{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T17:16:34Z" }, "path": "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)", "x": 7, "ff": { "i": [ [ "kernel32", "WriteFile" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "WaitForMultipleObjects" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "VirtualFree" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "SwitchToThread" ], [ "kernel32", "SuspendThread" ], [ "kernel32", "SetWaitableTimer" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "SetProcessPriorityBoost" ], [ "kernel32", "SetEvent" ], [ "kernel32", "SetErrorMode" ], [ "kernel32", "SetConsoleCtrlHandler" ], [ "kernel32", "ResumeThread" ], [ "kernel32", "PostQueuedCompletionStatus" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "LoadLibraryW" ], [ "kernel32", "SetThreadContext" ], [ "kernel32", "GetThreadContext" ], [ "kernel32", "GetSystemInfo" ], [ "kernel32", "GetSystemDirectoryA" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetQueuedCompletionStatusEx" ], [ "kernel32", "GetProcessAffinityMask" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "DuplicateHandle" ], [ "kernel32", "CreateWaitableTimerExW" ], [ "kernel32", "CreateThread" ], [ "kernel32", "CreateIoCompletionPort" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "CreateEventA" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "AddVectoredExceptionHandler" ] ], "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 1655507.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 212.0, "base_relocation_entry_count": 16742.0 }, "file": { "size": 1596416.0, "entropy": 6.21, "size_bytes": 1596416.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.13, "data_entropy": 5.18, "string_count": 6254.0, "entropy_variance": 4.82, "avg_string_length": 26.96, "max_string_length": 60456.0, "code_to_data_ratio": 0.89, "string_length_stddev": 766.61, "largest_section_ratio": 0.46, "sentence_string_count": 399.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 2.0 }, "imports": { "count": 39.0 }, "sections": { "count": 6.0, "code_size": 730624.0, "entropy_max": 6.67, "entropy_mean": 4.71, "name_entropy": 3.43, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.data" ], [ 496, "u8", ".idata" ], [ 536, "u8", ".reloc" ], [ 575, "u8", "B.symtab" ], [ 1163, "stack", "qi46" ], [ 732591, "u8", "time" ], [ 732873, "u8", "Zone" ], [ 732879, "u8", "abid" ], [ 732909, "u8", "base" ], [ 732933, "u8", "code" ], [ 732951, "u8", "data" ], [ 732957, "u8", "date" ], [ 732969, "u8", "done" ], [ 732987, "u8", "elem" ], [ 733035, "u8", "free" ], [ 733059, "u8", "goid" ], [ 733083, "u8", "head" ], [ 733089, "u8", "heap" ], [ 733095, "u8", "info" ], [ 733101, "u8", "init" ], [ 733107, "u8", "ireg" ], [ 733155, "u8", "load" ], [ 733173, "u8", "mode" ], [ 733185, "u8", "mono" ], [ 733191, "u8", "name" ], [ 733215, "u8", "node" ], [ 733233, "u8", "once" ], [ 733263, "u8", "path" ], [ 733329, "u8", "read" ], [ 733365, "u8", "seek" ], [ 733377, "u8", "sema" ], [ 733389, "u8", "size" ], [ 733401, "u8", "tail" ], [ 733407, "u8", "text" ], [ 733419, "u8", "user" ], [ 733437, "u8", "wait" ], [ 733443, "u8", "wake" ], [ 733467, "u8", "zero" ], [ 733473, "u8", "zone" ], [ 733794, "u8", "align" ], [ 733801, "u8", "alloc" ], [ 733815, "u8", "cache" ], [ 733836, "u8", "close" ], [ 733843, "u8", "count" ], [ 733850, "u8", "csema" ], [ 733857, "u8", "cutab" ], [ 733864, "u8", "datap" ], [ 733878, "u8", "edata" ], [ 733885, "u8", "elems" ], [ 733906, "u8", "equal" ], [ 733913, "u8", "errno" ], [ 733920, "u8", "etext" ], [ 733927, "u8", "evict" ], [ 733934, "u8", "extra" ], [ 733962, "u8", "fmtBs" ], [ 733969, "u8", "fmtBx" ], [ 733976, "u8", "fmtQc" ], [ 733983, "u8", "fmtSx" ], [ 733997, "u8", "gFree" ], [ 734004, "u8", "gList" ], [ 734018, "u8", "hash0" ], [ 734025, "u8", "idxhi" ], [ 734032, "u8", "idxlo" ], [ 734039, "u8", "incgo" ], [ 734046, "u8", "index" ], [ 734053, "u8", "inter" ], [ 734060, "u8", "iregs" ], [ 