local static thread guard'" ], [ 60944, "`managed vector copy constructor iterator'" ], [ 60992, "`vector vbase copy constructor iterator'" ], [ 61040, "`vector copy constructor iterator'" ], [ 61080, "`dynamic atexit destructor for '" ], [ 61120, "`dynamic initializer for '" ], [ 61152, "`eh vector vbase copy constructor iterator'" ], [ 61200, "`eh vector copy constructor iterator'" ], [ 61240, "`managed vector destructor iterator'" ], [ 61280, "`managed vector constructor iterator'" ], [ 61320, "`placement delete[] closure'" ], [ 61352, "`placement delete closure'" ], [ 61384, "`omni callsig'" ], [ 61400, "delete[]" ], [ 61424, "`local vftable constructor closure'" ], [ 61464, "`local vftable'" ], [ 61496, "`udt returning'" ], [ 61512, "`copy constructor closure'" ], [ 61544, "`eh vector vbase constructor iterator'" ], [ 61584, "`eh vector destructor iterator'" ], [ 61616, "`eh vector constructor iterator'" ], [ 61656, "`virtual displacement map'" ], [ 61688, "`vector vbase constructor iterator'" ], [ 61728, "`vector destructor iterator'" ], [ 61760, "`vector constructor iterator'" ], [ 61792, "`scalar deleting destructor'" ], [ 61824, "`default constructor closure'" ], [ 61856, "`vector deleting destructor'" ], [ 61888, "`vbase destructor'" ], [ 61928, "`local static guard'" ], [ 62128, "operator" ], [ 62168, "delete" ], [ 62184, "__unaligned" ], [ 62200, "__restrict" ], [ 62224, "__clrcall" ], [ 62240, "__fastcall" ], [ 62256, "__thiscall" ], [ 62272, "__stdcall" ], [ 62288, "__pascal" ], [ 62304, "__cdecl" ], [ 63135, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 63278, "700PP" ], [ 63352, "Unknown exception" ], [ 63376, "GetProcessWindowStation" ], [ 63400, "GetUserObjectInformationA" ], [ 63432, "GetLastActivePopup" ], [ 63456, "GetActiveWindow" ], [ 63472, "MessageBoxA" ], [ 63488, "USER32.DLL" ], [ 64274, "wide", "h(((( H" ], [ 64960, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 65344, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 65584, "dddd, MMMM dd, yyyy" ], [ 65608, "MM/dd/yy" ], [ 65632, "December" ], [ 65648, "November" ], [ 65664, "October" ], [ 65672, "September" ], [ 65684, "August" ], [ 65692, "July" ], [ 65700, "June" ], [ 65708, "April" ], [ 65716, "March" ], [ 65728, "February" ], [ 65744, "January" ], [ 65800, "Saturday" ], [ 65812, "Friday" ], [ 65824, "Thursday" ], [ 65840, "Wednesday" ], [ 65856, "Tuesday" ], [ 65864, "Monday" ], [ 65872, "Sunday" ], [ 65920, "SunMonTueWedThuFriSat" ], [ 65944, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 65984, "RSDS" ], [ 66008, "d:\\Projects\\WinRAR\\FormatSrc\\ace\\build\\64\\Release\\ace.pdb" ], [ 66802, "16.48.1.28:5298" ], [ 66906, "20.48.140.107:6322" ], [ 69110, "10.48.1.10:3634" ], [ 70530, "LocalFileTimeToFileTime" ], [ 70556, "DosDateTimeToFileTime" ], [ 70580, "GetCurrentDirectoryA" ], [ 70604, "FreeLibrary" ], [ 70618, "GetProcAddress" ], [ 70636, "LoadLibraryA" ], [ 70652, "CloseHandle" ], [ 70666, "CreateProcessA" ], [ 70684, "Sleep" ], [ 70692, "GetTickCount" ], [ 70708, "UnmapViewOfFile" ], [ 70726, "GetModuleFileNameA" ], [ 70748, "MapViewOfFile" ], [ 70764, "CreateFileMappingA" ], [ 70786, "GetCurrentProcessId" ], [ 70806, "KERNEL32.dll" ], [ 70822, "wsprintfA" ], [ 70846, "USER32.dll" ], [ 70860, "RaiseException" ], [ 70878, "RtlPcToFileHeader" ], [ 70898, "RtlLookupFunctionEntry" ], [ 70924, "RtlUnwindEx" ], [ 70938, "GetLastError" ], [ 70954, "HeapFree" ], [ 70966, "HeapAlloc" ], [ 70978, "SetFilePointer" ], [ 70996, "GetCurrentThreadId" ], [ 71018, "FlsSetValue" ], [ 71032, "GetCommandLineA" ], [ 71050, "TerminateProcess" ], [ 71070, "GetCurrentProcess" ], [ 71090, "UnhandledExceptionFilter" ], [ 71118, "SetUnhandledExceptionFilter" ], [ 71148, "IsDebuggerPresent" ], [ 71168, "RtlVirtualUnwind" ], [ 71188, "RtlCaptureContext" ], [ 71208, "EncodePointer" ], [ 71224, "DecodePointer" ], [ 71240, "FlsGetValue" ], [ 71254, "FlsFree" ], [ 71264, "SetLastError" ], [ 71280, "FlsAlloc" ], [ 71292, "HeapSetInformation" ], [ 71314, "HeapCreate" ], [ 71328, "HeapDestroy" ], [ 71342, "GetModuleHandleW" ], [ 71362, "ExitProcess" ], [ 71376, "WriteFile" ], [ 71388, "GetStdHandle" ], [ 71404, "SetHandleCount" ], [ 71422, "GetFileType" ], [ 71436, "GetStartupInfoA" ], [ 71454, "DeleteCriticalSection" ], [ 71478, "SetStdHandle" ], [ 71494, "EnterCriticalSection" ], [ 71518, "LeaveCriticalSection" ], [ 71542, "FreeEnvironmentStringsA" ], [ 71568, "GetEnvironmentStrings" ], [ 71592, "FreeEnvironmentStringsW" ], [ 71618, "WideCharToMultiByte" ], [ 71640, "GetEnvironmentStringsW" ], [ 71666, "QueryPerformanceCounter" ], [ 71692, "GetSystemTimeAsFileTime" ], [ 71718, "GetConsoleCP" ], [ 71734, "GetConsoleMode" ], [ 71752, "GetCPInfo" ], [ 71774, "GetOEMCP" ], [ 71786, "IsValidCodePage" ], [ 71804, "InitializeCriticalSectionAndSpinCount" ] ], "sz": 84992, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 248.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\ace\\build\\64\\Release\\ace.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555995.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.48" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.26" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "ace.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 84992.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 308.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.21" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b9", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.10:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Randomized executable name string", "e": [ "ace32loader.exe" ], "i": "objectives/anti-static/obfuscation/string::randomized-exe-name", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 7.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.39)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "UVWATAUAVAWH", "SVWATAUAVAWH", "VWATAUAVH", "UVWATAUH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.25" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 131072.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 248.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 248.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.21" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 248.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "16.48.1.28:5298", "20.48.140.107:6322" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "16.48.1.28:5298", "20.48.140.107:6322" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "e5 2f 01 00", "94 4b 00 00", "a9 3d 00 00", "b1 18 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "GetCurrentDirectoryA", "GetModuleFileNameA", "GetCurrentProcessId", "RtlLookupFunctionEntry", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "WideCharToMultiByte", "GetSystemTimeAsFileTime", "InitializeCriticalSectionAndSpinCount", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links USER32.dll (wsprintfA, OemToCharA)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (LocalFileTimeToFileTime, DosDateTimeToFileTime, GetCurrentDirectoryA, FreeLibrary, GetProcAddress, ... +78 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "GetTickCount", "b1 18 00 00", "e5 2f 01 00", "94 4b 00 00", "a9 3d 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 85.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsGetValue", "FlsSetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "9418de86fb97ded806f15eb8a6f1708356f48c388022fca501b8d8f2fea39c07", "path": "64301!!Formats/ace.fmt", "type": "pe" }, { "f": "KO₇(PrAl₂As₉C₂Er₇IXe)H₇(F₂Os₂Po₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 12, "dp": 1, "id": 8, "is": [ "SetFilePointer", "WriteFile", "GetFileSize", "GetCurrentProcess", "GetProcAddress", "GetModuleHandleA", "ReadFile", "CreateHardLinkA", "GetFullPathNameA", "GetLastError", "SetCurrentDirectoryA", "GetCurrentDirectoryA", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "SetFileTime", "CreateDirectoryA", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "CloseHandle", "CreateFileW", "GetFileAttributesA", "CreateFileA", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "HeapFree", "DeleteFileA", "HeapAlloc", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "SetHandleCount", "GetStdHandle", "GetStartupInfoA", "DeleteCriticalSection", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "RtlUnwindEx", "SetLastError", "InitializeCriticalSectionAndSpinCount", "Sleep", "HeapSetInformation", "HeapCreate", "HeapDestroy", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "GetModuleHandleW", "ExitProcess", "GetModuleFileNameA", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "FlsAlloc", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "HeapReAlloc", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "MultiByteToWideChar", "FlushFileBuffers", "LoadLibraryA", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "HeapSize", "SetEndOfFile", "GetProcessHeap", "GetLocaleInfoA", "GetStringTypeA", "GetStringTypeW", "LCMapStringA", "LCMapStringW", "LookupPrivilegeValueA", "AdjustTokenPrivileges", "OpenProcessToken" ], "ms": { "pe": { "machine": 34404.0, "checksum": 90951.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\tar\\build\\64\\Release\\tar.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368555999.0, "image_base": 6442450944.0, "rsrc_entropy": 4.57, "entry_section": ".text", "size_of_image": 106496.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 13984.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368555999.0, "import_dll_count": 2.0, "manifest_present": true, "computed_checksum": 90951.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555999.0, "debug_timestamp_min": 1368555999.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 46080.0, "file_size": 69120.0, "entry_point": 13984.0, "code_entropy": 6.34, "data_entropy": 3.72, "export_count": 5.0, "import_count": 91.0, "string_count": 243.0, "section_count": 6.0, "avg_complexity": 17.33, "function_count": 191.0, "import_density": 2.02, "max_complexity": 44.0, "string_density": 5.4, "overall_entropy": 3.99, "avg_basic_blocks": 27.33, "avg_section_size": 11349.33, "dependency_count": 2.0, "entropy_variance": 1.67, "function_density": 4.24, "avg_function_size": 483.33, "avg_string_length": 24.09, "complexity_per_kb": 0.39, "max_string_length": 417.0, "wide_string_count": 16.0, "writable_sections": 1.0, "avg_string_entropy": 3.29, "code_to_data_ratio": 2.09, "data_to_file_ratio": 0.08, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.67, "total_basic_blocks": 164.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 36.72, "debug_reference_count": 1.0, "largest_section_ratio": 0.67, "sentence_string_count": 47.0, "sentence_string_ratio": 0.19, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 2030, "VWATH" ], [ 2650, "VWATAUAV" ], [ 3171, "l$ VWATAUAW" ], [ 3621, "UVWH" ], [ 4860, "t$ WATAUAVAW" ], [ 6675, "AUAVAWH" ], [ 8684, "t$ WATAUAVAWH" ], [ 12503, "WATAUAVAWH" ], [ 14782, "\\$ UVWATAUAVAW" ], [ 18234, "WATAUH" ], [ 18566, "VWATAUAWH" ], [ 22649, "x ATAUAVH" ], [ 27275, "UVWATAUAVAWH" ], [ 30623, "ATAUAVH" ], [ 31714, "VWATAUAVH" ], [ 34817, "UVWATAUH" ], [ 36341, "x ATAUAWH" ], [ 36741, "SUVWATAUAVAWH" ], [ 37204, "D09A" ], [ 38332, "D19K" ], [ 41034, "L$ UATAUAVAWH" ], [ 41792, "@UATAUAVAWH" ], [ 44392, "@USVWATAUAVAWH" ], [ 45010, "M0H3" ], [ 47984, "SeCreateSymbolicLinkPrivilege" ], [ 48016, "CreateSymbolicLinkA" ], [ 48040, "kernel32.dll" ], [ 48056, ".tar" ], [ 48064, "'sparse file'" ], [ 48080, "././@LongLink" ], [ 48168, "UTF-16LE" ], [ 48184, "UNICODE" ], [ 48192, "CorExitProcess" ], [ 48208, "wide", "mscoree.dll" ], [ 48232, "runtime error" ], [ 48256, "TLOSS error" ], [ 48272, "SING error" ], [ 48288, "DOMAIN error" ], [ 48304, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 48311, "An application has made an attempt to load the C runtime library incorrectly." ], [ 48389, "Please contact the application's support team for more information." ], [ 48464, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 48471, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 48551, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 48712, "R6032\r\n- not enough space for locale information" ], [ 48719, "- not enough space for locale information" ], [ 48768, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 48775, "- Attempt to initialize the CRT more than once." ], [ 48823, "This indicates a bug in your application." ], [ 48872, "R6030\r\n- CRT not initialized" ], [ 48879, "- CRT not initialized" ], [ 48904, "R6028\r\n- unable to initialize heap" ], [ 48911, "- unable to initialize heap" ], [ 48944, "R6027\r\n- not enough space for lowio initialization" ], [ 48951, "- not enough space for lowio initialization" ], [ 49000, "R6026\r\n- not enough space for stdio initialization" ], [ 49007, "- not enough space for stdio initialization" ], [ 49056, "R6025\r\n- pure virtual function call" ], [ 49063, "- pure virtual function call" ], [ 49096, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 49103, "- not enough space for _onexit/atexit table" ], [ 49152, "R6019\r\n- unable to open console device" ], [ 49159, "- unable to open console device" ], [ 49200, "R6018\r\n- unexpected heap error" ], [ 49207, "- unexpected heap error" ], [ 49240, "R6017\r\n- unexpected multithread lock error" ], [ 49247, "- unexpected multithread lock error" ], [ 49288, "R6016\r\n- not enough space for thread data" ], [ 49295, "- not enough space for thread data" ], [ 49344, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 49346, "This application has requested the Runtime to terminate it in an unusual way." ], [ 49496, "R6009\r\n- not enough space for environment" ], [ 49503, "- not enough space for environment" ], [ 49544, "R6008\r\n- not enough space for arguments" ], [ 49551, "- not enough space for arguments" ], [ 49592, "R6002\r\n- floating point support not loaded" ], [ 49599, "- floating point support not loaded" ], [ 49640, "Microsoft Visual C++ Runtime Library" ], [ 49688, "\u003cprogram name unknown\u003e" ], [ 49712, "Runtime Error!\n\nProgram:" ], [ 49904, "GetProcessWindowStation" ], [ 49928, "GetUserObjectInformationA" ], [ 49960, "GetLastActivePopup" ], [ 49984, "GetActiveWindow" ], [ 50000, "MessageBoxA" ], [ 50016, "USER32.DLL" ], [ 50063, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 50946, "wide", "h(((( H" ], [ 51632, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 52016, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 52256, "dddd, MMMM dd, yyyy" ], [ 52280, "MM/dd/yy" ], [ 52304, "December" ], [ 52320, "November" ], [ 52336, "October" ], [ 52344, "September" ], [ 52356, "August" ], [ 52364, "July" ], [ 52372, "June" ], [ 52380, "April" ], [ 52388, "March" ], [ 52400, "February" ], [ 52416, "January" ], [ 52472, "Saturday" ], [ 52484, "Friday" ], [ 52496, "Thursday" ], [ 52512, "Wednesday" ], [ 52528, "Tuesday" ], [ 52536, "Monday" ], [ 52544, "Sunday" ], [ 52584, "SunMonTueWedThuFriSat" ], [ 52608, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 52672, "d:\\Projects\\WinRAR\\FormatSrc\\tar\\build\\64\\Release\\tar.pdb" ], [ 54910, "10.48.1.10:3634" ], [ 55986, "CreateFileA" ], [ 56000, "CreateFileW" ], [ 56014, "CloseHandle" ], [ 56028, "GetLastError" ], [ 56044, "SetFilePointer" ], [ 56062, "WriteFile" ], [ 56074, "GetFileSize" ], [ 56088, "GetCurrentProcess" ], [ 56108, "GetProcAddress" ], [ 56126, "GetModuleHandleA" ], [ 56146, "ReadFile" ], [ 56158, "CreateHardLinkA" ], [ 56176, "GetFullPathNameA" ], [ 56196, "GetFileAttributesA" ], [ 56218, "SetCurrentDirectoryA" ], [ 56242, "GetCurrentDirectoryA" ], [ 56266, "LocalFileTimeToFileTime" ], [ 56292, "DosDateTimeToFileTime" ], [ 56316, "SetFileTime" ], [ 56330, "CreateDirectoryA" ], [ 56350, "FileTimeToDosDateTime" ], [ 56374, "FileTimeToLocalFileTime" ], [ 56398, "KERNEL32.dll" ], [ 56414, "AdjustTokenPrivileges" ], [ 56438, "LookupPrivilegeValueA" ], [ 56462, "OpenProcessToken" ], [ 56480, "ADVAPI32.dll" ], [ 56496, "SetStdHandle" ], [ 56512, "EnterCriticalSection" ], [ 56536, "LeaveCriticalSection" ], [ 56560, "GetFileType" ], [ 56574, "HeapFree" ], [ 56586, "DeleteFileA" ], [ 56600, "HeapAlloc" ], [ 56612, "GetCurrentThreadId" ], [ 56634, "FlsSetValue" ], [ 56648, "GetCommandLineA" ], [ 56666, "SetHandleCount" ], [ 56684, "GetStdHandle" ], [ 56700, "GetStartupInfoA" ], [ 56718, "DeleteCriticalSection" ], [ 56742, "TerminateProcess" ], [ 56762, "UnhandledExceptionFilter" ], [ 56790, "SetUnhandledExceptionFilter" ], [ 56820, "IsDebuggerPresent" ], [ 56840, "RtlVirtualUnwind" ], [ 56860, "RtlLookupFunctionEntry" ], [ 56886, "RtlCaptureContext" ], [ 56906, "RtlUnwindEx" ], [ 56920, "SetLastError" ], [ 56936, "InitializeCriticalSectionAndSpinCount" ], [ 56976, "Sleep" ], [ 56984, "HeapSetInformation" ], [ 57006, "HeapCreate" ], [ 57020, "HeapDestroy" ], [ 57034, "WideCharToMultiByte" ], [ 57056, "GetConsoleCP" ], [ 57072, "GetConsoleMode" ], [ 57090, "GetModuleHandleW" ], [ 57110, "ExitProcess" ], [ 57124, "GetModuleFileNameA" ], [ 57146, "EncodePointer" ], [ 57162, "DecodePointer" ], [ 57178, "FlsGetValue" ], [ 57192, "FlsFree" ], [ 57202, "FlsAlloc" ], [ 57214, "FreeEnvironmentStringsA" ], [ 57240, "GetEnvironmentStrings" ], [ 57264, "FreeEnvironmentStringsW" ], [ 57290, "GetEnvironmentStringsW" ], [ 57316, "QueryPerformanceCounter" ], [ 57342, "GetTickCount" ], [ 57358, "GetCurrentProcessId" ], [ 57380, "GetSystemTimeAsFileTime" ], [ 57406, "HeapReAlloc" ], [ 57420, "WriteConsoleA" ], [ 57436, "GetConsoleOutputCP" ], [ 57458, "WriteConsoleW" ], [ 57474, "MultiByteToWideChar" ], [ 57496, "FlushFileBuffers" ], [ 57516, "LoadLibraryA" ], [ 57532, "GetCPInfo" ], [ 57554, "GetOEMCP" ], [ 57566, "IsValidCodePage" ], [ 57584, "HeapSize" ], [ 57596, "SetEndOfFile" ], [ 57612, "GetProcessHeap" ], [ 57630, "GetLocaleInfoA" ], [ 57648, "GetStringTypeA" ], [ 57666, "GetStringTypeW" ], [ 57684, "LCMapStringA" ], [ 57700, "LCMapStringW" ], [ 57818, "tar.dll" ], [ 57826, "Close" ], [ 57832, "Extract" ], [ 57840, "GetListItem" ], [ 57852, "Open" ], [ 57857, "Prepare" ], [ 61678, "abcdefghijklmnopqrstuvwxyz" ], [ 61710, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 66726, "wide", "VS_VERSION_INFO" ], [ 66818, "wide", "StringFileInfo" ], [ 66878, "wide", "ProductName" ], [ 66926, "wide", "CompanyName" ], [ 66952, "wide", "Alexander Roshal" ], [ 66994, "wide", "FileDescription" ], [ 67028, "wide", "TAR format support" ], [ 67074, "wide", "FileVersion" ], [ 67118, "wide", "InternalName" ], [ 67144, "wide", "tar.fmt" ], [ 67166, "wide", "LegalCopyright" ], [ 67196, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 67282, "wide", "VarFileInfo" ], [ 67314, "wide", "Translation" ], [ 67344, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 67419, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 67475, "\u003csecurity\u003e" ], [ 67491, "\u003crequestedPrivileges\u003e" ], [ 67520, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 67616, "\u003c/requestedPrivileges\u003e" ], [ 67646, "\u003c/security\u003e" ], [ 67663, "\u003c/trustInfo\u003e" ], [ 67679, "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD" ] ], "sz": 69120, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 191.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\tar\\build\\64\\Release\\tar.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555999.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.29" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "tar.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 69120.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 243.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.99" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.10:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.34)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "VWATAUAV", "WATAUAVAWH", "VWATAUAWH", "UVWATAUAVAWH", "VWATAUAVH", "UVWATAUH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 106496.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 191.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 191.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.99" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "c0 fc 00 00", "c8 af 00 00", "01 5f 00 00", "e1 2d 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueA" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SetCurrentDirectoryA", "GetCurrentDirectoryA", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "AdjustTokenPrivileges", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "RtlLookupFunctionEntry", "InitializeCriticalSectionAndSpinCount", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (LookupPrivilegeValueA, AdjustTokenPrivileges, OpenProcessToken)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (SetFilePointer, WriteFile, GetFileSize, GetCurrentProcess, GetProcAddress, ... +83 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "01 5f 00 00", "c0 fc 00 00", "e1 2d 00 00", "c8 af 00 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 91.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsGetValue", "FlsAlloc", "FlsSetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetFileSize", "ReadFile", "CreateFileA", "GetModuleFileNameA", "CreateFileW" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueA", "AdjustTokenPrivileges", "OpenProcessToken" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "8bb2f5f291441e5de278211fef087d6cb34d811e5496bff5b9a6fc63f63f7fd4", "path": "64301!!Formats/tar.fmt", "type": "pe" }, { "f": "KO₇(PrAl₂As₈C₃Er₇IXe)H₇(F₂Os₂Po₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 12, "dp": 1, "id": 9, "is": [ "SetFilePointer", "WriteFile", "GetCurrentProcess", "GetProcAddress", "GetModuleHandleA", "ReadFile", "CreateHardLinkA", "GetFullPathNameA", "GetFileAttributesA", "SetCurrentDirectoryA", "GetLastError", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "GetFileTime", "SetFileTime", "CreateDirectoryA", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "DeleteFileW", "CreateDirectoryW", "CloseHandle", "CreateFileW", "GetCurrentDirectoryA", "CreateFileA", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "HeapFree", "HeapReAlloc", "HeapAlloc", "DeleteFileA", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "SetHandleCount", "GetStdHandle", "GetStartupInfoA", "DeleteCriticalSection", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "RtlUnwindEx", "SetLastError", "InitializeCriticalSectionAndSpinCount", "Sleep", "HeapSetInformation", "HeapCreate", "HeapDestroy", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "GetModuleHandleW", "ExitProcess", "GetModuleFileNameA", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "FlsAlloc", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "MultiByteToWideChar", "FlushFileBuffers", "LoadLibraryA", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "HeapSize", "SetEndOfFile", "GetProcessHeap", "LookupPrivilegeValueA", "AdjustTokenPrivileges", "OpenProcessToken" ], "ms": { "pe": { "machine": 34404.0, "checksum": 141767.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\gz\\build\\64\\Release\\gz.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368556000.0, "image_base": 6442450944.0, "rsrc_entropy": 4.58, "entry_section": ".text", "size_of_image": 163840.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 23736.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368556000.0, "import_dll_count": 2.0, "manifest_present": true, "computed_checksum": 141767.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556000.0, "debug_timestamp_min": 1368556000.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 58880.0, "file_size": 83456.0, "entry_point": 23736.0, "code_entropy": 6.41, "data_entropy": 3.96, "export_count": 5.0, "import_count": 93.0, "string_count": 264.0, "section_count": 6.0, "avg_complexity": 14.0, "function_count": 228.0, "import_density": 1.62, "max_complexity": 36.0, "string_density": 4.59, "overall_entropy": 4.16, "avg_basic_blocks": 20.71, "avg_section_size": 13738.67, "dependency_count": 2.0, "entropy_variance": 1.61, "function_density": 3.97, "avg_function_size": 20099.0, "avg_string_length": 22.73, "complexity_per_kb": 0.24, "max_string_length": 421.0, "wide_string_count": 31.0, "writable_sections": 1.0, "avg_string_entropy": 3.23, "code_to_data_ratio": 2.5, "data_to_file_ratio": 0.07, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.71, "total_basic_blocks": 145.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 35.7, "debug_reference_count": 1.0, "largest_section_ratio": 0.71, "sentence_string_count": 47.0, "sentence_string_ratio": 0.18, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 2606, "VWATH" ], [ 3154, "VWATAUAV" ], [ 3682, "SUVWATAUAVAWH" ], [ 6992, "@SUVWATAUAVAWH" ], [ 9073, "UVWH" ], [ 10294, "UVWATAU" ], [ 11328, "t$ WATAUAVAW" ], [ 12830, "WATAU" ], [ 14747, "AUAVAWH" ], [ 16640, "t$ WATAUAVAWH" ], [ 19750, "WATAUH" ], [ 22255, "WATAUAVAWH" ], [ 24202, "\\$ UVWATAUAVAW" ], [ 29970, "VWATAUAWH" ], [ 32125, "UVWATAUH" ], [ 36469, "x ATAUAVH" ], [ 40783, "ATAUAVH" ], [ 41874, "VWATAUAVH" ], [ 43115, "UVWATAUAVAWH" ], [ 46380, "@UATAUAVAWH" ], [ 47878, "L$ UATAUAVAWH" ], [ 53317, "x ATAUAWH" ], [ 54180, "D09A" ], [ 55308, "D19K" ], [ 56576, "@USVWATAUAVAWH" ], [ 57194, "M0H3" ], [ 60800, "SeCreateSymbolicLinkPrivilege" ], [ 60832, "CreateSymbolicLinkA" ], [ 60856, "kernel32.dll" ], [ 60872, "gz|tgz|qpr|qpk" ], [ 60888, "'sparse file'" ], [ 60904, "././@LongLink" ], [ 60944, "GZIP" ], [ 60984, "wide", "Amiga" ], [ 61000, "wide", "VAX/VMS" ], [ 61016, "wide", "UNIX" ], [ 61032, "wide", "Atari" ], [ 61064, "wide", "Macintosh" ], [ 61088, "wide", "TOPS20" ], [ 61104, "wide", "Windows NT" ], [ 61128, "wide", "PRIMOS" ], [ 61168, "wide", ".qpk" ], [ 61184, "wide", ".qpr" ], [ 61200, "wide", ".tgz" ], [ 61216, "wide", ".tar" ], [ 61232, "wide", "tar.gz" ], [ 61280, "CorExitProcess" ], [ 61296, "wide", "mscoree.dll" ], [ 61320, "runtime error" ], [ 61344, "TLOSS error" ], [ 61360, "SING error" ], [ 61376, "DOMAIN error" ], [ 61392, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 61399, "An application has made an attempt to load the C runtime library incorrectly." ], [ 61477, "Please contact the application's support team for more information." ], [ 61552, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 61559, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 61639, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 61800, "R6032\r\n- not enough space for locale information" ], [ 61807, "- not enough space for locale information" ], [ 61856, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 61863, "- Attempt to initialize the CRT more than once." ], [ 61911, "This indicates a bug in your application." ], [ 61960, "R6030\r\n- CRT not initialized" ], [ 61967, "- CRT not initialized" ], [ 61992, "R6028\r\n- unable to initialize heap" ], [ 61999, "- unable to initialize heap" ], [ 62032, "R6027\r\n- not enough space for lowio initialization" ], [ 62039, "- not enough space for lowio initialization" ], [ 62088, "R6026\r\n- not enough space for stdio initialization" ], [ 62095, "- not enough space for stdio initialization" ], [ 62144, "R6025\r\n- pure virtual function call" ], [ 62151, "- pure virtual function call" ], [ 62184, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 62191, "- not enough space for _onexit/atexit table" ], [ 62240, "R6019\r\n- unable to open console device" ], [ 62247, "- unable to open console device" ], [ 62288, "R6018\r\n- unexpected heap error" ], [ 62295, "- unexpected heap error" ], [ 62328, "R6017\r\n- unexpected multithread lock error" ], [ 62335, "- unexpected multithread lock error" ], [ 62376, "R6016\r\n- not enough space for thread data" ], [ 62383, "- not enough space for thread data" ], [ 62432, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 62434, "This application has requested the Runtime to terminate it in an unusual way." ], [ 62584, "R6009\r\n- not enough space for environment" ], [ 62591, "- not enough space for environment" ], [ 62632, "R6008\r\n- not enough space for arguments" ], [ 62639, "- not enough space for arguments" ], [ 62680, "R6002\r\n- floating point support not loaded" ], [ 62687, "- floating point support not loaded" ], [ 62728, "Microsoft Visual C++ Runtime Library" ], [ 62776, "\u003cprogram name unknown\u003e" ], [ 62800, "Runtime Error!\n\nProgram:" ], [ 62848, "UTF-16LE" ], [ 62864, "UNICODE" ], [ 62911, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 63032, "wide", "UTF-16LE" ], [ 63056, "wide", "UNICODE" ], [ 63232, "GetProcessWindowStation" ], [ 63256, "GetUserObjectInformationA" ], [ 63288, "GetLastActivePopup" ], [ 63312, "GetActiveWindow" ], [ 63328, "MessageBoxA" ], [ 63344, "USER32.DLL" ], [ 64130, "wide", "h(((( H" ], [ 64816, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 65200, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 65440, "dddd, MMMM dd, yyyy" ], [ 65464, "MM/dd/yy" ], [ 65488, "December" ], [ 65504, "November" ], [ 65520, "October" ], [ 65528, "September" ], [ 65540, "August" ], [ 65548, "July" ], [ 65556, "June" ], [ 65564, "April" ], [ 65572, "March" ], [ 65584, "February" ], [ 65600, "January" ], [ 65656, "Saturday" ], [ 65668, "Friday" ], [ 65680, "Thursday" ], [ 65696, "Wednesday" ], [ 65712, "Tuesday" ], [ 65720, "Monday" ], [ 65728, "Sunday" ], [ 65776, "SunMonTueWedThuFriSat" ], [ 65800, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 65840, "RSDS" ], [ 65864, "d:\\Projects\\WinRAR\\FormatSrc\\gz\\build\\64\\Release\\gz.pdb" ], [ 68422, "10.48.1.10:3634" ], [ 69578, "CreateFileA" ], [ 69592, "CreateFileW" ], [ 69606, "CloseHandle" ], [ 69620, "GetLastError" ], [ 69636, "SetFilePointer" ], [ 69654, "WriteFile" ], [ 69666, "GetCurrentProcess" ], [ 69686, "GetProcAddress" ], [ 69704, "GetModuleHandleA" ], [ 69724, "ReadFile" ], [ 69736, "CreateHardLinkA" ], [ 69754, "GetFullPathNameA" ], [ 69774, "GetFileAttributesA" ], [ 69796, "SetCurrentDirectoryA" ], [ 69820, "GetCurrentDirectoryA" ], [ 69844, "LocalFileTimeToFileTime" ], [ 69870, "DosDateTimeToFileTime" ], [ 69894, "GetFileTime" ], [ 69908, "SetFileTime" ], [ 69922, "CreateDirectoryA" ], [ 69942, "FileTimeToDosDateTime" ], [ 69966, "FileTimeToLocalFileTime" ], [ 69992, "DeleteFileW" ], [ 70006, "CreateDirectoryW" ], [ 70024, "KERNEL32.dll" ], [ 70040, "AdjustTokenPrivileges" ], [ 70064, "LookupPrivilegeValueA" ], [ 70088, "OpenProcessToken" ], [ 70106, "ADVAPI32.dll" ], [ 70122, "SetStdHandle" ], [ 70138, "EnterCriticalSection" ], [ 70162, "LeaveCriticalSection" ], [ 70186, "GetFileType" ], [ 70200, "HeapFree" ], [ 70212, "HeapReAlloc" ], [ 70226, "HeapAlloc" ], [ 70238, "DeleteFileA" ], [ 70252, "GetCurrentThreadId" ], [ 70274, "FlsSetValue" ], [ 70288, "GetCommandLineA" ], [ 70306, "SetHandleCount" ], [ 70324, "GetStdHandle" ], [ 70340, "GetStartupInfoA" ], [ 70358, "DeleteCriticalSection" ], [ 70382, "TerminateProcess" ], [ 70402, "UnhandledExceptionFilter" ], [ 70430, "SetUnhandledExceptionFilter" ], [ 70460, "IsDebuggerPresent" ], [ 70480, "RtlVirtualUnwind" ], [ 70500, "RtlLookupFunctionEntry" ], [ 70526, "RtlCaptureContext" ], [ 70546, "RtlUnwindEx" ], [ 70560, "SetLastError" ], [ 70576, "InitializeCriticalSectionAndSpinCount" ], [ 70616, "Sleep" ], [ 70624, "HeapSetInformation" ], [ 70646, "HeapCreate" ], [ 70660, "HeapDestroy" ], [ 70674, "WideCharToMultiByte" ], [ 70696, "GetConsoleCP" ], [ 70712, "GetConsoleMode" ], [ 70730, "GetModuleHandleW" ], [ 70750, "ExitProcess" ], [ 70764, "GetModuleFileNameA" ], [ 70786, "GetCPInfo" ], [ 70808, "GetOEMCP" ], [ 70820, "IsValidCodePage" ], [ 70838, "EncodePointer" ], [ 70854, "DecodePointer" ], [ 70870, "FlsGetValue" ], [ 70884, "FlsFree" ], [ 70894, "FlsAlloc" ], [ 70906, "FreeEnvironmentStringsA" ], [ 70932, "GetEnvironmentStrings" ], [ 70956, "FreeEnvironmentStringsW" ], [ 70982, "GetEnvironmentStringsW" ], [ 71008, "QueryPerformanceCounter" ], [ 71034, "GetTickCount" ], [ 71050, "GetCurrentProcessId" ], [ 71072, "GetSystemTimeAsFileTime" ], [ 71098, "WriteConsoleA" ], [ 71114, "GetConsoleOutputCP" ], [ 71136, "WriteConsoleW" ], [ 71152, "MultiByteToWideChar" ], [ 71174, "FlushFileBuffers" ], [ 71194, "LoadLibraryA" ], [ 71210, "LCMapStringA" ], [ 71226, "LCMapStringW" ], [ 71242, "GetStringTypeA" ], [ 71260, "GetStringTypeW" ], [ 71278, "GetLocaleInfoA" ], [ 71296, "HeapSize" ], [ 71308, "SetEndOfFile" ], [ 71324, "GetProcessHeap" ], [ 71434, "gz.dll" ], [ 71441, "Close" ], [ 71447, "Extract" ], [ 71455, "GetListItem" ], [ 71467, "Open" ], [ 71472, "Prepare" ], [ 74958, "abcdefghijklmnopqrstuvwxyz" ], [ 74990, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 81062, "wide", "VS_VERSION_INFO" ], [ 81154, "wide", "StringFileInfo" ], [ 81214, "wide", "ProductName" ], [ 81262, "wide", "CompanyName" ], [ 81288, "wide", "Alexander Roshal" ], [ 81330, "wide", "FileDescription" ], [ 81364, "wide", "GZ format support" ], [ 81406, "wide", "FileVersion" ], [ 81450, "wide", "InternalName" ], [ 81476, "wide", "gz.fmt" ], [ 81498, "wide", "LegalCopyright" ], [ 81528, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 81614, "wide", "VarFileInfo" ], [ 81646, "wide", "Translation" ], [ 81676, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ] ], "sz": 83456, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 228.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\gz\\build\\64\\Release\\gz.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556000.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 93.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.23" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "gz.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 83456.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 264.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.16" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "DosDateTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b9", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 93.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.10:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 93.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 93.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.41)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "VWATAUAV", "WATAUAVAWH", "VWATAUAWH", "UVWATAUH", "VWATAUAVH", "UVWATAUAVAWH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 163840.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 228.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "2d", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 93.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_function_size = 20099.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 228.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 93.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.16" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 228.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "ac c5 01 00", "24 c6 00 00", "4f bf 01 00", "dd 59 00 00", "99 1b 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueA" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1195.002", "c": 0.8500000238418579, "d": "Extremely large average function size", "e": [ "binary.avg_function_size = 20099.00" ], "i": "objectives/command-and-control/backdoor/binary::massive-code-blob", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SetCurrentDirectoryA", "GetCurrentDirectoryA", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "AdjustTokenPrivileges", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "RtlLookupFunctionEntry", "InitializeCriticalSectionAndSpinCount", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (SetFilePointer, WriteFile, GetCurrentProcess, GetProcAddress, GetModuleHandleA, ... +85 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (LookupPrivilegeValueA, AdjustTokenPrivileges, OpenProcessToken)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "24 c6 00 00", "dd 59 00 00", "4f bf 01 00", "99 1b 00 00", "ac c5 01 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "IsDebuggerPresent", "TerminateProcess" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 93.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsGetValue", "FlsSetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileA", "DeleteFileW", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueA", "OpenProcessToken", "AdjustTokenPrivileges" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "247c60455c2d6b4de0566662759207d333bb8b238d7026833fe1b867f3cbc076", "path": "64301!!Formats/gz.fmt", "type": "pe" }, { "f": "K₂O₅(Al₂As₇C₃Er₈I)H₆(FPo₃Cm₂DbDsMg)Md₃(Bi₄Pa)", "x": 9, "dp": 1, "id": 10, "is": [ "SetFilePointer", "WriteFile", "GetProcAddress", "ReadFile", "GetModuleFileNameW", "FreeLibrary", "LoadLibraryW", "SetFileTime", "DeleteFileW", "GetLastError", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "GetFileAttributesW", "CreateDirectoryW", "RemoveDirectoryW", "GetSystemTimeAsFileTime", "GetFileSize", "SetEndOfFile", "CloseHandle", "CreateFileW", "SetFileAttributesW", "CreateFileA", "HeapSize", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "RtlLookupFunctionEntry", "RtlUnwindEx", "HeapFree", "HeapReAlloc", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "SetHandleCount", "GetStdHandle", "GetStartupInfoA", "DeleteCriticalSection", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlCaptureContext", "SetLastError", "InitializeCriticalSectionAndSpinCount", "Sleep", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "FlsAlloc", "RaiseException", "RtlPcToFileHeader", "GetModuleFileNameA", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "HeapAlloc", "HeapSetInformation", "HeapCreate", "HeapDestroy", "GetModuleHandleW", "ExitProcess", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "LoadLibraryA", "GetLocaleInfoA", "LCMapStringA", "MultiByteToWideChar", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "RegQueryValueExW", "RegCloseKey", "RegOpenKeyExW", "ORDINAL 9", "ORDINAL 2" ], "ms": { "pe": { "machine": 34404.0, "checksum": 107057.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\7z\\build\\64\\Release\\7z.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368555998.0, "image_base": 6442450944.0, "rsrc_entropy": 4.58, "entry_section": ".text", "size_of_image": 102400.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 17628.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368555998.0, "import_dll_count": 3.0, "manifest_present": true, "computed_checksum": 107057.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555998.0, "debug_timestamp_min": 1368555998.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 42496.0, "file_size": 69632.0, "entry_point": 17628.0, "code_entropy": 6.31, "data_entropy": 3.8, "export_count": 5.0, "import_count": 85.0, "string_count": 284.0, "section_count": 6.0, "avg_complexity": 7.1, "function_count": 226.0, "import_density": 2.05, "max_complexity": 22.0, "string_density": 6.84, "overall_entropy": 4.18, "avg_basic_blocks": 11.6, "avg_section_size": 11434.67, "dependency_count": 3.0, "entropy_variance": 1.36, "function_density": 5.45, "avg_function_size": 548.9, "avg_string_length": 24.3, "complexity_per_kb": 0.17, "max_string_length": 421.0, "wide_string_count": 19.0, "writable_sections": 1.0, "avg_string_entropy": 3.33, "code_to_data_ratio": 1.63, "data_to_file_ratio": 0.07, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.61, "total_basic_blocks": 116.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 34.42, "debug_reference_count": 1.0, "largest_section_ratio": 0.61, "sentence_string_count": 76.0, "sentence_string_ratio": 0.27, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 695, "@.reloc" ], [ 2920, "@SUVWATAUAVAW" ], [ 4104, "@UVWATAUAVAW" ], [ 5065, "UVWATAV" ], [ 6178, "f93u" ], [ 6668, "t$ WATAUAVAWH" ], [ 8427, "WATAUH" ], [ 10353, "p WATAUH" ], [ 16043, "WATAUAVAWH" ], [ 19084, "8MOC" ], [ 19171, "SVWATAUAVAWH" ], [ 19872, "@SWATAUAVAWH" ], [ 20463, "ATAUAVH" ], [ 21187, "VWATAUAVH" ], [ 21382, "UVWATAUAVAWH" ], [ 23375, "WATAVH" ], [ 25773, "UVWATAUH" ], [ 31053, "x ATAUAVH" ], [ 35884, "@UATAUAVAWH" ], [ 37382, "L$ UATAUAVAWH" ], [ 40388, "@USVWATAUAVAWH" ], [ 41006, "M0H3" ], [ 44416, "CreateObject" ], [ 44472, "wide", ".out" ], [ 44872, "GetHandlerProperty" ], [ 44896, "wide", "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\winrar.exe" ], [ 45024, "wide", "explorer.exe" ], [ 45056, "wide", "Formats\\7zxa.dll" ], [ 45264, "bad allocation" ], [ 45496, "bad exception" ], [ 45512, "runtime error" ], [ 45536, "TLOSS error" ], [ 45552, "SING error" ], [ 45568, "DOMAIN error" ], [ 45584, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 45591, "An application has made an attempt to load the C runtime library incorrectly." ], [ 45669, "Please contact the application's support team for more information." ], [ 45744, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 45751, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 45831, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 45992, "R6032\r\n- not enough space for locale information" ], [ 45999, "- not enough space for locale information" ], [ 46048, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 46055, "- Attempt to initialize the CRT more than once." ], [ 46103, "This indicates a bug in your application." ], [ 46152, "R6030\r\n- CRT not initialized" ], [ 46159, "- CRT not initialized" ], [ 46184, "R6028\r\n- unable to initialize heap" ], [ 46191, "- unable to initialize heap" ], [ 46224, "R6027\r\n- not enough space for lowio initialization" ], [ 46231, "- not enough space for lowio initialization" ], [ 46280, "R6026\r\n- not enough space for stdio initialization" ], [ 46287, "- not enough space for stdio initialization" ], [ 46336, "R6025\r\n- pure virtual function call" ], [ 46343, "- pure virtual function call" ], [ 46376, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 46383, "- not enough space for _onexit/atexit table" ], [ 46432, "R6019\r\n- unable to open console device" ], [ 46439, "- unable to open console device" ], [ 46480, "R6018\r\n- unexpected heap error" ], [ 46487, "- unexpected heap error" ], [ 46520, "R6017\r\n- unexpected multithread lock error" ], [ 46527, "- unexpected multithread lock error" ], [ 46568, "R6016\r\n- not enough space for thread data" ], [ 46575, "- not enough space for thread data" ], [ 46624, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 46626, "This application has requested the Runtime to terminate it in an unusual way." ], [ 46776, "R6009\r\n- not enough space for environment" ], [ 46783, "- not enough space for environment" ], [ 46824, "R6008\r\n- not enough space for arguments" ], [ 46831, "- not enough space for arguments" ], [ 46872, "R6002\r\n- floating point support not loaded" ], [ 46879, "- floating point support not loaded" ], [ 46920, "Microsoft Visual C++ Runtime Library" ], [ 46968, "\u003cprogram name unknown\u003e" ], [ 46992, "Runtime Error!\n\nProgram:" ], [ 47055, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 47184, "Unknown exception" ], [ 47312, "CorExitProcess" ], [ 47328, "wide", "mscoree.dll" ], [ 47520, "GetProcessWindowStation" ], [ 47544, "GetUserObjectInformationA" ], [ 47576, "GetLastActivePopup" ], [ 47600, "GetActiveWindow" ], [ 47616, "MessageBoxA" ], [ 47632, "USER32.DLL" ], [ 48418, "wide", "h(((( H" ], [ 49104, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 49488, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 49728, "dddd, MMMM dd, yyyy" ], [ 49752, "MM/dd/yy" ], [ 49776, "December" ], [ 49792, "November" ], [ 49808, "October" ], [ 49816, "September" ], [ 49828, "August" ], [ 49836, "July" ], [ 49844, "June" ], [ 49852, "April" ], [ 49860, "March" ], [ 49872, "February" ], [ 49888, "January" ], [ 49944, "Saturday" ], [ 49956, "Friday" ], [ 49968, "Thursday" ], [ 49984, "Wednesday" ], [ 50000, "Tuesday" ], [ 50008, "Monday" ], [ 50016, "Sunday" ], [ 50056, "SunMonTueWedThuFriSat" ], [ 50080, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 50120, "Complete Object Locator'" ], [ 50152, "Class Hierarchy Descriptor'" ], [ 50184, "Base Class Array'" ], [ 50208, "Base Class Descriptor at (" ], [ 50240, "Type Descriptor'" ], [ 50264, "`local static thread guard'" ], [ 50296, "`managed vector copy constructor iterator'" ], [ 50344, "`vector vbase copy constructor iterator'" ], [ 50392, "`vector copy constructor iterator'" ], [ 50432, "`dynamic atexit destructor for '" ], [ 50472, "`dynamic initializer for '" ], [ 50504, "`eh vector vbase copy constructor iterator'" ], [ 50552, "`eh vector copy constructor iterator'" ], [ 50592, "`managed vector destructor iterator'" ], [ 50632, "`managed vector constructor iterator'" ], [ 50672, "`placement delete[] closure'" ], [ 50704, "`placement delete closure'" ], [ 50736, "`omni callsig'" ], [ 50752, "delete[]" ], [ 50776, "`local vftable constructor closure'" ], [ 50816, "`local vftable'" ], [ 50848, "`udt returning'" ], [ 50864, "`copy constructor closure'" ], [ 50896, "`eh vector vbase constructor iterator'" ], [ 50936, "`eh vector destructor iterator'" ], [ 50968, "`eh vector constructor iterator'" ], [ 51008, "`virtual displacement map'" ], [ 51040, "`vector vbase constructor iterator'" ], [ 51080, "`vector destructor iterator'" ], [ 51112, "`vector constructor iterator'" ], [ 51144, "`scalar deleting destructor'" ], [ 51176, "`default constructor closure'" ], [ 51208, "`vector deleting destructor'" ], [ 51240, "`vbase destructor'" ], [ 51280, "`local static guard'" ], [ 51480, "operator" ], [ 51520, "delete" ], [ 51536, "__unaligned" ], [ 51552, "__restrict" ], [ 51576, "__clrcall" ], [ 51592, "__fastcall" ], [ 51608, "__thiscall" ], [ 51624, "__stdcall" ], [ 51640, "__pascal" ], [ 51656, "__cdecl" ], [ 52448, "RSDS" ], [ 52472, "d:\\Projects\\WinRAR\\FormatSrc\\7z\\build\\64\\Release\\7z.pdb" ], [ 54130, "20.48.152.74:6322" ], [ 55778, "10.48.1.20:3634" ], [ 56986, "CreateFileA" ], [ 57000, "CreateFileW" ], [ 57014, "CloseHandle" ], [ 57028, "GetLastError" ], [ 57044, "SetFilePointer" ], [ 57062, "WriteFile" ], [ 57074, "GetProcAddress" ], [ 57092, "ReadFile" ], [ 57104, "GetModuleFileNameW" ], [ 57126, "FreeLibrary" ], [ 57140, "LoadLibraryW" ], [ 57156, "SetFileTime" ], [ 57170, "DeleteFileW" ], [ 57184, "SetFileAttributesW" ], [ 57206, "FileTimeToDosDateTime" ], [ 57230, "FileTimeToLocalFileTime" ], [ 57256, "GetFileAttributesW" ], [ 57278, "CreateDirectoryW" ], [ 57298, "RemoveDirectoryW" ], [ 57318, "GetSystemTimeAsFileTime" ], [ 57344, "GetFileSize" ], [ 57358, "SetEndOfFile" ], [ 57372, "KERNEL32.dll" ], [ 57388, "RegCloseKey" ], [ 57402, "RegQueryValueExW" ], [ 57422, "RegOpenKeyExW" ], [ 57436, "ADVAPI32.dll" ], [ 57450, "OLEAUT32.dll" ], [ 57466, "EnterCriticalSection" ], [ 57490, "LeaveCriticalSection" ], [ 57514, "GetFileType" ], [ 57528, "RtlLookupFunctionEntry" ], [ 57554, "RtlUnwindEx" ], [ 57568, "HeapFree" ], [ 57580, "HeapReAlloc" ], [ 57594, "GetCurrentThreadId" ], [ 57616, "FlsSetValue" ], [ 57630, "GetCommandLineA" ], [ 57648, "SetHandleCount" ], [ 57666, "GetStdHandle" ], [ 57682, "GetStartupInfoA" ], [ 57700, "DeleteCriticalSection" ], [ 57724, "TerminateProcess" ], [ 57744, "GetCurrentProcess" ], [ 57764, "UnhandledExceptionFilter" ], [ 57792, "SetUnhandledExceptionFilter" ], [ 57822, "IsDebuggerPresent" ], [ 57842, "RtlVirtualUnwind" ], [ 57862, "RtlCaptureContext" ], [ 57882, "SetLastError" ], [ 57898, "InitializeCriticalSectionAndSpinCount" ], [ 57938, "Sleep" ], [ 57946, "EncodePointer" ], [ 57962, "DecodePointer" ], [ 57978, "FlsGetValue" ], [ 57992, "FlsFree" ], [ 58002, "FlsAlloc" ], [ 58014, "RaiseException" ], [ 58032, "RtlPcToFileHeader" ], [ 58052, "GetModuleFileNameA" ], [ 58074, "GetCPInfo" ], [ 58096, "GetOEMCP" ], [ 58108, "IsValidCodePage" ], [ 58126, "HeapAlloc" ], [ 58138, "HeapSetInformation" ], [ 58160, "HeapCreate" ], [ 58174, "HeapDestroy" ], [ 58188, "GetModuleHandleW" ], [ 58208, "ExitProcess" ], [ 58222, "FreeEnvironmentStringsA" ], [ 58248, "GetEnvironmentStrings" ], [ 58272, "FreeEnvironmentStringsW" ], [ 58298, "WideCharToMultiByte" ], [ 58320, "GetEnvironmentStringsW" ], [ 58346, "QueryPerformanceCounter" ], [ 58372, "GetTickCount" ], [ 58388, "GetCurrentProcessId" ], [ 58410, "LoadLibraryA" ], [ 58426, "GetLocaleInfoA" ], [ 58444, "LCMapStringA" ], [ 58460, "MultiByteToWideChar" ], [ 58482, "LCMapStringW" ], [ 58498, "GetStringTypeA" ], [ 58516, "GetStringTypeW" ], [ 58534, "HeapSize" ], [ 58641, "Close" ], [ 58647, "Extract" ], [ 58655, "GetListItem" ], [ 58667, "Open" ], [ 58672, "Prepare" ] ], "sz": 69632, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 226.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\7z\\build\\64\\Release\\7z.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555998.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.10" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.33" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "7z.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "explorer.exe" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 69632.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 284.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.18" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.20:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4608)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.31)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "SVWATAUAVAWH", "VWATAUAVH", "UVWATAUAVAWH", "UVWATAUH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1036.005", "c": 0.800000011920929, "d": "explorer.exe process name", "e": [ "explorer.exe" ], "i": "objectives/evasion/masquerade/process::explorer-name", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.27" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 102400.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 226.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 226.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "winrar", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 85.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.18" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 226.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "20.48.152.74:6322" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetModuleFileNameW", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "GetSystemTimeAsFileTime", "RtlLookupFunctionEntry", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "InitializeCriticalSectionAndSpinCount", "GetModuleFileNameA", "WideCharToMultiByte", "GetCurrentProcessId", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 9, ORDINAL 2)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegQueryValueExW, RegCloseKey, RegOpenKeyExW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (SetFilePointer, WriteFile, GetProcAddress, ReadFile, GetModuleFileNameW, ... +75 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 85.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsGetValue", "FlsSetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileW", "ReadFile", "CreateFileA", "GetModuleFileNameA", "GetFileSize" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameW", "GetModuleFileNameA", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "2278c2cb9fedb4755234a790372bdaa3788cd9964fd3de4f958c28243ce48d14", "path": "64301!!Formats/7z.fmt", "type": "pe" }, { "f": "KO₆(C₃Al₂As₇Er₇IXe)H₆(FPo₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 10, "dp": 1, "id": 11, "is": [ "CreateFileA", "CreateFileW", "CloseHandle", "GetLastError", "SetFilePointer", "WriteFile", "SystemTimeToFileTime", "ReadFile", "DeleteFileW", "SetFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "CreateDirectoryW", "SetFileAttributesW", "GetFileAttributesW", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "HeapFree", "HeapAlloc", "RtlLookupFunctionEntry", "RtlUnwindEx", "HeapReAlloc", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "SetHandleCount", "GetStdHandle", "GetStartupInfoA", "DeleteCriticalSection", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlCaptureContext", "SetLastError", "InitializeCriticalSectionAndSpinCount", "Sleep", "HeapSetInformation", "HeapCreate", "HeapDestroy", "GetModuleHandleW", "GetProcAddress", "ExitProcess", "GetModuleFileNameA", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "FlsAlloc", "RaiseException", "RtlPcToFileHeader", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "LoadLibraryA", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "MultiByteToWideChar", "FlushFileBuffers", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "HeapSize", "SetEndOfFile", "GetProcessHeap" ], "ms": { "pe": { "machine": 34404.0, "checksum": 114094.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\iso\\build\\64\\Release\\iso.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368556005.0, "image_base": 6442450944.0, "rsrc_entropy": 4.57, "entry_section": ".text", "size_of_image": 143360.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 25700.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368556005.0, "import_dll_count": 1.0, "manifest_present": true, "computed_checksum": 114094.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556005.0, "debug_timestamp_min": 1368556005.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 66560.0, "file_size": 96256.0, "entry_point": 25700.0, "code_entropy": 6.41, "data_entropy": 3.95, "export_count": 5.0, "import_count": 84.0, "string_count": 307.0, "section_count": 6.0, "avg_complexity": 17.67, "function_count": 284.0, "import_density": 1.29, "max_complexity": 31.0, "string_density": 4.72, "overall_entropy": 4.22, "avg_basic_blocks": 28.17, "avg_section_size": 15872.0, "dependency_count": 1.0, "entropy_variance": 1.55, "function_density": 4.37, "avg_function_size": 621.33, "avg_string_length": 23.09, "complexity_per_kb": 0.27, "max_string_length": 417.0, "wide_string_count": 21.0, "writable_sections": 1.0, "avg_string_entropy": 3.26, "code_to_data_ratio": 2.32, "data_to_file_ratio": 0.06, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.69, "total_basic_blocks": 169.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 33.15, "debug_reference_count": 1.0, "largest_section_ratio": 0.69, "sentence_string_count": 82.0, "sentence_string_ratio": 0.27, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 1978, "VWATH" ], [ 3045, "SUVWATAUAVAW" ], [ 4682, "VWATAUAV" ], [ 7164, "t$ WATAUAVAW" ], [ 8963, "WATAUAVAWH" ], [ 8991, "A 9B" ], [ 10615, "UVWATAUAVAWH" ], [ 11415, "l$ VWATAUAVH" ], [ 11988, "@SUVWATAUAV" ], [ 12933, "x ATAUAVH" ], [ 13159, "WATAUH" ], [ 15159, "AUAVAWH" ], [ 17416, "t$ WATAUAVAWH" ], [ 20105, "p WATAUH" ], [ 28150, "\\$ UVWATAUAVAW" ], [ 32369, "UVWATAUH" ], [ 37947, "ATAUAVH" ], [ 39048, "8MOC" ], [ 39135, "SVWATAUAVAWH" ], [ 39836, "@SWATAUAVAWH" ], [ 41151, "VWATAUAVH" ], [ 43339, "WATAVH" ], [ 53588, "@UATAUAVAWH" ], [ 55086, "L$ UATAUAVAWH" ], [ 61564, "@USVWATAUAVAWH" ], [ 62182, "M0H3" ], [ 62341, "x ATAUAWH" ], [ 62741, "SUVWATAUAVAWH" ], [ 63204, "D09A" ], [ 64332, "D19K" ], [ 68400, "ISO 9660" ], [ 68416, "ISO 9660 Joliet" ], [ 68433, "CD001" ], [ 68448, "wide", "trans.tbl" ], [ 68536, "%x.%02x" ], [ 68552, "*UDF Metadata Partition" ], [ 68576, "*UDF Sparable Partition" ], [ 68600, "*UDF Virtual Partition" ], [ 68632, "*UDF Virtual Alloc Tbl" ], [ 68656, "OSTA Compressed Unicode" ], [ 68680, "bad allocation" ], [ 68896, "CorExitProcess" ], [ 68912, "wide", "mscoree.dll" ], [ 68936, "runtime error" ], [ 68960, "TLOSS error" ], [ 68976, "SING error" ], [ 68992, "DOMAIN error" ], [ 69008, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 69015, "An application has made an attempt to load the C runtime library incorrectly." ], [ 69093, "Please contact the application's support team for more information." ], [ 69168, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 69175, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 69255, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 69416, "R6032\r\n- not enough space for locale information" ], [ 69423, "- not enough space for locale information" ], [ 69472, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 69479, "- Attempt to initialize the CRT more than once." ], [ 69527, "This indicates a bug in your application." ], [ 69576, "R6030\r\n- CRT not initialized" ], [ 69583, "- CRT not initialized" ], [ 69608, "R6028\r\n- unable to initialize heap" ], [ 69615, "- unable to initialize heap" ], [ 69648, "R6027\r\n- not enough space for lowio initialization" ], [ 69655, "- not enough space for lowio initialization" ], [ 69704, "R6026\r\n- not enough space for stdio initialization" ], [ 69711, "- not enough space for stdio initialization" ], [ 69760, "R6025\r\n- pure virtual function call" ], [ 69767, "- pure virtual function call" ], [ 69800, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 69807, "- not enough space for _onexit/atexit table" ], [ 69856, "R6019\r\n- unable to open console device" ], [ 69863, "- unable to open console device" ], [ 69904, "R6018\r\n- unexpected heap error" ], [ 69911, "- unexpected heap error" ], [ 69944, "R6017\r\n- unexpected multithread lock error" ], [ 69951, "- unexpected multithread lock error" ], [ 69992, "R6016\r\n- not enough space for thread data" ], [ 69999, "- not enough space for thread data" ], [ 70048, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 70050, "This application has requested the Runtime to terminate it in an unusual way." ], [ 70200, "R6009\r\n- not enough space for environment" ], [ 70207, "- not enough space for environment" ], [ 70248, "R6008\r\n- not enough space for arguments" ], [ 70255, "- not enough space for arguments" ], [ 70296, "R6002\r\n- floating point support not loaded" ], [ 70303, "- floating point support not loaded" ], [ 70344, "Microsoft Visual C++ Runtime Library" ], [ 70392, "\u003cprogram name unknown\u003e" ], [ 70416, "Runtime Error!\n\nProgram:" ], [ 70479, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 70608, "wide", "UTF-16LE" ], [ 70632, "wide", "UNICODE" ], [ 70672, "Unknown exception" ], [ 70816, "bad exception" ], [ 70832, "wide", "(null)" ], [ 70848, "(null)" ], [ 70905, "700WP" ], [ 70921, "`h````" ], [ 71120, "GetProcessWindowStation" ], [ 71144, "GetUserObjectInformationA" ], [ 71176, "GetLastActivePopup" ], [ 71200, "GetActiveWindow" ], [ 71216, "MessageBoxA" ], [ 71232, "USER32.DLL" ], [ 72018, "wide", "h(((( H" ], [ 72704, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 73088, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 73328, "dddd, MMMM dd, yyyy" ], [ 73352, "MM/dd/yy" ], [ 73376, "December" ], [ 73392, "November" ], [ 73408, "October" ], [ 73416, "September" ], [ 73428, "August" ], [ 73436, "July" ], [ 73444, "June" ], [ 73452, "April" ], [ 73460, "March" ], [ 73472, "February" ], [ 73488, "January" ], [ 73544, "Saturday" ], [ 73556, "Friday" ], [ 73568, "Thursday" ], [ 73584, "Wednesday" ], [ 73600, "Tuesday" ], [ 73608, "Monday" ], [ 73616, "Sunday" ], [ 73710, "700PP" ], [ 73768, "SunMonTueWedThuFriSat" ], [ 73792, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 73832, "Complete Object Locator'" ], [ 73864, "Class Hierarchy Descriptor'" ], [ 73896, "Base Class Array'" ], [ 73920, "Base Class Descriptor at (" ], [ 73952, "Type Descriptor'" ], [ 73976, "`local static thread guard'" ], [ 74008, "`managed vector copy constructor iterator'" ], [ 74056, "`vector vbase copy constructor iterator'" ], [ 74104, "`vector copy constructor iterator'" ], [ 74144, "`dynamic atexit destructor for '" ], [ 74184, "`dynamic initializer for '" ], [ 74216, "`eh vector vbase copy constructor iterator'" ], [ 74264, "`eh vector copy constructor iterator'" ], [ 74304, "`managed vector destructor iterator'" ], [ 74344, "`managed vector constructor iterator'" ], [ 74384, "`placement delete[] closure'" ], [ 74416, "`placement delete closure'" ], [ 74448, "`omni callsig'" ], [ 74464, "delete[]" ], [ 74488, "`local vftable constructor closure'" ], [ 74528, "`local vftable'" ], [ 74560, "`udt returning'" ], [ 74576, "`copy constructor closure'" ], [ 74608, "`eh vector vbase constructor iterator'" ], [ 74648, "`eh vector destructor iterator'" ], [ 74680, "`eh vector constructor iterator'" ], [ 74720, "`virtual displacement map'" ], [ 74752, "`vector vbase constructor iterator'" ], [ 74792, "`vector destructor iterator'" ], [ 74824, "`vector constructor iterator'" ], [ 74856, "`scalar deleting destructor'" ], [ 74888, "`default constructor closure'" ], [ 74920, "`vector deleting destructor'" ], [ 74952, "`vbase destructor'" ], [ 74992, "`local static guard'" ], [ 75192, "operator" ], [ 75232, "delete" ], [ 75248, "__unaligned" ], [ 75264, "__restrict" ], [ 75288, "__clrcall" ], [ 75304, "__fastcall" ], [ 75320, "__thiscall" ], [ 75336, "__stdcall" ], [ 75352, "__pascal" ], [ 75368, "__cdecl" ], [ 76160, "RSDS" ], [ 76184, "d:\\Projects\\WinRAR\\FormatSrc\\iso\\build\\64\\Release\\iso.pdb" ], [ 77834, "20.48.136.106:6322" ], [ 77914, "16.48.9.21:5298" ], [ 79962, "10.48.1.10:3634" ], [ 81266, "CreateFileA" ], [ 81280, "CreateFileW" ], [ 81294, "CloseHandle" ], [ 81308, "GetLastError" ], [ 81324, "SetFilePointer" ], [ 81342, "WriteFile" ], [ 81354, "SystemTimeToFileTime" ], [ 81378, "ReadFile" ], [ 81390, "DeleteFileW" ], [ 81404, "SetFileTime" ], [ 81418, "FileTimeToDosDateTime" ], [ 81442, "FileTimeToLocalFileTime" ], [ 81468, "CreateDirectoryW" ], [ 81488, "SetFileAttributesW" ], [ 81510, "GetFileAttributesW" ], [ 81530, "KERNEL32.dll" ], [ 81546, "SetStdHandle" ], [ 81562, "EnterCriticalSection" ], [ 81586, "LeaveCriticalSection" ], [ 81610, "GetFileType" ], [ 81624, "HeapFree" ], [ 81636, "HeapAlloc" ], [ 81648, "RtlLookupFunctionEntry" ], [ 81674, "RtlUnwindEx" ], [ 81688, "HeapReAlloc" ], [ 81702, "GetCurrentThreadId" ], [ 81724, "FlsSetValue" ], [ 81738, "GetCommandLineA" ], [ 81756, "SetHandleCount" ], [ 81774, "GetStdHandle" ], [ 81790, "GetStartupInfoA" ], [ 81808, "DeleteCriticalSection" ], [ 81832, "TerminateProcess" ], [ 81852, "GetCurrentProcess" ], [ 81872, "UnhandledExceptionFilter" ], [ 81900, "SetUnhandledExceptionFilter" ], [ 81930, "IsDebuggerPresent" ], [ 81950, "RtlVirtualUnwind" ], [ 81970, "RtlCaptureContext" ], [ 81990, "SetLastError" ], [ 82006, "InitializeCriticalSectionAndSpinCount" ], [ 82046, "Sleep" ], [ 82054, "HeapSetInformation" ], [ 82076, "HeapCreate" ], [ 82090, "HeapDestroy" ], [ 82104, "GetModuleHandleW" ], [ 82124, "GetProcAddress" ], [ 82142, "ExitProcess" ], [ 82156, "GetModuleFileNameA" ], [ 82178, "WideCharToMultiByte" ], [ 82200, "GetConsoleCP" ], [ 82216, "GetConsoleMode" ], [ 82234, "GetCPInfo" ], [ 82256, "GetOEMCP" ], [ 82268, "IsValidCodePage" ], [ 82286, "EncodePointer" ], [ 82302, "DecodePointer" ], [ 82318, "FlsGetValue" ], [ 82332, "FlsFree" ], [ 82342, "FlsAlloc" ], [ 82354, "RaiseException" ], [ 82372, "RtlPcToFileHeader" ], [ 82392, "FreeEnvironmentStringsA" ], [ 82418, "GetEnvironmentStrings" ], [ 82442, "FreeEnvironmentStringsW" ], [ 82468, "GetEnvironmentStringsW" ], [ 82494, "QueryPerformanceCounter" ], [ 82520, "GetTickCount" ], [ 82536, "GetCurrentProcessId" ] ], "sz": 96256, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 284.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\iso\\build\\64\\Release\\iso.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556005.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.26" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "iso.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 96256.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 307.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.22" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.10:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.41)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SUVWATAUAVAW", "VWATAUAV", "WATAUAVAWH", "UVWATAUAVAWH", "UVWATAUH", "SVWATAUAVAWH", "VWATAUAVH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.27" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 143360.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 284.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 284.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.22" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 284.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "20.48.136.106:6322", "16.48.9.21:5298" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "20.48.136.106:6322", "16.48.9.21:5298" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "7f 65 01 00", "3f 5c 01 00", "f3 f5 00 00", "2d 47 00 00", "74 25 00 00", "01 18 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SystemTimeToFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "RtlLookupFunctionEntry", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "InitializeCriticalSectionAndSpinCount", "GetModuleFileNameA", "WideCharToMultiByte", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateFileA, CreateFileW, CloseHandle, GetLastError, SetFilePointer, ... +79 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "01 18 00 00", "7f 65 01 00", "f3 f5 00 00", "74 25 00 00", "3f 5c 01 00", "2d 47 00 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "IsDebuggerPresent", "TerminateProcess" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 84.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsSetValue", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "Sleep", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "4fd10c8d6812de1214e83107cde8b93ccb26092ff738f8c6985c22b67dfead5e", "path": "64301!!Formats/iso.fmt", "type": "pe" }, { "f": "KO₄(As₈C₃Er₄I)H₃(Cm₃MgPo)Md₂(Bi₄)", "x": 5, "dp": 1, "id": 12, "is": [ "ORDINAL 150", "ORDINAL 2", "ORDINAL 6", "ORDINAL 9", "CharUpperW", "C_specific_handler", "beginthreadex", "memset", "memcmp", "purecall", "??1type_info@@UEAA@XZ", "memmove", "memcpy", "CxxFrameHandler", "free", "CxxThrowException", "malloc", "dllonexit", "initterm", "?terminate@@YAXXZ", "onexit", "GetSystemInfo", "EnterCriticalSection", "Sleep", "InitializeCriticalSection", "ResetEvent", "SetEvent", "CreateEventW", "WaitForSingleObject", "CloseHandle", "GetLastError", "VirtualFree", "VirtualAlloc", "DeleteCriticalSection", "WaitForMultipleObjects", "LeaveCriticalSection" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "rsrc_size": 6144.0, "subsystem": 2.0, "timestamp": 1303152798.0, "icon_count": 2.0, "image_base": 268435456.0, "rsrc_entropy": 3.91, "entry_section": ".text", "size_of_image": 233472.0, "timestamp_day": 18.0, "file_alignment": 512.0, "resource_count": 3.0, "timestamp_year": 2011.0, "characteristics": 8226.0, "entry_point_rva": 137616.0, "size_of_headers": 1024.0, "timestamp_month": 4.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1303152798.0, "import_dll_count": 4.0, "computed_checksum": 254244.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "rich_header_present": true, "export_timestamp_day": 18.0, "linker_major_version": 8.0, "version_info_present": true, "export_timestamp_year": 2011.0, "export_timestamp_month": 4.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 135168.0, "file_size": 199680.0, "entry_point": 137616.0, "code_entropy": 6.3, "data_entropy": 4.51, "export_count": 7.0, "import_count": 36.0, "string_count": 123.0, "section_count": 6.0, "avg_complexity": 6.8, "function_count": 1029.0, "import_density": 0.27, "max_complexity": 22.0, "string_density": 0.93, "overall_entropy": 4.55, "avg_basic_blocks": 9.5, "avg_section_size": 33109.33, "dependency_count": 4.0, "entropy_variance": 0.97, "function_density": 7.8, "avg_function_size": 153.3, "avg_string_length": 11.86, "complexity_per_kb": 0.05, "max_string_length": 40.0, "wide_string_count": 30.0, "writable_sections": 1.0, "avg_string_entropy": 2.77, "code_to_data_ratio": 2.13, "data_to_file_ratio": 0.01, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.68, "total_basic_blocks": 95.0, "executable_sections": 1.0, "string_length_stddev": 7.69, "largest_section_ratio": 0.68, "sentence_string_count": 4.0, "sentence_string_ratio": 0.03, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".pdata" ], [ 647, "@.rsrc" ], [ 687, "@.reloc" ], [ 1276, "HSUVWATH" ], [ 1384, "HSVWH" ], [ 1844, "HSWH" ], [ 3452, "8H9O" ], [ 5276, "HSUVWH" ], [ 5668, "HSUVWATAUAVAWH" ], [ 6160, "HSUVWATAUH" ], [ 6793, "CX9CT" ], [ 8371, "f93t" ], [ 11508, "HSVWATH" ], [ 12133, "SUVWH" ], [ 12545, "SUVWATH" ], [ 14552, "HSUVWATAUAVH" ], [ 15182, "SUVWATAUAVAWH" ], [ 18549, "SVWH" ], [ 22126, "L$ SUVWATAUAVAWH" ], [ 31590, "SVWATAUAVAWH" ], [ 35692, "HSUVWATAVH" ], [ 36036, "HcADLcAHL" ], [ 39436, "HSW3" ], [ 40075, "f97t" ], [ 42122, "L$ SVWATAUAVAWH" ], [ 45917, "SVWATAUAWH" ], [ 52024, "U E3" ], [ 52174, "W0E3" ], [ 57986, "SUVWATAUAVAWL" ], [ 132140, "SUVI" ], [ 132372, "or0f" ], [ 133056, "SUVW" ], [ 136864, "out of memory" ], [ 137648, "wide", "reduceSize" ], [ 138469, "15.23.35.193:105" ], [ 141920, "wide", "BCJ2" ], [ 142072, "wide", "SPARC" ], [ 142088, "wide", "ARMT" ], [ 142112, "wide", "IA64" ], [ 143406, "wide", "qώNjͽäƱ" ], [ 144224, "wide", "Copy" ], [ 144864, "wide", "Deflate" ], [ 145032, "wide", "Delta" ], [ 145432, "wide", "LZMA2" ], [ 145696, "wide", "LZMA" ], [ 145944, "wide", "PPMD" ], [ 175320, "OLEAUT32.dll" ], [ 175336, "CharUpperW" ], [ 175348, "USER32.dll" ], [ 175362, "malloc" ], [ 175372, "_CxxThrowException" ], [ 175394, "free" ], [ 175402, "__CxxFrameHandler" ], [ 175422, "memcpy" ], [ 175432, "memmove" ], [ 175442, "_purecall" ], [ 175454, "memcmp" ], [ 175464, "memset" ], [ 175474, "_beginthreadex" ], [ 175492, "__C_specific_handler" ], [ 175516, "??1type_info@@UEAA@XZ" ], [ 175538, "msvcrt.dll" ], [ 175552, "__dllonexit" ], [ 175566, "_onexit" ], [ 175576, "?terminate@@YAXXZ" ], [ 175596, "_initterm" ], [ 175608, "GetSystemInfo" ], [ 175624, "EnterCriticalSection" ], [ 175648, "LeaveCriticalSection" ], [ 175672, "WaitForMultipleObjects" ], [ 175698, "DeleteCriticalSection" ], [ 175722, "VirtualAlloc" ], [ 175738, "VirtualFree" ], [ 175752, "GetLastError" ], [ 175768, "CloseHandle" ], [ 175782, "WaitForSingleObject" ], [ 175804, "CreateEventW" ], [ 175820, "SetEvent" ], [ 175832, "ResetEvent" ], [ 175846, "InitializeCriticalSection" ], [ 175874, "Sleep" ], [ 175880, "KERNEL32.dll" ], [ 176014, "7zxa.dll" ], [ 176023, "CreateObject" ], [ 176036, "GetHandlerProperty" ], [ 176055, "GetHandlerProperty2" ], [ 176075, "GetMethodProperty" ], [ 176093, "GetNumberOfFormats" ], [ 176112, "GetNumberOfMethods" ], [ 176131, "SetLargePageMode" ], [ 176656, ".?AVCNewException@@" ], [ 176776, ".?AUCSystemException@@" ], [ 176816, ".?AUCInBufferException@@" ], [ 176864, ".?AUCOutBufferException@@" ], [ 176920, ".?AVCInArchiveException@N7z@NArchive@@" ], [ 178136, "GenuineIntelAuthenticAMDCentaurHauls" ], [ 178267, "9JLX" ], [ 191878, "wide", "VS_VERSION_INFO" ], [ 191970, "wide", "StringFileInfo" ], [ 192030, "wide", "CompanyName" ], [ 192056, "wide", "Igor Pavlov" ], [ 192086, "wide", "FileDescription" ], [ 192120, "wide", "7z Standalone Extracting Plugin" ], [ 192190, "wide", "FileVersion" ], [ 192216, "wide", "9.22 beta" ], [ 192242, "wide", "InternalName" ], [ 192268, "wide", "7zxa" ], [ 192286, "wide", "LegalCopyright" ], [ 192316, "wide", "Copyright (c) 1999-2011 Igor Pavlov" ], [ 192394, "wide", "OriginalFilename" ], [ 192428, "wide", "7zxa.dll" ], [ 192454, "wide", "ProductName" ], [ 192498, "wide", "ProductVersion" ], [ 192554, "wide", "VarFileInfo" ], [ 192586, "wide", "Translation" ], [ 193840, "0yyyyyyyyyyyyyyyyyyyyyyyyyyyyyy\"0" ], [ 194512, "0yyyyyyyyyyyyyyy" ], [ 195944, "0yyyyyyyyyyyyy" ], [ 196416, "333O" ], [ 197098, "33330" ] ], "sz": 199680, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1029.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 6144.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.30000001192092896, "d": "lzma compression reference", "e": [ "LZMA" ], "i": "micro-behaviors/dylib/library::lzma-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1303152798.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.80" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.77" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4b", "47" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 199680.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 123.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.55" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Memory compare", "e": [ "memcmp" ], "i": "micro-behaviors/mem/c-runtime/functions::memcmp", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 36.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "a": "T1562.001", "c": 0.9800000190734863, "d": "AMSI scan buffer memory patch bytes (E_INVALIDARG)", "e": [ "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3", "b8 57 00 07 80 c3" ], "i": "objectives/evasion/anti-av/platform::amsi-memory-patch-hex-bytes", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 2048)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "08 00 bd 37", "03 00 01 04", "08 00 10 99", "04 00 b0 d8", "0a 00 60 0c" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 7.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "HSUVWATH", "HSUVWATAUH", "HSUVWATAUAVH", "SVWATAUAVAWH", "HSUVWATAVH", "SVWATAUAWH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 233472.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1029.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "51" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 36.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1029.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "7zxa.dll" ], "i": "objectives/evasion/masquerade/dll::dll-basename", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 36.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 150", "e": [ "ORDINAL 150" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-150", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.55" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1029.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1029.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1029.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "15.23.35.193:105" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 36.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 36.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeCriticalSection", "GetNumberOfFormats", "GetNumberOfMethods", "GenuineIntelAuthenticAMDCentaurHauls" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetSystemInfo, EnterCriticalSection, Sleep, InitializeCriticalSection, ResetEvent, ... +10 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 150, ORDINAL 2, ORDINAL 6, ORDINAL 9)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (C_specific_handler, beginthreadex, memset, memcmp, purecall, ... +11 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CharUpperW)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.overall_entropy = 4.55", "binary.function_count = 1029.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 } ], "sha": "882a062f622d1e014b3256f3ec08591fe6c63ffc5da4eb08e55859274f71cf02", "path": "64301!!Formats/7zxa.dll", "type": "pe" }, { "f": "KO₇(PrAl₂As₈C₂Er₇IXe)H₇(F₂Os₂Po₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 12, "dp": 1, "id": 13, "is": [ "GetModuleHandleA", "CreateHardLinkA", "GetFullPathNameA", "GetFileAttributesA", "SetCurrentDirectoryA", "GetCurrentDirectoryA", "GetProcAddress", "DosDateTimeToFileTime", "SetFileTime", "CreateDirectoryA", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "DeleteFileW", "GetCurrentProcess", "GetLastError", "LocalFileTimeToFileTime", "CloseHandle", "HeapFree", "HeapAlloc", "DeleteFileA", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "GetFileType", "ReadFile", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "HeapSetInformation", "HeapCreate", "HeapDestroy", "GetModuleHandleW", "Sleep", "ExitProcess", "WriteFile", "GetStdHandle", "GetModuleFileNameA", "RtlUnwindEx", "SetFilePointer", "MultiByteToWideChar", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "SetLastError", "FlsAlloc", "SetHandleCount", "GetStartupInfoA", "DeleteCriticalSection", "InitializeCriticalSectionAndSpinCount", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "LoadLibraryA", "CreateFileW", "FlushFileBuffers", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "HeapReAlloc", "CreateFileA", "HeapSize", "SetEndOfFile", "GetProcessHeap", "LookupPrivilegeValueA", "AdjustTokenPrivileges", "OpenProcessToken" ], "ms": { "pe": { "machine": 34404.0, "checksum": 128109.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\xz\\build\\64\\Release\\xz.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368556008.0, "image_base": 6442450944.0, "rsrc_entropy": 4.58, "entry_section": ".text", "size_of_image": 172032.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 38720.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368556008.0, "import_dll_count": 2.0, "manifest_present": true, "computed_checksum": 128109.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556008.0, "debug_timestamp_min": 1368556008.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 74752.0, "file_size": 99840.0, "entry_point": 38720.0, "code_entropy": 6.44, "data_entropy": 4.03, "export_count": 5.0, "import_count": 91.0, "string_count": 259.0, "section_count": 6.0, "avg_complexity": 7.33, "function_count": 36.0, "import_density": 1.25, "max_complexity": 42.0, "string_density": 3.55, "overall_entropy": 4.16, "avg_basic_blocks": 11.81, "avg_section_size": 16469.33, "dependency_count": 2.0, "entropy_variance": 1.73, "function_density": 0.49, "avg_function_size": 518.42, "avg_string_length": 23.13, "complexity_per_kb": 0.1, "max_string_length": 421.0, "wide_string_count": 20.0, "writable_sections": 1.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 3.11, "data_to_file_ratio": 0.06, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.75, "total_basic_blocks": 425.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 35.94, "debug_reference_count": 1.0, "largest_section_ratio": 0.75, "sentence_string_count": 47.0, "sentence_string_ratio": 0.18, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 695, "@.reloc" ], [ 2281, "H WATAUAVE" ], [ 2729, "x ATAUAVAWE" ], [ 3114, "\\$ UVWATAUH" ], [ 3264, "T4 D" ], [ 3750, "UVWATAUAVAWH" ], [ 5142, "SUVWATAUAVAWH" ], [ 8952, "t$ WATAUAVAWD" ], [ 11741, "{ ATAUAVH" ], [ 14342, "VWATAUAV" ], [ 14870, "UVWATAU" ], [ 15573, "UVWH" ], [ 16792, "t$ WATAUAVAW" ], [ 19743, "VWATAVAWH" ], [ 21305, "G H9G" ], [ 21734, "VWATAUAVH" ], [ 22099, "WATAUH" ], [ 22420, "@SUVWATAUAVAWH" ], [ 23582, "H9F0" ], [ 23773, "F0H9F8s\u003eH+F8" ], [ 24632, "t$ WATAUAVAWH" ], [ 25146, "\\$ UVWATAUAVAWH" ], [ 32871, "AUAVAWH" ], [ 36819, "WATAUAVAWH" ], [ 42976, "D09A" ], [ 44104, "D19K" ], [ 45350, "\\$ UVWATAUAVAW" ], [ 48513, "UVWATAUH" ], [ 53678, "VWATAUAWH" ], [ 54701, "x ATAUAVH" ], [ 56723, "ATAUAVH" ], [ 61889, "VWATH" ], [ 63152, "@UATAUAVAWH" ], [ 64650, "L$ UATAUAVAWH" ], [ 70949, "x ATAUAWH" ], [ 71968, "@USVWATAUAVAWH" ], [ 72586, "M0H3" ], [ 76960, "SeCreateSymbolicLinkPrivilege" ], [ 76992, "CreateSymbolicLinkA" ], [ 77016, "kernel32.dll" ], [ 77064, "wide", ".tar" ], [ 77080, "wide", "tar.xz" ], [ 77112, "'sparse file'" ], [ 77128, "././@LongLink" ], [ 77208, "CorExitProcess" ], [ 77224, "wide", "mscoree.dll" ], [ 77248, "runtime error" ], [ 77272, "TLOSS error" ], [ 77288, "SING error" ], [ 77304, "DOMAIN error" ], [ 77328, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 77335, "An application has made an attempt to load the C runtime library incorrectly." ], [ 77413, "Please contact the application's support team for more information." ], [ 77488, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 77495, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 77575, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 77736, "R6032\r\n- not enough space for locale information" ], [ 77743, "- not enough space for locale information" ], [ 77792, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 77799, "- Attempt to initialize the CRT more than once." ], [ 77847, "This indicates a bug in your application." ], [ 77896, "R6030\r\n- CRT not initialized" ], [ 77903, "- CRT not initialized" ], [ 77928, "R6028\r\n- unable to initialize heap" ], [ 77935, "- unable to initialize heap" ], [ 77968, "R6027\r\n- not enough space for lowio initialization" ], [ 77975, "- not enough space for lowio initialization" ], [ 78024, "R6026\r\n- not enough space for stdio initialization" ], [ 78031, "- not enough space for stdio initialization" ], [ 78080, "R6025\r\n- pure virtual function call" ], [ 78087, "- pure virtual function call" ], [ 78120, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 78127, "- not enough space for _onexit/atexit table" ], [ 78176, "R6019\r\n- unable to open console device" ], [ 78183, "- unable to open console device" ], [ 78224, "R6018\r\n- unexpected heap error" ], [ 78231, "- unexpected heap error" ], [ 78264, "R6017\r\n- unexpected multithread lock error" ], [ 78271, "- unexpected multithread lock error" ], [ 78312, "R6016\r\n- not enough space for thread data" ], [ 78319, "- not enough space for thread data" ], [ 78368, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 78370, "This application has requested the Runtime to terminate it in an unusual way." ], [ 78520, "R6009\r\n- not enough space for environment" ], [ 78527, "- not enough space for environment" ], [ 78568, "R6008\r\n- not enough space for arguments" ], [ 78575, "- not enough space for arguments" ], [ 78616, "R6002\r\n- floating point support not loaded" ], [ 78623, "- floating point support not loaded" ], [ 78664, "Microsoft Visual C++ Runtime Library" ], [ 78712, "\u003cprogram name unknown\u003e" ], [ 78736, "Runtime Error!\n\nProgram:" ], [ 78792, "wide", "UTF-16LE" ], [ 78816, "wide", "UNICODE" ], [ 78863, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 78976, "UTF-16LE" ], [ 78992, "UNICODE" ], [ 79168, "GetProcessWindowStation" ], [ 79192, "GetUserObjectInformationA" ], [ 79224, "GetLastActivePopup" ], [ 79248, "GetActiveWindow" ], [ 79264, "MessageBoxA" ], [ 79280, "USER32.DLL" ], [ 80066, "wide", "h(((( H" ], [ 80752, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 81136, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 81376, "dddd, MMMM dd, yyyy" ], [ 81400, "MM/dd/yy" ], [ 81424, "December" ], [ 81440, "November" ], [ 81456, "October" ], [ 81464, "September" ], [ 81476, "August" ], [ 81484, "July" ], [ 81492, "June" ], [ 81500, "April" ], [ 81508, "March" ], [ 81520, "February" ], [ 81536, "January" ], [ 81592, "Saturday" ], [ 81604, "Friday" ], [ 81616, "Thursday" ], [ 81632, "Wednesday" ], [ 81648, "Tuesday" ], [ 81656, "Monday" ], [ 81664, "Sunday" ], [ 81712, "SunMonTueWedThuFriSat" ], [ 81736, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 81800, "d:\\Projects\\WinRAR\\FormatSrc\\xz\\build\\64\\Release\\xz.pdb" ], [ 84990, "10.48.1.10:3634" ], [ 86090, "CloseHandle" ], [ 86104, "GetLastError" ], [ 86120, "GetCurrentProcess" ], [ 86140, "GetProcAddress" ], [ 86158, "GetModuleHandleA" ], [ 86178, "CreateHardLinkA" ], [ 86196, "GetFullPathNameA" ], [ 86216, "GetFileAttributesA" ], [ 86238, "SetCurrentDirectoryA" ], [ 86262, "GetCurrentDirectoryA" ], [ 86286, "LocalFileTimeToFileTime" ], [ 86312, "DosDateTimeToFileTime" ], [ 86336, "SetFileTime" ], [ 86350, "CreateDirectoryA" ], [ 86370, "FileTimeToDosDateTime" ], [ 86394, "FileTimeToLocalFileTime" ], [ 86420, "DeleteFileW" ], [ 86432, "KERNEL32.dll" ], [ 86448, "AdjustTokenPrivileges" ], [ 86472, "LookupPrivilegeValueA" ], [ 86496, "OpenProcessToken" ], [ 86514, "ADVAPI32.dll" ], [ 86530, "HeapFree" ], [ 86542, "HeapAlloc" ], [ 86554, "DeleteFileA" ], [ 86568, "SetStdHandle" ], [ 86584, "EnterCriticalSection" ], [ 86608, "LeaveCriticalSection" ], [ 86632, "GetFileType" ], [ 86646, "ReadFile" ], [ 86658, "GetCurrentThreadId" ], [ 86680, "FlsSetValue" ], [ 86694, "GetCommandLineA" ], [ 86712, "TerminateProcess" ], [ 86732, "UnhandledExceptionFilter" ], [ 86760, "SetUnhandledExceptionFilter" ], [ 86790, "IsDebuggerPresent" ], [ 86810, "RtlVirtualUnwind" ], [ 86830, "RtlLookupFunctionEntry" ], [ 86856, "RtlCaptureContext" ], [ 86876, "HeapSetInformation" ], [ 86898, "HeapCreate" ], [ 86912, "HeapDestroy" ], [ 86926, "GetModuleHandleW" ], [ 86946, "Sleep" ], [ 86954, "ExitProcess" ], [ 86968, "WriteFile" ], [ 86980, "GetStdHandle" ], [ 86996, "GetModuleFileNameA" ], [ 87018, "RtlUnwindEx" ], [ 87032, "SetFilePointer" ], [ 87050, "MultiByteToWideChar" ], [ 87072, "WideCharToMultiByte" ], [ 87094, "GetConsoleCP" ], [ 87110, "GetConsoleMode" ], [ 87128, "GetCPInfo" ], [ 87150, "GetOEMCP" ], [ 87162, "IsValidCodePage" ], [ 87180, "EncodePointer" ], [ 87196, "DecodePointer" ], [ 87212, "FlsGetValue" ], [ 87226, "FlsFree" ], [ 87236, "SetLastError" ], [ 87252, "FlsAlloc" ], [ 87264, "SetHandleCount" ], [ 87282, "GetStartupInfoA" ], [ 87300, "DeleteCriticalSection" ], [ 87324, "InitializeCriticalSectionAndSpinCount" ], [ 87364, "FreeEnvironmentStringsA" ], [ 87390, "GetEnvironmentStrings" ], [ 87414, "FreeEnvironmentStringsW" ], [ 87440, "GetEnvironmentStringsW" ], [ 87466, "QueryPerformanceCounter" ], [ 87492, "GetTickCount" ], [ 87508, "GetCurrentProcessId" ], [ 87530, "GetSystemTimeAsFileTime" ], [ 87556, "LoadLibraryA" ], [ 87572, "CreateFileW" ], [ 87586, "FlushFileBuffers" ], [ 87606, "WriteConsoleA" ], [ 87622, "GetConsoleOutputCP" ], [ 87644, "WriteConsoleW" ], [ 87660, "LCMapStringA" ], [ 87676, "LCMapStringW" ], [ 87692, "GetStringTypeA" ], [ 87710, "GetStringTypeW" ], [ 87728, "GetLocaleInfoA" ], [ 87746, "HeapReAlloc" ], [ 87760, "CreateFileA" ], [ 87774, "HeapSize" ], [ 87786, "SetEndOfFile" ], [ 87802, "GetProcessHeap" ], [ 87914, "xz.dll" ], [ 87921, "Close" ], [ 87927, "Extract" ], [ 87935, "GetListItem" ], [ 87947, "Open" ], [ 87952, "Prepare" ], [ 90430, "abcdefghijklmnopqrstuvwxyz" ], [ 90462, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 97446, "wide", "VS_VERSION_INFO" ], [ 97538, "wide", "StringFileInfo" ], [ 97598, "wide", "ProductName" ], [ 97646, "wide", "CompanyName" ], [ 97672, "wide", "Alexander Roshal" ], [ 97714, "wide", "FileDescription" ], [ 97748, "wide", "XZ format support" ], [ 97790, "wide", "FileVersion" ], [ 97834, "wide", "InternalName" ], [ 97860, "wide", "xz.fmt" ], [ 97882, "wide", "LegalCopyright" ], [ 97912, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 97998, "wide", "VarFileInfo" ], [ 98030, "wide", "Translation" ], [ 98060, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 98135, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 98191, "\u003csecurity\u003e" ], [ 98207, "\u003crequestedPrivileges\u003e" ], [ 98236, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 98332, "\u003c/requestedPrivileges\u003e" ] ], "sz": 99840, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 36.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\xz\\build\\64\\Release\\xz.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz", "xz", "xz", "xz" ], "i": "micro-behaviors/dylib/library::xz-ref", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556008.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.75" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.33" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "xz.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 99840.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 259.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.16" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "DosDateTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b9", "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.10:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 5.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.44)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "UVWATAUAVAWH", "VWATAUAV", "VWATAVAWH", "VWATAUAVH", "WATAUAVAWH", "UVWATAUH", "VWATAUAWH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 172032.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 36.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 425.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.16" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "44 f5 01 00", "a4 f0 00 00", "7c f0 01 00", "7d 87 00 00", "85 40 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueA" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.75" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SetCurrentDirectoryA", "GetCurrentDirectoryA", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "AdjustTokenPrivileges", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "RtlLookupFunctionEntry", "GetModuleFileNameA", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (LookupPrivilegeValueA, AdjustTokenPrivileges, OpenProcessToken)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetModuleHandleA, CreateHardLinkA, GetFullPathNameA, GetFileAttributesA, SetCurrentDirectoryA, ... +83 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "a4 f0 00 00", "7d 87 00 00", "44 f5 01 00", "85 40 00 00", "7c f0 01 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "IsDebuggerPresent", "TerminateProcess" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 91.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsGetValue", "FlsSetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileW", "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueA", "OpenProcessToken", "AdjustTokenPrivileges" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "IsDebuggerPresent", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "b2a32e36c9eec06bd55bd6ef22e6dd3143f54731929cd2c2446bc6902cf44c6d", "path": "64301!!Formats/xz.fmt", "type": "pe" }, { "f": "KO₉(PrAlAs₉C₄CoEr₆I₄P₂Xe)H₆(F₆Os₃Po₄Db₂DsMg)Md₅(SiBi₅PaPt)", "x": 19, "dp": 1, "id": 14, "is": [ "InitCommonControlsEx", "SHAutoComplete", "ReadFile", "GetFileAttributesW", "SetFileAttributesW", "FindNextFileW", "GetFullPathNameW", "GetModuleFileNameW", "FindResourceW", "GetModuleHandleW", "FreeLibrary", "GetProcAddress", "LoadLibraryW", "GetCurrentProcessId", "GetLocaleInfoW", "GetNumberFormatW", "ExpandEnvironmentStringsW", "WaitForSingleObject", "DosDateTimeToFileTime", "GetDateFormatW", "GetTimeFormatW", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "GetExitCodeProcess", "GetTempPathW", "MoveFileExW", "Sleep", "UnmapViewOfFile", "MapViewOfFile", "GetCommandLineW", "CreateFileMappingW", "GetTickCount", "SetEnvironmentVariableW", "OpenFileMappingW", "CreateThread", "EnterCriticalSection", "LeaveCriticalSection", "GetProcessAffinityMask", "ReleaseSemaphore", "ResetEvent", "DeleteCriticalSection", "SetEvent", "SetThreadPriority", "InitializeCriticalSection", "CreateEventW", "CreateSemaphoreW", "SystemTimeToFileTime", "GetSystemTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "FindFirstFileW", "GetFileType", "WriteConsoleW", "GetConsoleOutputCP", "WriteConsoleA", "SetStdHandle", "GetLocaleInfoA", "GetStringTypeW", "GetStringTypeA", "InitializeCriticalSectionAndSpinCount", "LoadLibraryA", "GetConsoleMode", "GetConsoleCP", "QueryPerformanceCounter", "SetHandleCount", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "LCMapStringW", "LCMapStringA", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "ExitProcess", "HeapSize", "RtlCaptureContext", "RtlVirtualUnwind", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "TerminateProcess", "HeapCreate", "HeapSetInformation", "FlsAlloc", "GetCurrentThreadId", "FlsFree", "FlsSetValue", "FlsGetValue", "DecodePointer", "EncodePointer", "GetStartupInfoA", "GetCommandLineA", "HeapAlloc", "RtlPcToFileHeader", "RaiseException", "SetEndOfFile", "SetFilePointer", "GetStdHandle", "WriteFile", "FlushFileBuffers", "GetLongPathNameW", "MoveFileW", "GetShortPathNameW", "CreateDirectoryW", "RemoveDirectoryW", "SetCurrentDirectoryW", "DeleteFileW", "FindClose", "CreateFileW", "DeviceIoControl", "SetFileTime", "GetCurrentProcess", "CloseHandle", "CreateHardLinkW", "SetLastError", "GetLastError", "GetCurrentDirectoryW", "CreateFileA", "GlobalAlloc", "GetSystemTimeAsFileTime", "HeapReAlloc", "HeapFree", "RtlUnwindEx", "RtlLookupFunctionEntry", "EnableWindow", "GetDlgItem", "ShowWindow", "MessageBoxW", "FindWindowExW", "GetParent", "MapWindowPoints", "CreateWindowExW", "UpdateWindow", "LoadCursorW", "RegisterClassExW", "DefWindowProcW", "DestroyWindow", "CopyRect", "IsWindow", "CharUpperW", "OemToCharBuffA", "LoadBitmapW", "SetWindowLongPtrW", "PostMessageW", "GetSysColor", "SetForegroundWindow", "WaitForInputIdle", "IsWindowVisible", "DialogBoxParamW", "DestroyIcon", "SetFocus", "GetClassNameW", "SendDlgItemMessageW", "GetDlgItemTextW", "EndDialog", "SetDlgItemTextW", "wvsprintfW", "SendMessageW", "GetDC", "ReleaseDC", "PeekMessageW", "GetMessageW", "TranslateMessage", "DispatchMessageW", "LoadStringW", "GetWindowRect", "GetClientRect", "GetWindowLongPtrW", "SetWindowPos", "GetWindowTextW", "SetWindowTextW", "GetSystemMetrics", "GetWindow", "GetWindowLongW", "SetWindowLongW", "LoadIconW", "GetDeviceCaps", "CreateCompatibleDC", "GetObjectW", "CreateCompatibleBitmap", "SelectObject", "StretchBlt", "DeleteDC", "DeleteObject", "GetOpenFileNameW", "CommDlgExtendedError", "GetSaveFileNameW", "RegOpenKeyExW", "RegQueryValueExW", "RegCreateKeyExW", "RegSetValueExW", "RegCloseKey", "SetFileSecurityW", "OpenProcessToken", "LookupPrivilegeValueW", "AdjustTokenPrivileges", "SHBrowseForFolderW", "ShellExecuteExW", "SHGetSpecialFolderLocation", "SHFileOperationW", "SHGetPathFromIDListW", "SHGetMalloc", "SHChangeNotify", "SHGetFileInfoW", "CLSIDFromString", "CoCreateInstance", "OleInitialize", "OleUninitialize", "CreateStreamOnHGlobal", "ORDINAL 8" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\SFX\\build\\sfxrar64\\Release\\sfxrar.pdb", "rsrc_size": 17408.0, "subsystem": 2.0, "timestamp": 1368556014.0, "icon_count": 2.0, "image_base": 5368709120.0, "rsrc_entropy": 4.67, "entry_section": ".text", "size_of_image": 389120.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2013.0, "characteristics": 35.0, "entry_point_rva": 138908.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1368556014.0, "import_dll_count": 10.0, "manifest_present": true, "computed_checksum": 275910.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556014.0, "debug_timestamp_min": 1368556014.0, "dll_characteristics": 33024.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 176128.0, "file_size": 241664.0, "entry_point": 138908.0, "code_entropy": 6.45, "data_entropy": 4.21, "import_count": 216.0, "string_count": 604.0, "section_count": 5.0, "avg_complexity": 14.0, "function_count": 703.0, "import_density": 1.26, "max_complexity": 14.0, "string_density": 3.51, "overall_entropy": 4.75, "avg_basic_blocks": 31.0, "avg_section_size": 48128.0, "dependency_count": 10.0, "entropy_variance": 1.38, "function_density": 4.09, "avg_function_size": 494.0, "avg_string_length": 21.13, "complexity_per_kb": 0.08, "max_string_length": 248.0, "wide_string_count": 133.0, "writable_sections": 1.0, "avg_string_entropy": 3.24, "code_to_data_ratio": 2.73, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.07, "text_to_file_ratio": 0.73, "total_basic_blocks": 31.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 24.04, "debug_reference_count": 1.0, "largest_section_ratio": 0.73, "sentence_string_count": 126.0, "sentence_string_ratio": 0.21, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 2099, "WATAUAVAWH" ], [ 3353, "UVWH" ], [ 4772, "@UVWATAUAVAW" ], [ 7936, "t$ WATAUAVAW" ], [ 16942, "UVWATAUAVAWH" ], [ 19269, "x ATAUAVH" ], [ 19663, "WATAUH" ], [ 20043, "WATAU" ], [ 21676, "t$ WATAUAVAWH" ], [ 22937, "{ ATAUAVH" ], [ 23388, "L$ VWATAUAWH" ], [ 25065, "x ATAUAVAWH" ], [ 29249, "x AUAVAWH" ], [ 30046, "VWATAUAV" ], [ 30589, "VWATH" ], [ 36977, "x ATAUAV" ], [ 38543, "VWAUH" ], [ 39364, "@SUVWATAUAVH" ], [ 40565, "UVWATAUAVAW" ], [ 45540, "f92t" ], [ 46986, "f99u" ], [ 47508, "/tYH" ], [ 55929, "x ATAVAWH" ], [ 58825, "p WATAUAVAWH" ], [ 62617, "C E3" ], [ 77436, "xxxxwwww" ], [ 78115, "SUVWATAUAVAWH" ], [ 79594, "gfffffffI" ], [ 97018, "VWATAUAVH" ], [ 101359, "WATAWH" ], [ 102620, "@SUVWATAUAVAWH" ], [ 110781, "U E3" ], [ 114732, "F0E3" ], [ 115787, "ATAUAVH" ], [ 121388, "L$ UVWATAUAVAW" ], [ 123056, "C8E3" ], [ 124573, "p WATAUH" ], [ 125005, "x ATAUAWH" ], [ 131539, "SVWATH" ], [ 137396, "8MOC" ], [ 137483, "SVWATAUAVAWH" ], [ 138184, "@SWATAUAVAWH" ], [ 141687, "WATAVH" ], [ 151065, "UVWATAUH" ], [ 153144, "@UATAUAVAWH" ], [ 159802, "\\$ UVWATAUAVAW" ], [ 164707, "AUAVAWH" ], [ 165886, "L$ UATAUAVAWH" ], [ 167444, "@USVWATAUAVAWH" ], [ 168062, "M0H3" ], [ 179280, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 180280, "wide", "SeRestorePrivilege" ], [ 180320, "wide", "SeSecurityPrivilege" ], [ 180520, "wide", "SeCreateSymbolicLinkPrivilege" ], [ 180888, "wide", "%.*ls(%u)%ls" ], [ 180960, "wide", "rtmp%d" ], [ 180976, "YNANRC" ], [ 181072, "bad allocation" ], [ 181096, "wide", "__rar_" ], [ 181208, "wide", ".rar" ], [ 181352, "wide", "*messages***" ], [ 181384, "*messages***" ], [ 181440, "CryptUnprotectMemory" ], [ 181464, "CryptProtectMemory" ], [ 181488, "wide", "Crypt32.dll" ], [ 181512, "wide", "CryptUnprotectMemory failed" ], [ 181568, "wide", "CryptProtectMemory failed" ], [ 181648, "wide", "RENAMEDLG" ], [ 181672, "wide", "GETPASSWORD1" ], [ 181712, "wide", "ASKNEXTVOL" ], [ 181736, "wide", "Software\\WinRAR SFX" ], [ 181776, "wide", "STATIC" ], [ 181808, "wide", "%s %s %s" ], [ 181832, "wide", "REPLACEFILEDLG" ], [ 181912, "wide", ".exe" ], [ 181928, "wide", "Install" ], [ 181944, "wide", ".inf" ], [ 182000, "wide", ".lnk" ], [ 182016, "wide", "%s%s%d" ], [ 182032, "wide", "%s.%d.tmp" ], [ 182056, "wide", "\u003cbr\u003e" ], [ 182072, "wide", "ProgramFilesDir" ], [ 182112, "wide", "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 182208, "wide", "Delete" ], [ 182224, "wide", "Text" ], [ 182240, "wide", "Title" ], [ 182256, "wide", "Path" ], [ 182272, "wide", "Silent" ], [ 182288, "wide", "Overwrite" ], [ 182312, "wide", "Setup" ], [ 182328, "wide", "TempMode" ], [ 182352, "wide", "License" ], [ 182368, "wide", "Presetup" ], [ 182392, "wide", "Shortcut" ], [ 182416, "wide", "SavePath" ], [ 182440, "wide", "Update" ], [ 182456, "wide", "SetupCode" ], [ 182520, "wide", "LICENSEDLG" ], [ 182608, "wide", "winrarsfxmappingfile.tmp" ], [ 182664, "wide", "runas" ], [ 182680, "wide", "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" ], [ 182744, "wide", "__tmp_rar_sfx_access_check_%u" ], [ 182808, "wide", "STARTDLG" ], [ 182832, "wide", "sfxname" ], [ 183120, "SetDllDirectoryW" ], [ 183144, "wide", "kernel32" ], [ 183168, "wide", "CreateThread failed" ], [ 183216, "wide", "WaitForMultipleObjects error %d, GetLastError %d" ], [ 183328, "wide", "Thread pool initialization failed." ], [ 184144, "wide", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e" ], [ 184256, "wide", "\u003c/html\u003e" ], [ 184272, "wide", "utf-8\"\u003e\u003c/head\u003e" ], [ 184304, "wide", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=" ], [ 184440, "wide", "\u003chtml\u003e" ], [ 184456, "wide", "\u003c/style\u003e" ], [ 184480, "wide", "\u003cstyle\u003e" ], [ 184496, "wide", "\u003c/p\u003e" ], [ 184512, "wide", "about:blank" ], [ 184536, "wide", "Shell.Explorer" ], [ 184568, "wide", "RarHtmlClassName" ], [ 184608, "wide", "EDIT" ], [ 184624, "wide", "riched20.dll" ], [ 184656, "wide", "riched32.dll" ], [ 185160, "Unknown exception" ], [ 185216, "bad exception" ], [ 185232, "CorExitProcess" ], [ 185248, "wide", "mscoree.dll" ], [ 185296, "wide", "UTF-16LE" ], [ 185320, "wide", "UNICODE" ], [ 185336, "runtime error" ], [ 185360, "TLOSS error" ], [ 185376, "SING error" ], [ 185392, "DOMAIN error" ], [ 185408, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 185415, "An application has made an attempt to load the C runtime library incorrectly." ], [ 185493, "Please contact the application's support team for more information." ], [ 185568, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 185575, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 185655, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 185816, "R6032\r\n- not enough space for locale information" ], [ 185823, "- not enough space for locale information" ], [ 185872, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 185879, "- Attempt to initialize the CRT more than once." ], [ 185927, "This indicates a bug in your application." ], [ 185976, "R6030\r\n- CRT not initialized" ], [ 185983, "- CRT not initialized" ], [ 186008, "R6028\r\n- unable to initialize heap" ], [ 186015, "- unable to initialize heap" ], [ 186048, "R6027\r\n- not enough space for lowio initialization" ], [ 186055, "- not enough space for lowio initialization" ], [ 186104, "R6026\r\n- not enough space for stdio initialization" ], [ 186111, "- not enough space for stdio initialization" ], [ 186160, "R6025\r\n- pure virtual function call" ], [ 186167, "- pure virtual function call" ], [ 186200, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 186207, "- not enough space for _onexit/atexit table" ], [ 186256, "R6019\r\n- unable to open console device" ], [ 186263, "- unable to open console device" ], [ 186304, "R6018\r\n- unexpected heap error" ], [ 186311, "- unexpected heap error" ], [ 186344, "R6017\r\n- unexpected multithread lock error" ], [ 186351, "- unexpected multithread lock error" ], [ 186392, "R6016\r\n- not enough space for thread data" ], [ 186399, "- not enough space for thread data" ], [ 186448, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 186450, "This application has requested the Runtime to terminate it in an unusual way." ], [ 186600, "R6009\r\n- not enough space for environment" ], [ 186607, "- not enough space for environment" ], [ 186648, "R6008\r\n- not enough space for arguments" ], [ 186655, "- not enough space for arguments" ], [ 186696, "R6002\r\n- floating point support not loaded" ], [ 186703, "- floating point support not loaded" ], [ 186744, "Microsoft Visual C++ Runtime Library" ], [ 186792, "\u003cprogram name unknown\u003e" ], [ 186816, "Runtime Error!\n\nProgram:" ], [ 186879, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 187152, "wide", "(null)" ], [ 187168, "(null)" ], [ 187225, "700WP" ], [ 187241, "`h````" ], [ 187326, "700PP" ], [ 187376, "Complete Object Locator'" ], [ 187408, "Class Hierarchy Descriptor'" ], [ 187440, "Base Class Array'" ], [ 187464, "Base Class Descriptor at (" ], [ 187496, "Type Descriptor'" ], [ 187520, "`local static thread guard'" ], [ 187552, "`managed vector copy constructor iterator'" ], [ 187600, "`vector vbase copy constructor iterator'" ], [ 187648, "`vector copy constructor iterator'" ], [ 187688, "`dynamic atexit destructor for '" ], [ 187728, "`dynamic initializer for '" ], [ 187760, "`eh vector vbase copy constructor iterator'" ], [ 187808, "`eh vector copy constructor iterator'" ], [ 187848, "`managed vector destructor iterator'" ], [ 187888, "`managed vector constructor iterator'" ], [ 187928, "`placement delete[] closure'" ], [ 187960, "`placement delete closure'" ], [ 187992, "`omni callsig'" ], [ 188008, "delete[]" ], [ 188032, "`local vftable constructor closure'" ], [ 188072, "`local vftable'" ], [ 188104, "`udt returning'" ], [ 188120, "`copy constructor closure'" ], [ 188152, "`eh vector vbase constructor iterator'" ], [ 188192, "`eh vector destructor iterator'" ], [ 188224, "`eh vector constructor iterator'" ], [ 188264, "`virtual displacement map'" ], [ 188296, "`vector vbase constructor iterator'" ], [ 188336, "`vector destructor iterator'" ], [ 188368, "`vector constructor iterator'" ], [ 188400, "`scalar deleting destructor'" ], [ 188432, "`default constructor closure'" ], [ 188464, "`vector deleting destructor'" ], [ 188496, "`vbase destructor'" ], [ 188536, "`local static guard'" ], [ 188736, "operator" ], [ 188776, "delete" ], [ 188792, "__unaligned" ], [ 188808, "__restrict" ], [ 188832, "__clrcall" ], [ 188848, "__fastcall" ], [ 188864, "__thiscall" ], [ 188880, "__stdcall" ], [ 188896, "__pascal" ], [ 188912, "__cdecl" ], [ 189712, "GetProcessWindowStation" ], [ 189736, "GetUserObjectInformationA" ], [ 189768, "GetLastActivePopup" ], [ 189792, "GetActiveWindow" ], [ 189808, "MessageBoxA" ], [ 189824, "USER32.DLL" ], [ 190610, "wide", "h(((( H" ], [ 191296, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 191680, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 191920, "dddd, MMMM dd, yyyy" ], [ 191944, "MM/dd/yy" ], [ 191968, "December" ], [ 191984, "November" ], [ 192000, "October" ], [ 192008, "September" ], [ 192020, "August" ], [ 192028, "July" ], [ 192036, "June" ], [ 192044, "April" ], [ 192052, "March" ], [ 192064, "February" ], [ 192080, "January" ], [ 192136, "Saturday" ], [ 192148, "Friday" ], [ 192160, "Thursday" ] ], "sz": 241664, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 703.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-file-operation", "l": 3 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cbr\u003e", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e", "\u003c/html\u003e", "utf-8\"\u003e\u003c/head\u003e", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=", "\u003chtml\u003e", "\u003c/style\u003e", "\u003cstyle\u003e", "\u003c/p\u003e", "E\u003cul\u003e\u003cli\u003ePress \u003cb\u003eInstall\u003c/b\u003e button to start extraction.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003eE\u003cul\u003e\u003cli\u003ePress \u003cb\u003eExtract\u003c/b\u003e ...", "manually.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003e8\u003cli\u003eIf the destination folder does not exist, it will be", "2created automatically before extraction.\u003c/li\u003e\u003c/ul\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 216.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 216.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp", ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\SFX\\build\\sfxrar64\\Release\\sfxrar.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556014.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 216.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "password keyword", "e": [ "Enter password", "\u0026Enter password for the encrypted file:", "…. Corrupt file or wrong password.", "GETPASSWORD1", "Wrong password for %s5Write error in the file %s. Probably the disk is full", "Unknown encryption method in %s$The specified password is incorrect.", "GETPASSWORD1\nLICENSEDLG\nASKNEXTVOL" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.24" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ ".lnk" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "sfxrar.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "42", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "Find window by class/title", "e": [ "FindWindowExW" ], "i": "micro-behaviors/ui/window/manage::find-window-ex", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 133.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "c": 0.800000011920929, "d": "Notify shell of file changes", "e": [ "SHChangeNotify" ], "i": "micro-behaviors/ui/window/notify::shell-change-notify", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "runas privilege elevation string", "e": [ "runas" ], "i": "micro-behaviors/os/privilege/elevation::runas-string", "l": 3 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 241664.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Post message to window (Unicode)", "e": [ "PostMessageW" ], "i": "micro-behaviors/os/message/queue::post-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 604.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Display folder browse dialog", "e": [ "SHBrowseForFolderW" ], "i": "micro-behaviors/fs/shell-ops/commands::browse-for-folder", "l": 3 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.949999988079071, "d": "WinRAR SFX start dialog", "e": [ "STARTDLG" ], "i": "metadata/binary/installer/sfx::dialog-start", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.75" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b9", "b8", "b8", "b8", "b8", "b8", "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 216.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 216.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.7200000286102295, "d": "WININIT rename section marker", "e": [ "Rename" ], "i": "micro-behaviors/fs/config/system::wininit-rename-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 216.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6656)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "runas elevation verb", "e": [ "runas" ], "i": "objectives/privilege-escalation/token-manipulation::runas-word", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.45)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "UVWATAUAVAWH", "VWATAUAV", "UVWATAUAVAW", "VWATAUAVH", "SVWATAUAVAWH", "UVWATAUH", "RENAMEDLG", "ASKNEXTVOL", "LICENSEDLG", "STARTDLG" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.9800000190734863, "d": "WinRAR SFX registry key", "e": [ "Software\\WinRAR SFX" ], "i": "metadata/binary/installer/sfx::registry-key", "l": 1 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.21" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "Extracting files to %s folder$Extracting files to temporary folder", "Unknown encryption method in %s$The specified password is incorrect." ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 389120.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 703.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 216.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8", "b8", "b8", "b8", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 703.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "winrar", "WinRAR", "WINRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "a": "T1112", "c": 0.6499999761581421, "d": "Windows runas verb token", "e": [ "runas" ], "i": "objectives/impact/degrade/system::runas-verb-token", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "Peek message (Unicode)", "e": [ "PeekMessageW" ], "i": "micro-behaviors/os/message/queue::peek-message-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 216.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.699999988079071, "d": "Get file information and icon", "e": [ "SHGetFileInfoW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-file-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.75" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "NtCurrentProcess handle (-1) for NT API call", "e": [ "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::nt-current-process-handle", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 703.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 703.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "ANSI GUI probe API cluster", "e": [ "GetLastActivePopup", "GetActiveWindow", "MessageBoxA" ], "i": "well-known/malware/trojan/elex/test-loader::ansi-gui-probe-cluster", "l": 3 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "c4 54 02 00", "ec 20 02 00", "bd 20 02 00", "5a 1f 02 00", "c4 1d 02 00", "fe 1e 02 00", "df 1e 02 00", "47 1b 02 00", "c4 17 02 00", "a5 15 02 00", "6e 15 02 00", "3f a5 01 00", "ef 99 01 00", "a7 7a 01 00", "d9 24 00 00", "fc 20 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "InitCommonControlsEx", "GetCurrentDirectoryW", "GetModuleFileNameW", "GetCurrentProcessId", "DosDateTimeToFileTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "SetEnvironmentVariableW", "GetProcessAffinityMask", "InitializeCriticalSection", "SystemTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHBrowseForFolderW, ShellExecuteExW, SHGetSpecialFolderLocation, SHFileOperationW, SHGetPathFromIDListW, ... +3 more)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (EnableWindow, GetDlgItem, ShowWindow, MessageBoxW, FindWindowExW, ... +47 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CLSIDFromString, CoCreateInstance, OleInitialize, OleUninitialize, CreateStreamOnHGlobal)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (InitCommonControlsEx)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetDeviceCaps, CreateCompatibleDC, GetObjectW, CreateCompatibleBitmap, SelectObject, ... +3 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (ReadFile, GetFileAttributesW, SetFileAttributesW, FindNextFileW, GetFullPathNameW, ... +123 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (SHAutoComplete)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegOpenKeyExW, RegQueryValueExW, RegCreateKeyExW, RegSetValueExW, RegCloseKey, ... +4 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 8)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMDLG32.dll (GetOpenFileNameW, CommDlgExtendedError, GetSaveFileNameW)", "e": [ "COMDLG32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.800000011920929, "d": "Has file operation capabilities", "e": [ "FindFirstFileW", "MoveFileExW" ], "i": "objectives/impact/ransom/file-operations::has-file-operations", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "ReadFile", "CreateFileA", "DeviceIoControl", "CreateFileW" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathW", "MoveFileExW" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "GetModuleFileNameA", "FindFirstFileW", "WriteFile", "GetModuleFileNameW", "CreateFileW", "CreateFileA", "SetFileTime" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "CreateWindowExW", "RegisterClassExW", "DispatchMessageW", "GetMessageW", "DefWindowProcW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "d9 24 00 00", "47 1b 02 00", "c4 17 02 00", "5a 1f 02 00", "c4 54 02 00", "a7 7a 01 00", "fe 1e 02 00", "6e 15 02 00", "c4 1d 02 00", "ec 20 02 00", "GetTickCount", "bd 20 02 00", "a5 15 02 00", "df 1e 02 00", "ef 99 01 00", "fc 20 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindFirstFileW", "FindNextFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 216.