734067, "u8", "isDST" ], [ 734081, "u8", "isutc" ], [ 734088, "u8", "limit" ], [ 734095, "u8", "local" ], [ 734109, "u8", "magic" ], [ 734123, "u8", "minLC" ], [ 734137, "u8", "minus" ], [ 734158, "u8", "param" ], [ 734179, "u8", "plusV" ], [ 734186, "u8", "pread" ], [ 734193, "u8", "ptrTo" ], [ 734200, "u8", "ready" ], [ 734221, "u8", "reset" ], [ 734228, "u8", "rsema" ], [ 734242, "u8", "runes" ], [ 734277, "u8", "sigMu" ], [ 734291, "u8", "sleep" ], [ 734298, "u8", "space" ], [ 734333, "u8", "state" ], [ 734354, "u8", "timer" ], [ 734375, "u8", "valid" ], [ 734382, "u8", "value" ], [ 734389, "u8", "wbBuf" ], [ 734396, "u8", "wbuf1" ], [ 734403, "u8", "wbuf2" ], [ 734410, "u8", "write" ], [ 734417, "u8", "wsema" ], [ 734626, "u8", "errors" ], [ 734634, "u8", "unsafe" ], [ 735002, "u8", "Writev" ], [ 735010, "u8", "_defer" ], [ 735018, "u8", "_panic" ], [ 735026, "u8", "abiMap" ], [ 735034, "u8", "addArg" ], [ 735042, "u8", "addSec" ], [ 735050, "u8", "allocN" ], [ 735058, "u8", "append" ], [ 735066, "u8", "argLen" ], [ 735074, "u8", "closed" ], [ 735082, "u8", "common" ], [ 735090, "u8", "decref" ], [ 735098, "u8", "delete" ], [ 735106, "u8", "divMul" ], [ 735114, "u8", "divmod" ], [ 735122, "u8", "doSlow" ], [ 735130, "u8", "etypes" ], [ 735138, "u8", "exited" ], [ 735146, "u8", "extend" ], [ 735154, "u8", "fmtSbx" ], [ 735162, "u8", "frames" ], [ 735170, "u8", "funcID" ], [ 735178, "u8", "gcdata" ], [ 735186, "u8", "goexit" ], [ 735194, "u8", "gofunc" ], [ 735202, "u8", "handle" ], [ 735210, "u8", "inList" ], [ 735218, "u8", "incref" ], [ 735226, "u8", "insert" ], [ 735234, "u8", "intbuf" ], [ 735242, "u8", "isFile" ], [ 735250, "u8", "isFree" ], [ 735258, "u8", "isdone" ], [ 735266, "u8", "labels" ], [ 735274, "u8", "layout" ], [ 735282, "u8", "locabs" ], [ 735290, "u8", "lookup" ], [ 735298, "u8", "mcache" ], [ 735306, "u8", "mcount" ], [ 735314, "u8", "method" ], [ 735322, "u8", "mustBe" ], [ 735330, "u8", "nelems" ], [ 735338, "u8", "nfiles" ], [ 735346, "u8", "noCopy" ], [ 735354, "u8", "noscan" ], [ 735362, "u8", "npages" ], [ 735370, "u8", "offset" ], [ 735378, "u8", "opaque" ], [ 735386, "u8", "palloc" ], [ 735394, "u8", "parent" ], [ 735402, "u8", "parked" ], [ 735410, "u8", "pcache" ], [ 735418, "u8", "pcfile" ], [ 735426, "u8", "period" ], [ 735434, "u8", "prefix" ], [ 735442, "u8", "procid" ], [ 735450, "u8", "ptrbit" ], [ 735458, "u8", "pwrite" ], [ 735466, "u8", "qcount" ], [ 735474, "u8", "refill" ], [ 735482, "u8", "remove" ], [ 735490, "u8", "retPop" ], [ 735498, "u8", "rodata" ], [ 735506, "u8", "rusage" ], [ 735514, "u8", "rwlock" ], [ 735522, "u8", "setLoc" ], [ 735530, "u8", "shared" ], [ 735538, "u8", "sharpV" ], [ 735546, "u8", "signal" ], [ 735554, "u8", "signed" ], [ 735562, "u8", "status" ], [ 735570, "u8", "stkOff" ], [ 735578, "u8", "string" ], [ 735586, "u8", "thread" ], [ 735594, "u8", "ticket" ], [ 735602, "u8", "timers" ], [ 735610, "u8", "tryGet" ], [ 735618, "u8", "unpack" ], [ 735626, "u8", "vdsoPC" ], [ 735634, "u8", "vdsoSP" ], [ 735642, "u8", "victim" ], [ 735650, "u8", "xcount" ], [ 735658, "u8", "context" ], [ 735667, "u8", "os/exec" ], [ 735676, "u8", "reflect" ], [ 735685, "u8", "runtime" ], [ 735694, "u8", "syscall" ], [ 735703, "u8", "unicode" ], [ 736216, "u8", "YearDay" ], [ 736225, "u8", "aborted" ], [ 736234, "u8", "addRcvr" ], [ 736243, "u8", "alllink" ], [ 736252, "u8", "amended" ], [ 736261, "u8", "badVerb" ], [ 736270, "u8", "balance" ], [ 736279, "u8", "blocked" ], [ 736288, "u8", "buckets" ], [ 736297, "u8", "callers" ], [ 736306, "u8", "cgoCtxt" ], [ 736315, "u8", "chanDir" ], [ 736324, "u8", "closing" ], [ 736333, "u8", "consume" ], [ 736342, "u8", "covctrs" ], [ 736351, "u8", "dequeue" ], [ 736360, "u8", "destroy" ], [ 736369, "u8", "dirinfo" ], [ 736378, "u8", "discard" ], [ 736387, "u8", "dispose" ], [ 736396, "u8", "doPrint" ], [ 736405, "u8", "enqueue" ], [ 736414, "u8", "environ" ], [ 736423, "u8", "filetab" ], [ 736441, "u8", "fmtBool" ], [ 736450, "u8", "framepc" ], [ 736459, "u8", "funcoff" ], [ 736468, "u8", "gcSlice" ], [ 736477, "u8", "getInfo" ], [ 736486, "u8", "getSlow" ], [ 736495, "u8", "growing" ], [ 736504, "u8", "gsignal" ], [ 736513, "u8", "hasName" ], [ 736522, "u8", "hasmain" ], [ 736531, "u8", "inCount" ], [ 736540, "u8", "isBlank" ], [ 736549, "u8", "isEmpty" ], [ 736558, "u8", "isempty" ], [ 736567, "u8", "isextra" ], [ 736576, "u8", "libcall" ], [ 736585, "u8", "lockedg" ], [ 736594, "u8", "lockedm" ], [ 736603, "u8", "makeArg" ], [ 736612, "u8", "methods" ], [ 736621, "u8", "morebuf" ], [ 736630, "u8", "nameOff" ], [ 736639, "u8", "npcdata" ], [ 736657, "u8", "pinSlow" ], [ 736666, "u8", "pkgPath" ], [ 736675, "u8", "pkgpath" ], [ 736684, "u8", "pointer" ], [ 736693, "u8", "popHead" ], [ 736702, "u8", "popTail" ], [ 736711, "u8", "preempt" ], [ 736720, "u8", "prepare" ], [ 736729, "u8", "private" ], [ 736738, "u8", "ptrSize" ], [ 736747, "u8", "ptrdata" ], [ 736756, "u8", "pushAll" ], [ 736765, "u8", "pushcnt" ], [ 736774, "u8", "putFast" ], [ 736783, "u8", "racectx" ], [ 736792, "u8", "readdir" ], [ 736801, "u8", "regPtrs" ], [ 736810, "u8", "release" ], [ 736819, "u8", "runnext" ], [ 736828, "u8", "running" ], [ 736846, "u8", "setDone" ], [ 736855, "u8", "setMono" ], [ 736864, "u8", "sigmask" ] ], "v": { "file.stem": "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd", "pe.go.path": "command-line-arguments", "pe.imphash": "9cbefe68f395e67356e2a5d8d1b285c0", "pe.machine": "i386", "pe.subsystem": "windows_gui", "file.basename": "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd.exe", "pe.go.version": "go1.20.7", "pe.image_base": 4194304, "pe.image_size": 1781760, "pe.machine_id": 332, "pe.os_version": "6.1", "pe.entry_point": 410112, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "ce0c94f6335ef266492e029dd46caa79b9b158f2", "pe.image_hash.sha256": "cde12ee62259790336e7eeda5d3f5782e3674a1ce3983e1c975f022cc84df32d", "pe.image_hash.sha384": "258254779e9f9b7954f9144da74849fa6b2a510feaf82c5440a0d9d52df831c242c8c4ca92510a6767f1f5fa8ada2737", "pe.image_hash.sha512": "68f6dd214a80780658a10d055fd08552621f16170bf7354fcbc6fe428e8ead8180bd1e912ed37152a0c45030e9e217f17b26cded1fa60315e95736ed05b59cb7", "pe.section_alignment": 4096, "pe.subsystem_version": "6.1", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 770, "pe.linker_major_version": 3, "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.go.build_settings.GOOS": "windows", "pe.data_directories[0].rva": 1736704, "pe.data_directories[1].rva": 1740800, "pe.data_directories[2].rva": 1478912, "pe.dll_characteristics_raw": 33088, "pe.go.build_settings.GO386": "softfloat", "pe.number_of_rva_and_sizes": 16, "pe.coff.symbol_table_offset": 1595904, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 988, "pe.data_directories[1].name": "base_relocation", "pe.data_directories[1].size": 35180, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 160, "pe.go.build_settings.GOARCH": "386", "pe.coff.dos_header_pe_pointer": 128, "pe.go.build_settings.-compiler": "gc", "pe.go.build_settings.-trimpath": "true", "pe.base_relocations.block_count": 212, "pe.base_relocations.entry_count": 16742, "pe.go.build_settings.-buildmode": "exe", "pe.go.build_settings.CGO_ENABLED": "0" }, "id": "pe", "sc": [ [ ".text", 1024, 730624, 6.13, "r-x" ], [ ".rdata", 731648, 738816, 5.62, "r--" ], [ ".data", 1470464, 89088, 5.19, "rw-" ], [ ".idata", 1559552, 1024, 4.65, "rw-" ], [ ".reloc", 1560576, 35328, 6.67, "r--" ], [ ".symtab", 1595904, 512, 0.02, "r--" ] ] }, "id": 0, "sz": 1596416, "ts": [ { "c": 1.0, "d": "php code embedded in string", "e": [ "\u003c?=0\u003eN\u003e" ], "i": "metadata/lang/embedded::php", "l": 2, "el": [ "embedded@0x17de9f:0x17de9f" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 39.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "d": "overflow keyword", "e": [ "runtime.(*bmap).overflow", "integer overflow", "setoverflow", "runtime.panicoverflow", "newoverflow", "runtime.