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9700000286102295, "d": "WinRAR self-extractor footprint", "e": [ "Software\\WinRAR SFX", "STARTDLG" ], "i": "metadata/binary/installer/sfx::winrar-sfx-footprint", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsGetValue", "FlsSetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameW", "GetModuleFileNameA", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyExW", "RegSetValueExW", "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "OpenProcessToken", "AdjustTokenPrivileges", "LookupPrivilegeValueW" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.function_count = 703.00", "binary.overall_entropy = 4.75" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "WriteFile", "GetModuleFileNameW", "GetModuleFileNameA", "UnmapViewOfFile", "ShellExecuteExW" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "a31cf6db5c1bcf445c62012de7ee12275987d22fcaf507fb48c5821399580f6b", "path": "64301!!Default64.SFX", "type": "pe" }, { "f": "KO₉(AlAs₉C₄CoEr₆ILa₂PXe)H₆(Po₄Cm₂CrDb₂DsMg)Md₄(Bi₄PaPt)", "x": 12, "dp": 1, "id": 15, "is": [ "CreatePropertySheetPageW", "DestroyPropertySheetPage", "ORDINAL 8", "CreateDirectoryW", "GetVersionExW", "GetModuleFileNameW", "GetCurrentDirectoryW", "GetLocaleInfoW", "GetNumberFormatW", "ExpandEnvironmentStringsW", "FindResourceW", "LoadLibraryExW", "GetCurrentProcessId", "GetCurrentProcess", "Sleep", "SystemTimeToFileTime", "GetSystemTime", "FileTimeToSystemTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "GetTempPathW", "CreateFileA", "GetProcessHeap", "GetLocaleInfoA", "GetStringTypeW", "GetStringTypeA", "WriteConsoleW", "GetConsoleOutputCP", "WriteConsoleA", "SetStdHandle", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "GetTickCount", "QueryPerformanceCounter", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "LCMapStringW", "LCMapStringA", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "DeleteCriticalSection", "GetStartupInfoA", "SetHandleCount", "GetConsoleMode", "GetConsoleCP", "ExitProcess", "GetModuleHandleW", "HeapSize", "LeaveCriticalSection", "DeleteFileW", "GetFileAttributesW", "GetDriveTypeW", "ReadFile", "GetFileType", "SetEndOfFile", "SetFilePointer", "GetStdHandle", "WriteFile", "FlushFileBuffers", "CreateFileW", "SetLastError", "GetLastError", "FindFirstFileW", "WaitForSingleObject", "CloseHandle", "FindNextFileW", "FindClose", "DosDateTimeToFileTime", "LocalFileTimeToFileTime", "LoadLibraryW", "GetProcAddress", "FreeLibrary", "FileTimeToLocalFileTime", "FileTimeToDosDateTime", "EnterCriticalSection", "RtlCaptureContext", "RtlVirtualUnwind", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "TerminateProcess", "FlsAlloc", "FlsFree", "HeapFree", "HeapReAlloc", "RtlLookupFunctionEntry", "RtlUnwindEx", "RaiseException", "RtlPcToFileHeader", "HeapAlloc", "GetSystemTimeAsFileTime", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "HeapSetInformation", "HeapCreate", "HeapDestroy", "EncodePointer", "DecodePointer", "FlsGetValue", "OemToCharA", "CharUpperW", "CharLowerW", "OemToCharBuffA", "LoadStringW", "GetWindowRect", "GetWindowLongPtrW", "SetWindowPos", "GetWindowTextW", "GetSystemMetrics", "GetWindow", "GetClassNameW", "GetWindowLongW", "SetWindowLongW", "SetWindowTextW", "CreatePopupMenu", "InsertMenuItemW", "LoadImageW", "GetSysColor", "SendDlgItemMessageW", "SetDlgItemTextW", "SetWindowLongPtrW", "GetDlgItemTextW", "GetClientRect", "BeginPaint", "EndPaint", "SetMenuItemInfoW", "GetParent", "InvalidateRect", "GetDC", "SendMessageW", "ReleaseDC", "ShowWindow", "GetDlgItem", "GetDeviceCaps", "GetObjectW", "CreateCompatibleDC", "GetPixel", "SetPixel", "DeleteDC", "CreateDIBSection", "CreatePen", "CreateSolidBrush", "SetTextColor", "TextOutW", "Polygon", "Polyline", "DeleteObject", "SelectObject", "GetTextFaceW", "GetTextMetricsW", "CreateFontW", "RegSetValueExW", "RegQueryValueExW", "RegOpenKeyExW", "RegCloseKey", "RegCreateKeyExW", "SHGetPathFromIDListW", "DragQueryFileW", "ShellExecuteExW", "CoCreateInstance", "ReleaseStgMedium" ], "ms": { "pe": { "machine": 34404.0, "checksum": 208420.0, "pdb_path": "d:\\Projects\\WinRAR\\RarExt\\build\\64\\Release\\rarext.pdb", "rsrc_size": 16384.0, "subsystem": 2.0, "timestamp": 1368556030.0, "icon_count": 2.0, "image_base": 6442450944.0, "rsrc_entropy": 4.73, "entry_section": ".text", "size_of_image": 270336.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 7.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 83580.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368556030.0, "import_dll_count": 7.0, "manifest_present": true, "computed_checksum": 208420.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556030.0, "debug_timestamp_min": 1368556030.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 143360.0, "file_size": 207360.0, "entry_point": 83580.0, "code_entropy": 6.41, "data_entropy": 4.4, "export_count": 2.0, "import_count": 169.0, "string_count": 565.0, "section_count": 6.0, "avg_complexity": 7.67, "function_count": 574.0, "import_density": 1.21, "max_complexity": 16.0, "string_density": 4.04, "overall_entropy": 4.52, "avg_basic_blocks": 12.67, "avg_section_size": 34389.33, "dependency_count": 7.0, "entropy_variance": 1.29, "function_density": 4.1, "avg_function_size": 174.33, "avg_string_length": 18.12, "complexity_per_kb": 0.05, "max_string_length": 341.0, "wide_string_count": 140.0, "writable_sections": 1.0, "avg_string_entropy": 3.06, "code_to_data_ratio": 2.28, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.08, "text_to_file_ratio": 0.69, "total_basic_blocks": 38.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 23.57, "debug_reference_count": 1.0, "largest_section_ratio": 0.69, "sentence_string_count": 93.0, "sentence_string_ratio": 0.16, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 224, "Rich" ], [ 520, ".text" ], [ 599, "@.data" ], [ 640, ".pdata" ], [ 679, "@.rsrc" ], [ 719, "@.reloc" ], [ 1767, "WATAUAVAWH" ], [ 2953, "UVWH" ], [ 8817, "UVWATAUAVAW" ], [ 15412, "@SVWATAUAVAW" ], [ 17103, "WATAUH" ], [ 17529, "UVWATAUH" ], [ 19432, "@SVWATAUAVAWH" ], [ 27304, "@SUVWATAUAVAWH" ], [ 28661, "Q1E3" ], [ 30817, "x ATAUAVAWH" ], [ 31580, "@SUVWATAUAV" ], [ 32801, "x ATAUAVH" ], [ 33526, "VWATAUAVH" ], [ 35816, "f92t" ], [ 36866, "f99u" ], [ 37734, "tnf99ti" ], [ 38010, "SPE3" ], [ 39157, "A E3" ], [ 39717, "C E3" ], [ 44001, "UVWATAUAVAWH" ], [ 48898, "\\$ UVWATAUAVAW" ], [ 49949, "UVWATAU" ], [ 53316, "t$ WATAUAVAW" ], [ 59672, "@UVWATAUAVAW" ], [ 64291, "SUVWATAUAVAWH" ], [ 65696, "gfffffffI" ], [ 70276, "t$ WATAUAVAWH" ], [ 70617, "p WATAUH" ], [ 74767, "ATAUAVH" ], [ 76190, "\\$ UVWATAUAVAWH" ], [ 82556, "8MOC" ], [ 82643, "SVWATAUAVAWH" ], [ 83344, "@SWATAUAVAWH" ], [ 86847, "WATAVH" ], [ 96900, "D09A" ], [ 98028, "D19K" ], [ 99663, "AUAVAWH" ], [ 100325, "x ATAUAWH" ], [ 101948, "Z0E8" ], [ 102139, "gfffffffH" ], [ 110220, "@UATAUAVAWH" ], [ 123001, "VWATH" ], [ 126218, "L$ UATAUAVAWH" ], [ 127996, "@USVWATAUAVAWH" ], [ 128614, "M0H3" ], [ 139858, "VWAUH" ], [ 141900, "UVWATH" ], [ 141916, "9u0t" ], [ 146000, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 146528, "wide", "RAR 5.0" ], [ 146544, "wide", "Windows" ], [ 146560, "wide", "Unix" ], [ 146696, "wide", ".zip" ], [ 146720, "wide", "ZIP64" ], [ 146736, "wide", "zip|z##|jar" ], [ 146848, "GetComment" ], [ 146864, "Extract" ], [ 146872, "GetListItem" ], [ 146888, "GetNextName" ], [ 146900, "Close" ], [ 146908, "Open" ], [ 146920, "Prepare" ], [ 147240, "wide", "Amiga" ], [ 147256, "wide", "VAX/VMS" ], [ 147288, "wide", "Atari ST" ], [ 147328, "wide", "Z-System" ], [ 147368, "wide", "TOPS-20" ], [ 147384, "wide", "SMS/QDOS" ], [ 147408, "wide", "Acorn RISC OS" ], [ 147440, "wide", "Windows VFAT" ], [ 147480, "wide", "Tandem" ], [ 147632, "wide", "Ident" ], [ 147648, "wide", "Info" ], [ 147728, "wide", "t -iextinit -y $nonejustfmtinit" ], [ 147792, "wide", "Formats\\*.fmt" ], [ 147904, "wide", "FileList" ], [ 147928, "wide", "AllVolumes" ], [ 147992, "wide", "Setup" ], [ 148008, "wide", "CustomExt" ], [ 148152, "wide", "%u.%03u" ], [ 148176, "bad allocation" ], [ 148376, "wide", ".rar" ], [ 148736, "wide", "WinRAR_EmailArc" ], [ 148768, "wide", "WinRAR_EmailArcTo" ], [ 148832, "wide", "WinRAR_Convert" ], [ 148864, "wide", "WinRAR_Profile%d" ], [ 148904, "wide", "WinRAR_AddTo" ], [ 148936, "wide", "WinRAR_ExtractTo" ], [ 148976, "wide", "WinRAR_ExtractHere" ], [ 149016, "wide", "WinRAR_Extract" ], [ 149048, "wide", "WinRAR_ExtractSeparate" ], [ 149096, "wide", "WinRAR_OpenSFX" ], [ 149144, "wide", "EXTARCINFODLG" ], [ 149184, "wide", "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WinRAR.exe" ], [ 149312, "wide", "winrar.exe" ], [ 149336, "wide", "Software\\WinRAR" ], [ 149368, "wide", "exe64" ], [ 149424, "wide", "Default" ], [ 149464, "wide", "Name" ], [ 149480, "wide", "Profiles\\%d" ], [ 149504, "wide", "Interface\\Themes" ], [ 149544, "wide", "ShellExtBMP" ], [ 149576, "wide", "cw -y -scuc \"%s\" \"%s\"" ], [ 149656, "wide", "Courier New" ], [ 149680, "wide", "rarext.lng" ], [ 150008, "SHCreateItemFromParsingName" ], [ 150064, "wide", "ShellExtIcon" ], [ 150104, "wide", "CascadedMenu" ], [ 150136, "IsAppThemed" ], [ 150152, "wide", "UxTheme.dll" ], [ 150176, "wide", "MenuIcons" ], [ 150200, "wide", "Setup\\MenuItems" ], [ 150248, "wide", "Archive" ], [ 150296, "wide", "-ieml." ], [ 150336, "wide", "%c %s%s%s%s -scul -r0 -iext --" ], [ 150416, "wide", "\"-cp%s\"" ], [ 150440, "wide", "PathsNone" ], [ 150464, "wide", "PathsAbsDrive" ], [ 150496, "wide", "PathsAbs" ], [ 150640, "wide", "SFXOther" ], [ 150664, "wide", "SFXNetwork" ], [ 150688, "wide", "SFXLocal" ], [ 150720, "wide", "Convert" ], [ 150736, "wide", "Test" ], [ 150752, "wide", "OpenSFX" ], [ 150768, "wide", "Extr" ], [ 150792, "wide", ".part" ], [ 150808, "wide", "ExtrSep" ], [ 150824, "wide", "ExtrHere" ], [ 150864, "wide", "EmailArc" ], [ 150888, "wide", "EmailOpt" ], [ 150912, "wide", "Profile" ], [ 151056, "wide", "\"-anf=%s\" -scul" ], [ 151096, "wide", "t -iext" ], [ 151112, "wide", "cv -iext" ], [ 151136, "wide", "x -iext -ow -ver" ], [ 151192, "wide", "ArcName" ], [ 151208, "wide", "ImmExec" ], [ 151264, "wide", "EXTCMTARCINFODLG" ], [ 151344, "wide", "Software\\WinRAR%s%s" ], [ 151424, "wide", "*messages***" ], [ 151456, "*messages***" ], [ 151512, "wide", "COMBOBOX" ], [ 151536, "wide", "LanguageFolder" ], [ 151568, "wide", "Software\\WinRAR\\General" ], [ 151616, "wide", "rarlng.dll" ], [ 151640, "CryptUnprotectMemory" ], [ 151664, "CryptProtectMemory" ], [ 151688, "wide", "Crypt32.dll" ], [ 151712, "wide", "CryptUnprotectMemory failed" ], [ 151768, "wide", "CryptProtectMemory failed" ], [ 152144, "wide", "TempFolder" ], [ 152168, "wide", "Paths" ], [ 152624, "bad exception" ], [ 152664, "Unknown exception" ], [ 152728, "wide", "UTF-16LE" ], [ 152752, "wide", "UNICODE" ], [ 152768, "CorExitProcess" ], [ 152784, "wide", "mscoree.dll" ], [ 152808, "wide", "(null)" ], [ 152824, "(null)" ], [ 152873, "700WP" ], [ 152889, "`h````" ], [ 152944, "runtime error" ], [ 152968, "TLOSS error" ], [ 152984, "SING error" ], [ 153000, "DOMAIN error" ], [ 153024, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 153031, "An application has made an attempt to load the C runtime library incorrectly." ], [ 153109, "Please contact the application's support team for more information." ], [ 153184, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 153191, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 153271, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 153432, "R6032\r\n- not enough space for locale information" ], [ 153439, "- not enough space for locale information" ], [ 153488, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 153495, "- Attempt to initialize the CRT more than once." ], [ 153543, "This indicates a bug in your application." ], [ 153592, "R6030\r\n- CRT not initialized" ], [ 153599, "- CRT not initialized" ], [ 153624, "R6028\r\n- unable to initialize heap" ], [ 153631, "- unable to initialize heap" ], [ 153664, "R6027\r\n- not enough space for lowio initialization" ], [ 153671, "- not enough space for lowio initialization" ], [ 153720, "R6026\r\n- not enough space for stdio initialization" ], [ 153727, "- not enough space for stdio initialization" ], [ 153776, "R6025\r\n- pure virtual function call" ], [ 153783, "- pure virtual function call" ], [ 153816, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 153823, "- not enough space for _onexit/atexit table" ], [ 153872, "R6019\r\n- unable to open console device" ], [ 153879, "- unable to open console device" ], [ 153920, "R6018\r\n- unexpected heap error" ], [ 153927, "- unexpected heap error" ], [ 153960, "R6017\r\n- unexpected multithread lock error" ], [ 153967, "- unexpected multithread lock error" ], [ 154008, "R6016\r\n- not enough space for thread data" ], [ 154015, "- not enough space for thread data" ], [ 154064, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 154066, "This application has requested the Runtime to terminate it in an unusual way." ], [ 154216, "R6009\r\n- not enough space for environment" ], [ 154223, "- not enough space for environment" ], [ 154264, "R6008\r\n- not enough space for arguments" ], [ 154271, "- not enough space for arguments" ], [ 154312, "R6002\r\n- floating point support not loaded" ], [ 154319, "- floating point support not loaded" ], [ 154360, "Microsoft Visual C++ Runtime Library" ], [ 154408, "\u003cprogram name unknown\u003e" ], [ 154432, "Runtime Error!\n\nProgram:" ], [ 154495, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 154814, "700PP" ], [ 154864, "Complete Object Locator'" ], [ 154896, "Class Hierarchy Descriptor'" ], [ 154928, "Base Class Array'" ], [ 154952, "Base Class Descriptor at (" ], [ 154984, "Type Descriptor'" ], [ 155008, "`local static thread guard'" ], [ 155040, "`managed vector copy constructor iterator'" ], [ 155088, "`vector vbase copy constructor iterator'" ], [ 155136, "`vector copy constructor iterator'" ], [ 155176, "`dynamic atexit destructor for '" ], [ 155216, "`dynamic initializer for '" ], [ 155248, "`eh vector vbase copy constructor iterator'" ], [ 155296, "`eh vector copy constructor iterator'" ], [ 155336, "`managed vector destructor iterator'" ], [ 155376, "`managed vector constructor iterator'" ], [ 155416, "`placement delete[] closure'" ], [ 155448, "`placement delete closure'" ], [ 155480, "`omni callsig'" ], [ 155496, "delete[]" ], [ 155520, "`local vftable constructor closure'" ], [ 155560, "`local vftable'" ], [ 155592, "`udt returning'" ], [ 155608, "`copy constructor closure'" ], [ 155640, "`eh vector vbase constructor iterator'" ], [ 155680, "`eh vector destructor iterator'" ], [ 155712, "`eh vector constructor iterator'" ], [ 155752, "`virtual displacement map'" ], [ 155784, "`vector vbase constructor iterator'" ], [ 155824, "`vector destructor iterator'" ], [ 155856, "`vector constructor iterator'" ], [ 155888, "`scalar deleting destructor'" ], [ 155920, "`default constructor closure'" ], [ 155952, "`vector deleting destructor'" ], [ 155984, "`vbase destructor'" ], [ 156024, "`local static guard'" ], [ 156224, "operator" ], [ 156264, "delete" ], [ 156280, "__unaligned" ] ], "sz": 207360, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 574.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.9200000166893005, "d": "Shell drag query API", "e": [ "DragQueryFileW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-drag-query-file", "l": 1 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 169.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "a": "T1573", "c": 1.0, "d": "RC4 XOR decrypt loop pattern", "e": [ "02 f9" ], "i": "micro-behaviors/crypto/symmetric/stream::rc4-xor-loop", "l": 1, "m": "C0027" }, { "c": 0.949999988079071, "d": "COM unload export present", "e": [ "DllCanUnloadNow" ], "i": "metadata/binary/symbols::export-dll-can-unload-now", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 169.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\RarExt\\build\\64\\Release\\rarext.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556030.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 169.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "password keyword", "e": [ "Passwords" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "Open SFX archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.67" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.06" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "rarext.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.949999988079071, "d": "COM class factory export", "e": [ "DllGetClassObject" ], "i": "metadata/binary/symbols::export-dll-get-class-object", "l": 1 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 140.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 207360.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 565.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1105", "c": 0.9399999976158142, "d": "Embedded stage screen capture APIs", "e": [ "CreateDIBSection" ], "i": "objectives/command-and-control/dropper/staging/signed-bundle::embedded-stage-screen-capture", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.52" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "SystemTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 169.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.10:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 169.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 169.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 7168)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI DIB section creation for BMP capture", "e": [ "CreateDIBSection" ], "i": "micro-behaviors/hardware/display/screen::create-dib-section", "l": 2, "m": "C0014" }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "01 00 01 15" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.41)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "UVWATAUAVAW", "UVWATAUH", "VWATAUAVH", "UVWATAUAVAWH", "SVWATAUAVAWH", "COMBOBOX", "LMNOOOOOOPA", "BCDEFGHIJK", "UUUUUUPU" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "t -iextinit -y $nonejustfmtinit" ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 270336.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 574.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 169.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 574.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "winrar", "WinRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "RarExt.dll" ], "i": "objectives/evasion/masquerade/dll::dll-basename", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 169.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.52" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-getpixel", "l": 2 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 574.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 574.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "SetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-setpixel", "l": 2 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "c": 0.949999988079071, "d": "ANSI GUI probe API cluster", "e": [ "GetLastActivePopup", "GetActiveWindow", "MessageBoxA" ], "i": "well-known/malware/trojan/elex/test-loader::ansi-gui-probe-cluster", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "58 b8 01 00", "c2 b7 01 00", "a3 b7 01 00", "57 b5 01 00", "fd 6e 01 00", "fd 28 01 00", "39 b7 00 00", "bc 5b 00 00", "29 4e 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "DestroyPropertySheetPage", "CreatePropertySheetPageW", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "GetModuleFileNameW", "GetCurrentDirectoryW", "GetCurrentProcessId", "SystemTimeToFileTime", "FileTimeToSystemTime", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateDirectoryW, GetVersionExW, GetModuleFileNameW, GetCurrentDirectoryW, GetLocaleInfoW, ... +99 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetPathFromIDListW, DragQueryFileW, ShellExecuteExW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (OemToCharA, CharUpperW, CharLowerW, OemToCharBuffA, LoadStringW, ... +29 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (CreatePropertySheetPageW, DestroyPropertySheetPage, ORDINAL 8)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetDeviceCaps, GetObjectW, CreateCompatibleDC, GetPixel, SetPixel, ... +13 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegCreateKeyExW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, ReleaseStgMedium)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "ProductVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "GetTickCount", "fd 28 01 00", "a3 b7 01 00", "bc 5b 00 00", "c2 b7 01 00", "29 4e 00 00", "57 b5 01 00", "39 b7 00 00", "fd 6e 01 00", "58 b8 01 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindClose", "FindFirstFileW", "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 169.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsSetValue", "FlsGetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExW", "RegSetValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.overall_entropy = 4.52", "binary.function_count = 574.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "0f6ec16eb866c830c0c63746505d50b7744702f40b766041fb6ad5cdb1ad2326", "path": "64301!!RarExt.dll", "type": "pe" }, { "f": "KO₁₀(C₅I₄PrAlAs₁₀CoEr₈LaPXe)H₈(F₂Os₃Po₃UCm₂Db₂DsMg)Md₃(Bi₃Pa₂)", "x": 18, "dp": 1, "id": 16, "is": [ "SetConsoleCtrlHandler", "SetLastError", "LocalFree", "FormatMessageW", "CreateHardLinkW", "CloseHandle", "GetCurrentProcess", "SetFileTime", "DeviceIoControl", "CreateFileW", "FindClose", "FindFirstFileW", "DeleteFileW", "RemoveDirectoryW", "CreateDirectoryW", "MoveFileW", "GetShortPathNameW", "GetLongPathNameW", "FlushFileBuffers", "SetFilePointer", "SetEndOfFile", "ReadFile", "GetDriveTypeW", "GetDiskFreeSpaceExW", "GetFileAttributesW", "SetFileAttributesW", "ExpandEnvironmentStringsW", "FindNextFileW", "GetVersionExW", "GetModuleFileNameW", "GetFullPathNameW", "GetModuleHandleW", "SetErrorMode", "FreeLibrary", "LoadLibraryW", "LoadLibraryExW", "GetProcAddress", "Sleep", "CompareStringA", "SetThreadPriority", "GetCurrentThread", "SetPriorityClass", "CreateThread", "EnterCriticalSection", "LeaveCriticalSection", "WaitForSingleObject", "GetProcessAffinityMask", "ReleaseSemaphore", "ResetEvent", "DeleteCriticalSection", "SetEvent", "InitializeCriticalSection", "CreateEventW", "CreateSemaphoreW", "SystemTimeToFileTime", "GetSystemTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "GetConsoleOutputCP", "WriteConsoleA", "SetEnvironmentVariableA", "CreateFileA", "GetLocaleInfoA", "GetLastError", "GetCurrentDirectoryW", "WriteFile", "WriteConsoleW", "SetConsoleMode", "ReadConsoleW", "GetStdHandle", "GetFileType", "GetConsoleMode", "GetCurrentProcessId", "GetCommandLineW", "GetStringTypeW", "GetStringTypeA", "GetTickCount", "QueryPerformanceCounter", "RtlLookupFunctionEntry", "RtlUnwindEx", "HeapFree", "HeapReAlloc", "HeapAlloc", "GetSystemTimeAsFileTime", "ExitProcess", "RaiseException", "RtlPcToFileHeader", "GetCommandLineA", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsSetValue", "FlsFree", "GetCurrentThreadId", "FlsAlloc", "HeapSetInformation", "HeapCreate", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlCaptureContext", "GetModuleFileNameA", "GetACP", "GetOEMCP", "IsValidCodePage", "SetHandleCount", "GetStartupInfoA", "SetStdHandle", "GetConsoleCP", "HeapSize", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "LCMapStringA", "LCMapStringW", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "CharUpperW", "CharLowerW", "ExitWindowsEx", "CharToOemBuffW", "CharToOemA", "MessageBeep", "OemToCharBuffA", "OemToCharA", "LoadStringW", "RegQueryValueExW", "RegCloseKey", "SetFileSecurityW", "OpenProcessToken", "LookupPrivilegeValueW", "AdjustTokenPrivileges", "RegOpenKeyExW", "SHGetMalloc", "SHGetSpecialFolderLocation", "SHGetPathFromIDListW" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\rar\\build\\unrar64\\Release\\UnRAR.pdb", "rsrc_size": 31232.0, "subsystem": 3.0, "timestamp": 1368555984.0, "image_base": 5368709120.0, "rsrc_entropy": 3.5, "entry_section": ".text", "size_of_image": 425984.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 3.0, "timestamp_year": 2013.0, "characteristics": 34.0, "entry_point_rva": 188968.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 4.0, "manifest_present": true, "computed_checksum": 377811.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555984.0, "debug_timestamp_min": 1368555984.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 9.0, "version_info_present": true, "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 234496.0, "file_size": 322560.0, "entry_point": 188968.0, "code_entropy": 6.5, "data_entropy": 4.47, "import_count": 145.0, "string_count": 665.0, "section_count": 6.0, "avg_complexity": 14.0, "function_count": 871.0, "import_density": 0.63, "max_complexity": 14.0, "string_density": 2.9, "overall_entropy": 4.28, "avg_basic_blocks": 30.0, "avg_section_size": 53589.33, "dependency_count": 4.0, "entropy_variance": 1.51, "function_density": 3.8, "avg_function_size": 426.0, "avg_string_length": 21.34, "complexity_per_kb": 0.06, "max_string_length": 244.0, "wide_string_count": 277.0, "writable_sections": 1.0, "avg_string_entropy": 3.28, "code_to_data_ratio": 2.69, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.1, "text_to_file_ratio": 0.73, "total_basic_blocks": 30.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 20.34, "debug_reference_count": 1.0, "largest_section_ratio": 0.73, "sentence_string_count": 224.0, "sentence_string_ratio": 0.34, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 2363, "WATAUAVAWH" ], [ 5229, "UVWH" ], [ 11853, "UVWATAUAVAW" ], [ 20966, "UVWATAUAVAWH" ], [ 23287, "l$ VWATAUAVH" ], [ 23682, "VWATAUAV" ], [ 25123, "WATAUH" ], [ 28175, "f90u" ], [ 30077, "UVWATAU" ], [ 33169, "UVWATAUH" ], [ 33988, "t$ WATAUAVAWH" ], [ 35968, "@SUVWATAUAVAWH" ], [ 36724, "@SUVWATAUAVH" ], [ 38545, "x ATAUAVH" ], [ 40193, "T4 H" ], [ 40681, "x ATAUAVAWH" ], [ 41718, "VWATH" ], [ 46208, "@UVWATAUAVAW" ], [ 47733, "x ATAVAWH" ], [ 49900, "@SUVWATAUAV" ], [ 56713, "C E3" ], [ 57592, "@SUVWATAUAVAW" ], [ 59175, "VWATAUAVH" ], [ 68338, "\\$ UVWATAUAVAW" ], [ 74756, "f92t" ], [ 75932, "f93t" ], [ 76846, "f99u" ], [ 79686, "tnf99ti" ], [ 96632, "EXA84" ], [ 101011, "l$ VWATAVAWH" ], [ 101782, "\\$ UVWATAUH" ], [ 102837, "E 1G" ], [ 104603, "WATAUAVAW" ], [ 107083, "ATAUAVH" ], [ 114872, "A4A3" ], [ 117140, "xxxxwwww" ], [ 117863, "SUVWATAUAVAWH" ], [ 119744, "gfffffffI" ], [ 122602, "VWAUH" ], [ 139011, "WATAWH" ], [ 156425, "U E3" ], [ 157237, "x AUAVAWH" ], [ 162867, "WAUAVH" ], [ 166184, "F0E3" ], [ 173381, "p WATAUH" ], [ 179851, "AUAVAWH" ], [ 180251, "SVWATH" ], [ 187456, "8MOC" ], [ 187543, "SVWATAUAVAWH" ], [ 188244, "@SWATAUAVAWH" ], [ 191747, "WATAVH" ], [ 212976, "@UATAUAVAWH" ], [ 219418, "L$ UATAUAVAWH" ], [ 220992, "@USVWATAUAVAWH" ], [ 225786, "M0H3" ], [ 237008, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 237864, "wide", "%d.%02d %ls %d" ], [ 237936, "wide", "AFUMD" ], [ 237952, "wide", ".rar" ], [ 237968, "wide", "FUADPXETK" ], [ 238096, "wide", "rar.log" ], [ 238272, "wide", "AFUM" ], [ 238296, "wide", "ilog" ], [ 238440, "wide", "rar.ini" ], [ 238528, "wide", "[%c]%ls" ], [ 239192, "wide", "SeRestorePrivilege" ], [ 239232, "wide", "SeSecurityPrivilege" ], [ 239464, "wide", "SeCreateSymbolicLinkPrivilege" ], [ 239920, "wide", "%.*ls(%u)%ls" ], [ 239992, "wide", "rtmp%d" ], [ 240264, "bad allocation" ], [ 240280, "wide", "%c%c%c%c%c%c%c" ], [ 240312, "wide", "%c%c%c%c%c%c%c%c%c" ], [ 240496, "wide", "%c%10ls %9ls" ], [ 240568, "wide", "Unix owner" ], [ 240656, "wide", "%12ls: RAR %ls(v%d) -m%d -md=%d%s" ], [ 240760, "wide", "Unix" ], [ 240776, "wide", "Windows" ], [ 240792, "wide", "BLAKE2" ], [ 240808, "wide", "Pack-BLAKE2" ], [ 240832, "wide", "BLAKE2 MAC" ], [ 240888, "wide", "CRC32" ], [ 240928, "wide", "CRC32 MAC" ], [ 241448, "url", "!ls %9ls =%% \u0026ls %u" ], [ 241504, "wide", "%21ls %-14ls %u" ], [ 241544, "wide", "%21ls %9ls %3d%% %-25ls %u" ], [ 241656, "wide", "RAR 1.4" ], [ 241672, "wide", "RAR 5" ], [ 241688, "wide", "RAR 4" ], [ 241728, "wide", "__rar_" ], [ 241832, "wide", "AppData" ], [ 241848, "wide", "Software\\WinRAR\\Paths" ], [ 241936, "wide", "YMDHISWAEN" ], [ 241992, "wide", "yyyymmddhhmmss" ], [ 242296, "wide", "rar.lng" ], [ 242672, "wide", ".bad" ], [ 242720, "wide", ".rev" ], [ 242864, "wide", "*messages***" ], [ 242896, "*messages***" ], [ 242936, "wide", "LanguageFolder" ], [ 242968, "wide", "Software\\WinRAR\\General" ], [ 243016, "wide", "rarlng.dll" ], [ 243040, "wide", "System Volume Information\\" ], [ 243136, "wide", "%ls%c%ls" ], [ 243160, "CryptUnprotectMemory" ], [ 243184, "CryptProtectMemory" ], [ 243208, "wide", "Crypt32.dll" ], [ 243232, "wide", "CryptUnprotectMemory failed" ], [ 243288, "wide", "CryptProtectMemory failed" ], [ 243600, "wide", "SeShutdownPrivilege" ], [ 243640, "SetDllDirectoryW" ], [ 243664, "wide", "kernel32" ], [ 243688, "wide", "CreateThread failed" ], [ 243728, "wide", "WaitForMultipleObjects error %d, GetLastError %d" ], [ 243840, "wide", "Thread pool initialization failed." ], [ 244080, "wide", "%02u-%02u-%u %02u:%02u" ], [ 244128, "wide", "%u-%02u-%02u %02u:%02u,%03u" ], [ 244640, "CorExitProcess" ], [ 244656, "wide", "mscoree.dll" ], [ 244792, "Unknown exception" ], [ 244848, "bad exception" ], [ 244880, "runtime error" ], [ 244904, "TLOSS error" ], [ 244920, "SING error" ], [ 244936, "DOMAIN error" ], [ 244960, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 244967, "An application has made an attempt to load the C runtime library incorrectly." ], [ 245045, "Please contact the application's support team for more information." ], [ 245120, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 245127, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 245207, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 245368, "R6032\r\n- not enough space for locale information" ], [ 245375, "- not enough space for locale information" ], [ 245424, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 245431, "- Attempt to initialize the CRT more than once." ], [ 245479, "This indicates a bug in your application." ], [ 245528, "R6030\r\n- CRT not initialized" ], [ 245535, "- CRT not initialized" ], [ 245560, "R6028\r\n- unable to initialize heap" ], [ 245567, "- unable to initialize heap" ], [ 245600, "R6027\r\n- not enough space for lowio initialization" ], [ 245607, "- not enough space for lowio initialization" ], [ 245656, "R6026\r\n- not enough space for stdio initialization" ], [ 245663, "- not enough space for stdio initialization" ], [ 245712, "R6025\r\n- pure virtual function call" ], [ 245719, "- pure virtual function call" ], [ 245752, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 245759, "- not enough space for _onexit/atexit table" ], [ 245808, "R6019\r\n- unable to open console device" ], [ 245815, "- unable to open console device" ], [ 245856, "R6018\r\n- unexpected heap error" ], [ 245863, "- unexpected heap error" ], [ 245896, "R6017\r\n- unexpected multithread lock error" ], [ 245903, "- unexpected multithread lock error" ], [ 245944, "R6016\r\n- not enough space for thread data" ], [ 245951, "- not enough space for thread data" ], [ 246000, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 246002, "This application has requested the Runtime to terminate it in an unusual way." ], [ 246152, "R6009\r\n- not enough space for environment" ], [ 246159, "- not enough space for environment" ], [ 246200, "R6008\r\n- not enough space for arguments" ], [ 246207, "- not enough space for arguments" ], [ 246248, "R6002\r\n- floating point support not loaded" ], [ 246255, "- floating point support not loaded" ], [ 246296, "Microsoft Visual C++ Runtime Library" ], [ 246344, "\u003cprogram name unknown\u003e" ], [ 246368, "Runtime Error!\n\nProgram:" ], [ 246431, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 246536, "wide", "(null)" ], [ 246552, "(null)" ], [ 246601, "700WP" ], [ 246617, "`h````" ], [ 246878, "700PP" ], [ 246928, "GetProcessWindowStation" ], [ 246952, "GetUserObjectInformationA" ], [ 246984, "GetLastActivePopup" ], [ 247008, "GetActiveWindow" ], [ 247024, "MessageBoxA" ], [ 247040, "USER32.DLL" ], [ 247826, "wide", "h(((( H" ], [ 248512, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 248896, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 249136, "dddd, MMMM dd, yyyy" ], [ 249160, "MM/dd/yy" ], [ 249184, "December" ], [ 249200, "November" ], [ 249216, "October" ], [ 249224, "September" ], [ 249236, "August" ], [ 249244, "July" ], [ 249252, "June" ], [ 249260, "April" ], [ 249268, "March" ], [ 249280, "February" ], [ 249296, "January" ], [ 249352, "Saturday" ], [ 249364, "Friday" ], [ 249376, "Thursday" ], [ 249392, "Wednesday" ], [ 249408, "Tuesday" ], [ 249416, "Monday" ], [ 249424, "Sunday" ], [ 249464, "Complete Object Locator'" ], [ 249496, "Class Hierarchy Descriptor'" ], [ 249528, "Base Class Array'" ], [ 249552, "Base Class Descriptor at (" ], [ 249584, "Type Descriptor'" ], [ 249608, "`local static thread guard'" ], [ 249640, "`managed vector copy constructor iterator'" ], [ 249688, "`vector vbase copy constructor iterator'" ], [ 249736, "`vector copy constructor iterator'" ], [ 249776, "`dynamic atexit destructor for '" ], [ 249816, "`dynamic initializer for '" ], [ 249848, "`eh vector vbase copy constructor iterator'" ], [ 249896, "`eh vector copy constructor iterator'" ], [ 249936, "`managed vector destructor iterator'" ], [ 249976, "`managed vector constructor iterator'" ], [ 250016, "`placement delete[] closure'" ], [ 250048, "`placement delete closure'" ], [ 250080, "`omni callsig'" ], [ 250096, "delete[]" ], [ 250120, "`local vftable constructor closure'" ], [ 250160, "`local vftable'" ], [ 250192, "`udt returning'" ], [ 250208, "`copy constructor closure'" ], [ 250240, "`eh vector vbase constructor iterator'" ], [ 250280, "`eh vector destructor iterator'" ], [ 250312, "`eh vector constructor iterator'" ], [ 250352, "`virtual displacement map'" ], [ 250384, "`vector vbase constructor iterator'" ], [ 250424, "`vector destructor iterator'" ], [ 250456, "`vector constructor iterator'" ], [ 250488, "`scalar deleting destructor'" ], [ 250520, "`default constructor closure'" ], [ 250552, "`vector deleting destructor'" ], [ 250584, "`vbase destructor'" ], [ 250624, "`local static guard'" ], [ 250824, "operator" ], [ 250864, "delete" ], [ 250880, "__unaligned" ], [ 250896, "__restrict" ], [ 250920, "__clrcall" ], [ 250936, "__fastcall" ], [ 250952, "__thiscall" ], [ 250968, "__stdcall" ], [ 250984, "__pascal" ], [ 251000, "__cdecl" ], [ 251792, "SunMonTueWedThuFriSat" ], [ 251816, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 251864, "RSDS" ] ], "sz": 322560, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 871.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "\u003cCommands\u003e", "\u003cSwitches\u003e", "L\n ri\u003cP\u003e[:\u003cS\u003e] Set priority (0-default,1-min..15-max) and sleep time in ms", "M\n ta\u003cdate\u003e Process files modified after \u003cdate\u003e in YYYYMMDDHHMMSS format", "N\n tb\u003cdate\u003e Process files modified before \u003cdate\u003e in YYYYMMDDHHMMSS format" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 145.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\rar\\build\\unrar64\\Release\\UnRAR.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise process priority class", "e": [ "SetPriorityClass" ], "i": "micro-behaviors/process/thread/priority::set-priority-class", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555984.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.9399999976158142, "d": "HEAP_CREATE_ENABLE_EXECUTE flag (0x40000)", "e": [ "B9 00 00 04 00" ], "i": "micro-behaviors/mem/alloc/heap::heap-create-enable-execute-flag", "l": 1 }, { "d": "password keyword", "e": [ "%s - use current password ?", "I\nChecksum error in the encrypted file %s. Corrupt file or wrong password.", "ERROR: Passwords do not match", "#Enter password (will not be echoed)", "p[password] Set password", "Reenter password:" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "\u0026Corrupt archive - use 'Repair' command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Derived string condition", "e": [ "cannot recover data" ], "i": "objectives/impact/ransom/encrypt/threat-text::inline__data-loss-threat__any_3", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.28" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "UnRAR.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "42", "40", "41" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 322560.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/command-and-control/backdoor/binary::plaintext-sleep-command-token", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 665.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.28" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b9", "b8", "b8", "b9", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.25.36:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExW" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001" }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 7680)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "01 00 01 29" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.50)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "UVWATAUAVAW", "UVWATAUAVAWH", "VWATAUAV", "UVWATAUH", "VWATAUAVH", "WATAUAVAW", "SVWATAUAVAWH", "FUADPXETK", "YMDHISWAEN" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.34" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 425984.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "UnRAR.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 871.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8", "b8", "b8", "b8", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 871.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.28" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExW" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "NtCurrentProcess handle (-1) for NT API call", "e": [ "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::nt-current-process-handle", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "UnRAR.exe" ], "i": "objectives/evasion/masquerade/file::basename-is-exe", "l": 1 }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 871.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 871.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "c": 0.949999988079071, "d": "ANSI GUI probe API cluster", "e": [ "GetLastActivePopup", "GetActiveWindow", "MessageBoxA" ], "i": "well-known/malware/trojan/elex/test-loader::ansi-gui-probe-cluster", "l": 3 }, { "a": "T1091", "c": 0.8600000143051147, "d": "VB6 disk free space check GetDiskFreeSpaceExW", "e": [ "GetDiskFreeSpaceExW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-disk-free-space", "l": 1, "m": "B0017" }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "20.48.25.39:6194", "11.2.232.190:3329", "16.48.1.15:5298" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "20.48.25.39:6194", "11.2.232.190:3329", "16.48.1.15:5298" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "d4 2a 03 00", "99 05 03 00", "d3 be 02 00", "a0 be 02 00", "36 bb 02 00", "cc bc 02 00", "9a bb 02 00", "7b bb 02 00", "eb b6 02 00", "32 b6 02 00", "2e b0 02 00", "8b a5 02 00", "54 a5 02 00", "03 ca 01 00", "f5 39 00 00", "a8 37 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetCurrentDirectoryW", "SetConsoleCtrlHandler", "GetModuleFileNameW", "GetCurrentProcessId", "GetProcessAffinityMask", "InitializeCriticalSection", "SystemTimeToFileTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links USER32.dll (CharUpperW, CharLowerW, ExitWindowsEx, CharToOemBuffW, CharToOemA, ... +4 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegQueryValueExW, RegCloseKey, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, ... +2 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetMalloc, SHGetSpecialFolderLocation, SHGetPathFromIDListW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (SetConsoleCtrlHandler, SetLastError, LocalFree, FormatMessageW, CreateHardLinkW, ... +121 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "CreateFileW", "CreateFileA", "ReadFile", "DeviceIoControl" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "VS_VERSION_INFO", "ProductVersion", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "GetModuleFileNameW", "CreateFileW", "CreateFileA", "WriteFile", "FindFirstFileW", "SetFileTime", "GetModuleFileNameA" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "36 bb 02 00", "8b a5 02 00", "f5 39 00 00", "9a bb 02 00", "a8 37 00 00", "99 05 03 00", "32 b6 02 00", "d4 2a 03 00", "d3 be 02 00", "GetTickCount", "54 a5 02 00", "7b bb 02 00", "eb b6 02 00", "2e b0 02 00", "03 ca 01 00", "cc bc 02 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindNextFileW", "FindFirstFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 145.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsGetValue", "FlsSetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "binary.sentence_string_ratio = 0.34", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "binary.import_count = 145.00", "binary.function_count = 871.00" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "AdjustTokenPrivileges", "OpenProcessToken", "LookupPrivilegeValueW" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.overall_entropy = 4.28", "binary.function_count = 871.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1529", "c": 0.9399999976158142, "d": "Privilege-enabled reboot API use", "e": [ "LookupPrivilegeValueW", "AdjustTokenPrivileges", "ExitWindowsEx", "SeShutdownPrivilege" ], "i": "objectives/impact/system/shutdown::shutdown-privilege-reboot-api", "l": 3, "m": "B0029" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetConsoleCtrlHandler", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "bf93a064f1db793b52533adab4f64b0b24a0948fa16299d1830fa6f7cfc6dd92", "path": "64301!!UnRAR.exe", "type": "pe" }, { "f": "KO₁₃(Er₁₀As₈Co₄Dy₂I₇PrAlC₅CaEuLa₂P₄Xe)H₉(Db₄F₈Os₇Po₄U₂CmCrDsMg)Md₅(Bi₃PaPt)", "x": 69, "dp": 1, "id": 17, "is": [ "InitCommonControlsEx", "ImageList_ReplaceIcon", "ORDINAL 8", "CreateStatusWindowW", "ImageList_Destroy", "ImageList_Create", "ImageList_Remove", "ImageList_Add", "ImageList_AddMasked", "PropertySheetW", "StrCmpLogicalW", "SHAutoComplete", "IsAppThemed", "IsThemeActive", "SetFilePointer", "SetEndOfFile", "GetFileTime", "GetFileType", "ReadFile", "GetDriveTypeW", "GetDiskFreeSpaceExW", "GetVolumeInformationW", "SetFileAttributesW", "ExpandEnvironmentStringsW", "Sleep", "GetDiskFreeSpaceW", "GetVersionExW", "CompareFileTime", "FindCloseChangeNotification", "FindFirstChangeNotificationW", "GetTickCount", "GetLocaleInfoW", "GetNumberFormatW", "GetFullPathNameW", "CopyFileW", "GetCompressedFileSizeW", "FindResourceW", "SizeofResource", "LoadResource", "LoadLibraryExW", "GetCurrentProcessId", "UpdateResourceW", "EnumResourceLanguagesW", "EndUpdateResourceW", "EnumResourceNamesW", "BeginUpdateResourceW", "CompareStringA", "SetThreadPriority", "GetCurrentThread", "SetPriorityClass", "SetCurrentDirectoryW", "GetFullPathNameA", "CreateThread", "EnterCriticalSection", "LeaveCriticalSection", "GetProcessAffinityMask", "ReleaseSemaphore", "ResetEvent", "DeleteCriticalSection", "SetEvent", "InitializeCriticalSection", "CreateEventW", "CreateSemaphoreW", "SystemTimeToFileTime", "GetSystemTime", "WideCharToMultiByte", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "GetLogicalDrives", "ResumeThread", "SuspendThread", "GetSystemTimeAsFileTime", "GetStdHandle", "GetLocalTime", "GetThreadPriority", "GetPriorityClass", "SetErrorMode", "MulDiv", "FindNextChangeNotification", "WaitForMultipleObjects", "HeapFree", "HeapAlloc", "GetProcessHeap", "CreateFileA", "LoadLibraryA", "QueryPerformanceCounter", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "GetStringTypeW", "GetStringTypeA", "InitializeCriticalSectionAndSpinCount", "HeapSize", "LCMapStringW", "LCMapStringA", "SetHandleCount", "GetConsoleMode", "GetConsoleCP", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "ExitProcess", "HeapCreate", "HeapSetInformation", "FlsAlloc", "FlsFree", "FlsSetValue", "FlsGetValue", "DecodePointer", "EncodePointer", "RtlCaptureContext", "RtlVirtualUnwind", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "TerminateProcess", "GetStartupInfoA", "GetCommandLineA", "SetStdHandle", "ExitThread", "RtlPcToFileHeader", "RaiseException", "HeapReAlloc", "RtlUnwindEx", "RtlLookupFunctionEntry", "WriteFile", "FlushFileBuffers", "GetLongPathNameW", "GetShortPathNameW", "CreateDirectoryW", "RemoveDirectoryW", "DeleteFileW", "DeviceIoControl", "SetFileTime", "BackupSeek", "GetCurrentProcess", "BackupRead", "CreateFileW", "CreateHardLinkW", "FormatMessageW", "LocalFree", "GetCurrentDirectoryW", "MoveFileW", "CreateMutexW", "ReleaseMutex", "GlobalSize", "GlobalAlloc", "GlobalLock", "GlobalUnlock", "WriteConsoleW", "GlobalFree", "MultiByteToWideChar", "GetVersionExA", "CreateFileMappingW", "WaitForSingleObject", "OpenFileMappingW", "MapViewOfFile", "UnmapViewOfFile", "CloseHandle", "GetTempPathW", "GetCommandLineW", "GetModuleFileNameW", "FindNextFileW", "LoadLibraryW", "LocalFileTimeToFileTime", "GetLastError", "FreeLibrary", "FileTimeToDosDateTime", "FindFirstFileW", "FileTimeToLocalFileTime", "FileTimeToSystemTime", "GetTimeFormatW", "GetDateFormatW", "FindClose", "DosDateTimeToFileTime", "GetFileAttributesW", "GetModuleHandleW", "GetProcAddress", "SetLastError", "GetFileInformationByHandle", "GetLocaleInfoA", "SetEnvironmentVariableA", "WriteConsoleA", "GetConsoleOutputCP", "GetCurrentThreadId", "SetScrollPos", "CreateDialogParamW", "PostThreadMessageW", "IsChild", "GetLastActivePopup", "GetMenuItemID", "GetClipboardData", "SetMenu", "InsertMenuW", "LoadMenuW", "PostQuitMessage", "RegisterClassW", "LoadAcceleratorsW", "GetMenuState", "DispatchMessageW", "GetMessageW", "CopyRect", "IsWindow", "CharUpperW", "ValidateRect", "GetSysColor", "CopyImage", "FillRect", "ExitWindowsEx", "CharLowerA", "DrawIconEx", "LoadStringW", "GetWindow", "SetMenuItemInfoW", "GetWindowLongW", "SetWindowLongW", "GetSystemMenu", "KillTimer", "SetTimer", "SystemParametersInfoW", "ScrollWindowEx", "GetComboBoxInfo", "IsCharUpperW", "IsCharAlphaW", "RegisterClassExW", "OpenClipboard", "EmptyClipboard", "SetClipboardData", "CloseClipboard", "MessageBeep", "PeekMessageW", "GetFocus", "EnableMenuItem", "MoveWindow", "CheckMenuItem", "InsertMenuItemW", "LoadImageW", "BeginPaint", "EndPaint", "SetWindowTextW", "GetClientRect", "UpdateWindow", "GetWindowTextLengthW", "AppendMenuW", "DrawMenuBar", "GetMenu", "GetSubMenu", "DeleteMenu", "GetMenuItemCount", "GetMenuItemInfoW", "CharToOemBuffW", "ScreenToClient", "ClientToScreen", "CreatePopupMenu", "SetWindowLongPtrW", "TrackPopupMenu", "DestroyMenu", "CallWindowProcW", "RegisterClipboardFormatW", "PtInRect", "LoadIconW", "SetScrollRange", "CreateDialogIndirectParamW", "BringWindowToTop", "GetPropW", "RemovePropW", "GetIconInfo", "CreateIconIndirect", "TranslateAcceleratorW", "IsDialogMessageW", "SetPropW", "FindWindowW", "GetForegroundWindow", "RegisterWindowMessageW", "FindWindowExW", "EnumWindows", "CreateIcon", "SetForegroundWindow", "RedrawWindow", "FlashWindow", "SendMessageW", "SetFocus", "GetWindowTextW", "DefWindowProcW", "CreateWindowExW", "DestroyWindow", "SetDlgItemTextW", "EndDialog", "CharLowerW", "TranslateMessage", "GetKeyState", "LoadCursorW", "SetCursor", "WindowFromPoint", "GetWindowThreadProcessId", "GetDC", "ReleaseDC", "GetDesktopWindow", "GetCursorPos", "GetWindowLongPtrW", "EnableWindow", "IntersectRect", "SystemParametersInfoA", "IsIconic", "GetSystemMetrics", "IsWindowEnabled", "SetDlgItemInt", "GetDlgItemInt", "IsDlgButtonChecked", "ShowWindow", "PostMessageW", "EnumChildWindows", "GetClassNameW", "InvalidateRect", "CheckDlgButton", "MessageBoxW", "IsWindowVisible", "CharToOemA", "OemToCharBuffA", "OemToCharA", "CharToOemBuffA", "DialogBoxParamW", "DestroyIcon", "SetWindowPlacement", "GetWindowPlacement", "GetWindowRect", "GetParent", "MapWindowPoints", "SetWindowPos", "GetDlgItem", "SendDlgItemMessageW", "GetDlgItemTextW", "LoadBitmapW", "GetTextExtentPoint32W", "LineTo", "MoveToEx", "GetDeviceCaps", "SetPixel", "CreatePatternBrush", "TextOutA", "CreateCompatibleBitmap", "CreateBitmap", "GetMapMode", "Rectangle", "SetMapMode", "StretchBlt", "SetBkColor", "ExtTextOutW", "BitBlt", "GetObjectW", "CreateCompatibleDC", "GetPixel", "DeleteDC", "CreatePen", "CreateSolidBrush", "SetTextColor", "TextOutW", "Polygon", "Polyline", "SelectObject", "GetTextFaceW", "GetTextMetricsW", "CreateFontW", "DPtoLP", "DeleteObject", "GetSaveFileNameW", "GetOpenFileNameW", "CommDlgExtendedError", "ChooseFontW", "CryptGenRandom", "CryptAcquireContextW", "AdjustTokenPrivileges", "LookupPrivilegeValueW", "OpenProcessToken", "GetSecurityDescriptorLength", "GetFileSecurityW", "SetFileSecurityW", "RegCloseKey", "RegQueryValueExW", "IsTextUnicode", "RegEnumValueW", "RegSetValueExW", "RegCreateKeyExW", "RegDeleteValueW", "RegEnumKeyExW", "RegDeleteKeyW", "RegOpenKeyExW", "CryptReleaseContext", "SHChangeNotify", "SHGetPathFromIDListW", "FindExecutableW", "DragFinish", "DragQueryFileW", "DragAcceptFiles", "Shell_NotifyIconW", "ShellExecuteW", "ORDINAL 100", "SHGetFileInfoW", "SHAddToRecentDocs", "SHFileOperationW", "ShellExecuteExW", "SHGetMalloc", "SHBrowseForFolderW", "SHGetDesktopFolder", "SHGetSpecialFolderLocation", "CreateStreamOnHGlobal", "CoCreateInstance", "CoTaskMemFree", "OleInitialize", "OleUninitialize", "CoTaskMemAlloc", "CLSIDFromString", "OleSetClipboard", "DoDragDrop", "CoInitializeEx", "ORDINAL 8" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\build\\winrar64\\Release\\WinRAR.pdb", "rsrc_size": 212992.0, "subsystem": 2.0, "timestamp": 1368555974.0, "icon_count": 2.0, "image_base": 5368709120.0, "rsrc_entropy": 5.2, "entry_section": ".text", "size_of_image": 1970176.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 11.0, "timestamp_year": 2013.0, "characteristics": 34.0, "entry_point_rva": 829260.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 11.0, "manifest_present": true, "computed_checksum": 1350959.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555974.0, "debug_timestamp_min": 1368555974.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 9.0, "version_info_present": true, "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 904192.0, "file_size": 1305088.0, "entry_point": 829260.0, "code_entropy": 6.51, "data_entropy": 4.92, "import_count": 419.0, "string_count": 2860.0, "section_count": 6.0, "avg_complexity": 14.0, "function_count": 2923.0, "import_density": 0.47, "max_complexity": 14.0, "string_density": 3.24, "overall_entropy": 4.73, "avg_basic_blocks": 31.0, "avg_section_size": 217344.0, "dependency_count": 11.0, "entropy_variance": 1.49, "function_density": 3.31, "avg_function_size": 494.0, "avg_string_length": 18.64, "complexity_per_kb": 0.02, "max_string_length": 540.0, "wide_string_count": 1739.0, "writable_sections": 1.0, "avg_string_entropy": 3.15, "code_to_data_ratio": 2.26, "data_to_file_ratio": 0.01, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.16, "text_to_file_ratio": 0.69, "total_basic_blocks": 31.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 21.81, "debug_reference_count": 1.0, "largest_section_ratio": 0.69, "sentence_string_count": 613.0, "sentence_string_ratio": 0.21, "behavioral_import_ratio": 0.01, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 2145, "C E3" ], [ 3668, "@SUVWATAUAVAW" ], [ 3745, "AXD9" ], [ 4065, "EXD8" ], [ 4326, "EXD9" ], [ 4859, "UVWH" ], [ 5124, "@UVWATAUAVAW" ], [ 6279, "WATAUH" ], [ 6884, "t$ WATAUAVAWH" ], [ 7983, "WATAUAVAWH" ], [ 8343, "K0E3" ], [ 9868, "FXD8" ], [ 11613, "GXD9" ], [ 12554, "CXD8" ], [ 13171, "KXD9" ], [ 13584, "CXL9" ], [ 14509, "CXD9" ], [ 15003, "CXH9H" ], [ 15076, "SXD9" ], [ 20086, "SXD8" ], [ 22307, "f91t" ], [ 22332, "f93u" ], [ 22381, "UVWATAUAVAWH" ], [ 25588, "@SUVWATAUAV" ], [ 29937, "x ATAUAVH" ], [ 34457, "O0E3" ], [ 34464, "W4E3" ], [ 34636, "OPE3" ], [ 34643, "WTE3" ], [ 35912, "OXE3" ], [ 42437, "f93t" ], [ 43625, "x AUAVAWH" ], [ 48583, "ATAUAVH" ], [ 69425, "UVWATAUAVAW" ], [ 76344, "@SVWATAUAVAW" ], [ 78421, "f9l$ tFf9-%6" ], [ 81495, "WATAUAVAW" ], [ 83077, "UVWATAUH" ], [ 86093, "R895" ], [ 86194, "VWAT" ], [ 88224, "@SVWATAUAVAWH" ], [ 98604, "@SUVWATAUAVAWH" ], [ 101039, "l$ VWATAUAW" ], [ 110523, "l$ VWATAUAVH" ], [ 115146, "VWATAUAVH" ], [ 119079, "T30H" ], [ 119834, "VWATH" ], [ 121917, "SUVWATAUAVAWH" ], [ 128002, "VWATAUAV" ], [ 128810, "f92u" ], [ 136781, "UVWATAU" ], [ 137623, "/uhH" ], [ 140373, "f95v0" ], [ 161276, "@SUVWATAUAVH" ], [ 165197, "T4 H" ], [ 165964, "@SUVWATAUAVAWLcI" ], [ 170943, "WATAWH" ], [ 175759, "WATAVH" ], [ 177077, "SUVWATAUAVAW" ], [ 179609, "Q1E3" ], [ 195077, "x ATAUAVAWH" ], [ 197567, "L!|$HL!