(*hmap).incrnoverflow", "runtime.(*bmap).setoverflow", "LockOSThread nesting overflow", "noverflow", "oldoverflow", "overflow", "runtime.(*hmap).newoverflow", "incrnoverflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1, "el": [ "0xf4d4a", "0x4d0248", "0xb53af", "0xfa8e5", "0xb52ab", "0xf4d10", "0xf4d63", "0x4d3b7c", "0xb476c", "0xb52c5", "0xb4288", "0xf4d2e", "0xb5c2b" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "48", "40" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x59b84", "0x9ebac" ] }, { "c": 0.75, "d": "Go time.Sleep delay call", "e": [ "time.Sleep" ], "i": "micro-behaviors/time/sleep/interval::go-time-sleep", "l": 2, "el": [ "0xfc876" ] }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "0x16916c", "0x169174" ] }, { "c": 1.0, "d": "go/rs language suffix", "e": [ "runtime.rt0_go" ], "i": "micro-behaviors/data/text/malware/terms::malware-lang-suffix", "l": 1, "el": [ "0xfc8f2" ] }, { "a": "T1547.001", "c": 0.6000000238418579, "d": "Run value name string", "e": [ "Run" ], "i": "objectives/persistence/login/startup/registry::run-value-name", "l": 1, "el": [ "0x101b60" ] }, { "a": "T1027", "c": 1.0, "d": "Hardcoded alphabet array for filename randomization", "e": [ "30 30 30 31 30 32 30 33 30 34" ], "i": "objectives/command-and-control/dropper/standalone::mutated-exe-randomizer-string", "l": 1, "m": "E1027", "el": [ "0xd6d23" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.6000000238418579, "d": "TCP endpoint state error", "e": [ "transport endpoint is already connected", "transport endpoint is not connected" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint", "l": 2, "el": [ "0x4d5d92", "0x4d52f5" ] }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042", "el": [ "0x169108" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xe934" ] }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "path\tcommand-line-arguments", "os.commandLineToArgv" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1, "el": [ "0x16703b", "0x1009f0" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "runtime.pcdatavalue1", "of closed filevalue out of range", "runtime.pcvalueCacheKey", "stepsForValue", "reflect.Value.Elem on an invalid", "a non-pointer ValuegcSweep being", "printValue", "*[]reflect.Value", "runtime.pcdatavalue", "*reflect.Value", "valuesprofilealloc called withou", "*reflect.methodValue", "runtime.pcvalue", "*reflect.ValueError", "valueStart", "value" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0xfb234", "0xcf588", "0xfb10e", "0xb5cee", "0xd6606", "0xd4b6b", "0xb4dd4", "0xb64ab", "0xfb20c", "0xb5dda", "0xd6469", "0xb7227", "0xfb0fe", "0xb6f76", "0xb4f3c", "0xb34ae" ] }, { "a": "T1059", "c": 0.8500000238418579, "d": "Go binary uses os/exec", "e": [ "os/exec.wrappedError.Error", "…c.goos/file_windows.goos/exec_posix.goos/str.goos/e…", "os/exec", "os/exec.(*Cmd).childStdin.func1", "…os/exec/exec_windows.goos/exec/lp_windows.go./guardia…", "os/exec.(*Error).Error", "os/exec.lookExtensions", "os/exec.(*Cmd).writerDescriptor", "…path/filepath/match.goos/exec/exec.goos/exec/exec_wi…", "…oos/env.goos/error.goos/exec.goos/file_windows.goo…", "os/exec.(*Cmd).Run", "os/exec.skipStdinCopyError", "os/exec.(*Cmd).childStderr", "os/exec.(*Error).Unwrap", "…r.goos/exec_windows.goos/executable.goos/executable_…", "os/exec.wrappedError.Unwrap" ], "i": "micro-behaviors/process/create/system::go-os-exec-pclntab", "l": 2, "m": "E1059", "el": [ "0x101a2e", "0x504100", "0xb39b3", "0x101ac4", "0x504100", "0x1019df", "0x101b73", "0x101b1a", "0x504100", "0x504100", "0x101b60", "0x101ae4", "0x101aff", "0x101a16", "0x504100", "0x101a49" ] }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "Token" ], "i": "micro-behaviors/data/text/keywords/lexicon::token", "l": 1, "el": [ "0xff0d9" ] }, { "d": "Regex component marker", "e": [ "runtime.mstart" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-3", "l": 1, "el": [ "0xfc911" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0x169128" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2, "el": [ "0x169110" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 6254.