|$83" ], [ 202901, "UVWATAV" ], [ 207163, "SUVWATAUAVH" ], [ 209823, "SUVWH" ], [ 211135, "l$ VWATAUAV" ], [ 219459, "WATAU" ], [ 224664, "f98u" ], [ 226681, "x ATAVAWH" ], [ 247685, "x ATAUAWH" ], [ 249374, "D4 H" ], [ 249674, "f90u" ], [ 251715, "ATAUAWH" ], [ 262135, "L95R8" ], [ 271910, "36666I" ], [ 288074, "D85Q" ], [ 302194, "\\$ UVWATAUH" ], [ 314854, "VWATAUAW" ], [ 323668, "u5f9" ], [ 326794, "tUfA9.tOI" ], [ 335213, "8D9T" ], [ 341100, "t$ WATAUAVD" ], [ 341433, "x ATAUAVAW" ], [ 343453, "x ATAUAVL" ], [ 348042, "\\$ UVWATAUAVAWH" ], [ 357483, "VWATAUAVAW" ], [ 363889, "x ATAUAVAWE" ], [ 365276, "t$ WATAUAVAWL" ], [ 365781, "x ATAUD" ], [ 367024, "QPE3" ], [ 378331, "WAVAWH" ], [ 389924, "@SUVWATAUAW" ], [ 394836, "f92t" ], [ 397258, "f99u" ], [ 400098, "tnf99ti" ], [ 403849, "s WATAUAVAWH" ], [ 407962, "stack", "PKPKPK" ], [ 439057, "EXA84" ], [ 445298, "J0E3" ], [ 447732, "M E3" ], [ 456691, "SVWATAUAVAWH" ], [ 464930, "BT9AT" ], [ 465079, "F49G4" ], [ 475406, "\\$ UVWATAUAVAW" ], [ 478091, "l$ VWATAVAWH" ], [ 478893, "D3I D" ], [ 481005, "E 1G" ], [ 501689, "H SUVWATH" ], [ 502028, "t$ WATAUAVAW" ], [ 506780, "ATAUAV" ], [ 512140, "A4A3" ], [ 514408, "xxxxwwww" ], [ 515571, "xxxxwwww" ], [ 519908, "gfffffffI" ], [ 532282, "VWAUH" ], [ 535164, "gfffffffH" ], [ 535196, "stack", "gfffffff" ], [ 584353, "U E3" ], [ 590803, "WAUAVH" ], [ 594120, "F0E3" ], [ 606088, "C8E3" ], [ 609049, "p WATAUAVAWH" ], [ 628198, "f97u" ], [ 632480, "95vm" ], [ 644000, "AUAVAW" ], [ 693129, "s WATAUH" ], [ 702434, "f90t" ], [ 703483, "H956" ], [ 721488, "L$ SUVWATAUAV" ], [ 726656, "f95i" ], [ 746329, "f95r" ], [ 752890, "950z" ], [ 767267, "l$ VWATAUAWH" ], [ 790067, "SUVWATAUAWH" ], [ 793076, "D9553" ], [ 795007, "V0E3" ], [ 803926, "VWATAVAWH" ], [ 805249, "p WATAUH" ], [ 809935, "SVWATH" ], [ 821023, "AUAVAWH" ], [ 822453, "H SVWATH" ], [ 828168, "8MOC" ], [ 828956, "@SWATAUAVAWH" ], [ 849680, "@UATAUAVAWH" ], [ 856412, "D09A" ], [ 857540, "D19K" ], [ 861422, "L$ UATAUAVAWH" ], [ 867828, "@USVWATAUAVAWH" ], [ 871414, "M0H3" ], [ 909056, "bad allocation" ], [ 909168, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 909336, "YNANC" ], [ 909912, "wide", ".ext" ], [ 909952, "CompareStringOrdinal" ], [ 909976, "wide", "kernel32.dll" ], [ 910120, "wide", "rarfiles.lst" ], [ 910152, "wide", "General\\Toolbar" ], [ 910184, "wide", "ViewAddress" ], [ 910256, "wide", "ComboBoxEx32" ], [ 910288, "wide", "comctl32.dll" ], [ 910320, "wide", "RENAMEDLG" ], [ 910344, "wide", "CREATEVOLDLG" ], [ 910376, "wide", "ASKNEXTVOL" ], [ 910400, "wide", "HELPArcVolumes" ], [ 910448, "wide", "%s %s %s" ], [ 910472, "wide", "REPLACEFILEDLG" ], [ 910504, "wide", "HELPOverwrFile" ], [ 910624, "wide", ":Zone.Identifier" ], [ 910664, "wide", "__rar_" ], [ 912016, "wide", "Paths" ], [ 912032, "wide", "TempRemovableOnly" ], [ 912088, "wide", "RAR 5.0" ], [ 912104, "wide", "Windows" ], [ 912120, "wide", "Unix" ], [ 912256, "wide", ".zip" ], [ 912280, "wide", "ZIP64" ], [ 912296, "wide", "zip|z##|jar" ], [ 913216, "wide", "Amiga" ], [ 913232, "wide", "VAX/VMS" ], [ 913264, "wide", "Atari ST" ], [ 913304, "wide", "Z-System" ], [ 913344, "wide", "TOPS-20" ], [ 913360, "wide", "SMS/QDOS" ], [ 913384, "wide", "Acorn RISC OS" ], [ 913416, "wide", "Windows VFAT" ], [ 913456, "wide", "Tandem" ], [ 913912, "GetComment" ], [ 913928, "Extract" ], [ 913936, "GetListItem" ], [ 913952, "GetNextName" ], [ 913964, "Close" ], [ 913972, "Open" ], [ 913984, "Prepare" ], [ 914008, "wide", "Ident" ], [ 914024, "wide", "Info" ], [ 914104, "wide", "Formats\\*.fmt" ], [ 914176, "wide", "FileList" ], [ 914200, "wide", "AllVolumes" ], [ 914264, "wide", "Setup" ], [ 914280, "wide", "CustomExt" ], [ 914424, "wide", ".part" ], [ 914448, "wide", "ExclNames" ], [ 914472, "wide", "Extraction" ], [ 914496, "wide", "UseExclNames" ], [ 914568, "wide", "HELPCommandsBenchmark" ], [ 914616, "wide", "General" ], [ 914896, "wide", "SysListView32" ], [ 915072, "wide", "OKCANCELTPL" ], [ 915552, "70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434" ], [ 915864, "wide", "rarinfo.log" ], [ 915928, "wide", "default.sfx" ], [ 916008, "wide", "rar.log" ], [ 916208, "wide", "AFUM" ], [ 916296, "wide", "zip.sfx" ], [ 916352, "wide", "setup_integration" ], [ 916432, "wide", "iadm" ], [ 916448, "wide", "iimg" ], [ 916464, "wide", "iicon" ], [ 916480, "wide", "iextinit" ], [ 916504, "wide", "iext" ], [ 916536, "wide", "Password" ], [ 916648, "wide", "RemoveRedundantFolder" ], [ 916736, "wide", "Compression" ], [ 916760, "wide", "DefFolder" ], [ 916864, "wide", "Extraction\\Profile" ], [ 916904, "wide", "ShowExplorer" ], [ 916960, "wide", ".rar" ], [ 917024, "wide", "AFUMR" ], [ 917040, "wide", "AppendName" ], [ 917064, "wide", "DEFVOLSIZES" ], [ 917088, "wide", "CONFIGCOMPRESSION" ], [ 917128, "wide", "HELPCompressionSettings" ], [ 917176, "wide", "RestoreFolder" ], [ 917208, "wide", "StartFolder" ], [ 917232, "wide", "TempFolder" ], [ 917256, "wide", "CONFIGPATHS" ], [ 917280, "wide", "HELPPathsSettings" ], [ 917320, "wide", "ExternalViewer" ], [ 917352, "wide", "ViewerIgnoreModifications" ], [ 917408, "wide", "ViewerUnpackAll" ], [ 917440, "wide", "*.exe *.msi *.htm *.html" ], [ 917496, "wide", "Wrap" ], [ 917512, "wide", "ReuseWindow" ], [ 917560, "wide", "Type" ], [ 917576, "wide", "Viewer" ], [ 917592, "wide", "CONFIGVIEWER" ], [ 917624, "wide", "HELPViewerSettings" ], [ 917664, "wide", "VirusScan" ], [ 917688, "wide", "Prompt" ] ], "sz": 1305088, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassW", "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage::enum-windows", "l": 2 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 2923.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Standalone SHA256 hash string in binary", "e": [ "70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434", "a538f494a2afdb0ca5c008d34100dc71cb684672c0c511da8d95d38642fc2360" ], "i": "metadata/binary/anomaly::embedded-sha256-token", "l": 3 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-file-operation", "l": 3 }, { "c": 0.9200000166893005, "d": "Shell drag query API", "e": [ "DragQueryFileW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-drag-query-file", "l": 1 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "OpenClipboard", "EmptyClipboard", "CloseClipboard", "GetClipboardData", "RegisterClipboardFormatW", "SetClipboardData", "OleSetClipboard", "Clipboard" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat", ".dat", ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003c/b\u003e", "\u003cbr\u003e", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e", "\u003c/html\u003e", "utf-8\"\u003e\u003c/head\u003e", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=", "\u003chtml\u003e", "\u003c/style\u003e", "\u003cstyle\u003e", "\u003c/p\u003e", "Add \u0026to \u003carchive name\u003e", "Compress to \u003carchive name\u003e and email", "Cannot modify volume\u003cEncrypted file %s. Cannot modify the encrypted solid archive*Cannot update soli...", "This is not the first volume+Cannot convert old format (RAR 1.5) archive\u003cDOS SFX module can handle o..." ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 419.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "a": "T1567", "c": 1.0, "d": "Recursive sync transfer flags", "e": [ "--recursive" ], "i": "objectives/exfiltration/cloud/sync-tool::sync-recursive-flags", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "a": "T1573", "c": 1.0, "d": "RC4 XOR decrypt loop pattern", "e": [ "75 ff" ], "i": "micro-behaviors/crypto/symmetric/stream::rc4-xor-loop", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 419.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.75, "d": "Clear clipboard contents", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "l": 2 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "MoveToEx" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1 }, { "c": 0.75, "d": "Query active window title length", "e": [ "GetWindowTextLengthW" ], "i": "micro-behaviors/ui/window/manage::get-window-text-length", "l": 2 }, { "c": 0.8999999761581421, "d": "Release cryptographic context", "e": [ "CryptReleaseContext" ], "i": "micro-behaviors/crypto/library::crypt-release-context", "l": 2 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 419.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\build\\winrar64\\Release\\WinRAR.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoW", "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise process priority class", "e": [ "SetPriorityClass" ], "i": "micro-behaviors/process/thread/priority::set-priority-class", "l": 2 }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "a": "T1204", "c": 0.699999988079071, "d": "Virus reference", "e": [ "Virus", "Virus", "Virus", "Virus", "Virus", "virus", "Virus", "Virus", "Virus", "virus" ], "i": "micro-behaviors/data/text/malware::virus-marker", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage::get-window-thread-process-id", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555974.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 212992.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "a": "T1552.004", "d": "Generic key extension", "e": [ ".key" ], "i": "objectives/collection/file-targeting/filter::key-extension", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query volume information", "e": [ "GetVolumeInformationW" ], "i": "micro-behaviors/fs/enumerate/volume::get-volume-info", "l": 3 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 419.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.9399999976158142, "d": "HEAP_CREATE_ENABLE_EXECUTE flag (0x40000)", "e": [ "B9 00 00 04 00", "B9 00 00 04 00", "B9 00 00 04 00", "B9 00 00 04 00" ], "i": "micro-behaviors/mem/alloc/heap::heap-create-enable-execute-flag", "l": 1 }, { "d": "password keyword", "e": [ "…ate solid archives with password'Unknown method in %s. O…", "ORGPASSWORDS", "\u0026Reenter password for verification", "…. Corrupt file or wrong password.)Checksum error in %s. …", "PASSWORDITEM", "\u0026Show password", "\u0026Organize passwords...", "Wrong password for %s2The archive is e…", "\u0026Enter password", "Password \u0026label (optional)", "PasswordOff.ico", "OrgPasswords", "Enter password", "Passwords", "…ure you want to store a password to the profile?4Are you…", "Passwords do not match." ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 1.0, "d": ".bat extension", "e": [ ".bat", ".bat" ], "i": "objectives/command-and-control/dropper/builder::bat-ext", "l": 1 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "http\\shell\\open\\command", "/;The comment below contains SFX script commands", "%s\\shell\\open\\command", "WinRAR\\shell\\open\\command", "WinRAR.ZIP\\shell\\open\\command", "5The command is not supported for this type of archive", "Select command", "WinRAR.REV\\shell\\open\\command", "Unknown command \"%s\"" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "Open archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA", "SystemParametersInfoW" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.800000011920929, "d": "Initialize COM apartment model", "e": [ "CoInitializeEx" ], "i": "micro-behaviors/os/com/invoke::co-initialize-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "MAPI message send call", "e": [ "MAPISendMail" ], "i": "objectives/collection/email-harvest::mapi-send-mail", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Modify PE resources via UpdateResourceW", "e": [ "UpdateResourceW" ], "i": "micro-behaviors/fs/file/write::update-resource-w", "l": 3 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.800000011920929, "d": "Write data to clipboard", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.15" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ "*.exe *.com *.pif *.scr *.bat *.cmd *.lnk", ".lnk", "WinRAR.lnk" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives", "l": 3, "m": "E1083" }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "WinRAR.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to thread (Unicode)", "e": [ "PostThreadMessageW" ], "i": "micro-behaviors/os/message/queue::post-thread-message-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy image list", "e": [ "ImageList_Destroy" ], "i": "micro-behaviors/ui/controls/widget::image-list-destroy", "l": 2 }, { "c": 0.800000011920929, "d": "Commit PE resource modifications", "e": [ "EndUpdateResourceW" ], "i": "micro-behaviors/data/embedded/payload::end-update-resource-w", "l": 3 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "a": "T1057", "d": "Browser app safari", "e": [ "safari.exe" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-safari", "l": 2, "m": "E1592" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": ".cmd extension", "e": [ "*.exe *.com *.pif *.scr *.bat *.cmd *.lnk" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "Find window by class/title", "e": [ "FindWindowExW" ], "i": "micro-behaviors/ui/window/manage::find-window-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Notify shell of file changes", "e": [ "SHChangeNotify" ], "i": "micro-behaviors/ui/window/notify::shell-change-notify", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "WinRAR archiver FileDescription string", "e": [ "WinRAR archiver" ], "i": "objectives/evasion/masquerade/version-resource::winrar-archiver-filedesc", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Query current foreground window", "e": [ "GetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::get-foreground-window", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 0.75, "d": "RAR extract instruction", "e": [ "extract contents of RAR" ], "i": "objectives/lateral-movement/social-engineering/lures::extract-rar-archive", "l": 1 }, { "c": 0.699999988079071, "d": "runas privilege elevation string", "e": [ "runas" ], "i": "micro-behaviors/os/privilege/elevation::runas-string", "l": 3 }, { "c": 0.9300000071525574, "d": "Storm iexplore target name", "e": [ "iexplore.exe" ], "i": "well-known/malware/trojan/elex/storm::storm-iexplore-name", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 1305088.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window (Unicode)", "e": [ "PostMessageW" ], "i": "micro-behaviors/os/message/queue::post-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "d": ".bat extension reference", "e": [ ".bat", ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "c": 0.699999988079071, "d": "Add item to menu", "e": [ "AppendMenuW" ], "i": "micro-behaviors/ui/menu/popup::append-menu", "l": 2 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2860.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Display folder browse dialog", "e": [ "SHBrowseForFolderW" ], "i": "micro-behaviors/fs/shell-ops/commands::browse-for-folder", "l": 3 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 2, "m": "C0014" }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.73" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Acquire cryptographic service provider context", "e": [ "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library::crypt-acquire-context", "l": 2, "m": "C0027" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "SystemTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 1.0, "d": "scanner word", "e": [ "Scanner", "scanner", "scanner", "scanner", "scanner", "scanner" ], "i": "objectives/impact/infect/marker::scanner-word", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 1305088.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.6499999761581421, "d": "Close clipboard", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard", "l": 2 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "WinRAR.exe" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 419.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2860.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.75, "d": "Read data from clipboard", "e": [ "GetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::get-clipboard-data", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExW", "GetDiskFreeSpaceW" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.8500000238418579, "d": "AppID registry word", "e": [ "AppID" ], "i": "objectives/persistence/system/registry/com::appid-word", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "binary.file_size = 1305088.00" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "a": "T1562.001", "d": "Norton reference", "e": [ "Norton AntiVirus" ], "i": "objectives/impact/degrade/edr::norton-name", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 419.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.7200000286102295, "d": "WININIT rename section marker", "e": [ "Rename" ], "i": "micro-behaviors/fs/config/system::wininit-rename-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 419.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "binary.import_count = 419.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "c": 0.75, "d": "Open clipboard access", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "Encrypt", "encrypt", "encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 2 }, { "a": "T1562.001", "c": 0.9800000190734863, "d": "AMSI scan buffer memory patch bytes (E_INVALIDARG)", "e": [ "b8 57 00 07 80 c3" ], "i": "objectives/evasion/anti-av/platform::amsi-memory-patch-hex-bytes", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteW)", "e": [ "ShellExecuteW" ], "i": "micro-behaviors/process/create/exec::shell-execute", "l": 3 }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00", "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001" }, { "a": "T1562.001", "d": "McAfee reference", "e": [ "McAfee VirusScan" ], "i": "objectives/impact/degrade/edr::mcafee-name", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "runas elevation verb", "e": [ "runas" ], "i": "objectives/privilege-escalation/token-manipulation::runas-word", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.699999988079071, "d": "Compare file modification times", "e": [ "CompareFileTime" ], "i": "micro-behaviors/fs/sync/fsync::compare-file-time", "l": 2 }, { "a": "T1036", "c": 0.8199999928474426, "d": "System tray icon manipulation", "e": [ "Shell_NotifyIconW" ], "i": "micro-behaviors/ui/window/notify::shell-notify-icon", "l": 3 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 1.0, "d": "virus word", "e": [ "Virus", "Virus", "Virus", "Virus", "Virus", "virus", "Virus", "Virus", "Virus", "virus" ], "i": "objectives/impact/infect/marker::virus-word", "l": 1 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "01 00 01 21" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with many wide strings", "e": [ "binary.wide_string_count = 1739.00" ], "i": "objectives/anti-static/obfuscation/payload/section::heavy-wide-string-corpus", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.75, "d": "Find window by class/title (Wide)", "e": [ "FindWindowW" ], "i": "micro-behaviors/ui/window/manage::find-window-w-import", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2860.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "a": "T1562.001", "d": "Kaspersky reference", "e": [ "SOFTWARE\\KasperskyLab\\SetupFolders", "Kaspersky Anti-Virus", "Software\\KasperskyLab\\AVP%d\\environment", "SOFTWARE\\KasperskyLab\\Components\\101" ], "i": "objectives/impact/degrade/edr::kaspersky-name", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.51)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b9", "b9", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.699999988079071, "d": "Split Protect API fragment", "e": [ "Protect" ], "i": "objectives/evasion/process/injection::split-protect-api-fragment", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "UVWATAUAVAWH", "UVWATAUAVAW", "WATAUAVAW", "UVWATAUH", "VWATAUAVH", "VWATAUAV", "SUVWATAUAVAW", "SUVWATAUAVH", "VWATAUAW", "VWATAUAVAW", "SVWATAUAVAWH", "SUVWATAUAWH", "VWATAVAWH", "RENAMEDLG", "CREATEVOLDLG" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1057", "d": "Browser app chrome", "e": [ "chrome.exe" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-chrome-firefox", "l": 2, "m": "E1592" }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.21" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "Create modeless dialog", "e": [ "CreateDialogParamW" ], "i": "micro-behaviors/ui/dialog/prompt::create-dialog-param", "l": 2 }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcW" ], "i": "micro-behaviors/ui/window/manage::call-window-proc", "l": 2 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password", "password", "password", "password", "password", "password", "password", "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "Rar$Scan%d.bat", "$eToolbarWindow32", "Aborted$Cannot repair the old format archive9The archive header is corrupt. Mark the archive as soli...", "Converting archives$Select folder for converted archives", "Unknown encryption method in %s$The specified password is incorrect." ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "a": "T1543.003", "c": 0.8600000143051147, "d": "Services registry key fragment", "e": [ "SYSTEM\\CurrentControlSet\\Services\\avgntflt" ], "i": "objectives/persistence/system/service/install::service-registry-key-fragment", "l": 1, "m": "B0011.003" }, { "c": 0.800000011920929, "d": "Enumerate child windows", "e": [ "EnumChildWindows" ], "i": "micro-behaviors/ui/window/manage::enum-child-windows-import", "l": 2 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload::zip-magic", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA", "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "WinRAR.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 2923.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.949999988079071, "d": "Enumerate resource names (callback trigger)", "e": [ "EnumResourceNamesW" ], "i": "micro-behaviors/os/callback/enum::enum-resource-names", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "d": ".msi extension reference", "e": [ ".msi" ], "i": "micro-behaviors/fs/path/extension::msi", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has many functions", "e": [ "binary.function_count = 2923.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-function-count", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.699999988079071, "d": "Create image list", "e": [ "ImageList_Create" ], "i": "micro-behaviors/ui/controls/widget::image-list-create", "l": 2 }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 212992.00" ], "i": "well-known/malware/trojan/shellobject::xll-large-rsrc-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "a": "T1083", "c": 0.8799999952316284, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives-text", "l": 3, "m": "E1083" }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 419.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is enabled", "e": [ "IsWindowEnabled" ], "i": "micro-behaviors/ui/window/manage::is-window-enabled", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8", "b8", "b8", "b9", "b8", "b8", "b9", "b9", "b8", "b8", "b9", "b8", "b9", "b9", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 2923.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.7799999713897705, "d": "Register custom clipboard format", "e": [ "RegisterClipboardFormatW" ], "i": "micro-behaviors/os/clipboard/access::register-clipboard-format-w", "l": 2 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "winrar", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "a": "T1112", "c": 0.6499999761581421, "d": "Windows runas verb token", "e": [ "runas" ], "i": "objectives/impact/degrade/system::runas-verb-token", "l": 1 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 212992)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (Unicode)", "e": [ "PeekMessageW" ], "i": "micro-behaviors/os/message/queue::peek-message-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 419.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.949999988079071, "d": ".cab extension used as infection backup", "e": [ ".cab" ], "i": "micro-behaviors/fs/file/copy::cab-extension-infection", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.699999988079071, "d": "Get file information and icon", "e": [ "SHGetFileInfoW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-file-info", "l": 2 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "Add masked image", "e": [ "ImageList_AddMasked" ], "i": "micro-behaviors/ui/controls/widget::image-list-add-masked", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.73" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExW", "GetDiskFreeSpaceW" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll virtual key state", "e": [ "GetKeyState" ], "i": "micro-behaviors/hardware/input/keyboard::get-key-state", "l": 2, "m": "E1056.001" }, { "a": "T1562.001", "d": "Sophos reference", "e": [ "Sophos Anti-Virus", "SOFTWARE\\Sophos\\SweepNT" ], "i": "objectives/impact/degrade/edr::sophos-name", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055.012", "c": 0.6000000238418579, "d": "ResumeThread call", "e": [ "ResumeThread" ], "i": "objectives/evasion/process/injection/hollowing::resume-thread", "l": 1, "m": "E1055.012" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script::cmd-exe-dup", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 2923.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "NtCurrentProcess handle (-1) for NT API call", "e": [ "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::nt-current-process-handle", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-getpixel", "l": 2 }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Standalone SHA256 hash string in binary", "e": [ "70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434", "a538f494a2afdb0ca5c008d34100dc71cb684672c0c511da8d95d38642fc2360" ], "i": "objectives/anti-static/obfuscation/string::embedded-sha256-token", "l": 3 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "WinRAR.exe" ], "i": "objectives/evasion/masquerade/file::basename-is-exe", "l": 1 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Generate cryptographic random bytes", "e": [ "CryptGenRandom" ], "i": "micro-behaviors/os/random/generator::crypt-gen-random", "l": 2, "m": "C0027" }, { "a": "T1057", "d": "Browser app iexplore", "e": [ "iexplore" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-iexplore", "l": 3, "m": "E1592" }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{B41DB860-64E4-11D2-9906-E49FADC173CA}", "{B41DB860-8EE4-11D2-9906-E49FADC173CA}", "{EAAAB119-D0BF-4FF4-B6F0-B6FB0393921A}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 2923.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindow", "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.8500000238418579, "d": ".NET Clipboard class reference (WinForms)", "e": [ "Clipboard" ], "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "l": 3 }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Registry blob wipe API", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 3, "m": "F0007" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 2923.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "SetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-setpixel", "l": 2 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "a": "T1091", "c": 0.8600000143051147, "d": "VB6 disk free space check GetDiskFreeSpaceExW", "e": [ "GetDiskFreeSpaceExW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-disk-free-space", "l": 1, "m": "B0017" }, { "a": "T1055", "c": 0.8999999761581421, "d": "SuspendThread API reference", "e": [ "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime::suspend-thread", "l": 3 }, { "c": 0.6600000262260437, "d": "Copy files", "e": [ "CopyFileW" ], "i": "micro-behaviors/fs/file/copy::copyfile-w", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "Data before JAR/ZIP header", "e": [ "50 4B 03 04", "50 4B 03 04" ], "i": "objectives/anti-static/polyglot/format::jar-polyglot-prefix", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "66 41 fd 45 74" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password is set", "Password matching this label" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1057", "d": "Browser app opera", "e": [ "opera.exe" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-opera-brave", "l": 2, "m": "E1592" }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowEnabled", "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Avast service reference (binaries)", "e": [ "Avast.exe" ], "i": "objectives/impact/degrade/edr::avast-service-bin", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 1305088.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2860.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll mouse cursor position", "e": [ "GetCursorPos" ], "i": "micro-behaviors/hardware/input/keyboard::get-cursor-pos", "l": 2, "m": "E1056.001" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "ViewerIgnoreModifications", "ApplicationDescription", "RegisteredApplications", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetProcessWindowStation", "GetUserObjectInformationA", "InitCommonControlsEx", "DosDateTimeToFileTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "FileTimeToDosDateTime", "LocalFileTimeToFileTime", "GetModuleFileNameW", "MultiByteToWideChar", "GetCurrentDirectoryW" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1204", "c": 0.699999988079071, "d": "References being infected", "e": [ "infected" ], "i": "micro-behaviors/data/text/malware::infected-marker", "l": 3 }, { "c": 0.949999988079071, "d": "links UxTheme.dll (IsAppThemed, IsThemeActive)", "e": [ "UxTheme.dll" ], "i": "metadata/dylib::uxtheme/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (InitCommonControlsEx, ImageList_ReplaceIcon, ORDINAL 8, CreateStatusWindowW, ImageList_Destroy, ... +5 more)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHChangeNotify, SHGetPathFromIDListW, FindExecutableW, DragFinish, DragQueryFileW, ... +12 more)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (SetFilePointer, SetEndOfFile, GetFileTime, GetFileType, ReadFile, ... +169 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (CryptGenRandom, CryptAcquireContextW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, ... +14 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CreateStreamOnHGlobal, CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize, ... +5 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMDLG32.dll (GetSaveFileNameW, GetOpenFileNameW, CommDlgExtendedError, ChooseFontW)", "e": [ "COMDLG32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 8)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (StrCmpLogicalW, SHAutoComplete)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (SetScrollPos, CreateDialogParamW, PostThreadMessageW, IsChild, GetLastActivePopup, ... +143 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetTextExtentPoint32W, LineTo, MoveToEx, GetDeviceCaps, SetPixel, ... +27 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1113", "c": 0.9399999976158142, "d": "Windows GDI active window capture primitives", "e": [ "CreateCompatibleBitmap", "BitBlt", "GetDC", "GetDesktopWindow", "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-window-capture-primitives", "l": 2, "m": "C0014" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "CreateFileA", "ReadFile", "CreateFileW", "DeviceIoControl" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "VS_VERSION_INFO", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "CreateFileA", "SetFileTime", "FindFirstFileW", "CreateFileW", "GetModuleFileNameW", "GetModuleFileNameA", "WriteFile" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1083", "c": 0.8600000143051147, "d": "Drive context switching via cwd APIs", "e": [ "SetCurrentDirectoryW", "GetCurrentDirectoryW", "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::drive-context-switching", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "GetMessageW", "PostQuitMessage", "RegisterClassW", "DispatchMessageW", "DefWindowProcW", "CreateWindowExW", "RegisterClassExW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindFirstFileW", "FindNextFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "a": "T1115", "c": 0.800000011920929, "d": "Clipboard read and write APIs", "e": [ "GetClipboardData", "SetClipboardData" ], "i": "objectives/credential-access/clipboard/crypto::clipboard-rw", "l": 1, "m": "E1510" }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 419.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1562.001", "c": 0.800000011920929, "d": "EDR/Antivirus product name reference", "e": [ "McAfee VirusScan", "Software\\KasperskyLab\\AVP%d\\environment", "Kaspersky Anti-Virus", "SOFTWARE\\Sophos\\SweepNT", "Sophos Anti-Virus", "Norton AntiVirus", "SOFTWARE\\KasperskyLab\\Components\\101", "SOFTWARE\\KasperskyLab\\SetupFolders" ], "i": "objectives/impact/degrade/edr::edr-product-name", "l": 3 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsSetValue", "FlsAlloc", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "c": 0.8500000238418579, "d": "Semaphore coordination with wait logic", "e": [ "WaitForMultipleObjects", "CreateSemaphoreW", "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::coordinated-semaphore-wait", "l": 2, "m": "C0042" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExW", "RegSetValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "ExitProcess", "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueW", "AdjustTokenPrivileges", "OpenProcessToken" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.function_count = 2923.00", "binary.overall_entropy = 4.73" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "OpenClipboard", "Clipboard", "GetClipboardData", "RegisterClipboardFormatW", "SetClipboardData", "OleSetClipboard", "GetClipboardData", "SetClipboardData", "EmptyClipboard", "CloseClipboard" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetSystemMetrics", "GetDiskFreeSpaceExW", "GetDiskFreeSpaceW", "GetTickCount" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "a": "T1529", "c": 0.9399999976158142, "d": "Privilege-enabled reboot API use", "e": [ "ExitWindowsEx", "LookupPrivilegeValueW", "AdjustTokenPrivileges", "SeShutdownPrivilege" ], "i": "objectives/impact/system/shutdown::shutdown-privilege-reboot-api", "l": 3, "m": "B0029" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "SUVWATAUAWH", "SUVWATAUAVAW", "SVWATAUAVAWH", "WATAUAVAWH", "VWATAUAVH", "SUVWATAUAVH", "UVWATAUAVAW", "VWATAUAVAW", "CreateMutexW", "WATAUAVAW", "UVWATAUH", "VWATAUAW", "VWATAVAWH", "RENAMEDLG", "UVWATAUAVAWH", "VWATAUAV" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Multi-browser process target roster", "e": [ "iexplore", "opera.exe", "chrome.exe" ], "i": "objectives/discovery/host/browser::browser-process-roster", "l": 3 }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI window capture with screen context", "e": [ "GetDC", "GetWindowTextW", "CreateCompatibleBitmap", "BitBlt", "GetForegroundWindow", "CreateCompatibleDC", "GetWindowTextLengthW", "GetDesktopWindow" ], "i": "objectives/collection/screenshot/capture::gdi-window-capture", "l": 2, "m": "C0014" }, { "a": "T1036.005", "c": 0.9599999785423279, "d": "Unsigned PE claims WinRAR version identity", "e": [ "Copyright © Alexander Roshal 1993-2013", "Alexander Roshal", "WinRAR archiver" ], "i": "objectives/evasion/masquerade/version-resource::fake-winrar-version-resource", "l": 4 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with low average complexity", "e": [ "binary.file_size = 1305088.00", "binary.function_count = 2923.00", "binary.string_count = 2860.00", "binary.overall_entropy = 4.73", "binary.avg_complexity = 14.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-binary-low-average-complexity", "l": 2, "m": "B0032" }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "WriteFile", "ShellExecuteExW", "GetModuleFileNameA", "UnmapViewOfFile", "GetModuleFileNameW" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" }, { "a": "T1497.003", "c": 0.9100000262260437, "d": "Timer-gated key polling anti-analysis", "e": [ "KillTimer", "SetTimer", "GetProcAddress", "GetKeyState" ], "i": "objectives/anti-analysis/timing/evasion::ui-timer-keypoll-gate", "l": 2, "m": "B0003.003" }, { "a": "T1010", "c": 0.8500000238418579, "d": "Process discovery via window enumeration", "e": [ "GetWindowThreadProcessId", "GetWindowTextW", "EnumWindows", "EnumChildWindows" ], "i": "objectives/discovery/process/window::window-process-discovery", "l": 1 }, { "c": 0.9399999976158142, "d": "Browser process targeting via snapshot", "e": [ "opera.exe", "chrome.exe", "iexplore" ], "i": "objectives/discovery/host/browser::browser-process-targeting", "l": 3 } ], "sha": "4428a5a1f754cb26334ac08f57de6dd708a2169f4d485152832c791b4c7a2318", "path": "64301!!WinRAR.exe", "type": "pe" }, { "f": "KO₁₀(C₅PrAlAs₉CoEr₆I₃LaPXe)H₇(F₂Os₂Po₃CmDb₂DsMg)Md₃(Bi₄Pa₂)", "x": 15, "dp": 1, "id": 18, "is": [ "GetLastError", "Sleep", "SetConsoleCtrlHandler", "SetLastError", "CreateHardLinkW", "CloseHandle", "GetCurrentProcess", "SetFileTime", "DeviceIoControl", "CreateFileW", "FindClose", "FindFirstFileW", "DeleteFileW", "RemoveDirectoryW", "CreateDirectoryW", "MoveFileW", "GetShortPathNameW", "GetLongPathNameW", "FlushFileBuffers", "SetFilePointer", "SetEndOfFile", "ReadFile", "GetDriveTypeW", "GetFileAttributesW", "SetFileAttributesW", "FindNextFileW", "SetErrorMode", "GetModuleFileNameW", "FreeLibrary", "GetProcAddress", "LoadLibraryW", "GetCurrentDirectoryW", "GetModuleHandleW", "CreateThread", "EnterCriticalSection", "LeaveCriticalSection", "WaitForSingleObject", "GetProcessAffinityMask", "ReleaseSemaphore", "ResetEvent", "DeleteCriticalSection", "SetEvent", "SetThreadPriority", "InitializeCriticalSection", "CreateEventW", "CreateSemaphoreW", "SystemTimeToFileTime", "GetSystemTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "CreateFileA", "GetStringTypeW", "WriteFile", "WriteConsoleW", "SetConsoleMode", "ReadConsoleW", "GetStdHandle", "GetFileType", "GetCurrentProcessId", "GetConsoleMode", "RtlLookupFunctionEntry", "RtlUnwindEx", "HeapFree", "HeapReAlloc", "GetSystemTimeAsFileTime", "ExitProcess", "RaiseException", "RtlPcToFileHeader", "HeapAlloc", "GetCommandLineA", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsSetValue", "FlsFree", "GetCurrentThreadId", "FlsAlloc", "HeapSetInformation", "HeapCreate", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlCaptureContext", "SetHandleCount", "GetStartupInfoA", "SetStdHandle", "GetConsoleCP", "HeapSize", "GetModuleFileNameA", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "GetACP", "GetOEMCP", "IsValidCodePage", "LCMapStringA", "LCMapStringW", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "WriteConsoleA", "GetConsoleOutputCP", "GetLocaleInfoA", "GetStringTypeA", "CharUpperW", "OemToCharBuffA", "LoadStringW", "CharToOemA", "MessageBeep", "OpenProcessToken", "LookupPrivilegeValueW", "AdjustTokenPrivileges", "SetFileSecurityW" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\rar\\build\\sfxcon64\\Release\\sfxcon.pdb", "rsrc_size": 31232.0, "subsystem": 3.0, "timestamp": 1368555989.0, "image_base": 5368709120.0, "rsrc_entropy": 3.5, "entry_section": ".text", "size_of_image": 335872.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 3.0, "timestamp_year": 2013.0, "characteristics": 35.0, "entry_point_rva": 127880.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1368555989.0, "import_dll_count": 3.0, "manifest_present": true, "computed_checksum": 263534.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555989.0, "debug_timestamp_min": 1368555989.0, "dll_characteristics": 33024.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 162816.0, "file_size": 237056.0, "entry_point": 127880.0, "code_entropy": 6.47, "data_entropy": 4.2, "import_count": 123.0, "string_count": 618.0, "section_count": 5.0, "avg_complexity": 14.0, "function_count": 647.0, "import_density": 0.77, "max_complexity": 14.0, "string_density": 3.89, "overall_entropy": 4.52, "avg_basic_blocks": 30.0, "avg_section_size": 47206.4, "dependency_count": 3.0, "entropy_variance": 1.44, "function_density": 4.07, "avg_function_size": 426.0, "avg_string_length": 22.03, "complexity_per_kb": 0.09, "max_string_length": 244.0, "wide_string_count": 258.0, "writable_sections": 1.0, "avg_string_entropy": 3.3, "code_to_data_ratio": 2.22, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.13, "text_to_file_ratio": 0.69, "total_basic_blocks": 30.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 20.88, "debug_reference_count": 1.0, "largest_section_ratio": 0.69, "sentence_string_count": 223.0, "sentence_string_ratio": 0.36, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".pdata" ], [ 647, "@.rsrc" ], [ 2119, "WATAUAVAWH" ], [ 3525, "UVWH" ], [ 4761, "C E3" ], [ 4864, "@UVWATAUAVAW" ], [ 8028, "t$ WATAUAVAW" ], [ 17034, "UVWATAUAVAWH" ], [ 19361, "x ATAUAVH" ], [ 19579, "WATAU" ], [ 20679, "WATAUH" ], [ 23316, "@SUVWATAUAVAWH" ], [ 24684, "t$ WATAUAVAWH" ], [ 25945, "{ ATAUAVH" ], [ 26396, "L$ VWATAUAWH" ], [ 27925, "x ATAUAVAWH" ], [ 32177, "x AUAVAWH" ], [ 33070, "VWATAUAV" ], [ 33613, "VWATH" ], [ 40551, "WATAUAVAW" ], [ 41205, "x ATAUAV" ], [ 42099, "VWAUH" ], [ 42920, "@SUVWATAUAVH" ], [ 44205, "UVWATAUAVAW" ], [ 48803, "f93t" ], [ 49616, "@SUVWATAUAVAW" ], [ 53556, "f92t" ], [ 54946, "f99u" ], [ 55468, "/tYH" ], [ 62977, "x ATAVAWH" ], [ 65873, "p WATAUAVAWH" ], [ 68080, "xxxxwwww" ], [ 68759, "SUVWATAUAVAWH" ], [ 70574, "gfffffffI" ], [ 88914, "VWATAUAVH" ], [ 93255, "WATAWH" ], [ 97141, "U E3" ], [ 102719, "ATAUAVH" ], [ 107028, "F0E3" ], [ 108124, "D95Q" ], [ 114045, "p WATAUH" ], [ 119339, "AUAVAWH" ], [ 119811, "SVWATH" ], [ 126368, "8MOC" ], [ 126455, "SVWATAUAVAWH" ], [ 127156, "@SWATAUAVAWH" ], [ 130659, "WATAVH" ], [ 138782, "\\$ UVWATAUAVAW" ], [ 144809, "UVWATAUH" ], [ 146888, "@UATAUAVAWH" ], [ 154422, "L$ UATAUAVAWH" ], [ 155980, "@USVWATAUAVAWH" ], [ 156598, "M0H3" ], [ 165136, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 165960, "wide", "%d.%02d %ls %d" ], [ 166144, "wide", "[%c]%ls" ], [ 166368, "wide", "SeRestorePrivilege" ], [ 166408, "wide", "SeSecurityPrivilege" ], [ 166608, "wide", "SeCreateSymbolicLinkPrivilege" ], [ 167064, "wide", "%.*ls(%u)%ls" ], [ 167136, "wide", "rtmp%d" ], [ 167224, "bad allocation" ], [ 167240, "wide", "%c%c%c%c%c%c%c" ], [ 167272, "wide", "%c%c%c%c%c%c%c%c%c" ], [ 167456, "wide", "%c%10ls %9ls" ], [ 167528, "wide", "Unix owner" ], [ 167616, "wide", "%12ls: RAR %ls(v%d) -m%d -md=%d%s" ], [ 167720, "wide", "Unix" ], [ 167736, "wide", "Windows" ], [ 167752, "wide", "BLAKE2" ], [ 167768, "wide", "Pack-BLAKE2" ], [ 167792, "wide", "BLAKE2 MAC" ], [ 167848, "wide", "CRC32" ], [ 167888, "wide", "CRC32 MAC" ], [ 168424, "url", "!ls %9ls =%% \u0026ls %u" ], [ 168480, "wide", "%21ls %-14ls %u" ], [ 168520, "wide", "%21ls %9ls %3d%% %-25ls %u" ], [ 168608, "wide", "RAR 1.4" ], [ 168624, "wide", "RAR 5" ], [ 168640, "wide", "RAR 4" ], [ 168680, "wide", "__rar_" ], [ 168792, "wide", ".rar" ], [ 169008, "wide", "*messages***" ], [ 169040, "*messages***" ], [ 169080, "CryptUnprotectMemory" ], [ 169104, "CryptProtectMemory" ], [ 169128, "wide", "Crypt32.dll" ], [ 169152, "wide", "CryptUnprotectMemory failed" ], [ 169208, "wide", "CryptProtectMemory failed" ], [ 169520, "SetDllDirectoryW" ], [ 169544, "wide", "kernel32" ], [ 169568, "wide", "CreateThread failed" ], [ 169616, "wide", "WaitForMultipleObjects error %d, GetLastError %d" ], [ 169728, "wide", "Thread pool initialization failed." ], [ 169968, "wide", "%02u-%02u-%u %02u:%02u" ], [ 170016, "wide", "%u-%02u-%02u %02u:%02u,%03u" ], [ 170528, "CorExitProcess" ], [ 170544, "wide", "mscoree.dll" ], [ 170680, "Unknown exception" ], [ 170736, "bad exception" ], [ 170752, "runtime error" ], [ 170776, "TLOSS error" ], [ 170792, "SING error" ], [ 170808, "DOMAIN error" ], [ 170832, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 170839, "An application has made an attempt to load the C runtime library incorrectly." ], [ 170917, "Please contact the application's support team for more information." ], [ 170992, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 170999, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 171079, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 171240, "R6032\r\n- not enough space for locale information" ], [ 171247, "- not enough space for locale information" ], [ 171296, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 171303, "- Attempt to initialize the CRT more than once." ], [ 171351, "This indicates a bug in your application." ], [ 171400, "R6030\r\n- CRT not initialized" ], [ 171407, "- CRT not initialized" ], [ 171432, "R6028\r\n- unable to initialize heap" ], [ 171439, "- unable to initialize heap" ], [ 171472, "R6027\r\n- not enough space for lowio initialization" ], [ 171479, "- not enough space for lowio initialization" ], [ 171528, "R6026\r\n- not enough space for stdio initialization" ], [ 171535, "- not enough space for stdio initialization" ], [ 171584, "R6025\r\n- pure virtual function call" ], [ 171591, "- pure virtual function call" ], [ 171624, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 171631, "- not enough space for _onexit/atexit table" ], [ 171680, "R6019\r\n- unable to open console device" ], [ 171687, "- unable to open console device" ], [ 171728, "R6018\r\n- unexpected heap error" ], [ 171735, "- unexpected heap error" ], [ 171768, "R6017\r\n- unexpected multithread lock error" ], [ 171775, "- unexpected multithread lock error" ], [ 171816, "R6016\r\n- not enough space for thread data" ], [ 171823, "- not enough space for thread data" ], [ 171872, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 171874, "This application has requested the Runtime to terminate it in an unusual way." ], [ 172024, "R6009\r\n- not enough space for environment" ], [ 172031, "- not enough space for environment" ], [ 172072, "R6008\r\n- not enough space for arguments" ], [ 172079, "- not enough space for arguments" ], [ 172120, "R6002\r\n- floating point support not loaded" ], [ 172127, "- floating point support not loaded" ], [ 172168, "Microsoft Visual C++ Runtime Library" ], [ 172216, "\u003cprogram name unknown\u003e" ], [ 172240, "Runtime Error!\n\nProgram:" ], [ 172463, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 172568, "wide", "(null)" ], [ 172584, "(null)" ], [ 172633, "700WP" ], [ 172649, "`h````" ], [ 172734, "700PP" ], [ 172784, "GetProcessWindowStation" ], [ 172808, "GetUserObjectInformationA" ], [ 172840, "GetLastActivePopup" ], [ 172864, "GetActiveWindow" ], [ 172880, "MessageBoxA" ], [ 172896, "USER32.DLL" ], [ 172912, "Complete Object Locator'" ], [ 172944, "Class Hierarchy Descriptor'" ], [ 172976, "Base Class Array'" ], [ 173000, "Base Class Descriptor at (" ], [ 173032, "Type Descriptor'" ], [ 173056, "`local static thread guard'" ], [ 173088, "`managed vector copy constructor iterator'" ], [ 173136, "`vector vbase copy constructor iterator'" ], [ 173184, "`vector copy constructor iterator'" ], [ 173224, "`dynamic atexit destructor for '" ], [ 173264, "`dynamic initializer for '" ], [ 173296, "`eh vector vbase copy constructor iterator'" ], [ 173344, "`eh vector copy constructor iterator'" ], [ 173384, "`managed vector destructor iterator'" ], [ 173424, "`managed vector constructor iterator'" ], [ 173464, "`placement delete[] closure'" ], [ 173496, "`placement delete closure'" ], [ 173528, "`omni callsig'" ], [ 173544, "delete[]" ], [ 173568, "`local vftable constructor closure'" ], [ 173608, "`local vftable'" ], [ 173640, "`udt returning'" ], [ 173656, "`copy constructor closure'" ], [ 173688, "`eh vector vbase constructor iterator'" ], [ 173728, "`eh vector destructor iterator'" ], [ 173760, "`eh vector constructor iterator'" ], [ 173800, "`virtual displacement map'" ], [ 173832, "`vector vbase constructor iterator'" ], [ 173872, "`vector destructor iterator'" ], [ 173904, "`vector constructor iterator'" ], [ 173936, "`scalar deleting destructor'" ], [ 173968, "`default constructor closure'" ], [ 174000, "`vector deleting destructor'" ], [ 174032, "`vbase destructor'" ], [ 174072, "`local static guard'" ], [ 174272, "operator" ], [ 174312, "delete" ], [ 174328, "__unaligned" ], [ 174344, "__restrict" ], [ 174368, "__clrcall" ], [ 174384, "__fastcall" ], [ 174400, "__thiscall" ], [ 174416, "__stdcall" ], [ 174432, "__pascal" ], [ 174448, "__cdecl" ], [ 176018, "wide", "h(((( H" ], [ 176704, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 177088, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 177328, "dddd, MMMM dd, yyyy" ], [ 177352, "MM/dd/yy" ], [ 177376, "December" ], [ 177392, "November" ], [ 177408, "October" ], [ 177416, "September" ], [ 177428, "August" ], [ 177436, "July" ], [ 177444, "June" ], [ 177452, "April" ], [ 177460, "March" ], [ 177472, "February" ], [ 177488, "January" ], [ 177544, "Saturday" ], [ 177556, "Friday" ], [ 177568, "Thursday" ], [ 177584, "Wednesday" ], [ 177600, "Tuesday" ], [ 177608, "Monday" ], [ 177616, "Sunday" ], [ 177680, "SunMonTueWedThuFriSat" ], [ 177704, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 177768, "d:\\Projects\\WinRAR\\rar\\build\\sfxcon64\\Release\\sfxcon.pdb" ], [ 179994, "20.48.1.28:6194" ], [ 184802, "20.48.124.12:6322" ], [ 187142, "10.48.25.19:3634" ], [ 188730, "GetConsoleMode" ], [ 188748, "GetFileType" ], [ 188762, "GetStdHandle" ], [ 188778, "ReadConsoleW" ], [ 188794, "SetConsoleMode" ], [ 188812, "WriteConsoleW" ], [ 188828, "WriteFile" ], [ 188840, "GetCurrentDirectoryW" ], [ 188864, "GetLastError" ], [ 188880, "Sleep" ], [ 188888, "SetConsoleCtrlHandler" ], [ 188912, "SetLastError" ], [ 188928, "CreateHardLinkW" ], [ 188946, "CloseHandle" ], [ 188960, "GetCurrentProcess" ], [ 188980, "SetFileTime" ], [ 188994, "DeviceIoControl" ], [ 189012, "CreateFileW" ], [ 189026, "FindClose" ], [ 189038, "FindFirstFileW" ], [ 189056, "DeleteFileW" ] ], "sz": 237056, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 647.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "\u003cCommands\u003e", "\u003cSwitches\u003e", "L\n ri\u003cP\u003e[:\u003cS\u003e] Set priority (0-default,1-min..15-max) and sleep time in ms", "M\n ta\u003cdate\u003e Process files modified after \u003cdate\u003e in YYYYMMDDHHMMSS format", "N\n tb\u003cdate\u003e Process files modified before \u003cdate\u003e in YYYYMMDDHHMMSS format" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\rar\\build\\sfxcon64\\Release\\sfxcon.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555989.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "password keyword", "e": [ "ERROR: Passwords do not match", "Reenter password:", "%s - use current password ?", "I\nChecksum error in the encrypted file %s. Corrupt file or wrong password.", "p[password] Set password", "#Enter password (will not be echoed)" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "\u0026Corrupt archive - use 'Repair' command", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Derived string condition", "e": [ "cannot recover data" ], "i": "objectives/impact/ransom/encrypt/threat-text::inline__data-loss-threat__any_3", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.30" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "sfxcon.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "42", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 258.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 237056.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/command-and-control/backdoor/binary::plaintext-sleep-command-token", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 618.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.52" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b9", "b8", "b8", "b9", "b9", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.25.19:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001" }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.47)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "UVWATAUAVAWH", "VWATAUAV", "WATAUAVAW", "UVWATAUAVAW", "VWATAUAVH", "SVWATAUAVAWH", "UVWATAUH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.36" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 335872.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 647.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8", "b8", "b8", "b8", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 647.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "WINRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.52" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 647.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 647.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "c": 0.949999988079071, "d": "ANSI GUI probe API cluster", "e": [ "GetLastActivePopup", "GetActiveWindow", "MessageBoxA" ], "i": "well-known/malware/trojan/elex/test-loader::ansi-gui-probe-cluster", "l": 3 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "20.48.1.28:6194", "20.48.124.12:6322" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "20.48.1.28:6194", "20.48.124.12:6322" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "64 33 02 00", "40 15 02 00", "08 e1 01 00", "d9 e0 01 00", "5e de 01 00", "90 df 01 00", "c2 dc 01 00", "a3 dc 01 00", "3b da 01 00", "94 d9 01 00", "34 d5 01 00", "25 d3 01 00", "ee d2 01 00", "63 6d 01 00", "41 2d 00 00", "80 1c 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetCurrentDirectoryW", "SetConsoleCtrlHandler", "GetModuleFileNameW", "GetCurrentProcessId", "GetProcessAffinityMask", "InitializeCriticalSection", "SystemTimeToFileTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links USER32.dll (CharUpperW, OemToCharBuffA, LoadStringW, CharToOemA, MessageBeep)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, SetFileSecurityW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetLastError, Sleep, SetConsoleCtrlHandler, SetLastError, CreateHardLinkW, ... +109 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "DeviceIoControl", "CreateFileW", "ReadFile", "CreateFileA" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "VS_VERSION_INFO", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "GetModuleFileNameW", "FindFirstFileW", "CreateFileA", "WriteFile", "GetModuleFileNameA", "SetFileTime", "CreateFileW" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "d9 e0 01 00", "ee d2 01 00", "25 d3 01 00", "41 2d 00 00", "a3 dc 01 00", "90 df 01 00", "c2 dc 01 00", "94 d9 01 00", "63 6d 01 00", "3b da 01 00", "08 e1 01 00", "80 1c 00 00", "64 33 02 00", "GetTickCount", "5e de 01 00", "40 15 02 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindNextFileW", "FindFirstFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 123.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsSetValue", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileW", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "binary.sentence_string_ratio = 0.36", "binary.function_count = 647.00", "binary.import_count = 123.00" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "OpenProcessToken", "AdjustTokenPrivileges", "LookupPrivilegeValueW" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.function_count = 647.00", "binary.overall_entropy = 4.52" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetConsoleCtrlHandler", "IsDebuggerPresent", "Sleep", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindNextFileW", "FindFirstFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "061c64bc48fd42a8a52184cc76289ce71cedb3a824bcedfb124ab170697f2eb7", "path": "64301!!WinCon64.SFX", "type": "pe" }, { "f": "KO₉(AlAs₇C₄CoEr₅I₃P₂PrXe)H₆(F₅OsPo₄Db₂DsMg)Md₅(SiBi₅PaPt)", "x": 15, "dp": 1, "id": 19, "is": [ "InitCommonControlsEx", "SHAutoComplete", "GetFileAttributesW", "SetFileAttributesW", "MoveFileW", "DeleteFileW", "CreateDirectoryW", "FindClose", "FindNextFileW", "FindFirstFileW", "GetFullPathNameW", "GetModuleFileNameW", "FindResourceW", "GetModuleHandleW", "FreeLibrary", "GetProcAddress", "LoadLibraryW", "GetCurrentProcessId", "GetLocaleInfoW", "GetNumberFormatW", "ExpandEnvironmentStringsW", "WaitForSingleObject", "GetDateFormatW", "GetTimeFormatW", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "GetExitCodeProcess", "GetTempPathW", "MoveFileExW", "Sleep", "UnmapViewOfFile", "MapViewOfFile", "GetCommandLineW", "CreateFileMappingW", "GetTickCount", "SetEnvironmentVariableW", "OpenFileMappingW", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "GlobalAlloc", "SetCurrentDirectoryW", "WriteConsoleW", "GetConsoleOutputCP", "WriteConsoleA", "GetLocaleInfoA", "GetStringTypeW", "GetStringTypeA", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "GetConsoleMode", "GetConsoleCP", "QueryPerformanceCounter", "DeleteCriticalSection", "SetHandleCount", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "HeapSize", "LCMapStringW", "LCMapStringA", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "ExitProcess", "LeaveCriticalSection", "EnterCriticalSection", "RtlCaptureContext", "RtlVirtualUnwind", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "FlsAlloc", "GetCurrentThreadId", "FlsFree", "FlsSetValue", "FlsGetValue", "DecodePointer", "EncodePointer", "HeapCreate", "HeapSetInformation", "GetStartupInfoA", "GetCommandLineA", "GetSystemTimeAsFileTime", "SetFileTime", "ReadFile", "GetFileType", "SetEndOfFile", "SetFilePointer", "GetStdHandle", "FlushFileBuffers", "WriteFile", "CloseHandle", "CreateFileW", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "SetLastError", "GetLastError", "GetCurrentDirectoryW", "CreateFileA", "SetStdHandle", "HeapAlloc", "HeapReAlloc", "RtlPcToFileHeader", "RaiseException", "RtlUnwindEx", "RtlLookupFunctionEntry", "HeapFree", "EnableWindow", "GetDlgItem", "ShowWindow", "MessageBoxW", "FindWindowExW", "GetParent", "MapWindowPoints", "CreateWindowExW", "UpdateWindow", "LoadCursorW", "RegisterClassExW", "DefWindowProcW", "DestroyWindow", "CopyRect", "CharUpperW", "CharToOemA", "OemToCharA", "OemToCharBuffA", "LoadIconW", "LoadBitmapW", "SetWindowLongPtrW", "PostMessageW", "GetSysColor", "SetForegroundWindow", "WaitForInputIdle", "IsWindowVisible", "DialogBoxParamW", "DestroyIcon", "SetFocus", "GetClassNameW", "SendDlgItemMessageW", "GetDlgItemTextW", "EndDialog", "SetDlgItemTextW", "wvsprintfW", "SendMessageW", "GetDC", "ReleaseDC", "PeekMessageW", "GetMessageW", "TranslateMessage", "DispatchMessageW", "LoadStringW", "GetWindowRect", "GetClientRect", "GetWindowLongPtrW", "SetWindowPos", "GetWindowTextW", "SetWindowTextW", "GetSystemMetrics", "GetWindow", "GetWindowLongW", "SetWindowLongW", "IsWindow", "GetDeviceCaps", "CreateCompatibleDC", "GetObjectW", "CreateCompatibleBitmap", "SelectObject", "StretchBlt", "DeleteDC", "DeleteObject", "RegCloseKey", "RegOpenKeyExW", "RegQueryValueExW", "RegCreateKeyExW", "RegSetValueExW", "SHGetMalloc", "SHGetSpecialFolderLocation", "SHGetFileInfoW", "ShellExecuteExW", "SHChangeNotify", "SHFileOperationW", "SHBrowseForFolderW", "SHGetPathFromIDListW", "CLSIDFromString", "CoCreateInstance", "OleInitialize", "OleUninitialize", "CreateStreamOnHGlobal", "ORDINAL 8" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\SFX\\build\\sfxzip64\\Release\\sfxzip.pdb", "rsrc_size": 17408.0, "subsystem": 2.0, "timestamp": 1368556019.0, "icon_count": 2.0, "image_base": 5368709120.0, "rsrc_entropy": 4.67, "entry_section": ".text", "size_of_image": 372736.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2013.0, "characteristics": 35.0, "entry_point_rva": 73492.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1368556019.0, "import_dll_count": 9.0, "manifest_present": true, "computed_checksum": 174786.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556019.0, "debug_timestamp_min": 1368556019.0, "dll_characteristics": 33024.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 108544.0, "file_size": 164352.0, "entry_point": 73492.0, "code_entropy": 6.41, "data_entropy": 4.01, "import_count": 195.0, "string_count": 561.0, "section_count": 5.0, "avg_complexity": 14.0, "function_count": 474.0, "import_density": 1.84, "max_complexity": 14.0, "string_density": 5.29, "overall_entropy": 4.62, "avg_basic_blocks": 31.0, "avg_section_size": 32665.6, "dependency_count": 9.0, "entropy_variance": 1.41, "function_density": 4.47, "avg_function_size": 494.0, "avg_string_length": 21.56, "complexity_per_kb": 0.13, "max_string_length": 248.0, "wide_string_count": 123.0, "writable_sections": 1.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 1.98, "data_to_file_ratio": 0.04, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.11, "text_to_file_ratio": 0.66, "total_basic_blocks": 31.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 24.79, "debug_reference_count": 1.0, "largest_section_ratio": 0.66, "sentence_string_count": 124.0, "sentence_string_ratio": 0.22, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 177, "lpJAlqJ" ], [ 213, "lqJRich" ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".pdata" ], [ 655, "@.rsrc" ], [ 1215, "WATAU" ], [ 1903, "WATAUH" ], [ 4031, "WATAWH" ], [ 6164, "@SUVWATAUAVAW" ], [ 9728, "f98u" ], [ 11693, "x ATAUAV" ], [ 12475, "VWAUH" ], [ 13280, "@SUVWATAUAVH" ], [ 13685, "x ATAUAVH" ], [ 14437, "UVWATAUAVAW" ], [ 16927, "WATAUAVAWH" ], [ 19175, "SUVWATAUAVAWH" ], [ 20934, "UVWATAUAVAWH" ], [ 22480, "@SUVWATAUAVAWH" ], [ 24758, "UVWH" ], [ 26440, "f92t" ], [ 26533, "C E3" ], [ 27282, "f99u" ], [ 27804, "/tYH" ], [ 28443, "WATAVH" ], [ 29061, "p WATAUAVAWH" ], [ 29539, "ATAUAVH" ], [ 31671, "WATAUAVAW" ], [ 33095, "stack", "PKPKPK" ], [ 53270, "gfffffffI" ], [ 57776, "C8E3" ], [ 59293, "p WATAUH" ], [ 59725, "x ATAUAWH" ], [ 63052, "t$ WATAUAVAWH" ], [ 72264, "8MOC" ], [ 72351, "SVWATAUAVAWH" ], [ 73052, "@SWATAUAVAWH" ], [ 74367, "VWATAUAVH" ], [ 85561, "UVWATAUH" ], [ 87640, "@UATAUAVAWH" ], [ 94750, "\\$ UVWATAUAVAW" ], [ 98723, "AUAVAWH" ], [ 100654, "L$ UATAUAVAWH" ], [ 102212, "@USVWATAUAVAWH" ], [ 102830, "M0H3" ], [ 103990, "VWATH" ], [ 111488, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 111912, "bad allocation" ], [ 112344, "wide", "__rar_" ], [ 112504, "wide", "*messages***" ], [ 112536, "*messages***" ], [ 112600, "CryptUnprotectMemory" ], [ 112624, "CryptProtectMemory" ], [ 112648, "wide", "Crypt32.dll" ], [ 112672, "wide", "CryptUnprotectMemory failed" ], [ 112728, "wide", "CryptProtectMemory failed" ], [ 112808, "wide", "RENAMEDLG" ], [ 112832, "wide", "GETPASSWORD1" ], [ 112912, "wide", "Software\\WinRAR SFX" ], [ 112952, "wide", "STATIC" ], [ 112984, "wide", "%s %s %s" ], [ 113008, "wide", "REPLACEFILEDLG" ], [ 113088, "wide", ".exe" ], [ 113104, "wide", "Install" ], [ 113120, "wide", ".inf" ], [ 113176, "wide", ".lnk" ], [ 113192, "wide", "%s%s%d" ], [ 113208, "wide", "%s.%d.tmp" ], [ 113232, "wide", "\u003cbr\u003e" ], [ 113248, "wide", "ProgramFilesDir" ], [ 113280, "wide", "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 113376, "wide", "Delete" ], [ 113392, "wide", "Text" ], [ 113408, "wide", "Title" ], [ 113424, "wide", "Path" ], [ 113440, "wide", "Silent" ], [ 113456, "wide", "Overwrite" ], [ 113480, "wide", "Setup" ], [ 113496, "wide", "TempMode" ], [ 113520, "wide", "License" ], [ 113536, "wide", "Presetup" ], [ 113560, "wide", "Shortcut" ], [ 113584, "wide", "SavePath" ], [ 113608, "wide", "Update" ], [ 113624, "wide", "SetupCode" ], [ 113648, "wide", "LICENSEDLG" ], [ 113736, "wide", "winrarsfxmappingfile.tmp" ], [ 113792, "wide", "runas" ], [ 113808, "wide", "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" ], [ 113872, "wide", "__tmp_rar_sfx_access_check_%u" ], [ 113936, "wide", "STARTDLG" ], [ 113960, "wide", "sfxname" ], [ 113992, "SetDllDirectoryW" ], [ 114016, "wide", "kernel32" ], [ 114512, "wide", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e" ], [ 114624, "wide", "\u003c/html\u003e" ], [ 114640, "wide", "utf-8\"\u003e\u003c/head\u003e" ], [ 114672, "wide", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=" ], [ 114808, "wide", "\u003chtml\u003e" ], [ 114824, "wide", "\u003c/style\u003e" ], [ 114848, "wide", "\u003cstyle\u003e" ], [ 114864, "wide", "\u003c/p\u003e" ], [ 114880, "wide", "about:blank" ], [ 114904, "wide", "Shell.Explorer" ], [ 114936, "wide", "RarHtmlClassName" ], [ 114976, "wide", "EDIT" ], [ 114992, "wide", "riched20.dll" ], [ 115024, "wide", "riched32.dll" ], [ 115544, "bad exception" ], [ 115584, "wide", "UTF-16LE" ], [ 115608, "wide", "UNICODE" ], [ 115648, "Unknown exception" ], [ 115672, "CorExitProcess" ], [ 115688, "wide", "mscoree.dll" ], [ 115712, "runtime error" ], [ 115736, "TLOSS error" ], [ 115752, "SING error" ], [ 115768, "DOMAIN error" ], [ 115792, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 115799, "An application has made an attempt to load the C runtime library incorrectly." ], [ 115877, "Please contact the application's support team for more information." ], [ 115952, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 115959, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 116039, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 116200, "R6032\r\n- not enough space for locale information" ], [ 116207, "- not enough space for locale information" ], [ 116256, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 116263, "- Attempt to initialize the CRT more than once." ], [ 116311, "This indicates a bug in your application." ], [ 116360, "R6030\r\n- CRT not initialized" ], [ 116367, "- CRT not initialized" ], [ 116392, "R6028\r\n- unable to initialize heap" ], [ 116399, "- unable to initialize heap" ], [ 116432, "R6027\r\n- not enough space for lowio initialization" ], [ 116439, "- not enough space for lowio initialization" ], [ 116488, "R6026\r\n- not enough space for stdio initialization" ], [ 116495, "- not enough space for stdio initialization" ], [ 116544, "R6025\r\n- pure virtual function call" ], [ 116551, "- pure virtual function call" ], [ 116584, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 116591, "- not enough space for _onexit/atexit table" ], [ 116640, "R6019\r\n- unable to open console device" ], [ 116647, "- unable to open console device" ], [ 116688, "R6018\r\n- unexpected heap error" ], [ 116695, "- unexpected heap error" ], [ 116728, "R6017\r\n- unexpected multithread lock error" ], [ 116735, "- unexpected multithread lock error" ], [ 116776, "R6016\r\n- not enough space for thread data" ], [ 116783, "- not enough space for thread data" ], [ 116832, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 116834, "This application has requested the Runtime to terminate it in an unusual way." ], [ 116984, "R6009\r\n- not enough space for environment" ], [ 116991, "- not enough space for environment" ], [ 117032, "R6008\r\n- not enough space for arguments" ], [ 117039, "- not enough space for arguments" ], [ 117080, "R6002\r\n- floating point support not loaded" ], [ 117087, "- floating point support not loaded" ], [ 117128, "Microsoft Visual C++ Runtime Library" ], [ 117176, "\u003cprogram name unknown\u003e" ], [ 117200, "Runtime Error!\n\nProgram:" ], [ 117263, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 117536, "Complete Object Locator'" ], [ 117568, "Class Hierarchy Descriptor'" ], [ 117600, "Base Class Array'" ], [ 117624, "Base Class Descriptor at (" ], [ 117656, "Type Descriptor'" ], [ 117680, "`local static thread guard'" ], [ 117712, "`managed vector copy constructor iterator'" ], [ 117760, "`vector vbase copy constructor iterator'" ], [ 117808, "`vector copy constructor iterator'" ], [ 117848, "`dynamic atexit destructor for '" ], [ 117888, "`dynamic initializer for '" ], [ 117920, "`eh vector vbase copy constructor iterator'" ], [ 117968, "`eh vector copy constructor iterator'" ], [ 118008, "`managed vector destructor iterator'" ], [ 118048, "`managed vector constructor iterator'" ], [ 118088, "`placement delete[] closure'" ], [ 118120, "`placement delete closure'" ], [ 118152, "`omni callsig'" ], [ 118168, "delete[]" ], [ 118192, "`local vftable constructor closure'" ], [ 118232, "`local vftable'" ], [ 118264, "`udt returning'" ], [ 118280, "`copy constructor closure'" ], [ 118312, "`eh vector vbase constructor iterator'" ], [ 118352, "`eh vector destructor iterator'" ], [ 118384, "`eh vector constructor iterator'" ], [ 118424, "`virtual displacement map'" ], [ 118456, "`vector vbase constructor iterator'" ], [ 118496, "`vector destructor iterator'" ], [ 118528, "`vector constructor iterator'" ], [ 118560, "`scalar deleting destructor'" ], [ 118592, "`default constructor closure'" ], [ 118624, "`vector deleting destructor'" ], [ 118656, "`vbase destructor'" ], [ 118696, "`local static guard'" ], [ 118896, "operator" ], [ 118936, "delete" ], [ 118952, "__unaligned" ], [ 118968, "__restrict" ], [ 118992, "__clrcall" ], [ 119008, "__fastcall" ], [ 119024, "__thiscall" ], [ 119040, "__stdcall" ], [ 119056, "__pascal" ], [ 119072, "__cdecl" ], [ 119872, "wide", "(null)" ], [ 119888, "(null)" ], [ 119945, "700WP" ], [ 119961, "`h````" ], [ 120046, "700PP" ], [ 120096, "GetProcessWindowStation" ], [ 120120, "GetUserObjectInformationA" ], [ 120152, "GetLastActivePopup" ], [ 120176, "GetActiveWindow" ], [ 120192, "MessageBoxA" ], [ 120208, "USER32.DLL" ], [ 120994, "wide", "h(((( H" ], [ 121680, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 122064, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 122304, "dddd, MMMM dd, yyyy" ], [ 122328, "MM/dd/yy" ], [ 122352, "December" ], [ 122368, "November" ], [ 122384, "October" ], [ 122392, "September" ], [ 122404, "August" ], [ 122412, "July" ], [ 122420, "June" ], [ 122428, "April" ], [ 122436, "March" ], [ 122448, "February" ], [ 122464, "January" ], [ 122520, "Saturday" ], [ 122532, "Friday" ], [ 122544, "Thursday" ], [ 122560, "Wednesday" ], [ 122576, "Tuesday" ], [ 122584, "Monday" ], [ 122592, "Sunday" ], [ 122648, "SunMonTueWedThuFriSat" ], [ 122672, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 122720, "RSDS" ], [ 122744, "d:\\Projects\\WinRAR\\SFX\\build\\sfxzip64\\Release\\sfxzip.pdb" ], [ 130810, "InitCommonControlsEx" ], [ 130832, "COMCTL32.dll" ], [ 130848, "SHAutoComplete" ], [ 130864, "SHLWAPI.dll" ], [ 130878, "GetCurrentDirectoryW" ], [ 130902, "GetLastError" ], [ 130918, "SetLastError" ], [ 130934, "LocalFileTimeToFileTime" ], [ 130960, "DosDateTimeToFileTime" ], [ 130984, "CreateFileW" ] ], "sz": 164352, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 474.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-file-operation", "l": 3 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cbr\u003e", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e", "\u003c/html\u003e", "utf-8\"\u003e\u003c/head\u003e", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=", "\u003chtml\u003e", "\u003c/style\u003e", "\u003cstyle\u003e", "\u003c/p\u003e", "E\u003cul\u003e\u003cli\u003ePress \u003cb\u003eInstall\u003c/b\u003e button to start extraction.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003eE\u003cul\u003e\u003cli\u003ePress \u003cb\u003eExtract\u003c/b\u003e ...", "manually.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003e8\u003cli\u003eIf the destination folder does not exist, it will be", "2created automatically before extraction.\u003c/li\u003e\u003c/ul\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 195.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 195.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp", ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\SFX\\build\\sfxzip64\\Release\\sfxzip.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556019.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 195.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "password keyword", "e": [ "\u0026Enter password for the encrypted file:", "GETPASSWORD1", "GETPASSWORD1\nLICENSEDLG\nASKNEXTVOL", "…. Corrupt file or wrong password.", "Wrong password for %s5Write error in the file %s. Probably the disk is full", "Unknown encryption method in %s$The specified password is incorrect.", "Enter password" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ ".lnk" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "sfxzip.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "Find window by class/title", "e": [ "FindWindowExW" ], "i": "micro-behaviors/ui/window/manage::find-window-ex", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 123.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "c": 0.800000011920929, "d": "Notify shell of file changes", "e": [ "SHChangeNotify" ], "i": "micro-behaviors/ui/window/notify::shell-change-notify", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "runas privilege elevation string", "e": [ "runas" ], "i": "micro-behaviors/os/privilege/elevation::runas-string", "l": 3 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 164352.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Post message to window (Unicode)", "e": [ "PostMessageW" ], "i": "micro-behaviors/os/message/queue::post-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 561.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Display folder browse dialog", "e": [ "SHBrowseForFolderW" ], "i": "micro-behaviors/fs/shell-ops/commands::browse-for-folder", "l": 3 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.949999988079071, "d": "WinRAR SFX start dialog", "e": [ "STARTDLG" ], "i": "metadata/binary/installer/sfx::dialog-start", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.62" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 195.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 195.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.7200000286102295, "d": "WININIT rename section marker", "e": [ "Rename" ], "i": "micro-behaviors/fs/config/system::wininit-rename-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 195.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "runas elevation verb", "e": [ "runas" ], "i": "objectives/privilege-escalation/token-manipulation::runas-word", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.41)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "UVWATAUAVAW", "WATAUAVAWH", "UVWATAUAVAWH", "WATAUAVAW", "SVWATAUAVAWH", "VWATAUAVH", "UVWATAUH", "RENAMEDLG", "LICENSEDLG", "STARTDLG" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.9800000190734863, "d": "WinRAR SFX registry key", "e": [ "Software\\WinRAR SFX" ], "i": "metadata/binary/installer/sfx::registry-key", "l": 1 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.22" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "Extracting files to %s folder$Extracting files to temporary folder", "Unknown encryption method in %s$The specified password is incorrect." ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 372736.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 474.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 195.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 474.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "winrar", "WinRAR", "WINRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "a": "T1112", "c": 0.6499999761581421, "d": "Windows runas verb token", "e": [ "runas" ], "i": "objectives/impact/degrade/system::runas-verb-token", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "Peek message (Unicode)", "e": [ "PeekMessageW" ], "i": "micro-behaviors/os/message/queue::peek-message-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 195.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.699999988079071, "d": "Get file information and icon", "e": [ "SHGetFileInfoW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-file-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.62" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 474.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00", "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "58 ac 01 00", "48 86 01 00", "19 86 01 00", "d2 84 01 00", "a4 84 01 00", "12 84 01 00", "f3 83 01 00", "ab 80 01 00", "04 7d 01 00", "b9 6f 01 00", "82 6f 01 00", "b7 fe 00 00", "43 f4 00 00", "1d 22 00 00", "40 1e 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "InitCommonControlsEx", "GetCurrentDirectoryW", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "GetModuleFileNameW", "GetCurrentProcessId", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "SetEnvironmentVariableW", "WideCharToMultiByte", "MultiByteToWideChar", "SetCurrentDirectoryW" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (InitCommonControlsEx)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetDeviceCaps, CreateCompatibleDC, GetObjectW, CreateCompatibleBitmap, SelectObject, ... +3 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (SHAutoComplete)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CLSIDFromString, CoCreateInstance, OleInitialize, OleUninitialize, CreateStreamOnHGlobal)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 8)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey, RegOpenKeyExW, RegQueryValueExW, RegCreateKeyExW, RegSetValueExW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (EnableWindow, GetDlgItem, ShowWindow, MessageBoxW, FindWindowExW, ... +49 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetMalloc, SHGetSpecialFolderLocation, SHGetFileInfoW, ShellExecuteExW, SHChangeNotify, ... +3 more)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetFileAttributesW, SetFileAttributesW, MoveFileW, DeleteFileW, CreateDirectoryW, ... +107 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.800000011920929, "d": "Has file operation capabilities", "e": [ "MoveFileExW", "FindFirstFileW" ], "i": "objectives/impact/ransom/file-operations::has-file-operations", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathW", "MoveFileExW" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "GetModuleFileNameW", "SetFileTime", "WriteFile", "GetModuleFileNameA", "CreateFileA", "CreateFileW", "FindFirstFileW" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "DispatchMessageW", "GetMessageW", "CreateWindowExW", "RegisterClassExW", "DefWindowProcW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "d2 84 01 00", "b9 6f 01 00", "1d 22 00 00", "43 f4 00 00", "58 ac 01 00", "b7 fe 00 00", "f3 83 01 00", "ab 80 01 00", "a4 84 01 00", "04 7d 01 00", "12 84 01 00", "GetTickCount", "82 6f 01 00", "19 86 01 00", "48 86 01 00", "40 1e 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindNextFileW", "FindFirstFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 195.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9700000286102295, "d": "WinRAR self-extractor footprint", "e": [ "Software\\WinRAR SFX", "STARTDLG" ], "i": "metadata/binary/installer/sfx::winrar-sfx-footprint", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsGetValue", "FlsSetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileW", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyExW", "RegSetValueExW", "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "ShellExecuteExW", "UnmapViewOfFile", "GetModuleFileNameW", "GetModuleFileNameA", "WriteFile" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "3df360464fcbbd2f411498f1847c85befce3128c333f46b83f809080fb91c1b6", "path": "64301!!Zip64.SFX", "type": "pe" }, { "f": "KO₁₀(As₉Co₂I₄PrAlC₄Er₈LaPXe)H₈(F₅Os₄Po₃UCmDb₂DsMg)Md₃(Bi₄Pa₂)", "x": 21, "dp": 1, "id": 20, "is": [ "GetLastError", "Sleep", "SetConsoleCtrlHandler", "LocalFree", "FormatMessageW", "CreateHardLinkW", "CreateFileW", "CloseHandle", "BackupRead", "GetCurrentProcess", "BackupSeek", "SetFileTime", "DeviceIoControl", "FindClose", "FindFirstFileW", "DeleteFileW", "RemoveDirectoryW", "CreateDirectoryW", "MoveFileW", "GetShortPathNameW", "GetLongPathNameW", "FlushFileBuffers", "SetFilePointer", "SetEndOfFile", "GetFileTime", "ReadFile", "GetDriveTypeW", "GetDiskFreeSpaceExW", "GetVolumeInformationW", "GetFileAttributesW", "SetFileAttributesW", "ExpandEnvironmentStringsW", "FindNextFileW", "GetVersionExW", "GetModuleFileNameW", "GetFullPathNameW", "SetErrorMode", "FreeLibrary", "LoadLibraryW", "LoadLibraryExW", "GetCurrentProcessId", "GetCurrentDirectoryW", "SetThreadPriority", "GetCurrentThread", "SetPriorityClass", "SetCurrentDirectoryW", "GetFullPathNameA", "CreateThread", "EnterCriticalSection", "LeaveCriticalSection", "WaitForSingleObject", "GetProcessAffinityMask", "ReleaseSemaphore", "ResetEvent", "DeleteCriticalSection", "SetEvent", "InitializeCriticalSection", "CreateEventW", "CreateSemaphoreW", "SystemTimeToFileTime", "GetSystemTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "GetConsoleOutputCP", "WriteConsoleA", "CreateFileA", "SetEnvironmentVariableA", "GetLocaleInfoA", "GetStringTypeW", "WriteFile", "WriteConsoleW", "SetConsoleMode", "ReadConsoleW", "GetStdHandle", "GetFileType", "GetConsoleMode", "GetCommandLineW", "GetModuleHandleW", "GetProcAddress", "SetLastError", "CompareStringA", "GetFileInformationByHandle", "GetStringTypeA", "GetTickCount", "QueryPerformanceCounter", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "HeapFree", "HeapReAlloc", "RtlLookupFunctionEntry", "RtlUnwindEx", "RaiseException", "RtlPcToFileHeader", "HeapAlloc", "GetSystemTimeAsFileTime", "ExitProcess", "GetCommandLineA", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlCaptureContext", "HeapSetInformation", "HeapCreate", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsSetValue", "FlsFree", "GetCurrentThreadId", "FlsAlloc", "GetModuleFileNameA", "GetACP", "GetOEMCP", "IsValidCodePage", "SetHandleCount", "GetStartupInfoA", "SetStdHandle", "GetConsoleCP", "HeapSize", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "LCMapStringA", "LCMapStringW", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "CharUpperW", "CharLowerW", "ExitWindowsEx", "CharLowerA", "LoadStringW", "CharToOemBuffW", "CharToOemBuffA", "CharToOemA", "OemToCharBuffA", "OemToCharA", "MessageBeep", "RegQueryValueExW", "RegCloseKey", "SetFileSecurityW", "GetFileSecurityW", "GetSecurityDescriptorLength", "OpenProcessToken", "LookupPrivilegeValueW", "AdjustTokenPrivileges", "CryptAcquireContextW", "CryptGenRandom", "CryptReleaseContext", "RegOpenKeyExW", "SHGetMalloc", "SHGetSpecialFolderLocation", "SHGetPathFromIDListW", "SHFileOperationW" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\rar\\build\\rar64\\Release\\RAR.pdb", "rsrc_size": 31232.0, "subsystem": 3.0, "timestamp": 1368555980.0, "image_base": 5368709120.0, "rsrc_entropy": 3.5, "entry_section": ".text", "size_of_image": 659456.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 3.0, "timestamp_year": 2013.0, "characteristics": 34.0, "entry_point_rva": 355116.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 4.0, "manifest_present": true, "computed_checksum": 533133.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555980.0, "debug_timestamp_min": 1368555980.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 9.0, "version_info_present": true, "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 402432.0, "file_size": 516608.0, "entry_point": 355116.0, "code_entropy": 6.49, "data_entropy": 5.15, "import_count": 160.0, "string_count": 729.0, "section_count": 6.0, "avg_complexity": 14.0, "function_count": 1384.0, "import_density": 0.41, "max_complexity": 14.0, "string_density": 1.85, "overall_entropy": 4.58, "avg_basic_blocks": 30.0, "avg_section_size": 85930.66, "dependency_count": 4.0, "entropy_variance": 1.44, "function_density": 3.52, "avg_function_size": 426.0, "avg_string_length": 20.52, "complexity_per_kb": 0.04, "max_string_length": 244.0, "wide_string_count": 294.0, "writable_sections": 1.0, "avg_string_entropy": 3.23, "code_to_data_ratio": 3.56, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.06, "text_to_file_ratio": 0.78, "total_basic_blocks": 30.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 19.88, "debug_reference_count": 1.0, "largest_section_ratio": 0.78, "sentence_string_count": 225.0, "sentence_string_ratio": 0.31, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 2217, "C E3" ], [ 3512, "@SUVWATAUAVAW" ], [ 3589, "AXD9" ], [ 4723, "UVWH" ], [ 4988, "@UVWATAUAVAW" ], [ 6369, "x ATAUAVH" ], [ 6995, "WATAUAVAWH" ], [ 8415, "K0E3" ], [ 9916, "GXD8" ], [ 12685, "CXD8" ], [ 12724, "CXL9" ], [ 12751, "D85Z" ], [ 13320, "KXD9" ], [ 14744, "CXD9" ], [ 15259, "CXH9H" ], [ 15332, "SXD9" ], [ 20570, "SXD8" ], [ 22963, "f91t" ], [ 22988, "f93u" ], [ 23037, "UVWATAUAVAWH" ], [ 24039, "WATAUH" ], [ 29467, "ATAUAVH" ], [ 50665, "UVWATAUAVAW" ], [ 62283, "l$ VWATAUAVH" ], [ 62998, "VWATAUAVH" ], [ 66380, "t$ WATAUAVAWH" ], [ 66903, "T30H" ], [ 67654, "VWATH" ], [ 69725, "SUVWATAUAVAWH" ], [ 75862, "VWATAUAV" ], [ 76650, "f92u" ], [ 86297, "UVWATAU" ], [ 90525, "UVWATAUH" ], [ 94584, "@SUVWATAUAVAWH" ], [ 95340, "@SUVWATAUAVH" ], [ 99225, "T4 H" ], [ 107777, "x ATAUAVAWH" ], [ 111183, "l$ VWATAUAV" ], [ 117829, "x ATAVAWH" ], [ 119956, "@SUVWATAUAV" ], [ 144570, "\\$ UVWATAUAVAW" ], [ 148971, "WATAUAVAW" ], [ 149829, "8D9T" ], [ 152003, "VWATAUAVAW" ], [ 153052, "t$ WATAUAVD" ], [ 153385, "x ATAUAVAW" ], [ 155309, "x ATAUAVL" ], [ 157255, "WATAWH" ], [ 159898, "\\$ UVWATAUAVAWH" ], [ 176729, "x ATAUAVAWE" ], [ 178116, "t$ WATAUAVAWL" ], [ 178621, "x ATAUD" ], [ 179864, "QPE3" ], [ 189711, "WAVAWH" ], [ 194908, "f92t" ], [ 196128, "f93t" ], [ 197330, "f99u" ], [ 200170, "tnf99ti" ], [ 234144, "EXA84" ], [ 236048, "M E3" ], [ 244511, "SVWATAUAVAWH" ], [ 255199, "l$ VWATAVAWH" ], [ 255970, "\\$ UVWATAUH" ], [ 256001, "D3I D" ], [ 258113, "E 1G" ], [ 272344, "A4A3" ], [ 274612, "xxxxwwww" ], [ 277596, "gfffffffI" ], [ 281970, "VWAUH" ], [ 318117, "U E3" ], [ 318937, "x AUAVAWH" ], [ 324567, "WAUAVH" ], [ 327884, "F0E3" ], [ 335315, "WATAVH" ], [ 341701, "p WATAUH" ], [ 343079, "SVWATH" ], [ 343917, "x ATAUAWH" ], [ 348263, "AUAVAWH" ], [ 358524, "8MOC" ], [ 359312, "@SWATAUAVAWH" ], [ 379588, "@UATAUAVAWH" ], [ 385598, "L$ UATAUAVAWH" ], [ 387172, "@USVWATAUAVAWH" ], [ 391966, "M0H3" ], [ 405040, "bad allocation" ], [ 405120, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 405312, "wide", "%12s %s" ], [ 405832, "wide", ".ext" ], [ 405872, "CompareStringOrdinal" ], [ 405896, "wide", "kernel32.dll" ], [ 406000, "wide", "rarfiles.lst" ], [ 406048, "wide", "__rar_" ], [ 407776, "70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434" ], [ 408072, "wide", "%d.%02d %ls %d" ], [ 408144, "wide", "AFUMD" ], [ 408160, "wide", ".rar" ], [ 408176, "wide", "FUADPXETK" ], [ 408200, "wide", "rarinfo.log" ], [ 408264, "wide", "default.sfx" ], [ 408344, "wide", "rar.log" ], [ 408528, "wide", "AFUM" ], [ 408552, "wide", "ilog" ], [ 408696, "wide", "rar.ini" ], [ 408816, "wide", "%02d:%02d:%02d %s" ], [ 408952, "wide", "[%c]%ls" ], [ 409568, "a538f494a2afdb0ca5c008d34100dc71cb684672c0c511da8d95d38642fc2360" ], [ 409744, "wide", "SeRestorePrivilege" ], [ 409784, "wide", "SeSecurityPrivilege" ], [ 409992, "wide", "SeBackupPrivilege" ], [ 410104, "wide", "SeCreateSymbolicLinkPrivilege" ], [ 410504, "wide", "%.*ls(%u)%ls" ], [ 410576, "wide", "rtmp%d" ], [ 410704, "wide", "FAT32" ], [ 410824, "wide", "%u.%03u" ], [ 410840, "wide", "__rar_tmp" ], [ 411192, "wide", "%c%c%c%c%c%c%c" ], [ 411224, "wide", "%c%c%c%c%c%c%c%c%c" ], [ 411408, "wide", "%c%10ls %9ls" ], [ 411480, "wide", "Unix owner" ], [ 411568, "wide", "%12ls: RAR %ls(v%d) -m%d -md=%d%s" ], [ 411672, "wide", "Unix" ], [ 411688, "wide", "Windows" ], [ 411704, "wide", "BLAKE2" ], [ 411720, "wide", "Pack-BLAKE2" ], [ 411744, "wide", "BLAKE2 MAC" ], [ 411800, "wide", "CRC32" ], [ 411840, "wide", "CRC32 MAC" ], [ 412352, "url", "!ls %9ls =%% \u0026ls %u" ], [ 412408, "wide", "%21ls %-14ls %u" ], [ 412448, "wide", "%21ls %9ls %3d%% %-25ls %u" ], [ 412560, "wide", "RAR 1.4" ], [ 412576, "wide", "RAR 5" ], [ 412592, "wide", "RAR 4" ], [ 413136, "wide", "AppData" ], [ 413152, "wide", "Software\\WinRAR\\Paths" ], [ 413232, "wide", "YMDHISWAEN" ], [ 413288, "wide", "yyyymmddhhmmss" ], [ 413880, "wide", "rar.lng" ], [ 413896, "wide", "Too large block header." ], [ 414176, "wide", "%%s%%0%dd_%%0%dd_%%0%dd.rev" ], [ 414232, "wide", "%%s%%0%dd.rev" ], [ 414304, "wide", ".bad" ], [ 414344, "wide", ".rev" ], [ 415456, "wide", "rebuilt." ], [ 415480, "wide", "fixed." ], [ 415536, "wide", "*messages***" ], [ 415568, "*messages***" ], [ 415608, "wide", "LanguageFolder" ], [ 415640, "wide", "Software\\WinRAR\\General" ], [ 415688, "wide", "rarlng.dll" ], [ 415712, "wide", "System Volume Information\\" ], [ 415808, "wide", "%ls%c%ls" ], [ 415832, "CryptUnprotectMemory" ], [ 415856, "CryptProtectMemory" ], [ 415880, "wide", "Crypt32.dll" ], [ 415904, "wide", "CryptUnprotectMemory failed" ], [ 415960, "wide", "CryptProtectMemory failed" ], [ 416360, "wide", "SeShutdownPrivilege" ], [ 416400, "SetDllDirectoryW" ], [ 416424, "wide", "kernel32" ], [ 416504, "MAPIFreeBuffer" ], [ 416520, "MAPIResolveName" ], [ 416536, "MAPISendMail" ], [ 416552, "wide", "MAPI32.DLL" ], [ 416576, "wide", "CreateThread failed" ], [ 416624, "wide", "WaitForMultipleObjects error %d, GetLastError %d" ], [ 416736, "wide", "Thread pool initialization failed." ], [ 416976, "wide", "%02u-%02u-%u %02u:%02u" ], [ 417024, "wide", "%u-%02u-%02u %02u:%02u,%03u" ], [ 417456, "Unknown exception" ], [ 417752, "CorExitProcess" ], [ 417768, "wide", "mscoree.dll" ], [ 417840, "bad exception" ], [ 417856, "runtime error" ], [ 417872, "TLOSS error" ], [ 417888, "SING error" ], [ 417904, "DOMAIN error" ], [ 417920, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 417927, "An application has made an attempt to load the C runtime library incorrectly." ], [ 418005, "Please contact the application's support team for more information." ], [ 418080, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 418087, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 418167, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 418328, "R6032\r\n- not enough space for locale information" ], [ 418335, "- not enough space for locale information" ], [ 418384, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 418391, "- Attempt to initialize the CRT more than once." ], [ 418439, "This indicates a bug in your application." ], [ 418488, "R6030\r\n- CRT not initialized" ], [ 418495, "- CRT not initialized" ], [ 418520, "R6028\r\n- unable to initialize heap" ], [ 418527, "- unable to initialize heap" ], [ 418560, "R6027\r\n- not enough space for lowio initialization" ], [ 418567, "- not enough space for lowio initialization" ], [ 418616, "R6026\r\n- not enough space for stdio initialization" ], [ 418623, "- not enough space for stdio initialization" ], [ 418672, "R6025\r\n- pure virtual function call" ], [ 418679, "- pure virtual function call" ], [ 418712, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 418719, "- not enough space for _onexit/atexit table" ], [ 418768, "R6019\r\n- unable to open console device" ], [ 418775, "- unable to open console device" ], [ 418816, "R6018\r\n- unexpected heap error" ], [ 418823, "- unexpected heap error" ], [ 418856, "R6017\r\n- unexpected multithread lock error" ], [ 418863, "- unexpected multithread lock error" ], [ 418904, "R6016\r\n- not enough space for thread data" ], [ 418911, "- not enough space for thread data" ], [ 418960, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 418962, "This application has requested the Runtime to terminate it in an unusual way." ], [ 419112, "R6009\r\n- not enough space for environment" ], [ 419119, "- not enough space for environment" ], [ 419160, "R6008\r\n- not enough space for arguments" ], [ 419167, "- not enough space for arguments" ], [ 419208, "R6002\r\n- floating point support not loaded" ], [ 419215, "- floating point support not loaded" ], [ 419256, "Microsoft Visual C++ Runtime Library" ], [ 419304, "\u003cprogram name unknown\u003e" ], [ 419328, "Runtime Error!\n\nProgram:" ], [ 419391, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 419496, "wide", "(null)" ], [ 419512, "(null)" ], [ 419561, "700WP" ], [ 419577, "`h````" ], [ 419838, "700PP" ], [ 419888, "Complete Object Locator'" ], [ 419920, "Class Hierarchy Descriptor'" ], [ 419952, "Base Class Array'" ], [ 419976, "Base Class Descriptor at (" ], [ 420008, "Type Descriptor'" ], [ 420032, "`local static thread guard'" ], [ 420064, "`managed vector copy constructor iterator'" ], [ 420112, "`vector vbase copy constructor iterator'" ], [ 420160, "`vector copy constructor iterator'" ], [ 420200, "`dynamic atexit destructor for '" ], [ 420240, "`dynamic initializer for '" ], [ 420272, "`eh vector vbase copy constructor iterator'" ], [ 420320, "`eh vector copy constructor iterator'" ], [ 420360, "`managed vector destructor iterator'" ], [ 420400, "`managed vector constructor iterator'" ], [ 420440, "`placement delete[] closure'" ], [ 420472, "`placement delete closure'" ], [ 420504, "`omni callsig'" ], [ 420520, "delete[]" ], [ 420544, "`local vftable constructor closure'" ], [ 420584, "`local vftable'" ], [ 420616, "`udt returning'" ], [ 420632, "`copy constructor closure'" ], [ 420664, "`eh vector vbase constructor iterator'" ] ], "sz": 516608, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1384.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Standalone SHA256 hash string in binary", "e": [ "70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434", "a538f494a2afdb0ca5c008d34100dc71cb684672c0c511da8d95d38642fc2360" ], "i": "metadata/binary/anomaly::embedded-sha256-token", "l": 3 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-file-operation", "l": 3 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "\u003cCommands\u003e", "\u003cSwitches\u003e", "L\n ri\u003cP\u003e[:\u003cS\u003e] Set priority (0-default,1-min..15-max) and sleep time in ms", "M\n ta\u003cdate\u003e Process files modified after \u003cdate\u003e in YYYYMMDDHHMMSS format", "N\n tb\u003cdate\u003e Process files modified before \u003cdate\u003e in YYYYMMDDHHMMSS format" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 160.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 160.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Release cryptographic context", "e": [ "CryptReleaseContext" ], "i": "micro-behaviors/crypto/library::crypt-release-context", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 160.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\rar\\build\\rar64\\Release\\RAR.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise process priority class", "e": [ "SetPriorityClass" ], "i": "micro-behaviors/process/thread/priority::set-priority-class", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555980.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query volume information", "e": [ "GetVolumeInformationW" ], "i": "micro-behaviors/fs/enumerate/volume::get-volume-info", "l": 3 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 160.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.9399999976158142, "d": "HEAP_CREATE_ENABLE_EXECUTE flag (0x40000)", "e": [ "B9 00 00 04 00", "B9 00 00 04 00", "B9 00 00 04 00", "B9 00 00 04 00" ], "i": "micro-behaviors/mem/alloc/heap::heap-create-enable-execute-flag", "l": 1 }, { "d": "password keyword", "e": [ "Reenter password:", "#Enter password (will not be echoed)", "ERROR: Passwords do not match", "I\nChecksum error in the encrypted file %s. Corrupt file or wrong password.", "%s - use current password ?", "p[password] Set password" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "\u0026Corrupt archive - use 'Repair' command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "MAPI message send call", "e": [ "MAPISendMail" ], "i": "objectives/collection/email-harvest::mapi-send-mail", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Derived string condition", "e": [ "cannot recover data" ], "i": "objectives/impact/ransom/encrypt/threat-text::inline__data-loss-threat__any_3", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.23" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "RAR.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "44", "44", "42", "40", "41" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 516608.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/command-and-control/backdoor/binary::plaintext-sleep-command-token", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 729.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.58" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Acquire cryptographic service provider context", "e": [ "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library::crypt-acquire-context", "l": 2, "m": "C0027" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 516608.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 160.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExW" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 160.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 160.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001" }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 11776)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "01 00 01 21" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.49)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b8", "b9", "b9", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "UVWATAUAVAWH", "UVWATAUAVAW", "VWATAUAVH", "VWATAUAV", "UVWATAUH", "WATAUAVAW", "VWATAUAVAW", "SVWATAUAVAWH", "FUADPXETK", "YMDHISWAEN" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.31" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 659456.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "Rar.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1384.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 160.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b8", "b8", "b8", "b8", "b9", "b8", "b8", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1384.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 160.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.58" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExW" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1384.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "NtCurrentProcess handle (-1) for NT API call", "e": [ "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::nt-current-process-handle", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Standalone SHA256 hash string in binary", "e": [ "70c2441db366d92ea7be1342b3bf629026ba92bb675f06e684bdd34511097434", "a538f494a2afdb0ca5c008d34100dc71cb684672c0c511da8d95d38642fc2360" ], "i": "objectives/anti-static/obfuscation/string::embedded-sha256-token", "l": 3 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "Rar.exe" ], "i": "objectives/evasion/masquerade/file::basename-is-exe", "l": 1 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Generate cryptographic random bytes", "e": [ "CryptGenRandom" ], "i": "micro-behaviors/os/random/generator::crypt-gen-random", "l": 2, "m": "C0027" }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1384.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1384.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "a": "T1091", "c": 0.8600000143051147, "d": "VB6 disk free space check GetDiskFreeSpaceExW", "e": [ "GetDiskFreeSpaceExW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-disk-free-space", "l": 1, "m": "B0017" }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00", "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "10 db 04 00", "5d 8b 04 00", "23 3c 04 00", "f0 3b 04 00", "7e 38 04 00", "f0 39 04 00", "52 36 04 00", "33 36 04 00", "e3 33 04 00", "46 32 04 00", "32 22 04 00", "cf 12 04 00", "98 12 04 00", "cb eb 01 00", "d1 3e 00 00", "84 3c 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetCurrentDirectoryW", "SetConsoleCtrlHandler", "GetVolumeInformationW", "GetModuleFileNameW", "GetCurrentProcessId", "SetCurrentDirectoryW", "GetProcessAffinityMask", "InitializeCriticalSection", "SystemTimeToFileTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetMalloc, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHFileOperationW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetLastError, Sleep, SetConsoleCtrlHandler, LocalFree, FormatMessageW, ... +128 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CharUpperW, CharLowerW, ExitWindowsEx, CharLowerA, LoadStringW, ... +6 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegQueryValueExW, RegCloseKey, SetFileSecurityW, GetFileSecurityW, GetSecurityDescriptorLength, ... +7 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "DeviceIoControl", "CreateFileW", "CreateFileA", "ReadFile" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "VS_VERSION_INFO", "FileVersion", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "CreateFileA", "CreateFileW", "GetModuleFileNameW", "SetFileTime", "FindFirstFileW", "GetModuleFileNameA", "WriteFile" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1083", "c": 0.8600000143051147, "d": "Drive context switching via cwd APIs", "e": [ "GetCurrentDirectoryW", "SetCurrentDirectoryW", "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::drive-context-switching", "l": 3 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "d1 3e 00 00", "5d 8b 04 00", "f0 39 04 00", "98 12 04 00", "32 22 04 00", "33 36 04 00", "46 32 04 00", "10 db 04 00", "GetTickCount", "e3 33 04 00", "cb eb 01 00", "84 3c 00 00", "7e 38 04 00", "23 3c 04 00", "f0 3b 04 00", "cf 12 04 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindFirstFileW", "FindNextFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 160.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsGetValue", "FlsSetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "GetModuleFileNameW", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "binary.function_count = 1384.00", "binary.import_count = 160.00", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "binary.sentence_string_ratio = 0.31" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueW", "OpenProcessToken", "AdjustTokenPrivileges" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.function_count = 1384.00", "binary.overall_entropy = 4.58" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1529", "c": 0.9399999976158142, "d": "Privilege-enabled reboot API use", "e": [ "ExitWindowsEx", "SeShutdownPrivilege", "LookupPrivilegeValueW", "AdjustTokenPrivileges" ], "i": "objectives/impact/system/shutdown::shutdown-privilege-reboot-api", "l": 3, "m": "B0029" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "80028eafe7b64464557c4a23598042a5e4071560b3aaf56b7e55b4240721c12d", "path": "64301!!Rar.exe", "type": "pe" }, { "f": "KO₉(AlAs₈C₄CoEr₄ILa₂PXe)H₃(Po₄Db₂Ds)Md₃(Bi₃Pa)", "x": 10, "dp": 1, "id": 21, "is": [ "CreatePropertySheetPageW", "DestroyPropertySheetPage", "ORDINAL 8", "CreateDirectoryW", "GetVersionExW", "GetModuleFileNameW", "GetCurrentDirectoryW", "GetLocaleInfoW", "GetNumberFormatW", "ExpandEnvironmentStringsW", "WaitForSingleObject", "FindResourceW", "LoadLibraryExW", "GetCurrentProcessId", "GetCurrentProcess", "Sleep", "SystemTimeToFileTime", "GetSystemTime", "FileTimeToSystemTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "GetTempPathW", "CreateFileA", "GetProcessHeap", "GetLocaleInfoA", "GetStringTypeW", "GetStringTypeA", "WriteConsoleW", "GetConsoleOutputCP", "WriteConsoleA", "SetStdHandle", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "GetTickCount", "QueryPerformanceCounter", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "LCMapStringW", "LCMapStringA", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "GetStartupInfoA", "SetHandleCount", "GetConsoleMode", "GetConsoleCP", "GetModuleHandleA", "ExitProcess", "HeapSize", "DeleteFileW", "GetFileAttributesW", "GetDriveTypeW", "ReadFile", "GetFileType", "SetEndOfFile", "SetFilePointer", "GetStdHandle", "WriteFile", "FlushFileBuffers", "CloseHandle", "CreateFileW", "SetLastError", "GetLastError", "FindFirstFileW", "FindNextFileW", "FindClose", "DosDateTimeToFileTime", "LocalFileTimeToFileTime", "LoadLibraryW", "GetProcAddress", "FreeLibrary", "FileTimeToLocalFileTime", "FileTimeToDosDateTime", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "TerminateProcess", "InterlockedDecrement", "InterlockedIncrement", "TlsFree", "TlsSetValue", "TlsAlloc", "HeapFree", "HeapReAlloc", "HeapAlloc", "RtlUnwind", "RaiseException", "GetSystemTimeAsFileTime", "GetCurrentThreadId", "GetCommandLineA", "HeapCreate", "HeapDestroy", "VirtualFree", "DeleteCriticalSection", "LeaveCriticalSection", "EnterCriticalSection", "VirtualAlloc", "GetModuleHandleW", "TlsGetValue", "OemToCharA", "CharUpperW", "CharLowerW", "OemToCharBuffA", "LoadStringW", "GetWindowRect", "SetWindowPos", "GetWindowTextW", "GetSystemMetrics", "GetWindow", "GetClassNameW", "GetWindowLongW", "SetWindowTextW", "CreatePopupMenu", "InsertMenuItemW", "GetSysColor", "LoadImageW", "SendDlgItemMessageW", "SetDlgItemTextW", "SetWindowLongW", "GetDlgItemTextW", "GetClientRect", "BeginPaint", "EndPaint", "SetMenuItemInfoW", "GetParent", "InvalidateRect", "GetDC", "SendMessageW", "ReleaseDC", "ShowWindow", "GetDlgItem", "GetDeviceCaps", "GetObjectW", "CreateCompatibleDC", "GetPixel", "SetPixel", "DeleteDC", "CreateDIBSection", "CreatePen", "CreateSolidBrush", "SetTextColor", "TextOutW", "Polygon", "Polyline", "DeleteObject", "SelectObject", "GetTextFaceW", "GetTextMetricsW", "CreateFontW", "RegSetValueExW", "RegQueryValueExW", "RegOpenKeyExW", "RegCloseKey", "RegCreateKeyExW", "ShellExecuteExW", "DragQueryFileW", "SHGetPathFromIDListW", "CoCreateInstance", "ReleaseStgMedium" ], "ms": { "pe": { "machine": 332.0, "checksum": 235746.0, "pdb_path": "d:\\Projects\\WinRAR\\RarExt\\build\\32\\Release\\rarext.pdb", "rsrc_size": 16384.0, "subsystem": 2.0, "timestamp": 1368556027.0, "icon_count": 2.0, "image_base": 268435456.0, "rsrc_entropy": 4.73, "entry_section": ".text", "size_of_image": 237568.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 7.0, "timestamp_year": 2013.0, "characteristics": 8450.0, "entry_point_rva": 71715.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368556027.0, "import_dll_count": 7.0, "manifest_present": true, "computed_checksum": 235746.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556027.0, "debug_timestamp_min": 1368556027.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 125440.0, "file_size": 178176.0, "entry_point": 71715.0, "code_entropy": 6.64, "data_entropy": 4.32, "export_count": 2.0, "import_count": 165.0, "string_count": 551.0, "section_count": 5.0, "avg_complexity": 8.78, "function_count": 377.0, "import_density": 1.35, "max_complexity": 131.0, "string_density": 4.5, "overall_entropy": 4.9, "avg_basic_blocks": 14.18, "avg_section_size": 35430.4, "dependency_count": 7.0, "entropy_variance": 1.05, "function_density": 3.08, "avg_function_size": 236.07, "avg_string_length": 18.19, "complexity_per_kb": 0.07, "max_string_length": 341.0, "wide_string_count": 141.0, "writable_sections": 1.0, "avg_string_entropy": 3.04, "code_to_data_ratio": 2.43, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.09, "text_to_file_ratio": 0.7, "total_basic_blocks": 5344.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 23.92, "debug_reference_count": 1.0, "largest_section_ratio": 0.7, "sentence_string_count": 92.0, "sentence_string_ratio": 0.17, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "high_complexity_functions": 7.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".rsrc" ], [ 655, "@.reloc" ], [ 4454, "SVWP" ], [ 11061, "SUVW" ], [ 14868, "QQVW" ], [ 15529, "97vi" ], [ 19198, "f99u" ], [ 24624, "VVVVP" ], [ 24643, "VVVP" ], [ 29437, "9olv" ], [ 37561, "WWWSW" ], [ 38329, "PQWR" ], [ 42703, "WSWSS" ], [ 47889, "QQSUV" ], [ 53867, "QQSV" ], [ 59170, "QSVW" ], [ 61667, "f93u" ], [ 64767, "t79u" ], [ 64772, "t29u" ], [ 65308, "SVW3" ], [ 66415, "AABB" ], [ 66624, "WVS3" ], [ 67632, "WVU3" ], [ 74279, "YYPV" ], [ 81858, "RPSW" ], [ 84862, "UVWS" ], [ 90944, "SQRP" ], [ 101969, "UQPXY]Y[" ], [ 106010, "8VVVVV" ], [ 109321, "SSSSW" ], [ 112895, "WWWWV" ], [ 124308, "QCPC" ], [ 127280, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 127444, "wide", "RAR 5.0" ], [ 127460, "wide", "Windows" ], [ 127476, "wide", "Unix" ], [ 127556, "wide", ".zip" ], [ 127576, "wide", "ZIP64" ], [ 127588, "wide", "zip|z##|jar" ], [ 127648, "GetComment" ], [ 127660, "Extract" ], [ 127668, "GetListItem" ], [ 127680, "GetNextName" ], [ 127692, "Close" ], [ 127700, "Open" ], [ 127708, "Prepare" ], [ 127772, "wide", "Amiga" ], [ 127784, "wide", "VAX/VMS" ], [ 127816, "wide", "Atari ST" ], [ 127852, "wide", "Z-System" ], [ 127884, "wide", "TOPS-20" ], [ 127900, "wide", "SMS/QDOS" ], [ 127920, "wide", "Acorn RISC OS" ], [ 127948, "wide", "Windows VFAT" ], [ 127984, "wide", "Tandem" ], [ 128056, "wide", "Ident" ], [ 128072, "wide", "Info" ], [ 128108, "wide", "Formats\\*.fmt" ], [ 128136, "wide", "FileList" ], [ 128156, "wide", "AllVolumes" ], [ 128180, "wide", "Setup" ], [ 128192, "wide", "CustomExt" ], [ 128272, "wide", "%u.%03u" ], [ 128292, "bad allocation" ], [ 128368, "wide", ".rar" ], [ 128508, "wide", "WinRAR_Profile%d" ], [ 128544, "wide", "WinRAR_Convert" ], [ 128600, "wide", "WinRAR_EmailArcTo" ], [ 128636, "wide", "WinRAR_EmailArc" ], [ 128668, "wide", "WinRAR_OpenSFX" ], [ 128700, "wide", "WinRAR_ExtractSeparate" ], [ 128748, "wide", "WinRAR_ExtractHere" ], [ 128788, "wide", "WinRAR_Extract" ], [ 128820, "wide", "WinRAR_ExtractTo" ], [ 128880, "wide", "WinRAR_AddTo" ], [ 128924, "wide", "EXTARCINFODLG" ], [ 128952, "wide", "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\WinRAR.exe" ], [ 129080, "wide", "winrar.exe" ], [ 129104, "wide", "Software\\WinRAR" ], [ 129136, "wide", "exe32" ], [ 129148, "wide", "Default" ], [ 129184, "wide", "Name" ], [ 129196, "wide", "Profiles\\%d" ], [ 129220, "wide", "Interface\\Themes" ], [ 129256, "wide", "ShellExtBMP" ], [ 129288, "wide", "cw -y -scuc \"%s\" \"%s\"" ], [ 129364, "wide", "Courier New" ], [ 129388, "wide", "rarext.lng" ], [ 129592, "SHCreateItemFromParsingName" ], [ 129618, "wide", "eShell32.dll" ], [ 129644, "wide", "ShellExtIcon" ], [ 129680, "wide", "CascadedMenu" ], [ 129708, "IsAppThemed" ], [ 129718, "wide", "dUxTheme.dll" ], [ 129744, "wide", "MenuIcons" ], [ 129764, "wide", "Setup\\MenuItems" ], [ 129812, "wide", "Archive" ], [ 129848, "wide", "%c %s%s%s%s -scul -r0 -iext --" ], [ 129924, "wide", "-ieml." ], [ 129964, "wide", "\"-cp%s\"" ], [ 129984, "wide", "PathsNone" ], [ 130004, "wide", "PathsAbsDrive" ], [ 130032, "wide", "PathsAbs" ], [ 130052, "wide", "SFXOther" ], [ 130072, "wide", "SFXNetwork" ], [ 130096, "wide", "SFXLocal" ], [ 130124, "wide", "Convert" ], [ 130140, "wide", "Test" ], [ 130152, "wide", "OpenSFX" ], [ 130168, "wide", "Extr" ], [ 130188, "wide", ".part" ], [ 130200, "wide", "ExtrSep" ], [ 130216, "wide", "ExtrHere" ], [ 130252, "wide", "EmailArc" ], [ 130272, "wide", "EmailOpt" ], [ 130292, "wide", "Profile" ], [ 130416, "wide", "\"-anf=%s\" -scul" ], [ 130452, "wide", "t -iext" ], [ 130468, "wide", "cv -iext" ], [ 130488, "wide", "x -iext -ow -ver" ], [ 130540, "wide", "ArcName" ], [ 130556, "wide", "ImmExec" ], [ 130572, "wide", "EXTCMTARCINFODLG" ], [ 130608, "wide", "Software\\WinRAR%s%s" ], [ 130648, "wide", "*messages***" ], [ 130676, "*messages***" ], [ 130732, "wide", "COMBOBOX" ], [ 130752, "wide", "LanguageFolder" ], [ 130784, "wide", "Software\\WinRAR\\General" ], [ 130832, "wide", "rarlng.dll" ], [ 130856, "CryptUnprotectMemory" ], [ 130880, "CryptProtectMemory" ], [ 130900, "wide", "Crypt32.dll" ], [ 130924, "wide", "CryptUnprotectMemory failed" ], [ 130980, "wide", "CryptProtectMemory failed" ], [ 131308, "wide", "Paths" ], [ 131320, "wide", "TempFolder" ], [ 131548, "bad exception" ], [ 131564, "EncodePointer" ], [ 131580, "wide", "KERNEL32.DLL" ], [ 131608, "DecodePointer" ], [ 131624, "FlsFree" ], [ 131632, "FlsSetValue" ], [ 131644, "FlsGetValue" ], [ 131656, "FlsAlloc" ], [ 131688, "Unknown exception" ], [ 131728, "wide", "UTF-16LE" ], [ 131748, "wide", "UNICODE" ], [ 131764, "CorExitProcess" ], [ 131780, "wide", "mscoree.dll" ], [ 131804, "wide", "(null)" ], [ 131820, "(null)" ], [ 131873, "700WP" ], [ 131889, "`h````" ], [ 131950, "GAIsProcessorFeaturePresent" ], [ 131980, "KERNEL32" ], [ 131992, "runtime error" ], [ 132012, "TLOSS error" ], [ 132028, "SING error" ], [ 132044, "DOMAIN error" ], [ 132064, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 132071, "An application has made an attempt to load the C runtime library incorrectly." ], [ 132149, "Please contact the application's support team for more information." ], [ 132224, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 132231, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 132311, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 132472, "R6032\r\n- not enough space for locale information" ], [ 132479, "- not enough space for locale information" ], [ 132528, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 132535, "- Attempt to initialize the CRT more than once." ], [ 132583, "This indicates a bug in your application." ], [ 132628, "R6030\r\n- CRT not initialized" ], [ 132635, "- CRT not initialized" ], [ 132660, "R6028\r\n- unable to initialize heap" ], [ 132667, "- unable to initialize heap" ], [ 132700, "R6027\r\n- not enough space for lowio initialization" ], [ 132707, "- not enough space for lowio initialization" ], [ 132756, "R6026\r\n- not enough space for stdio initialization" ], [ 132763, "- not enough space for stdio initialization" ], [ 132812, "R6025\r\n- pure virtual function call" ], [ 132819, "- pure virtual function call" ], [ 132852, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 132859, "- not enough space for _onexit/atexit table" ], [ 132908, "R6019\r\n- unable to open console device" ], [ 132915, "- unable to open console device" ], [ 132952, "R6018\r\n- unexpected heap error" ], [ 132959, "- unexpected heap error" ], [ 132988, "R6017\r\n- unexpected multithread lock error" ], [ 132995, "- unexpected multithread lock error" ], [ 133036, "R6016\r\n- not enough space for thread data" ], [ 133043, "- not enough space for thread data" ], [ 133080, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 133082, "This application has requested the Runtime to terminate it in an unusual way." ], [ 133232, "R6009\r\n- not enough space for environment" ], [ 133239, "- not enough space for environment" ], [ 133276, "R6008\r\n- not enough space for arguments" ], [ 133283, "- not enough space for arguments" ], [ 133320, "R6002\r\n- floating point support not loaded" ], [ 133327, "- floating point support not loaded" ], [ 133368, "Microsoft Visual C++ Runtime Library" ], [ 133416, "\u003cprogram name unknown\u003e" ], [ 133440, "Runtime Error!