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "d": "Regex component marker", "e": [ "runtime.main", "runtime.goexit", "runtime.main." ], "i": "metadata/lang/compiled::go-runtime-marker--rx-1", "l": 1, "el": [ "0xf94d1", "0xfccab", "0xf94de" ] }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039", "el": [ "0x169130" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x169100" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0x169144", "0x169148" ] }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2, "el": [ "0x169158" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x2e58" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 39.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2, "el": [ "0x17cdda" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "0x1036fa" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x17cc28" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x17ce38" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "string", "*fmt.GoStringer", "*func(string) bool", "WriteString", "*map[string]time.abbr", "padString", "*runtime.stringer", "stringNonString", "*runtime.errorString", "fmtString", "*func(string)", "*[0]*string", "*map[string]uint64", "writeString", "truncateString", "*func(string, string)" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0xb395a", "0xb6163", "0xb6cb1", "0xb51a7", "0xb7412", "0xb478d", "0xb6a56", "0xb63fa", "0xb7295", "0xb467a", "0xb59d3", "0xb4f85", "0xb6cc5", "0xb5458", "0xb60aa", "0xb73e4" ] }, { "d": "Regex component marker", "e": [ "runtime.goexit", "runtime.main" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-2", "l": 1, "el": [ "0xfccab", "0xf94d1" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2, "el": [ "0x17cd2c" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "Command", "Cmd" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x101a65", "0x101a75" ] }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2, "el": [ "0x169114" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x14768" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 6254.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.13" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Go bytes.Buffer I/O", "e": [ ".ReadFrom", ".WriteTo" ], "i": "micro-behaviors/data/buffer::go-bytes-buffer-io", "l": 2, "el": [ "0x100a7f", "0x1013f1" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 39.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x1205" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2, "el": [ "0x169154" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x16918c" ] }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2, "el": [ "0x169184" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Go syscall LazyProc resolver", "e": [ "syscall.(*LazyProc).Find" ], "i": "micro-behaviors/os/api-resolution/manual::syscall-lazyproc-find", "l": 1, "el": [ "0xfef44" ] }, { "c": 0.20000000298023224, "d": "encrypted-file trailer vocabulary", "e": [ "magic" ], "i": "micro-behaviors/data/text/keywords/lexicon::encrypted-trailer-vocab", "l": 1, "el": [ "0xb339d" ] }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2, "el": [ "0x169170" ] }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2, "el": [ "0x169104" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0xff337" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 6254.