\n\nProgram:" ], [ 133503, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 133774, "700PP" ], [ 133820, "Complete Object Locator'" ], [ 133848, "Class Hierarchy Descriptor'" ], [ 133880, "Base Class Array'" ], [ 133900, "Base Class Descriptor at (" ], [ 133928, "Type Descriptor'" ], [ 133948, "`local static thread guard'" ], [ 133976, "`managed vector copy constructor iterator'" ], [ 134020, "`vector vbase copy constructor iterator'" ], [ 134064, "`vector copy constructor iterator'" ], [ 134100, "`dynamic atexit destructor for '" ], [ 134136, "`dynamic initializer for '" ], [ 134164, "`eh vector vbase copy constructor iterator'" ], [ 134208, "`eh vector copy constructor iterator'" ], [ 134248, "`managed vector destructor iterator'" ], [ 134288, "`managed vector constructor iterator'" ], [ 134328, "`placement delete[] closure'" ], [ 134360, "`placement delete closure'" ], [ 134388, "`omni callsig'" ], [ 134404, "delete[]" ], [ 134424, "`local vftable constructor closure'" ], [ 134460, "`local vftable'" ], [ 134488, "`udt returning'" ], [ 134504, "`copy constructor closure'" ], [ 134532, "`eh vector vbase constructor iterator'" ], [ 134572, "`eh vector destructor iterator'" ], [ 134604, "`eh vector constructor iterator'" ], [ 134640, "`virtual displacement map'" ], [ 134668, "`vector vbase constructor iterator'" ], [ 134704, "`vector destructor iterator'" ], [ 134736, "`vector constructor iterator'" ], [ 134768, "`scalar deleting destructor'" ], [ 134800, "`default constructor closure'" ], [ 134832, "`vector deleting destructor'" ], [ 134864, "`vbase destructor'" ], [ 134896, "`local static guard'" ], [ 135088, "operator" ], [ 135124, "delete" ], [ 135140, "__unaligned" ], [ 135152, "__restrict" ], [ 135172, "__clrcall" ], [ 135184, "__fastcall" ], [ 135196, "__thiscall" ], [ 135208, "__stdcall" ], [ 135220, "__pascal" ], [ 135232, "__cdecl" ], [ 135640, "GetProcessWindowStation" ], [ 135664, "GetUserObjectInformationA" ], [ 135692, "GetLastActivePopup" ], [ 135712, "GetActiveWindow" ] ], "sz": 178176, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 377.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.9200000166893005, "d": "Shell drag query API", "e": [ "DragQueryFileW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-drag-query-file", "l": 1 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.949999988079071, "d": "COM unload export present", "e": [ "DllCanUnloadNow" ], "i": "metadata/binary/symbols::export-dll-can-unload-now", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\RarExt\\build\\32\\Release\\rarext.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556027.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "password keyword", "e": [ "Passwords" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "Open SFX archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.70" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.78" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.04" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "rarext.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.949999988079071, "d": "COM class factory export", "e": [ "DllGetClassObject" ], "i": "metadata/binary/symbols::export-dll-get-class-object", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "45", "4d", "45", "45", "4d", "4d", "49", "46", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 141.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 178176.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 551.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1105", "c": 0.9399999976158142, "d": "Embedded stage screen capture APIs", "e": [ "CreateDIBSection" ], "i": "objectives/command-and-control/dropper/staging/signed-bundle::embedded-stage-screen-capture", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.90" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI DIB section creation for BMP capture", "e": [ "CreateDIBSection" ], "i": "micro-behaviors/hardware/display/screen::create-dib-section", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.64)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "COMBOBOX", "LMNOOOOOOPA", "BCDEFGHIJK", "UUUUUUPU" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 237568.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 377.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 377.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "WinRAR", "winrar", "WinRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 5344.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "RarExt32.dll" ], "i": "objectives/evasion/masquerade/dll::dll-basename", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 165.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.90" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-getpixel", "l": 2 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 377.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "SetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-setpixel", "l": 2 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "d": ".exe extension reference", "e": [ ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "54 01 02 10", "48 01 02 10", "78 01 02 10", "78 01 02 10", "70 01 02 10", "78 01 02 10", "78 01 02 10", "78 01 02 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "DestroyPropertySheetPage", "CreatePropertySheetPageW", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "GetModuleFileNameW", "GetCurrentDirectoryW", "GetCurrentProcessId", "SystemTimeToFileTime", "FileTimeToSystemTime", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, ReleaseStgMedium)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (OemToCharA, CharUpperW, CharLowerW, OemToCharBuffA, LoadStringW, ... +27 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegCreateKeyExW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (CreatePropertySheetPageW, DestroyPropertySheetPage, ORDINAL 8)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateDirectoryW, GetVersionExW, GetModuleFileNameW, GetCurrentDirectoryW, GetLocaleInfoW, ... +97 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetDeviceCaps, GetObjectW, CreateCompatibleDC, GetPixel, SetPixel, ... +13 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteExW, DragQueryFileW, SHGetPathFromIDListW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "78 01 02 10", "48 01 02 10", "70 01 02 10", "54 01 02 10", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindFirstFileW", "FindClose", "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 165.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "GetModuleFileNameW", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExW", "RegOpenKeyExW", "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "Sleep", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "e52ed73d0bfc4abf805b02823a1c0e6259b895d9cddd1b20ad1d300a0ecd0091", "path": "64301!!RarExt32.dll", "type": "pe" }, { "f": "KO₉(AlAs₈C₅CoEr₃I₃P₂PrXe)H₅(F₅OsPo₅Db₂Ds)Md₅(SiBi₅PaPt)", "x": 15, "dp": 1, "id": 22, "is": [ "InitCommonControlsEx", "SHAutoComplete", "GetFileAttributesW", "SetFileAttributesW", "MoveFileW", "DeleteFileW", "CreateDirectoryW", "FindClose", "FindNextFileW", "FindFirstFileW", "GetFullPathNameW", "GetModuleFileNameW", "FindResourceW", "GetModuleHandleW", "FreeLibrary", "GetProcAddress", "LoadLibraryW", "GetCurrentProcessId", "GetLocaleInfoW", "GetNumberFormatW", "ExpandEnvironmentStringsW", "WaitForSingleObject", "GetDateFormatW", "GetTimeFormatW", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "GetExitCodeProcess", "GetTempPathW", "MoveFileExW", "Sleep", "UnmapViewOfFile", "MapViewOfFile", "GetCommandLineW", "CreateFileMappingW", "GetTickCount", "SetEnvironmentVariableW", "OpenFileMappingW", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "GlobalAlloc", "SetCurrentDirectoryW", "WriteConsoleW", "GetConsoleOutputCP", "SetStdHandle", "GetLocaleInfoA", "GetStringTypeW", "GetStringTypeA", "LoadLibraryA", "GetConsoleMode", "GetConsoleCP", "InitializeCriticalSectionAndSpinCount", "QueryPerformanceCounter", "SetHandleCount", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "HeapSize", "LCMapStringW", "LCMapStringA", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "ExitProcess", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "InterlockedDecrement", "GetCurrentThreadId", "InterlockedIncrement", "TlsFree", "TlsSetValue", "TlsAlloc", "TlsGetValue", "VirtualAlloc", "EnterCriticalSection", "LeaveCriticalSection", "DeleteCriticalSection", "VirtualFree", "HeapCreate", "GetStartupInfoA", "GetCommandLineA", "SetFileTime", "ReadFile", "GetFileType", "SetEndOfFile", "SetFilePointer", "GetStdHandle", "FlushFileBuffers", "WriteFile", "CloseHandle", "CreateFileW", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "SetLastError", "GetLastError", "GetCurrentDirectoryW", "CreateFileA", "WriteConsoleA", "GetSystemTimeAsFileTime", "HeapAlloc", "HeapReAlloc", "RaiseException", "RtlUnwind", "HeapFree", "EnableWindow", "GetDlgItem", "MessageBoxW", "ShowWindow", "FindWindowExW", "GetParent", "MapWindowPoints", "CreateWindowExW", "UpdateWindow", "LoadCursorW", "RegisterClassExW", "DefWindowProcW", "DestroyWindow", "CopyRect", "CharUpperW", "CharToOemA", "OemToCharA", "OemToCharBuffA", "LoadIconW", "LoadBitmapW", "PostMessageW", "GetSysColor", "SetForegroundWindow", "WaitForInputIdle", "IsWindowVisible", "DialogBoxParamW", "DestroyIcon", "SetFocus", "GetClassNameW", "SendDlgItemMessageW", "EndDialog", "GetDlgItemTextW", "SetDlgItemTextW", "wvsprintfW", "SendMessageW", "GetDC", "ReleaseDC", "PeekMessageW", "GetMessageW", "TranslateMessage", "DispatchMessageW", "LoadStringW", "GetWindowRect", "GetClientRect", "SetWindowPos", "GetWindowTextW", "SetWindowTextW", "GetSystemMetrics", "GetWindow", "GetWindowLongW", "SetWindowLongW", "IsWindow", "GetDeviceCaps", "CreateCompatibleDC", "GetObjectW", "CreateCompatibleBitmap", "SelectObject", "StretchBlt", "DeleteDC", "DeleteObject", "RegCloseKey", "RegOpenKeyExW", "RegQueryValueExW", "RegCreateKeyExW", "RegSetValueExW", "SHBrowseForFolderW", "SHGetMalloc", "SHChangeNotify", "SHFileOperationW", "SHGetFileInfoW", "SHGetPathFromIDListW", "SHGetSpecialFolderLocation", "ShellExecuteExW", "CLSIDFromString", "CoCreateInstance", "OleInitialize", "OleUninitialize", "CreateStreamOnHGlobal", "ORDINAL 8" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\SFX\\build\\sfxzip32\\Release\\sfxzip.pdb", "rsrc_size": 17408.0, "subsystem": 2.0, "timestamp": 1368556016.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.66, "entry_section": ".text", "size_of_image": 344064.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2013.0, "characteristics": 259.0, "entry_point_rva": 67583.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1368556016.0, "import_dll_count": 9.0, "manifest_present": true, "computed_checksum": 144741.0, "section_alignment": 4096.0, "number_of_sections": 4.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556016.0, "debug_timestamp_min": 1368556016.0, "dll_characteristics": 33024.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 100352.0, "file_size": 141312.0, "entry_point": 67583.0, "code_entropy": 6.64, "data_entropy": 3.83, "import_count": 190.0, "string_count": 541.0, "section_count": 4.0, "avg_complexity": 9.0, "function_count": 335.0, "import_density": 1.94, "max_complexity": 384.0, "string_density": 5.52, "overall_entropy": 4.74, "avg_basic_blocks": 13.72, "avg_section_size": 35072.0, "dependency_count": 9.0, "entropy_variance": 1.55, "function_density": 3.42, "avg_function_size": 250.34, "avg_string_length": 21.86, "complexity_per_kb": 0.09, "max_string_length": 248.0, "wide_string_count": 124.0, "writable_sections": 1.0, "avg_string_entropy": 3.26, "code_to_data_ratio": 2.51, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.12, "text_to_file_ratio": 0.71, "total_basic_blocks": 4596.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 25.2, "debug_reference_count": 1.0, "largest_section_ratio": 0.71, "sentence_string_count": 124.0, "sentence_string_ratio": 0.23, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0, "high_complexity_functions": 4.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".rsrc" ], [ 5747, "VVVP" ], [ 6391, "E0PV" ], [ 13079, "SUVW" ], [ 18590, "5XEC" ], [ 18727, "54EC" ], [ 18733, "50EC" ], [ 22921, "YWj\\_f9\u003euOf9~" ], [ 31315, "u1jd" ], [ 35506, "EXPSV" ], [ 36267, "QSVW" ], [ 37225, "HtOHt^HtBHu#" ], [ 45191, "5 EC" ], [ 50865, "QQVW" ], [ 52992, "WVS3" ], [ 56367, "AABB" ], [ 57936, "WVU3" ], [ 70368, "YYPV" ], [ 77154, "RPSW" ], [ 78946, "UVWS" ], [ 89597, "UQPXY]Y[" ], [ 96863, "WWWWV" ], [ 102320, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 102480, "bad allocation" ], [ 102904, "wide", "__rar_" ], [ 102976, "wide", "*messages***" ], [ 103004, "*messages***" ], [ 103064, "CryptUnprotectMemory" ], [ 103088, "CryptProtectMemory" ], [ 103108, "wide", "Crypt32.dll" ], [ 103132, "wide", "CryptUnprotectMemory failed" ], [ 103188, "wide", "CryptProtectMemory failed" ], [ 103264, "wide", "RENAMEDLG" ], [ 103284, "wide", "GETPASSWORD1" ], [ 103320, "wide", "Software\\WinRAR SFX" ], [ 103360, "wide", "STATIC" ], [ 103388, "wide", "%s %s %s" ], [ 103408, "wide", "REPLACEFILEDLG" ], [ 103444, "wide", ".exe" ], [ 103456, "wide", "Install" ], [ 103472, "wide", ".inf" ], [ 103484, "wide", ".lnk" ], [ 103496, "wide", "%s%s%d" ], [ 103520, "wide", "ProgramFilesDir" ], [ 103552, "wide", "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 103636, "wide", "\u003cbr\u003e" ], [ 103648, "wide", "%s.%d.tmp" ], [ 103668, "wide", "Delete" ], [ 103684, "wide", "Text" ], [ 103696, "wide", "Title" ], [ 103708, "wide", "Path" ], [ 103720, "wide", "Silent" ], [ 103736, "wide", "Overwrite" ], [ 103756, "wide", "Setup" ], [ 103768, "wide", "TempMode" ], [ 103788, "wide", "License" ], [ 103804, "wide", "Presetup" ], [ 103824, "wide", "Shortcut" ], [ 103844, "wide", "SavePath" ], [ 103864, "wide", "Update" ], [ 103880, "wide", "SetupCode" ], [ 103900, "wide", "LICENSEDLG" ], [ 103944, "wide", "runas" ], [ 103956, "wide", "winrarsfxmappingfile.tmp" ], [ 104008, "wide", "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" ], [ 104068, "wide", "__tmp_rar_sfx_access_check_%u" ], [ 104128, "wide", "STARTDLG" ], [ 104148, "wide", "sfxname" ], [ 104180, "SetDllDirectoryW" ], [ 104200, "wide", "kernel32" ], [ 104472, "wide", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e" ], [ 104584, "wide", "\u003c/html\u003e" ], [ 104600, "wide", "utf-8\"\u003e\u003c/head\u003e" ], [ 104632, "wide", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=" ], [ 104768, "wide", "\u003chtml\u003e" ], [ 104784, "wide", "\u003c/style\u003e" ], [ 104804, "wide", "\u003cstyle\u003e" ], [ 104820, "wide", "\u003c/p\u003e" ], [ 104832, "wide", "about:blank" ], [ 104856, "wide", "Shell.Explorer" ], [ 104888, "wide", "RarHtmlClassName" ], [ 104924, "wide", "EDIT" ], [ 104936, "wide", "riched20.dll" ], [ 104964, "wide", "riched32.dll" ], [ 105183, "Fcsm" ], [ 105252, "bad exception" ], [ 105268, "EncodePointer" ], [ 105284, "wide", "KERNEL32.DLL" ], [ 105312, "DecodePointer" ], [ 105328, "FlsFree" ], [ 105336, "FlsSetValue" ], [ 105348, "FlsGetValue" ], [ 105360, "FlsAlloc" ], [ 105392, "wide", "UTF-16LE" ], [ 105412, "wide", "UNICODE" ], [ 105440, "Unknown exception" ], [ 105460, "CorExitProcess" ], [ 105476, "wide", "mscoree.dll" ], [ 105500, "runtime error" ], [ 105520, "TLOSS error" ], [ 105536, "SING error" ], [ 105552, "DOMAIN error" ], [ 105568, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 105575, "An application has made an attempt to load the C runtime library incorrectly." ], [ 105653, "Please contact the application's support team for more information." ], [ 105728, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 105735, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 105815, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 105976, "R6032\r\n- not enough space for locale information" ], [ 105983, "- not enough space for locale information" ], [ 106032, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 106039, "- Attempt to initialize the CRT more than once." ], [ 106087, "This indicates a bug in your application." ], [ 106132, "R6030\r\n- CRT not initialized" ], [ 106139, "- CRT not initialized" ], [ 106164, "R6028\r\n- unable to initialize heap" ], [ 106171, "- unable to initialize heap" ], [ 106204, "R6027\r\n- not enough space for lowio initialization" ], [ 106211, "- not enough space for lowio initialization" ], [ 106260, "R6026\r\n- not enough space for stdio initialization" ], [ 106267, "- not enough space for stdio initialization" ], [ 106316, "R6025\r\n- pure virtual function call" ], [ 106323, "- pure virtual function call" ], [ 106356, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 106363, "- not enough space for _onexit/atexit table" ], [ 106412, "R6019\r\n- unable to open console device" ], [ 106419, "- unable to open console device" ], [ 106456, "R6018\r\n- unexpected heap error" ], [ 106463, "- unexpected heap error" ], [ 106492, "R6017\r\n- unexpected multithread lock error" ], [ 106499, "- unexpected multithread lock error" ], [ 106540, "R6016\r\n- not enough space for thread data" ], [ 106547, "- not enough space for thread data" ], [ 106584, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 106586, "This application has requested the Runtime to terminate it in an unusual way." ], [ 106736, "R6009\r\n- not enough space for environment" ], [ 106743, "- not enough space for environment" ], [ 106780, "R6008\r\n- not enough space for arguments" ], [ 106787, "- not enough space for arguments" ], [ 106824, "R6002\r\n- floating point support not loaded" ], [ 106831, "- floating point support not loaded" ], [ 106872, "Microsoft Visual C++ Runtime Library" ], [ 106920, "\u003cprogram name unknown\u003e" ], [ 106944, "Runtime Error!\n\nProgram:" ], [ 107007, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 107240, "Complete Object Locator'" ], [ 107268, "Class Hierarchy Descriptor'" ], [ 107300, "Base Class Array'" ], [ 107320, "Base Class Descriptor at (" ], [ 107348, "Type Descriptor'" ], [ 107368, "`local static thread guard'" ], [ 107396, "`managed vector copy constructor iterator'" ], [ 107440, "`vector vbase copy constructor iterator'" ], [ 107484, "`vector copy constructor iterator'" ], [ 107520, "`dynamic atexit destructor for '" ], [ 107556, "`dynamic initializer for '" ], [ 107584, "`eh vector vbase copy constructor iterator'" ], [ 107628, "`eh vector copy constructor iterator'" ], [ 107668, "`managed vector destructor iterator'" ], [ 107708, "`managed vector constructor iterator'" ], [ 107748, "`placement delete[] closure'" ], [ 107780, "`placement delete closure'" ], [ 107808, "`omni callsig'" ], [ 107824, "delete[]" ], [ 107844, "`local vftable constructor closure'" ], [ 107880, "`local vftable'" ], [ 107908, "`udt returning'" ], [ 107924, "`copy constructor closure'" ], [ 107952, "`eh vector vbase constructor iterator'" ], [ 107992, "`eh vector destructor iterator'" ], [ 108024, "`eh vector constructor iterator'" ], [ 108060, "`virtual displacement map'" ], [ 108088, "`vector vbase constructor iterator'" ], [ 108124, "`vector destructor iterator'" ], [ 108156, "`vector constructor iterator'" ], [ 108188, "`scalar deleting destructor'" ], [ 108220, "`default constructor closure'" ], [ 108252, "`vector deleting destructor'" ], [ 108284, "`vbase destructor'" ], [ 108316, "`local static guard'" ], [ 108504, "operator" ], [ 108540, "delete" ], [ 108556, "__unaligned" ], [ 108568, "__restrict" ], [ 108588, "__clrcall" ], [ 108600, "__fastcall" ], [ 108612, "__thiscall" ], [ 108624, "__stdcall" ], [ 108636, "__pascal" ], [ 108648, "__cdecl" ], [ 109054, "wide", "A(null)" ], [ 109072, "(null)" ], [ 109121, "700WP" ], [ 109137, "`h````" ], [ 109222, "700PP" ], [ 109268, "GetProcessWindowStation" ], [ 109292, "GetUserObjectInformationA" ], [ 109320, "GetLastActivePopup" ], [ 109340, "GetActiveWindow" ], [ 109356, "MessageBoxA" ], [ 109368, "USER32.DLL" ], [ 110154, "wide", "h(((( H" ], [ 110832, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 111216, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 111452, "dddd, MMMM dd, yyyy" ], [ 111472, "MM/dd/yy" ], [ 111492, "December" ], [ 111504, "November" ], [ 111516, "October" ], [ 111524, "September" ], [ 111536, "August" ], [ 111544, "July" ], [ 111552, "June" ], [ 111560, "April" ], [ 111568, "March" ], [ 111576, "February" ], [ 111588, "January" ], [ 111644, "Saturday" ], [ 111656, "Friday" ], [ 111664, "Thursday" ], [ 111676, "Wednesday" ], [ 111688, "Tuesday" ], [ 111696, "Monday" ], [ 111704, "Sunday" ], [ 111740, "SunMonTueWedThuFriSat" ], [ 111764, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 111912, "d:\\Projects\\WinRAR\\SFX\\build\\sfxzip32\\Release\\sfxzip.pdb" ], [ 115466, "InitCommonControlsEx" ], [ 115488, "COMCTL32.dll" ], [ 115504, "SHAutoComplete" ], [ 115520, "SHLWAPI.dll" ], [ 115534, "GetCurrentDirectoryW" ], [ 115558, "GetLastError" ], [ 115574, "SetLastError" ], [ 115590, "LocalFileTimeToFileTime" ], [ 115616, "DosDateTimeToFileTime" ], [ 115640, "CreateFileW" ], [ 115654, "CloseHandle" ], [ 115668, "FlushFileBuffers" ], [ 115688, "WriteFile" ], [ 115700, "GetStdHandle" ], [ 115716, "SetFilePointer" ], [ 115734, "SetEndOfFile" ], [ 115750, "GetFileType" ], [ 115764, "ReadFile" ], [ 115776, "SetFileTime" ], [ 115790, "GetFileAttributesW" ], [ 115812, "SetFileAttributesW" ], [ 115846, "DeleteFileW" ], [ 115860, "CreateDirectoryW" ], [ 115880, "FindClose" ], [ 115892, "FindNextFileW" ] ], "sz": 141312, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 335.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-file-operation", "l": 3 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cbr\u003e", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e", "\u003c/html\u003e", "utf-8\"\u003e\u003c/head\u003e", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=", "\u003chtml\u003e", "\u003c/style\u003e", "\u003cstyle\u003e", "\u003c/p\u003e", "E\u003cul\u003e\u003cli\u003ePress \u003cb\u003eInstall\u003c/b\u003e button to start extraction.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003eE\u003cul\u003e\u003cli\u003ePress \u003cb\u003eExtract\u003c/b\u003e ...", "manually.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003e8\u003cli\u003eIf the destination folder does not exist, it will be", "2created automatically before extraction.\u003c/li\u003e\u003c/ul\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 190.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 190.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp", ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\SFX\\build\\sfxzip32\\Release\\sfxzip.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556016.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 190.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "password keyword", "e": [ "GETPASSWORD1", "GETPASSWORD1\nLICENSEDLG\nASKNEXTVOL", "Enter password", "\u0026Enter password for the encrypted file:", "…. Corrupt file or wrong password.", "Wrong password for %s5Write error in the file %s. Probably the disk is full", "Unknown encryption method in %s$The specified password is incorrect." ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.26" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ ".lnk" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "sfxzip.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4d", "40", "46", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "Find window by class/title", "e": [ "FindWindowExW" ], "i": "micro-behaviors/ui/window/manage::find-window-ex", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 124.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "c": 0.800000011920929, "d": "Notify shell of file changes", "e": [ "SHChangeNotify" ], "i": "micro-behaviors/ui/window/notify::shell-change-notify", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "runas privilege elevation string", "e": [ "runas" ], "i": "micro-behaviors/os/privilege/elevation::runas-string", "l": 3 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 141312.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Post message to window (Unicode)", "e": [ "PostMessageW" ], "i": "micro-behaviors/os/message/queue::post-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 541.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Display folder browse dialog", "e": [ "SHBrowseForFolderW" ], "i": "micro-behaviors/fs/shell-ops/commands::browse-for-folder", "l": 3 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.949999988079071, "d": "WinRAR SFX start dialog", "e": [ "STARTDLG" ], "i": "metadata/binary/installer/sfx::dialog-start", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.74" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 190.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 190.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.7200000286102295, "d": "WININIT rename section marker", "e": [ "Rename" ], "i": "micro-behaviors/fs/config/system::wininit-rename-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 190.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4608)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "runas elevation verb", "e": [ "runas" ], "i": "objectives/privilege-escalation/token-manipulation::runas-word", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.64)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00", "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "RENAMEDLG", "LICENSEDLG", "STARTDLG" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.9800000190734863, "d": "WinRAR SFX registry key", "e": [ "Software\\WinRAR SFX" ], "i": "metadata/binary/installer/sfx::registry-key", "l": 1 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.23" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "Extracting files to %s folder$Extracting files to temporary folder", "Unknown encryption method in %s$The specified password is incorrect." ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 344064.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "94 a0 41 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 335.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 190.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 335.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "winrar", "WinRAR", "WINRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "a": "T1112", "c": 0.6499999761581421, "d": "Windows runas verb token", "e": [ "runas" ], "i": "objectives/impact/degrade/system::runas-verb-token", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 4596.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8500000238418579, "d": "Peek message (Unicode)", "e": [ "PeekMessageW" ], "i": "micro-behaviors/os/message/queue::peek-message-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 190.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.699999988079071, "d": "Get file information and icon", "e": [ "SHGetFileInfoW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-file-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.74" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 335.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "d0 a1 41 00", "38 a2 41 00", "a4 a1 41 00", "d0 a1 41 00", "d0 a1 41 00", "d0 a1 41 00", "38 a2 41 00", "d0 a1 41 00", "d0 a1 41 00", "d0 a1 41 00", "d0 a1 41 00", "d0 a1 41 00", "d0 a1 41 00", "d0 a1 41 00", "d0 a1 41 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "InitCommonControlsEx", "GetCurrentDirectoryW", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "GetModuleFileNameW", "GetCurrentProcessId", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "SetEnvironmentVariableW", "WideCharToMultiByte", "MultiByteToWideChar", "SetCurrentDirectoryW" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CLSIDFromString, CoCreateInstance, OleInitialize, OleUninitialize, CreateStreamOnHGlobal)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetDeviceCaps, CreateCompatibleDC, GetObjectW, CreateCompatibleBitmap, SelectObject, ... +3 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey, RegOpenKeyExW, RegQueryValueExW, RegCreateKeyExW, RegSetValueExW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 8)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (EnableWindow, GetDlgItem, MessageBoxW, ShowWindow, FindWindowExW, ... +47 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHBrowseForFolderW, SHGetMalloc, SHChangeNotify, SHFileOperationW, SHGetFileInfoW, ... +3 more)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (InitCommonControlsEx)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (SHAutoComplete)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetFileAttributesW, SetFileAttributesW, MoveFileW, DeleteFileW, CreateDirectoryW, ... +104 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.800000011920929, "d": "Has file operation capabilities", "e": [ "FindFirstFileW", "MoveFileExW" ], "i": "objectives/impact/ransom/file-operations::has-file-operations", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathW", "MoveFileExW" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "FindFirstFileW", "CreateFileA", "SetFileTime", "CreateFileW", "GetModuleFileNameW", "GetModuleFileNameA", "WriteFile" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "RegisterClassExW", "CreateWindowExW", "GetMessageW", "DispatchMessageW", "DefWindowProcW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "d0 a1 41 00", "a4 a1 41 00", "GetTickCount", "38 a2 41 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindClose", "FindNextFileW", "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 190.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9700000286102295, "d": "WinRAR self-extractor footprint", "e": [ "Software\\WinRAR SFX", "STARTDLG" ], "i": "metadata/binary/installer/sfx::winrar-sfx-footprint", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExW", "RegCreateKeyExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "UnmapViewOfFile", "GetModuleFileNameW", "WriteFile", "ShellExecuteExW", "GetModuleFileNameA" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "3fb8f00a4644a2da45d2ceb6adba842d194948c20ac830ed809939710bc77e8c", "path": "64301!!Zip.SFX", "type": "pe" }, { "f": "KO₁₀(PrAlAs₈C₅CoEr₄I₃LaPXe)H₅(F₂Os₂Po₂Db₂Ds)Md₃(Bi₄Pa₂)", "x": 13, "dp": 1, "id": 23, "is": [ "GetLastError", "Sleep", "SetConsoleCtrlHandler", "SetLastError", "CreateHardLinkW", "CloseHandle", "GetCurrentProcess", "SetFileTime", "DeviceIoControl", "CreateFileW", "FindClose", "FindFirstFileW", "DeleteFileW", "RemoveDirectoryW", "CreateDirectoryW", "MoveFileW", "GetShortPathNameW", "GetLongPathNameW", "FlushFileBuffers", "SetFilePointer", "SetEndOfFile", "ReadFile", "GetDriveTypeW", "GetFileAttributesW", "SetFileAttributesW", "FindNextFileW", "SetErrorMode", "GetModuleFileNameW", "FreeLibrary", "GetProcAddress", "LoadLibraryW", "GetCurrentDirectoryW", "GetModuleHandleW", "CreateThread", "EnterCriticalSection", "LeaveCriticalSection", "WaitForSingleObject", "GetProcessAffinityMask", "ReleaseSemaphore", "ResetEvent", "DeleteCriticalSection", "SetEvent", "SetThreadPriority", "InitializeCriticalSection", "CreateEventW", "CreateSemaphoreW", "SystemTimeToFileTime", "GetSystemTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "GetCPInfo", "CreateFileA", "GetStringTypeW", "WriteFile", "WriteConsoleW", "SetConsoleMode", "ReadConsoleW", "GetStdHandle", "GetFileType", "GetCurrentProcessId", "GetConsoleMode", "RtlUnwind", "HeapFree", "HeapReAlloc", "HeapAlloc", "GetSystemTimeAsFileTime", "ExitProcess", "RaiseException", "GetCommandLineA", "TlsGetValue", "TlsAlloc", "TlsSetValue", "TlsFree", "InterlockedIncrement", "GetCurrentThreadId", "InterlockedDecrement", "HeapCreate", "VirtualFree", "VirtualAlloc", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "SetHandleCount", "GetStartupInfoA", "SetStdHandle", "GetConsoleCP", "HeapSize", "GetModuleFileNameA", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "GetACP", "GetOEMCP", "IsValidCodePage", "LCMapStringA", "LCMapStringW", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "WriteConsoleA", "GetConsoleOutputCP", "GetLocaleInfoA", "GetStringTypeA", "CharUpperW", "LoadStringW", "CharToOemA", "MessageBeep", "OemToCharBuffA", "OpenProcessToken", "LookupPrivilegeValueW", "AdjustTokenPrivileges", "SetFileSecurityW" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\rar\\build\\sfxcon32\\Release\\sfxcon.pdb", "rsrc_size": 31232.0, "subsystem": 3.0, "timestamp": 1368555987.0, "image_base": 4194304.0, "rsrc_entropy": 3.5, "entry_section": ".text", "size_of_image": 294912.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 3.0, "timestamp_year": 2013.0, "characteristics": 259.0, "entry_point_rva": 111340.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1368555987.0, "import_dll_count": 3.0, "manifest_present": true, "computed_checksum": 220110.0, "section_alignment": 4096.0, "number_of_sections": 4.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555987.0, "debug_timestamp_min": 1368555987.0, "dll_characteristics": 33024.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 142336.0, "file_size": 197120.0, "entry_point": 111340.0, "code_entropy": 6.71, "data_entropy": 3.9, "import_count": 120.0, "string_count": 597.0, "section_count": 4.0, "avg_complexity": 9.89, "function_count": 381.0, "import_density": 0.86, "max_complexity": 384.0, "string_density": 4.29, "overall_entropy": 4.5, "avg_basic_blocks": 15.48, "avg_section_size": 49024.0, "dependency_count": 3.0, "entropy_variance": 1.55, "function_density": 2.74, "avg_function_size": 291.9, "avg_string_length": 22.28, "complexity_per_kb": 0.07, "max_string_length": 244.0, "wide_string_count": 259.0, "writable_sections": 1.0, "avg_string_entropy": 3.31, "code_to_data_ratio": 2.65, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.16, "text_to_file_ratio": 0.72, "total_basic_blocks": 5896.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 21.22, "debug_reference_count": 1.0, "largest_section_ratio": 0.72, "sentence_string_count": 223.0, "sentence_string_ratio": 0.37, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0, "high_complexity_functions": 10.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".rsrc" ], [ 1997, "SVW3" ], [ 7056, "Udup" ], [ 10940, "SUVW" ], [ 19431, "YPVW" ], [ 19512, "YPWV" ], [ 28315, "QQSV" ], [ 42209, "W8]]tR8]ctMhLJB" ], [ 45702, "YWj\\_f9\u003euOf9~" ], [ 49499, "QQSUV" ], [ 50208, "N0WS" ], [ 59543, "SWWS" ], [ 62015, "QQSVW" ], [ 65043, "f98t" ], [ 68598, "QSVW" ], [ 77136, "FTSP" ], [ 103854, "AABB" ], [ 105920, "WVS3" ], [ 107248, "WVU3" ], [ 109834, "YYPV" ], [ 112688, "5DAB" ], [ 120706, "RPSW" ], [ 130204, "5LAB" ], [ 130359, "5TAB" ], [ 134341, "UQPXY]Y[" ], [ 134371, "URPQQhd" ], [ 134598, "UVWS" ], [ 139359, "WWWWV" ], [ 143984, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 144316, "wide", "%d.%02d %ls %d" ], [ 144376, "wide", "[%c]%ls" ], [ 144428, "wide", "SeRestorePrivilege" ], [ 144468, "wide", "SeSecurityPrivilege" ], [ 144540, "wide", "SeCreateSymbolicLinkPrivilege" ], [ 144704, "wide", "%.*ls(%u)%ls" ], [ 144732, "wide", "rtmp%d" ], [ 144764, "bad allocation" ], [ 144780, "wide", "%c%c%c%c%c%c%c" ], [ 144812, "wide", "%c%c%c%c%c%c%c%c%c" ], [ 144988, "wide", "%c%10ls %9ls" ], [ 145052, "wide", "Unix owner" ], [ 145136, "wide", "%12ls: RAR %ls(v%d) -m%d -md=%d%s" ], [ 145232, "wide", "Unix" ], [ 145244, "wide", "Windows" ], [ 145260, "wide", "BLAKE2" ], [ 145276, "wide", "Pack-BLAKE2" ], [ 145300, "wide", "BLAKE2 MAC" ], [ 145352, "wide", "CRC32" ], [ 145388, "wide", "CRC32 MAC" ], [ 145844, "url", "!ls %9ls =%% \u0026ls %u" ], [ 145896, "wide", "%21ls %-14ls %u" ], [ 145936, "wide", "%21ls %9ls %3d%% %-25ls %u" ], [ 146016, "wide", "RAR 5" ], [ 146028, "wide", "RAR 4" ], [ 146040, "wide", "RAR 1.4" ], [ 146080, "wide", "__rar_" ], [ 146148, "wide", ".rar" ], [ 146224, "wide", "*messages***" ], [ 146252, "*messages***" ], [ 146292, "CryptUnprotectMemory" ], [ 146316, "CryptProtectMemory" ], [ 146336, "wide", "Crypt32.dll" ], [ 146360, "wide", "CryptUnprotectMemory failed" ], [ 146416, "wide", "CryptProtectMemory failed" ], [ 146728, "SetDllDirectoryW" ], [ 146748, "wide", "kernel32" ], [ 146768, "wide", "CreateThread failed" ], [ 146808, "wide", "WaitForMultipleObjects error %d, GetLastError %d" ], [ 146912, "wide", "Thread pool initialization failed." ], [ 147104, "wide", "%02u-%02u-%u %02u:%02u" ], [ 147152, "wide", "%u-%02u-%02u %02u:%02u,%03u" ], [ 147252, "CorExitProcess" ], [ 147268, "wide", "mscoree.dll" ], [ 147344, "Unknown exception" ], [ 147380, "bad exception" ], [ 147396, "EncodePointer" ], [ 147412, "wide", "KERNEL32.DLL" ], [ 147440, "DecodePointer" ], [ 147456, "FlsFree" ], [ 147464, "FlsSetValue" ], [ 147476, "FlsGetValue" ], [ 147488, "FlsAlloc" ], [ 147500, "runtime error" ], [ 147520, "TLOSS error" ], [ 147536, "SING error" ], [ 147552, "DOMAIN error" ], [ 147568, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 147575, "An application has made an attempt to load the C runtime library incorrectly." ], [ 147653, "Please contact the application's support team for more information." ], [ 147728, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 147735, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 147815, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 147976, "R6032\r\n- not enough space for locale information" ], [ 147983, "- not enough space for locale information" ], [ 148032, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 148039, "- Attempt to initialize the CRT more than once." ], [ 148087, "This indicates a bug in your application." ], [ 148132, "R6030\r\n- CRT not initialized" ], [ 148139, "- CRT not initialized" ], [ 148164, "R6028\r\n- unable to initialize heap" ], [ 148171, "- unable to initialize heap" ], [ 148204, "R6027\r\n- not enough space for lowio initialization" ], [ 148211, "- not enough space for lowio initialization" ], [ 148260, "R6026\r\n- not enough space for stdio initialization" ], [ 148267, "- not enough space for stdio initialization" ], [ 148316, "R6025\r\n- pure virtual function call" ], [ 148323, "- pure virtual function call" ], [ 148356, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 148363, "- not enough space for _onexit/atexit table" ], [ 148412, "R6019\r\n- unable to open console device" ], [ 148419, "- unable to open console device" ], [ 148456, "R6018\r\n- unexpected heap error" ], [ 148463, "- unexpected heap error" ], [ 148492, "R6017\r\n- unexpected multithread lock error" ], [ 148499, "- unexpected multithread lock error" ], [ 148540, "R6016\r\n- not enough space for thread data" ], [ 148547, "- not enough space for thread data" ], [ 148584, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 148586, "This application has requested the Runtime to terminate it in an unusual way." ], [ 148736, "R6009\r\n- not enough space for environment" ], [ 148743, "- not enough space for environment" ], [ 148780, "R6008\r\n- not enough space for arguments" ], [ 148787, "- not enough space for arguments" ], [ 148824, "R6002\r\n- floating point support not loaded" ], [ 148831, "- floating point support not loaded" ], [ 148872, "Microsoft Visual C++ Runtime Library" ], [ 148920, "\u003cprogram name unknown\u003e" ], [ 148944, "Runtime Error!\n\nProgram:" ], [ 149127, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 149238, "wide", "C(null)" ], [ 149256, "(null)" ], [ 149305, "700WP" ], [ 149321, "`h````" ], [ 149406, "700PP" ], [ 149452, "GetProcessWindowStation" ], [ 149476, "GetUserObjectInformationA" ], [ 149504, "GetLastActivePopup" ], [ 149524, "GetActiveWindow" ], [ 149540, "MessageBoxA" ], [ 149552, "USER32.DLL" ], [ 149564, "Complete Object Locator'" ], [ 149592, "Class Hierarchy Descriptor'" ], [ 149624, "Base Class Array'" ], [ 149644, "Base Class Descriptor at (" ], [ 149672, "Type Descriptor'" ], [ 149692, "`local static thread guard'" ], [ 149720, "`managed vector copy constructor iterator'" ], [ 149764, "`vector vbase copy constructor iterator'" ], [ 149808, "`vector copy constructor iterator'" ], [ 149844, "`dynamic atexit destructor for '" ], [ 149880, "`dynamic initializer for '" ], [ 149908, "`eh vector vbase copy constructor iterator'" ], [ 149952, "`eh vector copy constructor iterator'" ], [ 149992, "`managed vector destructor iterator'" ], [ 150032, "`managed vector constructor iterator'" ], [ 150072, "`placement delete[] closure'" ], [ 150104, "`placement delete closure'" ], [ 150132, "`omni callsig'" ], [ 150148, "delete[]" ], [ 150168, "`local vftable constructor closure'" ], [ 150204, "`local vftable'" ], [ 150232, "`udt returning'" ], [ 150248, "`copy constructor closure'" ], [ 150276, "`eh vector vbase constructor iterator'" ], [ 150316, "`eh vector destructor iterator'" ], [ 150348, "`eh vector constructor iterator'" ], [ 150384, "`virtual displacement map'" ], [ 150412, "`vector vbase constructor iterator'" ], [ 150448, "`vector destructor iterator'" ], [ 150480, "`vector constructor iterator'" ], [ 150512, "`scalar deleting destructor'" ], [ 150544, "`default constructor closure'" ], [ 150576, "`vector deleting destructor'" ], [ 150608, "`vbase destructor'" ], [ 150640, "`local static guard'" ], [ 150832, "operator" ], [ 150868, "delete" ], [ 150884, "__unaligned" ], [ 150896, "__restrict" ], [ 150916, "__clrcall" ], [ 150928, "__fastcall" ], [ 150940, "__thiscall" ], [ 150952, "__stdcall" ], [ 150964, "__pascal" ], [ 150976, "__cdecl" ], [ 152154, "wide", "h(((( H" ], [ 152832, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 153216, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 153452, "dddd, MMMM dd, yyyy" ], [ 153472, "MM/dd/yy" ], [ 153492, "December" ], [ 153504, "November" ], [ 153516, "October" ], [ 153524, "September" ], [ 153536, "August" ], [ 153544, "July" ], [ 153552, "June" ], [ 153560, "April" ], [ 153568, "March" ], [ 153576, "February" ], [ 153588, "January" ], [ 153644, "Saturday" ], [ 153656, "Friday" ], [ 153664, "Thursday" ], [ 153676, "Wednesday" ], [ 153688, "Tuesday" ], [ 153696, "Monday" ], [ 153704, "Sunday" ], [ 153748, "SunMonTueWedThuFriSat" ], [ 153772, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 153888, "RSDS5" ], [ 153912, "d:\\Projects\\WinRAR\\rar\\build\\sfxcon32\\Release\\sfxcon.pdb" ], [ 158466, "GetConsoleMode" ], [ 158484, "GetFileType" ], [ 158498, "GetStdHandle" ], [ 158514, "ReadConsoleW" ], [ 158530, "SetConsoleMode" ], [ 158548, "WriteConsoleW" ], [ 158564, "WriteFile" ], [ 158576, "GetCurrentDirectoryW" ], [ 158600, "GetLastError" ], [ 158616, "Sleep" ], [ 158624, "SetConsoleCtrlHandler" ], [ 158648, "SetLastError" ], [ 158664, "CreateHardLinkW" ], [ 158682, "CloseHandle" ], [ 158696, "GetCurrentProcess" ], [ 158716, "SetFileTime" ], [ 158730, "DeviceIoControl" ], [ 158748, "CreateFileW" ], [ 158762, "FindClose" ], [ 158774, "FindFirstFileW" ], [ 158792, "DeleteFileW" ], [ 158806, "RemoveDirectoryW" ], [ 158826, "CreateDirectoryW" ], [ 158858, "GetShortPathNameW" ], [ 158878, "GetLongPathNameW" ], [ 158898, "FlushFileBuffers" ], [ 158918, "SetFilePointer" ], [ 158936, "SetEndOfFile" ], [ 158952, "ReadFile" ], [ 158964, "GetDriveTypeW" ], [ 158980, "GetFileAttributesW" ], [ 159002, "SetFileAttributesW" ], [ 159024, "FindNextFileW" ], [ 159040, "SetErrorMode" ], [ 159056, "GetModuleFileNameW" ], [ 159078, "FreeLibrary" ], [ 159092, "GetProcAddress" ], [ 159110, "LoadLibraryW" ], [ 159126, "GetCurrentProcessId" ], [ 159148, "GetModuleHandleW" ] ], "sz": 197120, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 381.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "\u003cCommands\u003e", "\u003cSwitches\u003e", "L\n ri\u003cP\u003e[:\u003cS\u003e] Set priority (0-default,1-min..15-max) and sleep time in ms", "M\n ta\u003cdate\u003e Process files modified after \u003cdate\u003e in YYYYMMDDHHMMSS format", "N\n tb\u003cdate\u003e Process files modified before \u003cdate\u003e in YYYYMMDDHHMMSS format" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 120.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeW" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\rar\\build\\sfxcon32\\Release\\sfxcon.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555987.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 120.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "password keyword", "e": [ "p[password] Set password", "#Enter password (will not be echoed)", "ERROR: Passwords do not match", "%s - use current password ?", "I\nChecksum error in the encrypted file %s. Corrupt file or wrong password.", "Reenter password:" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "\u0026Corrupt archive - use 'Repair' command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Derived string condition", "e": [ "cannot recover data" ], "i": "objectives/impact/ransom/encrypt/threat-text::inline__data-loss-threat__any_3", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.89" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.31" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "sfxcon.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 259.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 197120.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/command-and-control/backdoor/binary::plaintext-sleep-command-token", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 597.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.50" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 120.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 120.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 120.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4608)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.71)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00", "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.37" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 294912.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 381.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 120.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 381.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "WINRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 5896.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 120.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.50" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 381.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1091", "c": 0.8799999952316284, "d": "Windows drive type query", "e": [ "GetDriveTypeW" ], "i": "objectives/lateral-movement/usb-worm/drive-infector::vb6-get-drive-type-w", "l": 1, "m": "B0017" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "10 41 42 00", "14 40 42 00", "38 40 42 00", "10 41 42 00", "6c 40 42 00", "14 40 42 00", "14 40 42 00", "14 40 42 00", "a4 40 42 00", "14 40 42 00", "14 40 42 00", "14 40 42 00", "14 40 42 00", "14 40 42 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetCurrentDirectoryW", "SetConsoleCtrlHandler", "GetModuleFileNameW", "GetCurrentProcessId", "GetProcessAffinityMask", "InitializeCriticalSection", "SystemTimeToFileTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.949999988079071, "d": "links USER32.dll (CharUpperW, LoadStringW, CharToOemA, MessageBeep, OemToCharBuffA)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetLastError, Sleep, SetConsoleCtrlHandler, SetLastError, CreateHardLinkW, ... +106 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, SetFileSecurityW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "CreateFileW", "ReadFile", "DeviceIoControl", "CreateFileA" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "VS_VERSION_INFO", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "GetModuleFileNameA", "SetFileTime", "GetModuleFileNameW", "FindFirstFileW", "WriteFile", "CreateFileA", "CreateFileW" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "GetTickCount", "a4 40 42 00", "38 40 42 00", "14 40 42 00", "6c 40 42 00", "10 41 42 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindClose", "FindFirstFileW", "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 120.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameW", "GetModuleFileNameA", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "binary.sentence_string_ratio = 0.37", "binary.import_count = 120.00", "H\nUsage: unrar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "F\nUsage: rar \u003ccommand\u003e -\u003cswitch 1\u003e -\u003cswitch N\u003e \u003carchive\u003e \u003cfiles...\u003e", "binary.function_count = 381.00" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueW", "OpenProcessToken", "AdjustTokenPrivileges" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "Sleep", "SetConsoleCtrlHandler", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindNextFileW", "FindFirstFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "57ac0dc9216d4db6732770dd85dd0b593683fe817805423fc296e0cf693dad62", "path": "64301!!WinCon.SFX", "type": "pe" }, { "f": "KO₆(As₉C₃Er₅I₃PXe)H₄(F₄Os₃Po₃Ds)Md₃(Bi₄)", "x": 15, "dp": 1, "id": 24, "is": [ "ShellExecuteA", "ShellExecuteExA", "AllocConsole", "CloseHandle", "CreateDirectoryA", "CreateFileA", "CreateProcessA", "DeleteFileA", "DeviceIoControl", "DisableThreadLibraryCalls", "DosDateTimeToFileTime", "ExitProcess", "ExitThread", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "FileTimeToSystemTime", "FillConsoleOutputAttribute", "FillConsoleOutputCharacterA", "FindClose", "FindFirstFileA", "FindNextFileA", "FlushFileBuffers", "FreeConsole", "GetCommandLineA", "GetConsoleCursorInfo", "GetConsoleScreenBufferInfo", "GetCurrentDirectoryA", "GetCurrentProcess", "GetDiskFreeSpaceA", "GetDriveTypeA", "GetEnvironmentStrings", "GetEnvironmentVariableA", "GetExitCodeProcess", "GetFileAttributesA", "GetFileInformationByHandle", "GetFileTime", "GetFileType", "GetFullPathNameA", "GetLastError", "GetLocalTime", "GetModuleFileNameA", "GetModuleHandleA", "GetProcAddress", "GetShortPathNameA", "GetStartupInfoA", "GetStdHandle", "GetSystemTime", "GetTempPathA", "GetTimeZoneInformation", "GetVersion", "GetVolumeInformationA", "GlobalMemoryStatus", "HeapAlloc", "HeapCreate", "HeapDestroy", "HeapFree", "HeapReAlloc", "HeapSize", "LCMapStringA", "LoadLibraryA", "LocalFileTimeToFileTime", "MoveFileA", "PeekConsoleInputA", "ReadConsoleInputA", "ReadConsoleOutputAttribute", "ReadConsoleOutputA", "ReadFile", "RemoveDirectoryA", "ScrollConsoleScreenBufferA", "SearchPathA", "SetConsoleCtrlHandler", "SetConsoleCursorInfo", "SetConsoleCursorPosition", "SetConsoleScreenBufferSize", "SetConsoleWindowInfo", "SetCurrentDirectoryA", "SetEndOfFile", "SetEnvironmentVariableA", "SetFileAttributesA", "SetFilePointer", "SetFileTime", "SetHandleCount", "SetStdHandle", "Sleep", "SystemTimeToFileTime", "TerminateProcess", "VirtualAlloc", "VirtualFree", "WaitForSingleObject", "WriteConsoleOutputA", "WriteConsoleOutputCharacterA", "WriteFile", "RegCloseKey", "RegCreateKeyA", "RegOpenKeyExA", "RegQueryValueExA", "RegSetValueExA", "CreateFontA", "DeleteObject", "CharToOemBuffA", "CreateDialogParamA", "DestroyWindow", "DialogBoxParamA", "DispatchMessageA", "EnableWindow", "EndDialog", "GetDlgItem", "GetDlgItemTextA", "GetKeyState", "GetWindowTextA", "KillTimer", "LoadBitmapA", "LoadCursorA", "LoadIconA", "LoadImageA", "MessageBeep", "MessageBoxA", "OemToCharBuffA", "PeekMessageA", "SendDlgItemMessageA", "SetCursor", "SetDlgItemTextA", "SetFocus", "SetTimer", "SetWindowTextA", "ShowCursor", "ShowWindow", "TranslateMessage" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1125070881.0, "image_base": 4194304.0, "rsrc_entropy": 2.62, "entry_section": "AUTO", "size_of_image": 307200.0, "timestamp_day": 26.0, "file_alignment": 512.0, "resource_count": 1.0, "timestamp_year": 2005.0, "characteristics": 8578.0, "entry_point_rva": 27894.0, "size_of_headers": 1024.0, "timestamp_month": 8.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 5.0, "computed_checksum": 82415.0, "dos_stub_modified": true, "section_alignment": 4096.0, "number_of_sections": 7.0, "resource_timestamp": 1125070881.0, "linker_major_version": 2.0, "linker_minor_version": 18.0, "version_info_present": true, "api_hashing_indicators": 1.0, "resource_timestamp_day": 26.0, "resource_timestamp_year": 2005.0, "export_timestamp_present": false, "resource_timestamp_month": 8.0, "resource_timestamp_present": true, "entry_in_nonstandard_section": true }, "binary": { "code_size": 60928.0, "file_size": 77312.0, "entry_point": 27894.0, "code_entropy": 6.65, "data_entropy": 3.59, "export_count": 6.0, "import_count": 128.0, "string_count": 261.0, "section_count": 7.0, "avg_complexity": 3.86, "function_count": 35.0, "import_density": 2.15, "max_complexity": 18.0, "string_density": 4.39, "overall_entropy": 4.75, "avg_basic_blocks": 5.54, "avg_section_size": 41691.43, "dependency_count": 5.0, "entropy_variance": 1.76, "function_density": 0.59, "avg_function_size": 89.86, "avg_string_length": 16.43, "complexity_per_kb": 0.06, "max_string_length": 76.0, "wide_string_count": 17.0, "writable_sections": 3.0, "avg_string_entropy": 3.14, "code_to_data_ratio": 0.26, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "total_basic_blocks": 194.0, "executable_sections": 1.0, "string_length_stddev": 11.74, "largest_section_ratio": 2.79, "sentence_string_count": 37.0, "sentence_string_ratio": 0.14, "behavioral_import_ratio": 0.05, "function_analysis_depth": 2.0, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 77, "!this is a Windows NT (own RTL) dynamic link library" ], [ 392, "AUTO" ], [ 472, "DGROUP" ], [ 512, ".bss" ], [ 552, ".edata" ], [ 591, "@.reloc" ], [ 631, "B.rsrc" ], [ 1468, "WVIDEO" ], [ 2022, "SQVW" ], [ 2333, "SQRV" ], [ 3383, "SQRVW" ], [ 4526, "SQR1" ], [ 4774, "SQRV1" ], [ 16318, "PSWR" ], [ 22383, "PSWV" ], [ 24827, "Copyright by ACE Compression Software (1998-2000). U" ], [ 25558, "5X2A" ], [ 29332, "UPSQRVW" ], [ 30148, "USQRVW" ], [ 30226, "UWSP" ], [ 30364, "UWVRSP" ], [ 30536, "WRQSP" ], [ 30675, "PSQRVWU" ], [ 30683, "5TZA" ], [ 30692, "5HZA" ], [ 31071, "PSQRU" ], [ 31250, "SQRUVWR" ], [ 31305, "5P2A" ], [ 31604, "SQRW1" ], [ 31786, "SQRW" ], [ 32206, "PSQRWV" ], [ 32680, "USQRWV" ], [ 32805, "PSQW" ], [ 49692, "SQRU" ], [ 52508, "PSQRVW" ], [ 59010, "PSRS" ], [ 63136, "SHELL32.DLL" ], [ 63148, "KERNEL32.DLL" ], [ 63161, "ADVAPI32.DLL" ], [ 63174, "GDI32.DLL" ], [ 63184, "USER32.DLL" ], [ 63198, "ShellExecuteA" ], [ 63214, "ShellExecuteExA" ], [ 63232, "AllocConsole" ], [ 63248, "CloseHandle" ], [ 63262, "CreateDirectoryA" ], [ 63282, "CreateFileA" ], [ 63296, "CreateProcessA" ], [ 63314, "DeleteFileA" ], [ 63328, "DeviceIoControl" ], [ 63346, "DisableThreadLibraryCalls" ], [ 63374, "DosDateTimeToFileTime" ], [ 63398, "ExitProcess" ], [ 63412, "ExitThread" ], [ 63426, "FileTimeToDosDateTime" ], [ 63450, "FileTimeToLocalFileTime" ], [ 63476, "FileTimeToSystemTime" ], [ 63500, "FillConsoleOutputAttribute" ], [ 63530, "FillConsoleOutputCharacterA" ], [ 63560, "FindClose" ], [ 63572, "FindFirstFileA" ], [ 63590, "FindNextFileA" ], [ 63606, "FlushFileBuffers" ], [ 63626, "FreeConsole" ], [ 63640, "GetCommandLineA" ], [ 63658, "GetConsoleCursorInfo" ], [ 63682, "GetConsoleScreenBufferInfo" ], [ 63712, "GetCurrentDirectoryA" ], [ 63736, "GetCurrentProcess" ], [ 63756, "GetDiskFreeSpaceA" ], [ 63776, "GetDriveTypeA" ], [ 63792, "GetEnvironmentStrings" ], [ 63816, "GetEnvironmentVariableA" ], [ 63842, "GetExitCodeProcess" ], [ 63864, "GetFileAttributesA" ], [ 63886, "GetFileInformationByHandle" ], [ 63916, "GetFileTime" ], [ 63930, "GetFileType" ], [ 63944, "GetFullPathNameA" ], [ 63964, "GetLastError" ], [ 63980, "GetLocalTime" ], [ 63996, "GetModuleFileNameA" ], [ 64018, "GetModuleHandleA" ], [ 64038, "GetProcAddress" ], [ 64056, "GetShortPathNameA" ], [ 64076, "GetStartupInfoA" ], [ 64094, "GetStdHandle" ], [ 64110, "GetSystemTime" ], [ 64126, "GetTempPathA" ], [ 64142, "GetTimeZoneInformation" ], [ 64168, "GetVersion" ], [ 64182, "GetVolumeInformationA" ], [ 64206, "GlobalMemoryStatus" ], [ 64228, "HeapAlloc" ], [ 64240, "HeapCreate" ], [ 64254, "HeapDestroy" ], [ 64268, "HeapFree" ], [ 64280, "HeapReAlloc" ], [ 64294, "HeapSize" ], [ 64306, "LCMapStringA" ], [ 64322, "LoadLibraryA" ], [ 64338, "LocalFileTimeToFileTime" ], [ 64376, "PeekConsoleInputA" ], [ 64396, "ReadConsoleInputA" ], [ 64416, "ReadConsoleOutputAttribute" ], [ 64446, "ReadConsoleOutputA" ], [ 64468, "ReadFile" ], [ 64480, "RemoveDirectoryA" ], [ 64500, "ScrollConsoleScreenBufferA" ], [ 64530, "SearchPathA" ], [ 64544, "SetConsoleCtrlHandler" ], [ 64568, "SetConsoleCursorInfo" ], [ 64592, "SetConsoleCursorPosition" ], [ 64620, "SetConsoleScreenBufferSize" ], [ 64650, "SetConsoleWindowInfo" ], [ 64674, "SetCurrentDirectoryA" ], [ 64698, "SetEndOfFile" ], [ 64714, "SetEnvironmentVariableA" ], [ 64740, "SetFileAttributesA" ], [ 64762, "SetFilePointer" ], [ 64780, "SetFileTime" ], [ 64794, "SetHandleCount" ], [ 64812, "SetStdHandle" ], [ 64828, "Sleep" ], [ 64836, "SystemTimeToFileTime" ], [ 64860, "TerminateProcess" ], [ 64880, "VirtualAlloc" ], [ 64896, "VirtualFree" ], [ 64910, "WaitForSingleObject" ], [ 64932, "WriteConsoleOutputA" ], [ 64954, "WriteConsoleOutputCharacterA" ], [ 64986, "WriteFile" ], [ 64998, "RegCloseKey" ], [ 65012, "RegCreateKeyA" ], [ 65028, "RegOpenKeyExA" ], [ 65044, "RegQueryValueExA" ], [ 65064, "RegSetValueExA" ], [ 65082, "CreateFontA" ], [ 65096, "DeleteObject" ], [ 65112, "CharToOemBuffA" ], [ 65130, "CreateDialogParamA" ], [ 65152, "DestroyWindow" ], [ 65168, "DialogBoxParamA" ], [ 65186, "DispatchMessageA" ], [ 65206, "EnableWindow" ], [ 65222, "EndDialog" ], [ 65248, "GetDlgItemTextA" ], [ 65266, "GetKeyState" ], [ 65280, "GetWindowTextA" ], [ 65298, "KillTimer" ], [ 65310, "LoadBitmapA" ], [ 65324, "LoadCursorA" ], [ 65350, "LoadImageA" ], [ 65364, "MessageBeep" ], [ 65378, "MessageBoxA" ], [ 65392, "OemToCharBuffA" ], [ 65410, "PeekMessageA" ], [ 65426, "SendDlgItemMessageA" ], [ 65448, "SetCursor" ], [ 65460, "SetDlgItemTextA" ], [ 65478, "SetFocus" ], [ 65490, "SetTimer" ], [ 65502, "SetWindowTextA" ], [ 65520, "ShowCursor" ], [ 65534, "ShowWindow" ], [ 65548, "TranslateMessage" ], [ 66048, "undefined member function called through debug information!" ], [ 66108, "undefined constructor or destructor called!" ], [ 66152, ".exe" ], [ 66157, ".cmd" ], [ 66162, ".bat" ], [ 66167, ".com" ], [ 66179, "PATH" ], [ 66209, "(null)" ], [ 66242, "\u003cprogram name unknown\u003e" ], [ 66269, "Runtime Error!\n\nProgram:" ], [ 66298, "Microsoft Visual C++ Runtime Library" ], [ 66335, "R6008\r\n- not enough space for arguments" ], [ 66342, "- not enough space for arguments" ], [ 66377, "R6009\r\n- not enough space for environment" ], [ 66384, "- not enough space for environment" ], [ 66421, "abnormal program termination" ], [ 66454, "R6016\r\n- not enough space for thread data" ], [ 66461, "- not enough space for thread data" ], [ 66498, "R6017\r\n- unexpected multithread lock error" ], [ 66505, "- unexpected multithread lock error" ], [ 66543, "R6018\r\n- unexpected heap error" ], [ 66550, "- unexpected heap error" ], [ 66576, "R6019\r\n- unable to open console device" ], [ 66583, "- unable to open console device" ], [ 66617, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 66624, "- not enough space for _onexit/atexit table" ], [ 66670, "R6025\r\n- pure virtual function call" ], [ 66677, "- pure virtual function call" ], [ 66708, "R6026\r\n- not enough space for stdio initialization" ], [ 66715, "- not enough space for stdio initialization" ], [ 66761, "R6027\r\n- not enough space for lowio initialization" ], [ 66768, "- not enough space for lowio initialization" ], [ 66814, "R6028\r\n- unable to initialize heap" ], [ 66821, "- unable to initialize heap" ], [ 66851, "DOMAIN error" ], [ 66866, "SING error" ], [ 66879, "TLOSS error" ], [ 66896, "runtime error" ], [ 66911, "kernel32.dll" ], [ 66932, "*UNREGISTERED VERSION*" ], [ 67027, "128K" ], [ 67032, "256K" ], [ 67037, "512K" ], [ 67042, "1024K" ], [ 67048, "2048K" ], [ 67054, "4096K" ], [ 67100, ".ace" ], [ 67121, "this is just a small test *juk*..abcdefghijklmnop" ], [ 67175, "Software\\ACE Compression Software\\ActiveAce\\2.0" ], [ 67223, "Count" ], [ 67229, "Name" ], [ 67234, "Size" ], [ 67252, "NtQueryInformationFile" ], [ 67275, "ntdll.dll" ], [ 67285, "GetFileSecurityA" ], [ 67302, "advapi32.dll" ], [ 67315, "SetFileSecurityA" ], [ 67332, "GetDiskFreeSpaceExA" ], [ 67368, "Warning" ], [ 67376, "This is not a fully ACE compatible archive.\nTrying to decompress might fail." ], [ 67420, "Trying to decompress might fail." ], [ 67752, "SunMonTueWedThuFriSat" ], [ 67776, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 67889, "700WP" ], [ 67905, "`h````" ], [ 70184, "UNACEV2.DLL" ], [ 70256, "ACEExtract" ], [ 70267, "ACEInitDll" ], [ 70278, "ACEList" ], [ 70286, "ACEReadArchiveData" ], [ 70305, "ACETest" ], [ 70313, "___DllMainCRTStartup@12" ], [ 70729, "5.53595@5F5M5S5Z5`5" ], [ 71267, "42585" ], [ 72049, "61.229.61.6:210" ], [ 72183, "2)212\u003e2D2Z2`2f2l2r2}2" ], [ 72641, "63.16.63.22:4" ], [ 75031, "\u003c~\u003cx\u003cr\u003cl\u003cf\u003c`\u003cZ\u003cT\u003cN\u003cH\u003cB\u003c\u003c\u003c6\u003c0\u003c*\u003c$\u003c" ], [ 75870, "wide", "VS_VERSION_INFO" ], [ 75962, "wide", "StringFileInfo" ], [ 76022, "wide", "CompanyName" ], [ 76048, "wide", "ACE Compression Software" ], [ 76106, "wide", "FileDescription" ], [ 76140, "wide", "UNACE Dynamic Link Library" ], [ 76202, "wide", "FileVersion" ], [ 76250, "wide", "InternalName" ], [ 76276, "wide", "UnAceV2.Dll" ], [ 76306, "wide", "LegalCopyright" ], [ 76336, "wide", "ACE Compression Software, 2000-2005" ], [ 76414, "wide", "LegalTrademarks" ] ], "sz": 77312, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 35.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 128.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Query drive type by symbol", "e": [ "GetDriveTypeA" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type", "l": 2 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 2.79" ], "i": "metadata/binary/metrics::section-exceeds-file-size", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "d": "PATH environment variable", "e": [ "PATH" ], "i": "micro-behaviors/os/env/vars::path-var", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 1.0, "d": "Call to GetDriveTypeA by raw bytes", "e": [ "GetDriveTypeA" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type-raw", "l": 1 }, { "a": "T1059.003", "c": 0.8999999761581421, "d": "ShellExecuteExA ANSI extended API", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/system::shell-execute-ex-a", "l": 3, "m": "E1059.003" }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1125070881.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query volume information", "e": [ "GetVolumeInformationA" ], "i": "micro-behaviors/fs/enumerate/volume::get-volume-info", "l": 3 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 128.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 1.0, "d": ".bat extension", "e": [ ".bat" ], "i": "objectives/command-and-control/dropper/builder::bat-ext", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll", "ADVAPI32.DLL" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 2.79" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 3.86" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.14" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "Entry point in non-standard section", "e": [ "AUTO (size: 60928, entropy: 6.65, perms: r-x)" ], "i": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section", "l": 1, "m": "F0001" }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyA" ], "i": "micro-behaviors/os/registry/access::reg-create-key-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 77312.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".bat extension reference", "e": [ ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 261.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.75" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "DosDateTimeToFileTime", "LocalFileTimeToFileTime", "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 128.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceA", "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 128.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 128.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8500000238418579, "d": "FillConsoleOutputAttribute junk API import", "e": [ "FillConsoleOutputAttribute" ], "i": "objectives/anti-static/obfuscation/imports::fill-console-output-attribute-import", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 6.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileA" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextA" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 307200.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.699999988079071, "d": "GetConsoleScreenBufferInfo API", "e": [ "GetConsoleScreenBufferInfo" ], "i": "micro-behaviors/os/sysinfo/console::console-screen-buffer-info", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 128.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 35.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 128.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.75" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll virtual key state", "e": [ "GetKeyState" ], "i": "micro-behaviors/hardware/input/keyboard::get-key-state", "l": 2, "m": "E1056.001" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Compatibility alias", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex-a", "l": 1 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 2.79" ], "i": "objectives/anti-static/obfuscation/binary-metrics::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014" }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform::ntdll-dll-str", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 2.79" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 2.79" ], "i": "objectives/anti-static/obfuscation/payload::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextA" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "DisableThreadLibraryCalls", "DosDateTimeToFileTime", "FileTimeToDosDateTime", "FileTimeToLocalFileTime", "FileTimeToSystemTime", "FillConsoleOutputAttribute", "FillConsoleOutputCharacterA", "GetConsoleCursorInfo", "GetConsoleScreenBufferInfo", "GetCurrentDirectoryA", "GetEnvironmentVariableA", "GetModuleFileNameA", "GetTimeZoneInformation", "GetVolumeInformationA", "LocalFileTimeToFileTime", "ReadConsoleOutputAttribute" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.DLL (CreateFontA, DeleteObject)", "e": [ "GDI32.DLL" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.DLL (CharToOemBuffA, CreateDialogParamA, DestroyWindow, DialogBoxParamA, DispatchMessageA, ... +24 more)", "e": [ "USER32.DLL" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.DLL (RegCloseKey, RegCreateKeyA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA)", "e": [ "ADVAPI32.DLL" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.DLL (ShellExecuteA, ShellExecuteExA)", "e": [ "SHELL32.DLL" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (AllocConsole, CloseHandle, CreateDirectoryA, CreateFileA, CreateProcessA, ... +85 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8500000238418579, "d": "Drop and execute file from Temp directory", "e": [ "ShellExecuteA", "CreateProcessA", "GetTempPathA", "WriteFile" ], "i": "objectives/command-and-control/dropper/staging::temp-file-execution", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindFirstFileA", "FindNextFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "ReadFile", "CreateFileA", "DeviceIoControl" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1083", "c": 0.8600000143051147, "d": "Drive context switching via cwd APIs", "e": [ "GetDriveTypeA", "GetCurrentDirectoryA", "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::drive-context-switching", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExA", "RegCreateKeyA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegOpenKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1497.003", "c": 0.9100000262260437, "d": "Timer-gated key polling anti-analysis", "e": [ "KillTimer", "GetProcAddress", "SetTimer", "GetKeyState" ], "i": "objectives/anti-analysis/timing/evasion::ui-timer-keypoll-gate", "l": 2, "m": "B0003.003" } ], "sha": "c9d28800e740a1569aec8fe27df10ef186d883f94cec15a5c228826b45a24f9d", "path": "64301!!Formats/UNACEV2.DLL", "type": "pe" }, { "f": "KO₆(Al₂As₇C₂Er₇IXe)H₆(FPo₃CmDbDsMg)Md₃(Bi₄Pa)", "x": 9, "dp": 1, "id": 25, "is": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "SetFilePointer", "ReadFile", "CloseHandle", "CreateFileW", "HeapAlloc", "HeapFree", "DeleteFileW", "CreateDirectoryW", "SetFileAttributesW", "SetFileTime", "HeapDestroy", "FreeLibrary", "HeapCreate", "GetProcAddress", "LoadLibraryW", "GetLastError", "MultiByteToWideChar", "WriteFile", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "GetFileType", "GetCurrentThreadId", "FlsSetValue", "GetCommandLineA", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "HeapSetInformation", "GetModuleHandleW", "Sleep", "ExitProcess", "GetStdHandle", "GetModuleFileNameA", "SetHandleCount", "GetStartupInfoA", "DeleteCriticalSection", "RtlUnwindEx", "SetStdHandle", "EnterCriticalSection", "LeaveCriticalSection", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "EncodePointer", "DecodePointer", "FlsGetValue", "FlsFree", "SetLastError", "FlsAlloc", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "SetEndOfFile", "GetProcessHeap", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "HeapReAlloc", "CreateFileA", "LCMapStringA", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "HeapSize" ], "ms": { "pe": { "machine": 34404.0, "checksum": 92656.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\cab\\build\\64\\Release\\cab.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368555992.0, "image_base": 6442450944.0, "rsrc_entropy": 4.58, "entry_section": ".text", "size_of_image": 110592.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8226.0, "entry_point_rva": 19996.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1368555992.0, "import_dll_count": 1.0, "manifest_present": true, "computed_checksum": 92656.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555992.0, "debug_timestamp_min": 1368555992.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 41472.0, "file_size": 61952.0, "entry_point": 19996.0, "code_entropy": 6.33, "data_entropy": 3.87, "export_count": 6.0, "import_count": 81.0, "string_count": 227.0, "section_count": 6.0, "avg_complexity": 10.43, "function_count": 161.0, "import_density": 2.0, "max_complexity": 20.0, "string_density": 5.6, "overall_entropy": 4.06, "avg_basic_blocks": 16.29, "avg_section_size": 10154.67, "dependency_count": 1.0, "entropy_variance": 1.61, "function_density": 3.98, "avg_function_size": 422.14, "avg_string_length": 24.54, "complexity_per_kb": 0.26, "max_string_length": 417.0, "wide_string_count": 19.0, "writable_sections": 1.0, "avg_string_entropy": 3.3, "code_to_data_ratio": 2.13, "data_to_file_ratio": 0.07, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.67, "total_basic_blocks": 114.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 37.92, "debug_reference_count": 1.0, "largest_section_ratio": 0.67, "sentence_string_count": 47.0, "sentence_string_ratio": 0.21, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".pdata" ], [ 663, "@.rsrc" ], [ 703, "@.reloc" ], [ 1253, "UVWH" ], [ 1978, "\\$ UVWATAUAVAW" ], [ 5092, "t$ WATAUAVAW" ], [ 7869, "SUVWATAUAVAWH" ], [ 8332, "D09A" ], [ 9460, "D19K" ], [ 9794, "WATAUAVAWH" ], [ 13419, "UVWATAUAVAWH" ], [ 22239, "AUAVAWH" ], [ 25573, "UVWATAUH" ], [ 27921, "x ATAUAWH" ], [ 28514, "WATAUH" ], [ 29373, "x ATAUAVH" ], [ 31991, "ATAUAVH" ], [ 33342, "VWATAUAVH" ], [ 35640, "@UATAUAVAWH" ], [ 37138, "L$ UATAUAVAWH" ], [ 39772, "@USVWATAUAVAWH" ], [ 40390, "M0H3" ], [ 43288, "wide", "Windows" ], [ 43312, "FDIDestroy" ], [ 43328, "FDICopy" ], [ 43336, "FDIIsCabinet" ], [ 43352, "FDICreate" ], [ 43368, "wide", "cabinet.dll" ], [ 43392, "wide", "CABINET" ], [ 43432, "CorExitProcess" ], [ 43448, "wide", "mscoree.dll" ], [ 43472, "runtime error" ], [ 43496, "TLOSS error" ], [ 43512, "SING error" ], [ 43528, "DOMAIN error" ], [ 43552, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 43559, "An application has made an attempt to load the C runtime library incorrectly." ], [ 43637, "Please contact the application's support team for more information." ], [ 43712, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 43719, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 43799, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 43960, "R6032\r\n- not enough space for locale information" ], [ 43967, "- not enough space for locale information" ], [ 44016, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 44023, "- Attempt to initialize the CRT more than once." ], [ 44071, "This indicates a bug in your application." ], [ 44120, "R6030\r\n- CRT not initialized" ], [ 44127, "- CRT not initialized" ], [ 44152, "R6028\r\n- unable to initialize heap" ], [ 44159, "- unable to initialize heap" ], [ 44192, "R6027\r\n- not enough space for lowio initialization" ], [ 44199, "- not enough space for lowio initialization" ], [ 44248, "R6026\r\n- not enough space for stdio initialization" ], [ 44255, "- not enough space for stdio initialization" ], [ 44304, "R6025\r\n- pure virtual function call" ], [ 44311, "- pure virtual function call" ], [ 44344, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 44351, "- not enough space for _onexit/atexit table" ], [ 44400, "R6019\r\n- unable to open console device" ], [ 44407, "- unable to open console device" ], [ 44448, "R6018\r\n- unexpected heap error" ], [ 44455, "- unexpected heap error" ], [ 44488, "R6017\r\n- unexpected multithread lock error" ], [ 44495, "- unexpected multithread lock error" ], [ 44536, "R6016\r\n- not enough space for thread data" ], [ 44543, "- not enough space for thread data" ], [ 44592, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 44594, "This application has requested the Runtime to terminate it in an unusual way." ], [ 44744, "R6009\r\n- not enough space for environment" ], [ 44751, "- not enough space for environment" ], [ 44792, "R6008\r\n- not enough space for arguments" ], [ 44799, "- not enough space for arguments" ], [ 44840, "R6002\r\n- floating point support not loaded" ], [ 44847, "- floating point support not loaded" ], [ 44888, "Microsoft Visual C++ Runtime Library" ], [ 44936, "\u003cprogram name unknown\u003e" ], [ 44960, "Runtime Error!\n\nProgram:" ], [ 45023, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 45280, "GetProcessWindowStation" ], [ 45304, "GetUserObjectInformationA" ], [ 45336, "GetLastActivePopup" ], [ 45360, "GetActiveWindow" ], [ 45376, "MessageBoxA" ], [ 45392, "USER32.DLL" ], [ 46194, "wide", "h(((( H" ], [ 46880, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 47264, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 47504, "dddd, MMMM dd, yyyy" ], [ 47528, "MM/dd/yy" ], [ 47552, "December" ], [ 47568, "November" ], [ 47584, "October" ], [ 47592, "September" ], [ 47604, "August" ], [ 47612, "July" ], [ 47620, "June" ], [ 47628, "April" ], [ 47636, "March" ], [ 47648, "February" ], [ 47664, "January" ], [ 47720, "Saturday" ], [ 47732, "Friday" ], [ 47744, "Thursday" ], [ 47760, "Wednesday" ], [ 47776, "Tuesday" ], [ 47784, "Monday" ], [ 47792, "Sunday" ], [ 47832, "SunMonTueWedThuFriSat" ], [ 47856, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 47920, "d:\\Projects\\WinRAR\\FormatSrc\\cab\\build\\64\\Release\\cab.pdb" ], [ 49938, "10.48.1.15:3634" ], [ 50762, "LocalFileTimeToFileTime" ], [ 50788, "DosDateTimeToFileTime" ], [ 50812, "SetFilePointer" ], [ 50830, "ReadFile" ], [ 50842, "CloseHandle" ], [ 50856, "CreateFileW" ], [ 50870, "HeapAlloc" ], [ 50882, "HeapFree" ], [ 50894, "DeleteFileW" ], [ 50908, "CreateDirectoryW" ], [ 50928, "SetFileAttributesW" ], [ 50950, "SetFileTime" ], [ 50964, "HeapDestroy" ], [ 50978, "FreeLibrary" ], [ 50992, "HeapCreate" ], [ 51006, "GetProcAddress" ], [ 51024, "LoadLibraryW" ], [ 51038, "KERNEL32.dll" ], [ 51054, "GetLastError" ], [ 51070, "MultiByteToWideChar" ], [ 51092, "WriteFile" ], [ 51104, "WideCharToMultiByte" ], [ 51126, "GetConsoleCP" ], [ 51142, "GetConsoleMode" ], [ 51160, "GetFileType" ], [ 51174, "GetCurrentThreadId" ], [ 51196, "FlsSetValue" ], [ 51210, "GetCommandLineA" ], [ 51228, "TerminateProcess" ], [ 51248, "GetCurrentProcess" ], [ 51268, "UnhandledExceptionFilter" ], [ 51296, "SetUnhandledExceptionFilter" ], [ 51326, "IsDebuggerPresent" ], [ 51346, "RtlVirtualUnwind" ], [ 51366, "RtlLookupFunctionEntry" ], [ 51392, "RtlCaptureContext" ], [ 51412, "HeapSetInformation" ], [ 51434, "GetModuleHandleW" ], [ 51454, "Sleep" ], [ 51462, "ExitProcess" ], [ 51476, "GetStdHandle" ], [ 51492, "GetModuleFileNameA" ], [ 51514, "SetHandleCount" ], [ 51532, "GetStartupInfoA" ], [ 51550, "DeleteCriticalSection" ], [ 51574, "RtlUnwindEx" ], [ 51588, "SetStdHandle" ], [ 51604, "EnterCriticalSection" ], [ 51628, "LeaveCriticalSection" ], [ 51652, "WriteConsoleA" ], [ 51668, "GetConsoleOutputCP" ], [ 51690, "WriteConsoleW" ], [ 51706, "EncodePointer" ], [ 51722, "DecodePointer" ], [ 51738, "FlsGetValue" ], [ 51752, "FlsFree" ], [ 51762, "SetLastError" ], [ 51778, "FlsAlloc" ], [ 51790, "GetCPInfo" ], [ 51812, "GetOEMCP" ], [ 51824, "IsValidCodePage" ], [ 51842, "SetEndOfFile" ], [ 51858, "GetProcessHeap" ], [ 51876, "FreeEnvironmentStringsA" ], [ 51902, "GetEnvironmentStrings" ], [ 51926, "FreeEnvironmentStringsW" ], [ 51952, "GetEnvironmentStringsW" ], [ 51978, "QueryPerformanceCounter" ], [ 52004, "GetTickCount" ], [ 52020, "GetCurrentProcessId" ], [ 52042, "GetSystemTimeAsFileTime" ], [ 52068, "LoadLibraryA" ], [ 52084, "InitializeCriticalSectionAndSpinCount" ], [ 52124, "HeapReAlloc" ], [ 52138, "CreateFileA" ], [ 52152, "LCMapStringA" ], [ 52168, "LCMapStringW" ], [ 52184, "GetStringTypeA" ], [ 52202, "GetStringTypeW" ], [ 52220, "GetLocaleInfoA" ], [ 52238, "HeapSize" ], [ 52356, "cab.dll" ], [ 52364, "Close" ], [ 52370, "Extract" ], [ 52378, "GetListItem" ], [ 52390, "GetNextName" ], [ 52402, "Open" ], [ 52407, "Prepare" ], [ 54238, "abcdefghijklmnopqrstuvwxyz" ], [ 54270, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 59558, "wide", "VS_VERSION_INFO" ], [ 59650, "wide", "StringFileInfo" ], [ 59710, "wide", "ProductName" ], [ 59758, "wide", "CompanyName" ], [ 59784, "wide", "Alexander Roshal" ], [ 59826, "wide", "FileDescription" ], [ 59860, "wide", "CAB format support" ], [ 59906, "wide", "FileVersion" ], [ 59950, "wide", "InternalName" ], [ 59976, "wide", "cab.fmt" ], [ 59998, "wide", "LegalCopyright" ], [ 60028, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 60114, "wide", "VarFileInfo" ], [ 60146, "wide", "Translation" ], [ 60176, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 60251, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 60307, "\u003csecurity\u003e" ], [ 60323, "\u003crequestedPrivileges\u003e" ], [ 60352, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 60448, "\u003c/requestedPrivileges\u003e" ], [ 60478, "\u003c/security\u003e" ], [ 60495, "\u003c/trustInfo\u003e" ], [ 60511, "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD" ] ], "sz": 61952, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 161.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\cab\\build\\64\\Release\\cab.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555992.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 81.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 10.43" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.30" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "cab.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 61952.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 227.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.06" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b9", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 81.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "10/8 IPv4 with port literal", "e": [ "10.48.1.15:3634" ], "i": "micro-behaviors/communications/ip::private-ipv4-port-10-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 81.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 81.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4608)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 6.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.33)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WATAUAVAWH", "UVWATAUAVAWH", "UVWATAUH", "VWATAUAVH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.21" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 110592.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 161.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 81.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 161.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 81.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.06" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "MultiByteToWideChar", "WideCharToMultiByte", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "RtlLookupFunctionEntry", "GetModuleFileNameA", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "InitializeCriticalSectionAndSpinCount" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (LocalFileTimeToFileTime, DosDateTimeToFileTime, SetFilePointer, ReadFile, CloseHandle, ... +76 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "IsDebuggerPresent", "TerminateProcess" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 81.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsGetValue", "FlsSetValue", "FlsAlloc" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "IsDebuggerPresent", "SetUnhandledExceptionFilter", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "e6dd69bbe7a80419b43ccb66e11fd7b7d6a70994ddf39acfa211a445e3f8432f", "path": "64301!!Formats/cab.fmt", "type": "pe" }, { "f": "KO₅(Al₂As₆C₃Er₄I)H₄(FPo₂DbDs)Md₃(Bi₃Pa)", "x": 9, "dp": 1, "id": 26, "is": [ "FreeLibrary", "GetProcAddress", "LoadLibraryA", "GetModuleFileNameA", "Sleep", "GetTickCount", "CreateDirectoryA", "GetCurrentDirectoryA", "SetCurrentDirectoryA", "CloseHandle", "UnmapViewOfFile", "MapViewOfFile", "OpenFileMappingA", "RaiseException", "GetLastError", "HeapReAlloc", "HeapAlloc", "RtlUnwind", "HeapFree", "GetCommandLineA", "GetStartupInfoA", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "DeleteCriticalSection", "LeaveCriticalSection", "EnterCriticalSection", "HeapCreate", "VirtualFree", "VirtualAlloc", "GetModuleHandleW", "TlsGetValue", "TlsAlloc", "TlsSetValue", "TlsFree", "InterlockedIncrement", "SetLastError", "GetCurrentThreadId", "InterlockedDecrement", "ExitProcess", "WriteFile", "GetStdHandle", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStringsW", "SetHandleCount", "GetFileType", "QueryPerformanceCounter", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "InitializeCriticalSectionAndSpinCount", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "GetLocaleInfoA", "GetStringTypeA", "MultiByteToWideChar", "GetStringTypeW", "LCMapStringA", "LCMapStringW", "HeapSize" ], "ms": { "pe": { "machine": 332.0, "checksum": 56657.0, "pdb_path": "d:\\Projects\\WinRAR\\FormatSrc\\ace\\build\\ace32loader\\Release\\ace32loader.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1368555996.0, "image_base": 4194304.0, "rsrc_entropy": 4.58, "entry_section": ".text", "size_of_image": 81920.0, "timestamp_day": 14.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 258.0, "entry_point_rva": 9863.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 1.0, "manifest_present": true, "computed_checksum": 56657.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368555996.0, "debug_timestamp_min": 1368555996.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 9.0, "version_info_present": true, "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 33792.0, "file_size": 55296.0, "entry_point": 9863.0, "code_entropy": 6.55, "data_entropy": 3.94, "import_count": 66.0, "string_count": 247.0, "section_count": 5.0, "avg_complexity": 7.42, "function_count": 151.0, "import_density": 2.0, "max_complexity": 50.0, "string_density": 7.48, "overall_entropy": 4.58, "avg_basic_blocks": 11.38, "avg_section_size": 10854.4, "dependency_count": 1.0, "entropy_variance": 1.36, "function_density": 4.58, "avg_function_size": 228.62, "avg_string_length": 25.92, "complexity_per_kb": 0.22, "max_string_length": 397.0, "wide_string_count": 17.0, "writable_sections": 1.0, "avg_string_entropy": 3.39, "code_to_data_ratio": 1.65, "data_to_file_ratio": 0.06, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.61, "total_basic_blocks": 1718.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 35.51, "debug_reference_count": 1.0, "largest_section_ratio": 0.61, "sentence_string_count": 76.0, "sentence_string_ratio": 0.31, "behavioral_import_ratio": 0.05, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 200, "Rich" ], [ 472, ".text" ], [ 551, "@.data" ], [ 592, ".rsrc" ], [ 631, "@.reloc" ], [ 5779, "QSVW" ], [ 14336, "YYPV" ], [ 22350, "UVWS" ], [ 27893, "UQPXY]Y[" ], [ 33771, "WWWWV" ], [ 35164, "ACEExtract" ], [ 35176, "ACETest" ], [ 35184, "ACEList" ], [ 35192, "ACEReadArchiveData" ], [ 35212, "ACEInitDll" ], [ 35224, "UnAceV2.Dll" ], [ 35272, "bad allocation" ], [ 35320, "bad exception" ], [ 35336, "EncodePointer" ], [ 35352, "wide", "KERNEL32.DLL" ], [ 35380, "DecodePointer" ], [ 35396, "FlsFree" ], [ 35404, "FlsSetValue" ], [ 35416, "FlsGetValue" ], [ 35428, "FlsAlloc" ], [ 35440, "CorExitProcess" ], [ 35456, "wide", "mscoree.dll" ], [ 35480, "runtime error" ], [ 35500, "TLOSS error" ], [ 35516, "SING error" ], [ 35532, "DOMAIN error" ], [ 35552, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 35559, "An application has made an attempt to load the C runtime library incorrectly." ], [ 35637, "Please contact the application's support team for more information." ], [ 35712, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 35719, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 35799, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 35960, "R6032\r\n- not enough space for locale information" ], [ 35967, "- not enough space for locale information" ], [ 36016, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 36023, "- Attempt to initialize the CRT more than once." ], [ 36071, "This indicates a bug in your application." ], [ 36116, "R6030\r\n- CRT not initialized" ], [ 36123, "- CRT not initialized" ], [ 36148, "R6028\r\n- unable to initialize heap" ], [ 36155, "- unable to initialize heap" ], [ 36188, "R6027\r\n- not enough space for lowio initialization" ], [ 36195, "- not enough space for lowio initialization" ], [ 36244, "R6026\r\n- not enough space for stdio initialization" ], [ 36251, "- not enough space for stdio initialization" ], [ 36300, "R6025\r\n- pure virtual function call" ], [ 36307, "- pure virtual function call" ], [ 36340, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 36347, "- not enough space for _onexit/atexit table" ], [ 36396, "R6019\r\n- unable to open console device" ], [ 36403, "- unable to open console device" ], [ 36440, "R6018\r\n- unexpected heap error" ], [ 36447, "- unexpected heap error" ], [ 36476, "R6017\r\n- unexpected multithread lock error" ], [ 36483, "- unexpected multithread lock error" ], [ 36524, "R6016\r\n- not enough space for thread data" ], [ 36531, "- not enough space for thread data" ], [ 36568, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 36570, "This application has requested the Runtime to terminate it in an unusual way." ], [ 36720, "R6009\r\n- not enough space for environment" ], [ 36727, "- not enough space for environment" ], [ 36764, "R6008\r\n- not enough space for arguments" ], [ 36771, "- not enough space for arguments" ], [ 36808, "R6002\r\n- floating point support not loaded" ], [ 36815, "- floating point support not loaded" ], [ 36856, "Microsoft Visual C++ Runtime Library" ], [ 36904, "\u003cprogram name unknown\u003e" ], [ 36928, "Runtime Error!\n\nProgram:" ], [ 37080, "Complete Object Locator'" ], [ 37108, "Class Hierarchy Descriptor'" ], [ 37140, "Base Class Array'" ], [ 37160, "Base Class Descriptor at (" ], [ 37188, "Type Descriptor'" ], [ 37208, "`local static thread guard'" ], [ 37236, "`managed vector copy constructor iterator'" ], [ 37280, "`vector vbase copy constructor iterator'" ], [ 37324, "`vector copy constructor iterator'" ], [ 37360, "`dynamic atexit destructor for '" ], [ 37396, "`dynamic initializer for '" ], [ 37424, "`eh vector vbase copy constructor iterator'" ], [ 37468, "`eh vector copy constructor iterator'" ], [ 37508, "`managed vector destructor iterator'" ], [ 37548, "`managed vector constructor iterator'" ], [ 37588, "`placement delete[] closure'" ], [ 37620, "`placement delete closure'" ], [ 37648, "`omni callsig'" ], [ 37664, "delete[]" ], [ 37684, "`local vftable constructor closure'" ], [ 37720, "`local vftable'" ], [ 37748, "`udt returning'" ], [ 37764, "`copy constructor closure'" ], [ 37792, "`eh vector vbase constructor iterator'" ], [ 37832, "`eh vector destructor iterator'" ], [ 37864, "`eh vector constructor iterator'" ], [ 37900, "`virtual displacement map'" ], [ 37928, "`vector vbase constructor iterator'" ], [ 37964, "`vector destructor iterator'" ], [ 37996, "`vector constructor iterator'" ], [ 38028, "`scalar deleting destructor'" ], [ 38060, "`default constructor closure'" ], [ 38092, "`vector deleting destructor'" ], [ 38124, "`vbase destructor'" ], [ 38156, "`local static guard'" ], [ 38348, "operator" ], [ 38388, "delete" ], [ 38404, "__unaligned" ], [ 38416, "__restrict" ], [ 38436, "__clrcall" ], [ 38448, "__fastcall" ], [ 38460, "__thiscall" ], [ 38472, "__stdcall" ], [ 38484, "__pascal" ], [ 38496, "__cdecl" ], [ 38916, "Unknown exception" ], [ 38967, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 39064, "GetProcessWindowStation" ], [ 39088, "GetUserObjectInformationA" ], [ 39116, "GetLastActivePopup" ], [ 39136, "GetActiveWindow" ], [ 39152, "MessageBoxA" ], [ 39164, "USER32.DLL" ], [ 39946, "wide", "h(((( H" ], [ 40624, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 41008, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 41244, "dddd, MMMM dd, yyyy" ], [ 41264, "MM/dd/yy" ], [ 41284, "December" ], [ 41296, "November" ], [ 41308, "October" ], [ 41316, "September" ], [ 41328, "August" ], [ 41336, "July" ], [ 41344, "June" ], [ 41352, "April" ], [ 41360, "March" ], [ 41368, "February" ], [ 41380, "January" ], [ 41436, "Saturday" ], [ 41448, "Friday" ], [ 41456, "Thursday" ], [ 41468, "Wednesday" ], [ 41480, "Tuesday" ], [ 41488, "Monday" ], [ 41496, "Sunday" ], [ 41536, "SunMonTueWedThuFriSat" ], [ 41560, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 41696, "d:\\Projects\\WinRAR\\FormatSrc\\ace\\build\\ace32loader\\Release\\ace32loader.pdb" ], [ 43570, "FreeLibrary" ], [ 43584, "GetProcAddress" ], [ 43602, "LoadLibraryA" ], [ 43618, "GetModuleFileNameA" ], [ 43640, "Sleep" ], [ 43648, "GetTickCount" ], [ 43664, "CreateDirectoryA" ], [ 43684, "GetCurrentDirectoryA" ], [ 43708, "SetCurrentDirectoryA" ], [ 43732, "CloseHandle" ], [ 43746, "UnmapViewOfFile" ], [ 43764, "MapViewOfFile" ], [ 43780, "OpenFileMappingA" ], [ 43798, "KERNEL32.dll" ], [ 43814, "RaiseException" ], [ 43832, "GetLastError" ], [ 43848, "HeapReAlloc" ], [ 43862, "HeapAlloc" ], [ 43874, "RtlUnwind" ], [ 43886, "HeapFree" ], [ 43898, "GetCommandLineA" ], [ 43916, "GetStartupInfoA" ], [ 43934, "TerminateProcess" ], [ 43954, "GetCurrentProcess" ], [ 43974, "UnhandledExceptionFilter" ], [ 44002, "SetUnhandledExceptionFilter" ], [ 44032, "IsDebuggerPresent" ], [ 44052, "DeleteCriticalSection" ], [ 44076, "LeaveCriticalSection" ], [ 44100, "EnterCriticalSection" ], [ 44124, "HeapCreate" ], [ 44138, "VirtualFree" ], [ 44152, "VirtualAlloc" ], [ 44168, "GetModuleHandleW" ], [ 44188, "TlsGetValue" ], [ 44202, "TlsAlloc" ], [ 44214, "TlsSetValue" ], [ 44228, "TlsFree" ], [ 44238, "InterlockedIncrement" ], [ 44262, "SetLastError" ], [ 44278, "GetCurrentThreadId" ], [ 44300, "InterlockedDecrement" ], [ 44324, "ExitProcess" ], [ 44338, "WriteFile" ], [ 44350, "GetStdHandle" ], [ 44366, "FreeEnvironmentStringsA" ], [ 44392, "GetEnvironmentStrings" ], [ 44416, "FreeEnvironmentStringsW" ], [ 44442, "WideCharToMultiByte" ], [ 44464, "GetEnvironmentStringsW" ], [ 44490, "SetHandleCount" ], [ 44508, "GetFileType" ], [ 44522, "QueryPerformanceCounter" ], [ 44548, "GetCurrentProcessId" ], [ 44570, "GetSystemTimeAsFileTime" ], [ 44596, "InitializeCriticalSectionAndSpinCount" ], [ 44636, "GetCPInfo" ], [ 44658, "GetOEMCP" ], [ 44670, "IsValidCodePage" ], [ 44688, "GetLocaleInfoA" ], [ 44706, "GetStringTypeA" ], [ 44724, "MultiByteToWideChar" ], [ 44746, "GetStringTypeW" ], [ 44764, "LCMapStringA" ], [ 44780, "LCMapStringW" ], [ 44796, "HeapSize" ], [ 45100, ".?AVtype_info@@" ], [ 45820, ".?AVbad_exception@std@@" ], [ 45852, ".?AVexception@std@@" ], [ 46758, "abcdefghijklmnopqrstuvwxyz" ], [ 46790, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 48806, "wide", "VS_VERSION_INFO" ], [ 48898, "wide", "StringFileInfo" ], [ 48958, "wide", "ProductName" ], [ 49006, "wide", "CompanyName" ], [ 49032, "wide", "Alexander Roshal" ], [ 49074, "wide", "FileDescription" ], [ 49108, "wide", "32 bit UnAceV2.Dll loader" ], [ 49166, "wide", "FileVersion" ], [ 49210, "wide", "InternalName" ], [ 49236, "wide", "ace32loader" ], [ 49266, "wide", "LegalCopyright" ], [ 49296, "wide", "Copyright © Alexander Roshal 1993-2013" ], [ 49382, "wide", "VarFileInfo" ], [ 49414, "wide", "Translation" ], [ 49444, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 49519, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 49575, "\u003csecurity\u003e" ], [ 49591, "\u003crequestedPrivileges\u003e" ], [ 49620, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 49716, "\u003c/requestedPrivileges\u003e" ], [ 49746, "\u003c/security\u003e" ], [ 49763, "\u003c/trustInfo\u003e" ], [ 49779, "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD" ] ], "sz": 55296, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 151.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Alexander Roshal (WinRAR author) version-info", "e": [ "Alexander Roshal", "Copyright © Alexander Roshal 1993-2013" ], "i": "objectives/evasion/masquerade/version-resource::alexander-roshal-author", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\FormatSrc\\ace\\build\\ace32loader\\Release\\ace32loader.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368555996.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.42" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.39" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "ace32loader.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 55296.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 247.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.58" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 3584)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.55)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00", "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.31" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 81920.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8500000238418579, "d": "Open named file mapping", "e": [ "OpenFileMappingA" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "ace32loader.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 151.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 151.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.58" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "ace32loader.exe" ], "i": "objectives/evasion/masquerade/file::basename-is-exe", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 66.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetModuleFileNameA", "GetCurrentDirectoryA", "SetCurrentDirectoryA", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "InterlockedIncrement", "InterlockedDecrement", "WideCharToMultiByte", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "InitializeCriticalSectionAndSpinCount", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (FreeLibrary, GetProcAddress, LoadLibraryA, GetModuleFileNameA, Sleep, ... +61 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "Sleep", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "1d06bb3ced3c93a85001381c67b8f8bcc4d369ae19d52bd641213394a1bafb2c", "path": "64301!!Formats/ace32loader.exe", "type": "pe" }, { "f": "KO₉(PrAlAs₇C₅CoEr₃I₄P₂Xe)H₅(F₆Os₃Po₅Db₂Ds)Md₅(SiBi₅PaPt)", "x": 18, "dp": 1, "id": 27, "is": [ "InitCommonControlsEx", "SHAutoComplete", "ReadFile", "GetFileAttributesW", "SetFileAttributesW", "FindNextFileW", "GetFullPathNameW", "GetModuleFileNameW", "FindResourceW", "GetModuleHandleW", "FreeLibrary", "GetProcAddress", "LoadLibraryW", "GetCurrentProcessId", "GetLocaleInfoW", "GetNumberFormatW", "ExpandEnvironmentStringsW", "WaitForSingleObject", "DosDateTimeToFileTime", "GetDateFormatW", "GetTimeFormatW", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "GetExitCodeProcess", "GetTempPathW", "MoveFileExW", "Sleep", "UnmapViewOfFile", "MapViewOfFile", "GetCommandLineW", "CreateFileMappingW", "GetTickCount", "SetEnvironmentVariableW", "OpenFileMappingW", "CreateThread", "EnterCriticalSection", "LeaveCriticalSection", "GetProcessAffinityMask", "ReleaseSemaphore", "ResetEvent", "DeleteCriticalSection", "SetEvent", "SetThreadPriority", "InitializeCriticalSection", "CreateEventW", "CreateSemaphoreW", "SystemTimeToFileTime", "GetSystemTime", "LocalFileTimeToFileTime", "WideCharToMultiByte", "MultiByteToWideChar", "CompareStringW", "IsDBCSLeadByte", "FindFirstFileW", "GetFileType", "SetCurrentDirectoryW", "WriteConsoleW", "GetConsoleOutputCP", "WriteConsoleA", "SetStdHandle", "GetLocaleInfoA", "GetStringTypeW", "GetStringTypeA", "LoadLibraryA", "GetConsoleMode", "GetConsoleCP", "InitializeCriticalSectionAndSpinCount", "QueryPerformanceCounter", "SetHandleCount", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsA", "LCMapStringW", "LCMapStringA", "IsValidCodePage", "GetOEMCP", "GetACP", "GetModuleFileNameA", "ExitProcess", "HeapSize", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "TerminateProcess", "VirtualAlloc", "VirtualFree", "HeapCreate", "InterlockedDecrement", "GetCurrentThreadId", "InterlockedIncrement", "TlsFree", "TlsSetValue", "TlsAlloc", "TlsGetValue", "GetStartupInfoA", "GetCommandLineA", "RaiseException", "GetSystemTimeAsFileTime", "SetEndOfFile", "SetFilePointer", "GetStdHandle", "WriteFile", "FlushFileBuffers", "GetLongPathNameW", "MoveFileW", "GetShortPathNameW", "CreateDirectoryW", "RemoveDirectoryW", "GlobalAlloc", "DeleteFileW", "FindClose", "CreateFileW", "DeviceIoControl", "SetFileTime", "GetCurrentProcess", "CloseHandle", "CreateHardLinkW", "SetLastError", "GetLastError", "GetCurrentDirectoryW", "CreateFileA", "GetCPInfo", "HeapAlloc", "HeapReAlloc", "HeapFree", "RtlUnwind", "EnableWindow", "ShowWindow", "GetDlgItem", "MessageBoxW", "FindWindowExW", "GetParent", "MapWindowPoints", "CreateWindowExW", "UpdateWindow", "LoadCursorW", "RegisterClassExW", "DefWindowProcW", "DestroyWindow", "CopyRect", "IsWindow", "CharUpperW", "OemToCharBuffA", "LoadIconW", "PostMessageW", "GetSysColor", "SetForegroundWindow", "WaitForInputIdle", "IsWindowVisible", "DialogBoxParamW", "DestroyIcon", "SetFocus", "GetClassNameW", "SendDlgItemMessageW", "EndDialog", "GetDlgItemTextW", "SetDlgItemTextW", "wvsprintfW", "SendMessageW", "GetDC", "ReleaseDC", "PeekMessageW", "GetMessageW", "TranslateMessage", "DispatchMessageW", "LoadStringW", "GetWindowRect", "GetClientRect", "SetWindowPos", "GetWindowTextW", "SetWindowTextW", "GetSystemMetrics", "GetWindow", "GetWindowLongW", "SetWindowLongW", "LoadBitmapW", "GetDeviceCaps", "CreateCompatibleDC", "GetObjectW", "CreateCompatibleBitmap", "SelectObject", "StretchBlt", "DeleteDC", "DeleteObject", "GetSaveFileNameW", "CommDlgExtendedError", "GetOpenFileNameW", "RegOpenKeyExW", "RegQueryValueExW", "RegCreateKeyExW", "RegSetValueExW", "RegCloseKey", "SetFileSecurityW", "OpenProcessToken", "LookupPrivilegeValueW", "AdjustTokenPrivileges", "SHChangeNotify", "SHGetFileInfoW", "SHGetMalloc", "SHGetSpecialFolderLocation", "SHGetPathFromIDListW", "SHBrowseForFolderW", "ShellExecuteExW", "SHFileOperationW", "CLSIDFromString", "CoCreateInstance", "OleInitialize", "OleUninitialize", "CreateStreamOnHGlobal", "ORDINAL 8" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "pdb_path": "d:\\Projects\\WinRAR\\SFX\\build\\sfxrar32\\Release\\sfxrar.pdb", "rsrc_size": 17408.0, "subsystem": 2.0, "timestamp": 1368556011.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.66, "entry_section": ".text", "size_of_image": 335872.0, "timestamp_day": 14.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2013.0, "characteristics": 259.0, "entry_point_rva": 119176.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1368556011.0, "import_dll_count": 10.0, "manifest_present": true, "computed_checksum": 243568.0, "section_alignment": 4096.0, "number_of_sections": 4.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1368556011.0, "debug_timestamp_min": 1368556011.0, "dll_characteristics": 33024.0, "rich_header_present": true, "export_timestamp_day": 14.0, "linker_major_version": 9.0, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 5.0, "debug_directory_entries": 1.0, "export_timestamp_present": true, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 151552.0, "file_size": 195584.0, "entry_point": 119176.0, "code_entropy": 6.71, "data_entropy": 3.93, "import_count": 211.0, "string_count": 580.0, "section_count": 4.0, "avg_complexity": 9.58, "function_count": 419.0, "import_density": 1.43, "max_complexity": 384.0, "string_density": 3.92, "overall_entropy": 4.81, "avg_basic_blocks": 15.08, "avg_section_size": 48640.0, "dependency_count": 10.0, "entropy_variance": 1.51, "function_density": 2.83, "avg_function_size": 276.17, "avg_string_length": 21.45, "complexity_per_kb": 0.06, "max_string_length": 248.0, "wide_string_count": 134.0, "writable_sections": 1.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 3.52, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.09, "text_to_file_ratio": 0.77, "total_basic_blocks": 6319.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 24.48, "debug_reference_count": 1.0, "largest_section_ratio": 0.77, "sentence_string_count": 126.0, "sentence_string_ratio": 0.22, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0, "high_complexity_functions": 10.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 472, ".text" ], [ 551, "@.data" ], [ 592, ".rsrc" ], [ 1980, "SVW3" ], [ 6962, "Udup" ], [ 10840, "SUVW" ], [ 25940, "QQSV" ], [ 39283, "YWj\\_f9\u003euOf9~" ], [ 42660, "QQSUV" ], [ 43836, "N0WS" ], [ 49313, "u1jd" ], [ 52037, "SSShthB" ], [ 53369, "EXPSV" ], [ 55264, "HtOHt^HtBHu#" ], [ 65972, "SWWS" ], [ 68323, "QQSVW" ], [ 71469, "f98t" ], [ 75024, "QSVW" ], [ 83562, "FTSP" ], [ 101138, "QQVW" ], [ 111632, "AABB" ], [ 114176, "WVS3" ], [ 115040, "WVU3" ], [ 117670, "YYPV" ], [ 128546, "RPSW" ], [ 131746, "UVWS" ], [ 139685, "UQPXY]Y[" ], [ 147583, "WWWWV" ], [ 153616, "wide", "Maximum allowed array size (%u) is exceeded" ], [ 153956, "wide", "SeRestorePrivilege" ], [ 153996, "wide", "SeSecurityPrivilege" ], [ 154068, "wide", "SeCreateSymbolicLinkPrivilege" ], [ 154152, "wide", "%.*ls(%u)%ls" ], [ 154180, "wide", "rtmp%d" ], [ 154196, "YNANRC" ], [ 154232, "bad allocation" ], [ 154256, "wide", "__rar_" ], [ 154324, "wide", ".rar" ], [ 154376, "wide", "*messages***" ], [ 154404, "*messages***" ], [ 154460, "CryptUnprotectMemory" ], [ 154484, "CryptProtectMemory" ], [ 154504, "wide", "Crypt32.dll" ], [ 154528, "wide", "CryptUnprotectMemory failed" ], [ 154584, "wide", "CryptProtectMemory failed" ], [ 154660, "wide", "RENAMEDLG" ], [ 154680, "wide", "GETPASSWORD1" ], [ 154716, "wide", "ASKNEXTVOL" ], [ 154740, "wide", "Software\\WinRAR SFX" ], [ 154780, "wide", "STATIC" ], [ 154808, "wide", "%s %s %s" ], [ 154828, "wide", "REPLACEFILEDLG" ], [ 154864, "wide", ".exe" ], [ 154876, "wide", "Install" ], [ 154892, "wide", ".inf" ], [ 154904, "wide", ".lnk" ], [ 154916, "wide", "%s%s%d" ], [ 154940, "wide", "ProgramFilesDir" ], [ 154976, "wide", "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 155060, "wide", "\u003cbr\u003e" ], [ 155072, "wide", "%s.%d.tmp" ], [ 155092, "wide", "Delete" ], [ 155108, "wide", "Text" ], [ 155120, "wide", "Title" ], [ 155132, "wide", "Path" ], [ 155144, "wide", "Silent" ], [ 155160, "wide", "Overwrite" ], [ 155180, "wide", "Setup" ], [ 155192, "wide", "TempMode" ], [ 155212, "wide", "License" ], [ 155228, "wide", "Presetup" ], [ 155248, "wide", "Shortcut" ], [ 155268, "wide", "SavePath" ], [ 155288, "wide", "Update" ], [ 155304, "wide", "SetupCode" ], [ 155324, "wide", "LICENSEDLG" ], [ 155368, "wide", "runas" ], [ 155380, "wide", "winrarsfxmappingfile.tmp" ], [ 155432, "wide", "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" ], [ 155492, "wide", "__tmp_rar_sfx_access_check_%u" ], [ 155552, "wide", "STARTDLG" ], [ 155572, "wide", "sfxname" ], [ 155864, "SetDllDirectoryW" ], [ 155884, "wide", "kernel32" ], [ 155904, "wide", "CreateThread failed" ], [ 155944, "wide", "WaitForMultipleObjects error %d, GetLastError %d" ], [ 156048, "wide", "Thread pool initialization failed." ], [ 156368, "wide", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e" ], [ 156480, "wide", "\u003c/html\u003e" ], [ 156496, "wide", "utf-8\"\u003e\u003c/head\u003e" ], [ 156528, "wide", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=" ], [ 156664, "wide", "\u003chtml\u003e" ], [ 156680, "wide", "\u003c/style\u003e" ], [ 156700, "wide", "\u003cstyle\u003e" ], [ 156716, "wide", "\u003c/p\u003e" ], [ 156728, "wide", "about:blank" ], [ 156752, "wide", "Shell.Explorer" ], [ 156784, "wide", "RarHtmlClassName" ], [ 156820, "wide", "EDIT" ], [ 156832, "wide", "riched20.dll" ], [ 156860, "wide", "riched32.dll" ], [ 157144, "Unknown exception" ], [ 157180, "bad exception" ], [ 157196, "EncodePointer" ], [ 157212, "wide", "KERNEL32.DLL" ], [ 157240, "DecodePointer" ], [ 157256, "FlsFree" ], [ 157264, "FlsSetValue" ], [ 157276, "FlsGetValue" ], [ 157288, "FlsAlloc" ], [ 157300, "CorExitProcess" ], [ 157316, "wide", "mscoree.dll" ], [ 157360, "wide", "UTF-16LE" ], [ 157380, "wide", "UNICODE" ], [ 157396, "runtime error" ], [ 157416, "TLOSS error" ], [ 157432, "SING error" ], [ 157448, "DOMAIN error" ], [ 157464, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 157471, "An application has made an attempt to load the C runtime library incorrectly." ], [ 157549, "Please contact the application's support team for more information." ], [ 157624, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 157631, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 157711, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 157872, "R6032\r\n- not enough space for locale information" ], [ 157879, "- not enough space for locale information" ], [ 157928, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 157935, "- Attempt to initialize the CRT more than once." ], [ 157983, "This indicates a bug in your application." ], [ 158028, "R6030\r\n- CRT not initialized" ], [ 158035, "- CRT not initialized" ], [ 158060, "R6028\r\n- unable to initialize heap" ], [ 158067, "- unable to initialize heap" ], [ 158100, "R6027\r\n- not enough space for lowio initialization" ], [ 158107, "- not enough space for lowio initialization" ], [ 158156, "R6026\r\n- not enough space for stdio initialization" ], [ 158163, "- not enough space for stdio initialization" ], [ 158212, "R6025\r\n- pure virtual function call" ], [ 158219, "- pure virtual function call" ], [ 158252, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 158259, "- not enough space for _onexit/atexit table" ], [ 158308, "R6019\r\n- unable to open console device" ], [ 158315, "- unable to open console device" ], [ 158352, "R6018\r\n- unexpected heap error" ], [ 158359, "- unexpected heap error" ], [ 158388, "R6017\r\n- unexpected multithread lock error" ], [ 158395, "- unexpected multithread lock error" ], [ 158436, "R6016\r\n- not enough space for thread data" ], [ 158443, "- not enough space for thread data" ], [ 158480, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 158482, "This application has requested the Runtime to terminate it in an unusual way." ], [ 158632, "R6009\r\n- not enough space for environment" ], [ 158639, "- not enough space for environment" ], [ 158676, "R6008\r\n- not enough space for arguments" ], [ 158683, "- not enough space for arguments" ], [ 158720, "R6002\r\n- floating point support not loaded" ], [ 158727, "- floating point support not loaded" ], [ 158768, "Microsoft Visual C++ Runtime Library" ], [ 158816, "\u003cprogram name unknown\u003e" ], [ 158840, "Runtime Error!\n\nProgram:" ], [ 158903, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 159134, "wide", "D(null)" ], [ 159152, "(null)" ], [ 159201, "700WP" ], [ 159217, "`h````" ], [ 159302, "700PP" ], [ 159348, "Complete Object Locator'" ], [ 159376, "Class Hierarchy Descriptor'" ], [ 159408, "Base Class Array'" ], [ 159428, "Base Class Descriptor at (" ], [ 159456, "Type Descriptor'" ], [ 159476, "`local static thread guard'" ], [ 159504, "`managed vector copy constructor iterator'" ], [ 159548, "`vector vbase copy constructor iterator'" ], [ 159592, "`vector copy constructor iterator'" ], [ 159628, "`dynamic atexit destructor for '" ], [ 159664, "`dynamic initializer for '" ], [ 159692, "`eh vector vbase copy constructor iterator'" ], [ 159736, "`eh vector copy constructor iterator'" ], [ 159776, "`managed vector destructor iterator'" ], [ 159816, "`managed vector constructor iterator'" ], [ 159856, "`placement delete[] closure'" ], [ 159888, "`placement delete closure'" ], [ 159916, "`omni callsig'" ], [ 159932, "delete[]" ], [ 159952, "`local vftable constructor closure'" ], [ 159988, "`local vftable'" ], [ 160016, "`udt returning'" ], [ 160032, "`copy constructor closure'" ], [ 160060, "`eh vector vbase constructor iterator'" ], [ 160100, "`eh vector destructor iterator'" ], [ 160132, "`eh vector constructor iterator'" ], [ 160168, "`virtual displacement map'" ], [ 160196, "`vector vbase constructor iterator'" ], [ 160232, "`vector destructor iterator'" ], [ 160264, "`vector constructor iterator'" ], [ 160296, "`scalar deleting destructor'" ], [ 160328, "`default constructor closure'" ], [ 160360, "`vector deleting destructor'" ], [ 160392, "`vbase destructor'" ], [ 160424, "`local static guard'" ], [ 160616, "operator" ], [ 160652, "delete" ], [ 160668, "__unaligned" ], [ 160680, "__restrict" ], [ 160700, "__clrcall" ], [ 160712, "__fastcall" ], [ 160724, "__thiscall" ], [ 160736, "__stdcall" ], [ 160748, "__pascal" ], [ 160760, "__cdecl" ], [ 161168, "GetProcessWindowStation" ], [ 161192, "GetUserObjectInformationA" ], [ 161220, "GetLastActivePopup" ], [ 161240, "GetActiveWindow" ], [ 161256, "MessageBoxA" ], [ 161268, "USER32.DLL" ], [ 162050, "wide", "h(((( H" ], [ 162728, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 163112, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 163348, "dddd, MMMM dd, yyyy" ], [ 163368, "MM/dd/yy" ], [ 163388, "December" ], [ 163400, "November" ], [ 163412, "October" ], [ 163420, "September" ], [ 163432, "August" ], [ 163440, "July" ], [ 163448, "June" ], [ 163456, "April" ], [ 163464, "March" ], [ 163472, "February" ], [ 163484, "January" ], [ 163540, "Saturday" ], [ 163552, "Friday" ], [ 163560, "Thursday" ], [ 163572, "Wednesday" ], [ 163584, "Tuesday" ], [ 163592, "Monday" ], [ 163600, "Sunday" ], [ 163636, "SunMonTueWedThuFriSat" ], [ 163660, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 163808, "d:\\Projects\\WinRAR\\SFX\\build\\sfxrar32\\Release\\sfxrar.pdb" ], [ 168870, "InitCommonControlsEx" ], [ 168892, "COMCTL32.dll" ], [ 168908, "SHAutoComplete" ], [ 168924, "SHLWAPI.dll" ], [ 168938, "GetCurrentDirectoryW" ], [ 168962, "GetLastError" ], [ 168978, "SetLastError" ], [ 168994, "CreateHardLinkW" ], [ 169012, "CloseHandle" ], [ 169026, "GetCurrentProcess" ], [ 169046, "SetFileTime" ] ], "sz": 195584, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Extract file path", "e": [ "SHGetPathFromIDListW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-path-from-idlist", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 419.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.75, "d": "Perform file operation through shell", "e": [ "SHFileOperationW" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-file-operation", "l": 3 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cbr\u003e", "\u003cstyle\u003ebody{font-family:\"Arial\";font-size:12;}\u003c/style\u003e", "\u003c/html\u003e", "utf-8\"\u003e\u003c/head\u003e", "\u003chead\u003e\u003cmeta http-equiv=\"content-type\" content=\"text/html; charset=", "\u003chtml\u003e", "\u003c/style\u003e", "\u003cstyle\u003e", "\u003c/p\u003e", "E\u003cul\u003e\u003cli\u003ePress \u003cb\u003eInstall\u003c/b\u003e button to start extraction.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003eE\u003cul\u003e\u003cli\u003ePress \u003cb\u003eExtract\u003c/b\u003e ...", "manually.\u003c/li\u003e\u003cbr\u003e\u003cbr\u003e8\u003cli\u003eIf the destination folder does not exist, it will be", "2created automatically before extraction.\u003c/li\u003e\u003c/ul\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.77" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 211.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 211.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp", ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "d:\\Projects\\WinRAR\\SFX\\build\\sfxrar32\\Release\\sfxrar.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1368556011.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 211.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "password keyword", "e": [ "Wrong password for %s5Write error in the file %s. Probably the disk is full", "GETPASSWORD1", "\u0026Enter password for the encrypted file:", "Unknown encryption method in %s$The specified password is incorrect.", "Enter password", "…. Corrupt file or wrong password.", "GETPASSWORD1\nLICENSEDLG\nASKNEXTVOL" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.77" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.58" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ ".lnk" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "sfxrar.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "Find window by class/title", "e": [ "FindWindowExW" ], "i": "micro-behaviors/ui/window/manage::find-window-ex", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 134.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "c": 0.800000011920929, "d": "Notify shell of file changes", "e": [ "SHChangeNotify" ], "i": "micro-behaviors/ui/window/notify::shell-change-notify", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "runas privilege elevation string", "e": [ "runas" ], "i": "micro-behaviors/os/privilege/elevation::runas-string", "l": 3 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 195584.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Post message to window (Unicode)", "e": [ "PostMessageW" ], "i": "micro-behaviors/os/message/queue::post-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 580.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Display folder browse dialog", "e": [ "SHBrowseForFolderW" ], "i": "micro-behaviors/fs/shell-ops/commands::browse-for-folder", "l": 3 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.949999988079071, "d": "WinRAR SFX start dialog", "e": [ "STARTDLG" ], "i": "metadata/binary/installer/sfx::dialog-start", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.81" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime", "DosDateTimeToFileTime", "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 211.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 211.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.7200000286102295, "d": "WININIT rename section marker", "e": [ "Rename" ], "i": "micro-behaviors/fs/config/system::wininit-rename-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 211.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5120)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "runas elevation verb", "e": [ "runas" ], "i": "objectives/privilege-escalation/token-manipulation::runas-word", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.71)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00", "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "RENAMEDLG", "ASKNEXTVOL", "LICENSEDLG", "STARTDLG" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.9800000190734863, "d": "WinRAR SFX registry key", "e": [ "Software\\WinRAR SFX" ], "i": "metadata/binary/installer/sfx::registry-key", "l": 1 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.22" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "Extracting files to %s folder$Extracting files to temporary folder", "Unknown encryption method in %s$The specified password is incorrect." ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 335872.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "a8 60 42 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 419.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 211.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 419.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR", "winrar", "WinRAR", "WINRAR", "WinRAR", "WinRAR", "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "a": "T1112", "c": 0.6499999761581421, "d": "Windows runas verb token", "e": [ "runas" ], "i": "objectives/impact/degrade/system::runas-verb-token", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 6319.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8500000238418579, "d": "Peek message (Unicode)", "e": [ "PeekMessageW" ], "i": "micro-behaviors/os/message/queue::peek-message-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 211.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.699999988079071, "d": "Get file information and icon", "e": [ "SHGetFileInfoW" ], "i": "micro-behaviors/fs/shell-ops/commands::get-file-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.81" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8799999952316284, "d": "Apply file security descriptor", "e": [ "SetFileSecurityW" ], "i": "micro-behaviors/os/security/descriptor::set-file-security", "l": 3 }, { "c": 0.8500000238418579, "d": "DeviceIoControl API usage", "e": [ "DeviceIoControl" ], "i": "micro-behaviors/fs/file/operations::device-io-control-win", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 419.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "38 62 42 00", "9c 62 42 00", "1c 62 42 00", "34 61 42 00", "38 62 42 00", "38 62 42 00", "38 62 42 00", "9c 62 42 00", "38 62 42 00", "38 62 42 00", "38 62 42 00", "a0 60 42 00", "38 62 42 00", "38 62 42 00", "38 62 42 00", "38 62 42 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.77" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "InitCommonControlsEx", "GetCurrentDirectoryW", "GetModuleFileNameW", "GetCurrentProcessId", "DosDateTimeToFileTime", "FileTimeToSystemTime", "FileTimeToLocalFileTime", "SetEnvironmentVariableW", "GetProcessAffinityMask", "InitializeCriticalSection", "SystemTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (EnableWindow, ShowWindow, GetDlgItem, MessageBoxW, FindWindowExW, ... +45 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (InitCommonControlsEx)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (ReadFile, GetFileAttributesW, SetFileAttributesW, FindNextFileW, GetFullPathNameW, ... +120 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHChangeNotify, SHGetFileInfoW, SHGetMalloc, SHGetSpecialFolderLocation, SHGetPathFromIDListW, ... +3 more)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 8)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetDeviceCaps, CreateCompatibleDC, GetObjectW, CreateCompatibleBitmap, SelectObject, ... +3 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (SHAutoComplete)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegOpenKeyExW, RegQueryValueExW, RegCreateKeyExW, RegSetValueExW, RegCloseKey, ... +4 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CLSIDFromString, CoCreateInstance, OleInitialize, OleUninitialize, CreateStreamOnHGlobal)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMDLG32.dll (GetSaveFileNameW, CommDlgExtendedError, GetOpenFileNameW)", "e": [ "COMDLG32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.800000011920929, "d": "Has file operation capabilities", "e": [ "MoveFileExW", "FindFirstFileW" ], "i": "objectives/impact/ransom/file-operations::has-file-operations", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1485", "c": 0.8799999952316284, "d": "Raw disk I/O helper API set", "e": [ "ReadFile", "DeviceIoControl", "CreateFileW", "CreateFileA" ], "i": "objectives/impact/system/directory::windows-raw-disk-io-api-set", "l": 1 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "MoveFileExW", "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "SetFileTime", "CreateFileW", "GetModuleFileNameA", "GetModuleFileNameW", "CreateFileA", "WriteFile", "FindFirstFileW" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "RegisterClassExW", "GetMessageW", "CreateWindowExW", "DefWindowProcW", "DispatchMessageW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "1c 62 42 00", "9c 62 42 00", "a0 60 42 00", "34 61 42 00", "38 62 42 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindNextFileW", "FindClose", "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 211.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9700000286102295, "d": "WinRAR self-extractor footprint", "e": [ "Software\\WinRAR SFX", "STARTDLG" ], "i": "metadata/binary/installer/sfx::winrar-sfx-footprint", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameW", "GetModuleFileNameA", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExW", "RegSetValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "LookupPrivilegeValueW", "OpenProcessToken", "AdjustTokenPrivileges" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "ShellExecuteExW", "GetModuleFileNameA", "UnmapViewOfFile", "WriteFile", "GetModuleFileNameW" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" } ], "sha": "c5fa7a96394dac1ef0acf9001f77beae0f9c25efbfa5bf270e95288dc1182f66", "path": "64301!!Default.SFX", "type": "pe" }, { "f": "H(Po₂)", "x": 1, "dp": 1, "id": 28, "ms": { "text": { "digit_ratio": 0.02, "space_count": 9614.0, "total_lines": 902.0, "char_entropy": 4.55, "unique_chars": 87.0, "avg_line_length": 45.01, "max_line_length": 78.0, "empty_line_ratio": 0.27, "last_line_length": 34.0, "most_common_char": "e", "whitespace_ratio": 0.27, "most_common_ratio": 0.08, "line_length_stddev": 30.12, "repeated_char_sequences": 2.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 49.0 } }, "ss": [ [ 0, "WinRAR - What's new in the latest version" ], [ 63, "Version 5.00 beta 3" ], [ 89, "1. Fixed XZ archive support, which did not work in beta 2." ], [ 154, "2. \"Convert\" command did not allow to use compression dictionaries" ], [ 225, "exceeding 4 MB." ], [ 250, "3. If both encryption password and archive comment were specified" ], [ 320, "when creating RAR archive, archive comment was not added." ], [ 387, "4. \"View as Unicode (UTF-8)\" command in internal viewer did not work," ], [ 461, "so UTF-8 files were displayed correctly only if their encoding" ], [ 531, "was detected by viewer automatically." ], [ 578, "5. Maximum compression dictionary size when running in Windows XP x86" ], [ 652, "is reduced to 128 MB. WinRAR cannot allocate enough memory to" ], [ 721, "create archives with 256 MB dictionary in Windows XP x86." ], [ 788, "6. Corrections in relative path processing, such as \"..\\arcname.rar\" name" ], [ 866, "in archiving dialog or \"WinRAR foldername\" in the command line." ], [ 944, "Version 5.00 beta 2" ], [ 970, "1. When adding an incompressible file to non-solid RAR archive," ], [ 1038, "beta 1 could duplicate the first megabyte of archived file," ], [ 1105, "resulting in damaged file." ], [ 1141, "2. \"Add to archive...\" context menu command could place a created archive" ], [ 1219, "to a wrong folder." ], [ 1252, "Version 5.00 beta 1" ], [ 1278, "1. New RAR 5.0 archiving format. You can use \"RAR 5.0\" option" ], [ 1344, "in archiving dialog or -ma command line switch to create" ], [ 1408, "RAR 5.0 archives." ], [ 1441, "Older software including older WinRAR versions is not able to" ], [ 1510, "decompress RAR 5.0 archives, so if you plan to send an archive" ], [ 1580, "to other people, it is necessary to take the compatibility issue" ], [ 1652, "into consideration. You can select \"RAR\" instead of \"RAR5\" option" ], [ 1725, "in archiving dialog to create RAR 4.x archives compatible with" ], [ 1795, "previous WinRAR versions." ], [ 1830, "2. Changes in RAR 5.0 compression algorithm:" ], [ 1881, "a) maximum compression dictionary size is increased up to 1 GB" ], [ 1951, "in 64 bit WinRAR. 32 bit WinRAR version can use up to 256 MB" ], [ 2022, "dictionary when creating an archive. Both 32 bit and 64 bit" ], [ 2092, "versions can unpack archives with any dictionary size," ], [ 2157, "including 1 GB;" ], [ 2185, "b) default dictionary size for RAR 5.0 is 32 MB, typically resulting" ], [ 2261, "in higher compression ratio and lower speed than RAR 4.x 4 MB." ], [ 2334, "You can use \"Dictionary size\" archiving dialog option or -md\u003csize\u003e" ], [ 2411, "switch to change this value;" ], [ 2452, "c) -md\u003csize\u003e switch syntax is modified to support larger dictionary" ], [ 2527, "sizes. Append 'k', 'm' and 'g' modifiers to specify the size" ], [ 2598, "in kilo-, mega- and gigabytes, like -md64m for 64 MB dictionary." ], [ 2673, "If modifiers are not present, megabytes are assumed," ], [ 2736, "so -md64m is equal to -md64;" ], [ 2777, "d) RAR 5.0 format includes Intel IA-32 executable and delta" ], [ 2844, "compression algorithms, but RAR 4.x text, audio, true color" ], [ 2914, "and Itanium algorithms are not supported. These excluded algorithms" ], [ 2992, "are not efficient for modern data types and hardware configurations;" ], [ 3073, "e) RAR 5.0 decompression can utilize several CPU cores." ], [ 3136, "Though not to same extent as in compression algorithm," ], [ 3201, "it improves the decompression speed on large files" ], [ 3262, "with poorly compressible data or when using BLAKE2 checksums." ], [ 3336, "3. Changes in RAR 5.0 archive format:" ], [ 3380, "a) file times are stored as Coordinated Universal Time (UTC)" ], [ 3448, "instead of former local time, making file exchange among" ], [ 3515, "several time zones more straightforward;" ], [ 3568, "b) file names and archive comments use UTF-8 encoding." ], [ 3635, "4. RAR 5.0 recovery record is based on Reed-Solomon error correction" ], [ 3708, "codes. If recovery record size is large enough, 5% and more," ], [ 3776, "the new error correction scheme provides much higher resistance to" ], [ 3850, "multiple damages comparing to RAR 4.x recovery record." ], [ 3912, "Smaller record, such as 1 - 2%, or less random damage type would" ], [ 3984, "result in less difference between 4.x and 5.0. For single continuous" ], [ 4060, "damage 4.x and 5.0 efficiency is about the same." ], [ 4118, "Additionally to usual data erasures, the new recovery record" ], [ 4186, "is able to detect deletions and insertions of much larger size" ], [ 4256, "than in previous RAR versions. Maximum insertion size is several" ], [ 4328, "megabytes. Maximum deletion size depends on the damage type" ], [ 4395, "and in some cases can be as large as the recovery record size." ], [ 4473, "Still, the best recovery performance and efficiency is achieved" ], [ 4544, "if no deletions and insertions are present, so all data including" ], [ 4617, "damaged sectors preserve their original positions. Thus, if you use" ], [ 4692, "some special software to copy an archive from damaged media," ], [ 4760, "it is better to choose the mode, when damaged sectors are filled by" ], [ 4835, "zeroes or any other data instead of cutting them out completely" ], [ 4906, "from resulting file." ], [ 4936, "RAR 5.0 recovery record is more resistant to damage of recovery record" ], [ 5014, "itself and can utilize a partially corrupt recovery record data." ], [ 5086, "Note, though, that \"Repair\" command does not fix broken blocks" ], [ 5156, "in recovery record. Only file data are corrected. After successful" ], [ 5230, "archive repair, you may need to create a new recovery record" ], [ 5298, "for saved files." ], [ 5324, "New recovery record is not based on 512 byte sectors anymore" ], [ 5393, "and incorporates more complicated data structures. So it is impossible" ], [ 5471, "to specify its size in sectors. For RAR 5.0 archives the parameter of" ], [ 5548, "-rr[N] switch and rr[N] command is always treated as a percent of" ], [ 5621, "archive size regardless of presence of % character. Typically N%" ], [ 5693, "recovery record can repair up to N% of continuously damaged data" ], [ 5765, "and increases the archive size by only slightly more than N%." ], [ 5834, "Ability to fix multiple damages is proportional to N." ], [ 5897, "We used \"Screaming Fast Galois Field Arithmetic Using Intel" ], [ 5964, "SIMD Instructions\" paper by James S. Plank, Kevin M. Greenan" ], [ 6032, "and Ethan L. Miller to improve Reed-Solomon coding performance." ], [ 6103, "Also we are grateful to Artem Drobanov and Bulat Ziganshin" ], [ 6169, "for samples and ideas allowed to make Reed-Solomon coding" ], [ 6234, "more efficient." ], [ 6259, "5. \"Test\" command verifies validity of RAR 5.0 recovery record." ], [ 6327, "Recovery record is tested after processing all archived files." ], [ 6399, "If corrupt archive contains the recovery record, it might be possible" ], [ 6476, "to repair it even if recovery record validity test is failed." ], [ 6545, "\"Repair\" command attempts to utilize even a partially damaged" ], [ 6614, "recovery record. So treat the negative recovery record test result" ], [ 6688, "as a reason to re-create the archive if original files are still" ], [ 6760, "available, but not as a reason to avoid \"Repair\" command." ], [ 6827, "6. Changes in RAR 5.0 encryption algorithm:" ], [ 6877, "a) encryption algorithm is changed from AES-128 to AES-256 in CBC mode." ], [ 6956, "Key derivation function is based on PBKDF2 using HMAC-SHA256;" ], [ 7030, "b) special password verification value allows to detect most of" ], [ 7101, "wrong passwords without necessity to unpack the entire file;" ], [ 7174, "c) if archive headers are not encrypted (\"Encrypt file names\" option" ], [ 7250, "is off), file checksums for encrypted RAR 5.0 files are modified" ], [ 7325, "using a special password dependent algorithm, to make impossible" ], [ 7400, "guessing file contents based on checksums. Do not expect such" ], [ 7472, "encrypted file checksums to match usual CRC32 and BLAKE2 values." ], [ 7552, "7. RAR 5.0 archives allow to utilize 256 bit length BLAKE2sp hash" ], [ 7622, "( https://blake2.net ) instead of 32 bit CRC32 as a file checksum." ], [ 7696, "Enable \"Use BLAKE2 file checksum\" option in \"Options\" page of" ], [ 7765, "archiving dialog or specify -htb command line switch to use BLAKE2" ], [ 7839, "checksums." ], [ 7859, "While producing slightly larger archives, BLAKE2 can be used" ], [ 7927, "for file contents identification. If two files have the same" ], [ 7995, "BLAKE2 value, it practically guarantees that file contents" ], [ 8061, "is the same. BLAKE2 error detection property is also stronger" ], [ 8130, "than in much shorter CRC32." ], [ 8167, "8. Features removed:" ], [ 8194, "a) authenticity verification feature did not provide the required" ], [ 8267, "level of reliability and was removed;" ], [ 8323, "b) switch -en (do not add \"end of archive\" block) is not supported" ], [ 8397, "by RAR 5.0 archives, which always have the end of archive block." ], [ 8472, "This block helps WinRAR to safely skip external data like" ], [ 8540, "digital signatures appended to archive;" ], [ 8592, "c) old style extension based arcname.rNN volume names are not" ], [ 8661, "supported by RAR 5.0 archives, which use only arcname.partN.rar" ], [ 8735, "volume names;" ], [ 8767, "d) file comments are not supported anymore both in RAR 4.x" ], [ 8833, "and RAR 5.0 archives. Console RAR 'cf' command is removed." ], [ 8902, "It does not affect the archive comment support, which is present" ], [ 8977, "in both versions of archive format and is not planned for removal." ], [ 9056, "9. \"Set password\" command and \"Dictionary size\" option are moved to" ], [ 9128, "\"General\" page of archiving dialog." ], [ 9176, "10. You can use \"Save symbolic links as links\" option on \"Advanced\" page" ], [ 9252, "of archiving dialog to save and restore NTFS symbolic links" ], [ 9319, "and reparse points as links, so their contents is not archived." ], [ 9390, "Command line equivalent of this option is -ol switch." ], [ 9453, "Similar option for NTFS hard links is \"Save hard links as links\"." ], [ 9526, "Its command line equivalent is -oh switch." ], [ 9578, "Both options are available only for RAR 5.0 archive format." ], [ 9650, "11. Added extraction only support for XZ archive format." ], [ 9715, "12. Changes in recovery volume processing in RAR 5.0 archive format:" ], [ 9789, "a) maximum number of RAR+REV volumes in RAR 5.0 format is 65535" ], [ 9860, "instead of 255;" ], [ 9888, "b) recovery volume operations are faster than in RAR 4.x;" ], [ 9955, "c) additionally to recovery data, RAR 5.0 REV files also store" ], [ 10025, "service information such as checksums of protected RAR files." ], [ 10097, "So they are slightly larger than RAR volumes which they protect." ], [ 10172, "If you plan to copy individual RAR and REV files to some removable" ], [ 10249, "media, you need to take it into account and specify RAR volume" ], [ 10322, "size by a few kilobytes smaller than media size." ], [ 10385, "13. Maximum path length for files in RAR and ZIP archives is increased" ], [ 10459, "up to 2048 characters." ], [ 10493, "14. Command line RAR returns the exit code 11 if it can detect that" ], [ 10564, "user entered a wrong password. This code can be returned only" ], [ 10633, "for RAR 5.0 archives. It is impossible to distinguish a wrong" ], [ 10702, "password and data damage for RAR 4.x archives." ], [ 10758, "15. 'v' and 'l' commands display archived file names in the end of line," ], [ 10834, "not in that beginning as before. Also some fields previously" ], [ 10902, "available in 'l' and 'v' output are now shown only by 'lt' and 'vt'." ], [ 10986, "'vt' and 'lt' commands provide the detailed multiline information" ], [ 11059, "for every archived file." ], [ 11093, "'vta' and 'lta' also include service headers into list." ], [ 11158, "16. Now the default charset for filelists in commands like" ], [ 11221, "'rar a arcname @filelist' is ANSI for both WinRAR and console RAR." ], [ 11296, "In previous versions it was ANSI for WinRAR and OEM for console RAR." ], [ 11373, "You can use -sc\u003ccharset\u003el switch to override this default." ], [ 11442, "17. Internal WinRAR viewer can detect and display files in UTF-8" ], [ 11511, "and UTF-16 little endian encodings." ], [ 11557, "18. UTF-16 little endian encoding is used in RAR and WinRAR log file" ], [ 11630, "rar.log, so Unicode file names are stored in the log correctly." ], [ 11702, "WinRAR automatically truncates the old rar.log file in non-Unicode" ], [ 11777, "format to avoid mixing different encoding in the same log file." ], [ 11849, "In case of console RAR you need to delete the old rar.log manually," ], [ 11925, "otherwide RAR will append UTF-16 messages to existing rar.log." ], [ 11998, "19. Command line 'r' (repair) command can include an optional destpath\\" ], [ 12074, "parameter defining the destination folder for repaired archive:" ], [ 12148, "rar r archive.rar destpath\\" ], [ 12197, "Version 4.20" ], [ 12216, "1. Changes in RAR compression:" ], [ 12253, "a) RAR general compression algorithm is optimized for better" ], [ 12321, "utilization of several processor cores. While some speed gain" ], [ 12393, "is possible even in single processor mode, best results" ], [ 12459, "are achieved in multi-core environment." ], [ 12511, "Speed gain depends on data type and average file size." ], [ 12576, "Several cores are utilized more efficiently when compressing" ], [ 12647, "large files." ], [ 12672, "b) we had to increase memory requirements to achieve higher" ], [ 12739, "compression speed. General RAR compression algorithm allocates" ], [ 12812, "about 120 MB comparing to 40 MB in WinRAR 4.11;" ], [ 12872, "c) RAR text compression algorithm cannot utilize several CPU cores" ], [ 12946, "efficiently, so its performance in multiprocessor environment" ], [ 13018, "is much lower than for general algorithm. Also its decompression" ], [ 13093, "speed is much lower than in general algorithm regardless of" ], [ 13163, "CPU number. So we decided to disable the text algorithm by default." ], [ 13243, "If you need maximum possible compression ratio for plain text data" ], [ 13320, "regardless of speed, you can enable the text compression" ], [ 13387, "in \"Advanced compression parameter\" dialog. Press \"Compression...\"" ], [ 13464, "button on \"Advanced\" page of archiving dialog to access it." ], [ 13534, "You can also change this option permanently in default compression" ], [ 13632, "In the command line mode the text compression can be enabled" ], [ 13703, "with -mct switch;" ], [ 13733, "d) \"Fastest\" (-m1) compression mode also supports several processor" ], [ 13808, "cores now. In 4.11 it could use only a single processor core." ], [ 13882, "2. RAR general decompression algorithm speed is slightly improved," ], [ 13953, "though not to same extent as RAR compression. RAR decompression" ], [ 14024, "is not able to use several processor cores, so its performance" ], [ 14094, "does not depend on a number of cores." ], [ 14141, "3. Changes in ZIP compression:" ], [ 14178, "a) now ZIP compression supports several processor cores resulting" ], [ 14251, "in noticeably higher performance in multi-core environment." ], [ 14321, "Single CPU ZIP compression is also faster than in 4.11;" ], [ 14389, "b) memory use for ZIP compression is increased to about 15 MB." ], [ 14461, "4. Recovery volume creating and processing can use several CPU cores" ], [ 14534, "resulting in higher speed. Though, typically hard drive seek speed" ], [ 14608, "is a limiting factor for recovery volumes, so this gain is most" ], [ 14679, "noticeable when working with solid state drive." ], [ 14736, "5. Now the allowed \u003cthreads\u003e value for -mt\u003cthreads\u003e switch is 1 - 32," ], [ 14810, "not 0 - 16 as before." ], [ 14841, "6. \"Find files\" command can search data in 7-Zip archives." ], [ 14904, "Previously \"Find files\" did not support .7z archive format." ], [ 14973, "7. Windows 2000 is not supported by WinRAR and WinRAR self-extracting" ], [ 15047, "modules anymore." ], [ 15073, "8. \"Save current settings\" button in \"Advanced SFX options\" dialog" ], [ 15144, "is now available only when converting an existing archive to SFX." ], [ 15217, "Options saved with this button are applied only to convert to SFX" ], [ 15290, "operation." ], [ 15310, "If you create or update SFX archive, only SFX options stored" ], [ 15378, "in default compression profile are used. Options saved" ], [ 15440, "in \"Advanced SFX options\" dialog are ignored for these operations." ], [ 15518, "Version 4.11" ], [ 15537, "1. Bugs fixed:" ], [ 15558, "a) WinRAR did not store NTFS \"Compressed\" attribute, when creating" ], [ 15632, "RAR archives;" ], [ 15658, "b) WinRAR crashed in command line mode if @filelist parameter" ], [ 15728, "was present and 'filelist' did not exist. This bug affected" ], [ 15798, "only WinRAR.exe, not RAR.exe;" ], [ 15840, "c) if -x*\\somefolder\\* exclusion mask was specified when archiving" ], [ 15915, "and if name of current folder contained 'somefolder'," ], [ 15980, "WinRAR excluded all files and stopped creating an archive;" ], [ 16051, "d) GUI self-extracting archives did not work in Windows" ], [ 16114, "Preinstallation Environment (Windows PE)." ], [ 16173, "Version 4.10" ], [ 16192, "1. WinRAR can create ZIP archives of practically any size." ], [ 16257, "2 GB archive size and 65535 file number ZIP limitations of previous" ], [ 16332, "WinRAR versions are not valid anymore." ], [ 16380, "2. WinRAR can create multivolume ZIP archives, which are also known as" ] ], "sz": 42404, "ts": [ { "c": 0.8399999737739563, "d": "Right string trimming", "e": [ "right" ], "i": "micro-behaviors/process/create/shell/lang::right-string-call", "l": 2 }, { "c": 0.8399999737739563, "d": "Split string reconstruction", "e": [ "split" ], "i": "micro-behaviors/process/create/shell/lang::split-string-call", "l": 2 } ], "sha": "6a6e83740b74d3b6b06214edf930f3003dcde195fd877f1e49ee9b4d0fb923f0", "path": "64301!!WhatsNew.txt", "type": "text" }, { "f": "H(Db₂)", "x": 1, "dp": 1, "id": 29, "ms": { "text": { "digit_ratio": 0.01, "space_count": 29290.0, "total_lines": 2388.0, "char_entropy": 4.28, "unique_chars": 93.0, "ascii_art_lines": 2.0, "avg_line_length": 39.17, "max_line_length": 78.0, "empty_line_ratio": 0.32, "last_line_length": 34.0, "most_common_char": "e", "whitespace_ratio": 0.35, "most_common_ratio": 0.07, "line_length_stddev": 30.74, "repeated_char_sequences": 1369.0, "max_inline_whitespace_run": 19.0, "trailing_whitespace_lines": 18.0 } }, "ss": [ [ 0, "User's Manual" ], [ 88, "RAR 5.00 console version" ], [ 243, "Welcome to the RAR Archiver!" ], [ 351, "Introduction" ], [ 383, "RAR is a console application allowing to manage archive files" ], [ 450, "in command line mode. RAR provides compression, encryption," ], [ 513, "data recovery and many other functions described in this manual." ], [ 583, "RAR supports only RAR format archives, which have .rar file name" ], [ 653, "extension by default. ZIP and other formats are not supported." ], [ 719, "Even if you specify .zip extension when creating an archive, it will" ], [ 791, "still be in RAR format. Windows users may install WinRAR, which supports" ], [ 867, "more archive types including RAR and ZIP formats." ], [ 922, "WinRAR provides both graphical user interface and command line mode." ], [ 996, "While console RAR and GUI WinRAR have the similar command line syntax," ], [ 1070, "some differences exist. So it is recommended to use this rar.txt manual" ], [ 1145, "for console RAR (rar.exe in case of Windows version) and winrar.chm" ], [ 1216, "WinRAR help file for GUI WinRAR (winrar.exe)." ], [ 1269, "Configuration file" ], [ 1313, "RAR for Unix reads configuration information from the file .rarrc" ], [ 1382, "in the user's home directory (stored in HOME environment variable)" ], [ 1452, "or in /etc directory." ], [ 1479, "RAR for Windows reads configuration information from the file rar.ini," ], [ 1553, "placed in the same directory as the rar.exe file." ], [ 1608, "This file may contain the following string:" ], [ 1657, "switches=any RAR switches, separated by spaces" ], [ 1709, "For example:" ], [ 1727, "switches=-m5 -s" ], [ 1750, "Environment variable" ], [ 1798, "Default parameters may be added to the RAR command line by establishing" ], [ 1875, "an environment variable \"RAR\"." ], [ 1913, "For instance, in Unix following lines may be added to your profile:" ], [ 1988, "RAR='-s -md1024'" ], [ 2012, "export RAR" ], [ 2032, "RAR will use this string as default parameters in the command line and" ], [ 2108, "will create \"solid\" archives with 1024 KB sliding dictionary size." ], [ 2182, "RAR handles options with priority as following:" ], [ 2237, "command line switches highest priority" ], [ 2302, "switches in the RAR variable lower priority" ], [ 2365, "switches saved in configuration file lowest priority" ], [ 2433, "Log file" ], [ 2457, "If the switch -ilog is specified in the command line or configuration" ], [ 2530, "file, RAR will write informational messages, concerning errors" ], [ 2596, "encountered while processing archives, into a log file. Read switch" ], [ 2667, "-ilog description for more details." ], [ 2710, "The file order list for solid archiving - rarfiles.lst" ], [ 2826, "rarfiles.lst contains a user-defined file list, which tells RAR" ], [ 2893, "the order in which to add files to a solid archive. It may contain" ], [ 2963, "file names, wildcards and special entry - $default. The default" ], [ 3030, "entry defines the place in order list for files not matched" ], [ 3093, "with other entries in this file. The comment character is ';'." ], [ 3161, "In Windows this file should be placed in the same directory as RAR" ], [ 3231, "or in %APPDATA%\\WinRAR directory, in Unix - to the user's home directory" ], [ 3307, "or in /etc." ], [ 3324, "Tips to provide improved compression and speed of operation:" ], [ 3390, "- similar files should be grouped together in the archive;" ], [ 3452, "- frequently accessed files should be placed at the beginning." ], [ 3520, "Normally masks placed nearer to the top of list have a higher priority," ], [ 3595, "but there is an exception from this rule. If rarfiles.lst contains such" ], [ 3670, "two masks that all files matched by one mask are also matched by another," ], [ 3747, "that mask which matches a smaller subset of file names will have higher" ], [ 3822, "priority regardless of its position in the list. For example, if you have" ], [ 3899, "*.cpp and f*.cpp masks, f*.cpp has a higher priority, so the position of" ], [ 3975, "'filename.cpp' will be chosen according to 'f*.cpp', not '*.cpp'." ], [ 4048, "RAR command line syntax" ], [ 4102, "Syntax" ], [ 4113, "RAR \u003ccommand\u003e [ -\u003cswitches\u003e ] \u003carchive\u003e [ \u003c@listfiles...\u003e ]" ], [ 4181, "[ \u003cfiles...\u003e ] [ \u003cpath_to_extract\\\u003e ]" ], [ 4231, "Description" ], [ 4247, "Command line options (commands and switches) provide control of" ], [ 4316, "creating and managing archives with RAR. The command is a string (or a" ], [ 4392, "single letter) which commands RAR to perform a corresponding action." ], [ 4466, "Switches are designed to modify the way RAR performs the action. Other" ], [ 4542, "parameters are archive name and files to be archived into or extracted" ], [ 4618, "from the archive." ], [ 4643, "Listfiles are plain text files that contain names of files to process." ], [ 4719, "File names should start at the first column. It is possible to" ], [ 4787, "put comments to the listfile after // characters. For example," ], [ 4855, "you may create backup.lst containing the following strings:" ], [ 4922, "c:\\work\\doc\\*.txt //backup text documents" ], [ 4977, "c:\\work\\image\\*.bmp //backup pictures" ], [ 5026, "c:\\work\\misc" ], [ 5046, "and then run:" ], [ 5067, "rar a backup @backup.lst" ], [ 5102, "If you wish to read file names from stdin (standard input)," ], [ 5167, "specify the empty listfile name (just @)." ], [ 5216, "By default, console RAR uses the single byte encoding in list files," ], [ 5290, "but it can be redefined with -sc\u003ccharset\u003el switch." ], [ 5348, "You may specify both usual file names and list files in the same" ], [ 5418, "command line. If neither files nor listfiles are specified," ], [ 5483, "then *.* is implied and RAR will process all files." ], [ 5542, "Many RAR commands, such as extraction, test or list, allow to use" ], [ 5613, "wildcards in archive name. If no extension is specified in archive" ], [ 5685, "mask, RAR assumes .rar, so * means all archives with .rar extension." ], [ 5759, "If you need to process all archives without extension, use *. mask." ], [ 5832, "*.* mask selects all files. Wildcards in archive name are not allowed" ], [ 5907, "when archiving and deleting." ], [ 5943, "In Unix you need to enclose RAR command line parameters containing" ], [ 6015, "wildcards in single or double quotes to prevent their expansion" ], [ 6084, "by Unix shell. For example, this command will extract *.asm files" ], [ 6155, "from all *.rar archives in current directory:" ], [ 6242, "Command could be any of the following:" ], [ 6288, "a Add files to archive." ], [ 6350, "1) add all *.hlp files from the current directory to" ], [ 6416, "the archive help.rar:" ], [ 6453, "rar a help *.hlp" ], [ 6485, "2) archive all files from the current directory and subdirectories" ], [ 6565, "to 362000 bytes size solid, self-extracting volumes" ], [ 6630, "and add the recovery record to each volume:" ], [ 6689, "rar a -r -v362 -s -sfx -rr save" ], [ 6736, "Because no file names are specified, all files (*) are assumed." ], [ 6815, "3) as a special exception, if directory name is specified as" ], [ 6889, "an argument and if directory name does not include file masks" ], [ 6964, "and trailing backslashes, the entire contents of the directory" ], [ 7040, "and all subdirectories will be added to the archive even" ], [ 7110, "if switch -r is not specified." ], [ 7156, "The following command will add all files from the directory" ], [ 7229, "Bitmaps and its subdirectories to the RAR archive Pictures.rar:" ], [ 7308, "rar a Pictures.rar Bitmaps" ], [ 7350, "4) if directory name includes file masks or trailing backslashes," ], [ 7429, "normal rules apply and you need to specify switch -r to process" ], [ 7506, "its subdirectories." ], [ 7541, "The following command will add all files from directory Bitmaps," ], [ 7619, "but not from its subdirectories, because switch -r is not" ], [ 7716, "rar a Pictures.rar Bitmaps\\*" ], [ 7762, "c Add archive comment. Comments are displayed while the archive is" ], [ 7840, "being processed. Comment length is limited to 62000 bytes" ], [ 7938, "rar c distrib.rar" ], [ 7971, "Also comments may be added from a file using -z[file] switch." ], [ 8046, "The following command adds a comment from info.txt file:" ], [ 8118, "rar c -zinfo.txt dummy" ], [ 8158, "ch Change archive parameters." ], [ 8200, "This command can be used with most of archive modification" ], [ 8272, "switches to modify archive parameters. It is especially" ], [ 8341, "convenient for switches like -cl, -cu, -tl, which do not" ], [ 8411, "have a dedicated command." ], [ 8452, "It is not able to recompress, encrypt or decrypt archive data" ], [ 8527, "and it cannot merge or create volumes. If used without any" ], [ 8599, "switches, 'ch' command just copies the archive data without" ], [ 8672, "modification." ], [ 8725, "Set archive time to latest file:" ], [ 8773, "rar ch -tl files.rar" ], [ 8811, "cw Write archive comment to specified file." ], [ 8867, "Format of output file depends on -sc switch." ], [ 8927, "If output file name is not specified, comment data will be" ], [ 8999, "sent to stdout." ], [ 9055, "1) rar cw arc comment.txt" ], [ 9096, "2) rar cw -scuc arc unicode.txt" ], [ 9174, "d Delete files from archive. Please note if the processing of this" ], [ 9252, "command results in removing all the files from the archive," ], [ 9325, "the empty archive would removed." ], [ 9375, "e Extract files without archived paths." ], [ 9428, "Extract files excluding their path component, so all files" ], [ 9500, "are created in the same destination directory." ], [ 9562, "Use 'x' command if you wish to extract full pathnames." ], [ 9656, "rar e -or html.rar *.css css\\" ], [ 9701, "extract all *.css files from html.rar archive to 'css' folder" ], [ 9776, "excluding archived paths. Rename extracted files automatically" ], [ 9852, "in case several files have the same name." ], [ 9911, "f Freshen files in archive. Updates those files changed since they" ], [ 9989, "were packed to the archive. This command will not add new files" ], [ 10066, "to the archive." ], [ 10124, "Find string in archives." ], [ 10164, "Supports following optional parameters:" ], [ 10219, "i - case insensitive search (default);" ], [ 10275, "c - case sensitive search;" ], [ 10319, "h - hexadecimal search;" ], [ 10360, "t - use ANSI, Unicode and OEM character tables (Windows only);" ], [ 10440, "If no parameters are specified, it is possible to use" ], [ 10507, "the simplified command syntax i\u003cstring\u003e instead of i=\u003cstring\u003e" ], [ 10584, "It is allowed to specify 't' modifier with other parameters," ], [ 10658, "for example, ict=string performs case sensitive search" ], [ 10726, "using all mentioned above character tables." ], [ 10810, "1) rar \"ic=first level\" -r c:\\*.rar *.txt" ], [ 10867, "Perform case sensitive search of \"first level\" string" ], [ 10934, "in *.txt files in *.rar archives on the disk c:" ], [ 10997, "2) rar ih=f0e0aeaeab2d83e3a9 -r e:\\texts" ], [ 11053, "Search for hex string f0 e0 ae ae ab 2d 83 e3 a9" ], [ 11115, "in rar archives in e:\\texts directory." ], [ 11171, "k Lock archive. Any command which intends to change the archive" ], [ 11246, "will be ignored." ], [ 11302, "rar k final.rar" ], [ 11350, "List archive contents [technical [all], bare]." ], [ 11416, "'l' command lists archived file attributes, size, date," ], [ 11485, "time and name, one file per line. If file is encrypted," ], [ 11554, "line starts from '*' character." ], [ 11601, "'lt' displays the detailed file information in multiline mode." ], [ 11677, "This information includes file checksum value, host OS," ], [ 11746, "compression options and other parameters." ], [ 11803, "'lta' provide the detailed information not only for files," ], [ 11875, "but also for service headers like NTFS streams" ], [ 11935, "or file security data." ], [ 11973, "'lb' lists bare file names with path, one per line," ], [ 12038, "without any additional information." ], [ 12089, "You can use -v switch to list contents of all volumes" ], [ 12156, "in volume set: rar l -v vol.part1.rar" ], [ 12277, "and 'vb' correspondingly." ], [ 12320, "m[f] Move to archive [files only]. Moving files and directories" ], [ 12392, "results in the files and directories being erased upon" ], [ 12460, "successful completion of the packing operation. Directories will" ], [ 12538, "not be removed if 'f' modifier is used and/or '-ed' switch is" ], [ 12613, "applied." ], [ 12639, "p Print file to stdout." ], [ 12676, "You may use this command together with -inul switch to disable" ], [ 12752, "all RAR messages and print only file data. It may be important" ], [ 12828, "when you need to send a file to stdout for use in pipes." ], [ 12906, "r Repair archive. Archive repairing is performed in two stages." ], [ 12981, "First, the damaged archive is searched for a recovery record" ], [ 13055, "(see 'rr' command). If archive contains the previously added" ], [ 13129, "recovery record and if damaged data area is continuous" ], [ 13197, "and smaller than error correction code size in recovery record," ], [ 13274, "chance of successful archive reconstruction is high." ], [ 13340, "When this stage has been completed, a new archive is created," ], [ 13415, "named as fixed.arcname.rar, where 'arcname' is the original" ], [ 13488, "(damaged) archive name." ], [ 13539, "If broken archive does not contain a recovery record or if" ], [ 13611, "archive is not completely recovered due to major damage," ], [ 13681, "second stage is performed. During this stage only the archive" ], [ 13756, "structure is reconstructed and it is impossible to recover" ], [ 13828, "files which fail checksum validation, it is still possible," ], [ 13901, "however, to recover undamaged files, which were inaccessible" ], [ 13975, "due to the broken archive structure. Mostly this is useful" ], [ 14047, "for non-solid archives. This stage is never efficient" ], [ 14114, "for archives with encrypted file headers, which can be repaired" ], [ 14191, "only if recovery record is present." ], [ 14242, "When the second stage is completed, the reconstructed archive" ], [ 14317, "is saved as rebuilt.arcname.rar, where 'arcname' is" ], [ 14382, "the original archive name." ], [ 14424, "By default, repaired archives are created in the current" ], [ 14494, "directory, but you can append an optional destpath\\ parameter" ], [ 14569, "to specify another destination directory." ], [ 14650, "rar r buggy.rar c:\\fixed\\" ], [ 14691, "repair buggy.rar and place the result to 'c:\\fixed' directory." ], [ 14771, "rc Reconstruct missing and damaged volumes using recovery volumes" ], [ 14847, "(.rev files). You need to specify any existing volume" ], [ 14914, "as the archive name, for example, 'rar rc backup.part03.rar'" ], [ 14990, "Read 'rv' command description for information about" ], [ 15055, "recovery volumes." ], [ 15090, "rn Rename archived files." ], [ 15128, "The command syntax is:" ], [ 15166, "rar rn \u003carcname\u003e \u003csrcname1\u003e \u003cdestname1\u003e ... \u003csrcnameN\u003e \u003cdestnameN\u003e" ], [ 15248, "For example, the following command:" ], [ 15299, "rar rn data.rar readme.txt readme.bak info.txt info.bak" ], [ 15370, "will rename readme.txt to readme.bak and info.txt to info.bak" ], [ 15445, "in the archive data.rar." ], [ 15485, "It is allowed to use wildcards in the source and destination" ], [ 15559, "names for simple name transformations like changing file" ], [ 15629, "extensions. For example:" ], [ 15669, "rar rn data.rar *.txt *.bak" ], [ 15712, "will rename all *.txt files to *.bak." ], [ 15765, "RAR does not check if the destination file name is already" ], [ 15837, "present in the archive, so you need to be careful to avoid" ], [ 15909, "duplicated names. It is especially important when using" ], [ 15978, "wildcards. Such a command is potentially dangerous, because" ], [ 16051, "a wrong wildcard may corrupt all archived names." ], [ 16117, "rr[N] Add data recovery record. Optionally, redundant information" ], [ 16190, "(recovery record) may be added to archive. While it increases" ] ], "sz": 98311, "ts": [ { "c": 0.8999999761581421, "d": "RAR member contains shell script", "e": [ ".bat" ], "i": "micro-behaviors/data/archive/rar::shell-script-member-extension", "l": 1 }, { "c": 0.8399999737739563, "d": "Split string reconstruction", "e": [ "split" ], "i": "micro-behaviors/process/create/shell/lang::split-string-call", "l": 2 }, { "c": 0.8199999928474426, "d": "LLM secret data target", "e": [ "secret" ], "i": "micro-behaviors/data/text/llm::llm-secret-target", "l": 1 } ], "sha": "8d7d14761e991aba5fed6a91cb24a4454644126d8412beae6232b8322e90738f", "path": "64301!!Rar.txt", "type": "text" }, { "dp": 1, "id": 30, "ms": { "text": { "digit_ratio": 0.01, "space_count": 216.0, "total_lines": 31.0, "char_entropy": 4.7, "unique_chars": 60.0, "avg_line_length": 39.42, "max_line_length": 73.0, "empty_line_ratio": 0.32, "last_line_length": 61.0, "most_common_char": "e", "whitespace_ratio": 0.22, "most_common_ratio": 0.07, "line_length_stddev": 30.19, "max_inline_whitespace_run": 1.0 } }, "ss": [ [ 0, "This archive contains WinRAR multifunctional archive manager." ], [ 68, "WinRAR features:" ], [ 91, "* WinRAR introduces an original compression algorithm. It provides" ], [ 160, "a high compression ratio on executable files, object libraries," ], [ 228, "large text files, etc." ], [ 257, "* Internally RAR format does not limit archive and file sizes" ], [ 321, "also as a number of files in archive. These values may be limited by" ], [ 394, "file and operating systems also as by available memory." ], [ 456, "* WinRAR provides complete support for RAR and ZIP 2.0 archives" ], [ 522, "and is able to unpack 7Z, ACE, ARJ, BZ2, CAB, GZ, ISO, JAR, LZH," ], [ 591, "TAR, UUE, XZ, Z archives." ], [ 623, "* WinRAR offers both a classic interactive Windows interface" ], [ 686, "and the command line interface." ], [ 724, "* WinRAR provides functionality for creating a 'solid' archive," ], [ 790, "which can raise the compression ratio by 10% - 50% over more common" ], [ 862, "methods, particularly when packing large numbers of small files." ], [ 933, "* WinRAR offers the ability to create customizable SFX archives." ], [ 1002, "* WinRAR offers the ability to create a multi-volume archive as SFX." ], [ 1075, "* Optional recovery record allows to protect archives from damage." ], [ 1146, "* WinRAR offers a number of service functions, such as encrypting files," ], [ 1221, "adding archive comments and preserving NTFS file security." ] ], "sz": 1284, "sha": "25c6c5f336b404579889549b10a45f5e32ce5844a5a5a29075168d460d025bd2", "path": "64301!!ReadMe.txt", "type": "text" }, { "f": "H(Po)", "x": 1, "dp": 1, "id": 31, "ms": { "text": { "digit_ratio": 0.01, "space_count": 1280.0, "total_lines": 114.0, "char_entropy": 4.39, "unique_chars": 68.0, "avg_line_length": 52.03, "max_line_length": 79.0, "empty_line_ratio": 0.21, "last_line_length": 35.0, "most_common_char": "e", "whitespace_ratio": 0.24, "most_common_ratio": 0.1, "line_length_stddev": 29.9, "max_inline_whitespace_run": 1.0 } }, "ss": [ [ 0, "END USER LICENSE AGREEMENT" ], [ 35, "The following agreement regarding RAR (and its Windows version - WinRAR)" ], [ 114, "archiver - referred to as \"software\" - is made between win.rar GmbH -" ], [ 190, "referred to as \"licensor\" - and anyone who is installing, accessing" ], [ 264, "or in any other way using the software - referred to as \"user\"." ], [ 336, "1. The author and holder of the copyright of the software is" ], [ 400, "Alexander L. Roshal. The licensor and as such issuer of the license" ], [ 474, "and bearer of the worldwide exclusive usage rights including the rights" ], [ 552, "to reproduce, distribute and make the software available to the public" ], [ 629, "in any form is win.rar GmbH, Schumannstr. 17, 10117 Berlin, Germany." ], [ 706, "2. The software is distributed as try before you buy. This means that" ], [ 779, "anyone may use the software during a test period of a maximum of 40 days" ], [ 858, "at no charge. Following this test period, the user must purchase" ], [ 929, "a license to continue using the software." ], [ 979, "3. The software's trial version may be freely distributed, with exceptions" ], [ 1057, "noted below, provided the distribution package is not modified in any way." ], [ 1140, "a. Nobody may distribute separate parts of the package, with the exception" ], [ 1221, "of the UnRAR components, without written permission." ], [ 1285, "b. The software's unlicensed trial version may not be distributed" ], [ 1357, "inside of any other software package without written permission." ], [ 1433, "c. Hacks/cracks, keys or key generators may not be included, pointed to" ], [ 1511, "or referred to by the distributor of the trial version." ], [ 1578, "4. The trial version of the software can display a registration reminder" ], [ 1654, "dialog. Depending on the software version and configuration such dialog" ], [ 1732, "can contain either a predefined text and links loaded locally" ], [ 1800, "or a web page loaded from the internet. Such web page can contain" ], [ 1872, "licensing instructions or other materials according to the licensor's" ], [ 1948, "choice, including advertisement. When opening a web page, the software" ], [ 2025, "transfers only those parameters which are technically required" ], [ 2094, "by HTTP protocol to successfully open a web page in a browser." ], [ 2165, "5. The software is distributed \"as is\". No warranty of any kind is expressed" ], [ 2245, "or implied. You use at your own risk. Neither the author, the licensor" ], [ 2322, "nor the agents of the licensor will be liable for data loss, damages," ], [ 2398, "loss of profits or any other kind of loss while using or misusing" ], [ 2470, "this software." ], [ 2493, "6. There are 2 basic types of licenses issued for the software. These are:" ], [ 2573, "a. A single computer usage license. The user purchases one license to" ], [ 2649, "use the software on one computer." ], [ 2694, "Home users may use their single computer usage license on all" ], [ 2765, "computers and mobile devices (USB drive, external hard drive, etc.)" ], [ 2842, "which are property of the license owner." ], [ 2894, "Business users require one license per computer or mobile device" ], [ 2968, "on which the software is installed." ], [ 3015, "b. A multiple usage license. The user purchases a number of usage" ], [ 3087, "licenses for use, by the purchaser or the purchaser's employees" ], [ 3160, "on the same number of computers." ], [ 3204, "In a network (server/client) environment the user must purchase" ], [ 3277, "a license copy for each separate client (workstation) on which" ], [ 3349, "the software is installed, used or accessed. A separate license copy" ], [ 3427, "for each client (workstation) is needed regardless of whether" ], [ 3498, "the clients (workstations) will use the software simultaneously" ], [ 3571, "or at different times. If for example you wish to have 9 different" ], [ 3647, "clients (workstations) in your network with access to RAR," ], [ 3715, "you must purchase 9 license copies." ], [ 3762, "A user who purchased a license, is granted a non-exclusive right to use" ], [ 3840, "the software on as many computers as defined by the licensing terms above" ], [ 3920, "according to the number of licenses purchased, for any legal purpose." ], [ 3998, "7. There are no additional license fees, apart from the cost of the license," ], [ 4078, "associated with the creation and distribution of RAR archives," ], [ 4147, "volumes, self-extracting archives or self-extracting volumes." ], [ 4215, "Owners of a license may use their copies of the software to produce" ], [ 4289, "archives and self-extracting archives and to distribute those archives" ], [ 4366, "free of any additional royalties." ], [ 4408, "8. The licensed software may not be rented or leased but may be permanently" ], [ 4487, "transferred, in its entirety, if the recipient agrees to the terms of" ], [ 4563, "this license." ], [ 4585, "9. To buy a license, please read the file order.htm provided with" ], [ 4654, "the software for details." ], [ 4688, "10. You may not use, copy, emulate, clone, rent, lease, sell, modify," ], [ 4760, "decompile, disassemble, otherwise reverse engineer, or transfer" ], [ 4830, "the licensed software, or any subset of the licensed software," ], [ 4899, "except as provided for in this agreement. Any such unauthorized use" ], [ 4973, "shall result in immediate and automatic termination of this license" ], [ 5047, "and may result in criminal and/or civil prosecution." ], [ 5108, "Neither RAR binary code, WinRAR binary code, UnRAR source" ], [ 5172, "or UnRAR binary code may be used or reverse engineered to re-create" ], [ 5246, "the RAR compression algorithm, which is proprietary, without written" ], [ 5321, "permission." ], [ 5341, "The software may be using components developed and/or copyrighted" ], [ 5413, "by third parties. Please read \"Acknowledgments\" help file topic" ], [ 5483, "for WinRAR or acknow.txt text file for other RAR versions for details." ], [ 5562, "11. This License Agreement is construed solely and exclusively under" ], [ 5633, "German law. If you are a merchant, the courts at the registered office" ], [ 5710, "of win.rar GmbH in Berlin/Germany shall have exclusive jurisdiction" ], [ 5784, "for any and all disputes arising in connection with this License" ], [ 5855, "Agreement or its validity." ], [ 5890, "12. Installing and using the software signifies acceptance of these terms" ], [ 5966, "and conditions of the license. If you do not agree with the terms of this" ], [ 6046, "license, you must remove all software files from your storage devices" ], [ 6122, "and cease to use the software." ] ], "sz": 6159, "ts": [ { "c": 0.8399999737739563, "d": "Right string trimming", "e": [ "right" ], "i": "micro-behaviors/process/create/shell/lang::right-string-call", "l": 2 } ], "sha": "bb2d3977ed5c4e066a5b57dae9b7a07074a1262ec8591aa5dd3b4137ef4fc12e", "path": "64301!!License.txt", "type": "text" } ], "tv": "feb13" } }