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "syscall.CreateProcessAsUser", "syscall.CreateProcess" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012", "el": [ "0xff256", "0xff371" ] }, { "c": 0.699999988079071, "d": "Reference to tempfile module", "e": [ "…s/types.goos/dir.goos/tempfile.gofmt/format.gofmt/pr…", "os/tempfile.go" ], "i": "micro-behaviors/fs/temp/reference::tempfile-ref", "l": 2, "el": [ "0x504100", "0x103c12" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.06" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2, "el": [ "0x16917c" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "0x169174" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x4d269e" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Go syscall SyscallN dispatch", "e": [ "syscall.SyscallN" ], "i": "micro-behaviors/os/api-resolution/manual::syscall-syscalln", "l": 1, "el": [ "0xfc865" ] }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.6600000262260437, "d": "Read files (Go)", "e": [ "os.(*File).Read" ], "i": "micro-behaviors/fs/file/read::read-go", "l": 2, "el": [ "0x100a36" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2, "el": [ "0x169118" ] }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039", "el": [ "0x169190" ] }, { "c": 0.699999988079071, "d": "Go bytes.Buffer methods", "e": [ ".WriteString", ".WriteByte" ], "i": "micro-behaviors/data/buffer::go-bytes-buffer-methods", "l": 2, "el": [ "0x101789", "0x1017e5" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x169178" ] }, { "c": 0.8799999952316284, "d": "Go PE retains .symtab section", "e": [ ".symtab" ], "i": "metadata/lang/compiler/systems::go-pe-symtab", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "input/output error" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1, "el": [ "0x4d0a0a" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 6254.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2, "el": [ "0x17ceca" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2, "el": [ "0xff64a" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "0x16915c" ] }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "0x16916c" ] }, { "c": 0.949999988079071, "d": "Go binary built with trimpath flag", "e": [ "build\t-trimpath=true" ], "i": "metadata/lang/go-build::go-trimpath", "l": 2, "el": [ "0x16707f" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "ResumeThread API reference", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/call::resume-thread-dup", "l": 2, "el": [ "0x17cd54" ] }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "10 02 09 65", "08 0c 07 12", "02 08 01 03", "07 02 04 0f", "2b 02 05 72" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1, "el": [ "0x1109d9", "0x11c4ac", "0x11791c", "0x119318", "0x105a7d" ] }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "refillAllocCache", "*runtime.pageCache", "cache", "allocCache", "stackcache", "goidcache", "goidcacheend", "cacheEnd", "cacheStart", "pcache", "mcache", "mspancache", "sudogcache", "*runtime.mcache", "cacheZone", "allocCountBeforeCache" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "0xb67b1", "0xb6db5", "0xb3277", "0xb4bb8", "0xb4e70", "0xb46a6", "0xb573c", "0xb40da", "0xb4c00", "0xb38b2", "0xb3842", "0xb4d5c", "0xb4e7c", "0xb6262", "0xb4638", "0xb74f8" ] }, { "c": 0.8999999761581421, "d": "Register vectored exception handler", "e": [ "AddVectoredExceptionHandler" ], "i": "micro-behaviors/os/exception/error-handling::add-vectored-exception-handler", "l": 1, "m": "B0001", "el": [ "0x169198" ] }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 1, "el": [ "0x169164" ] }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-sleep-command-token", "l": 1, "m": "B0025", "el": [ "0xb3453" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 2, "el": [ "0x17ccd4" ] }, { "c": 0.949999988079071, "d": "Dense embedded domain list", "e": [ "runtime.hmap", "runtime.bmap", "cpu.option", "reflect.rtype", "fmt.buffer", "time.abbr", "runtime.note", "sync.entry", "reflect.tflag", "sync.eface", "runtime.name", "runtime.itab" ], "i": "metadata/package/quality::dense-domain-list", "l": 1, "el": [ "0xb5a5a", "0xb5a4b", "0xb5007", "0xb5dea", "0xb5021", "0xb5901", "0xb5a87", "0xb506f", "0xb5dfa", "0xb5062", "0xb5a78", "0xb5a69" ] }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "os.(*fileStat).saveInfoFromPath", "os.IsPathSeparator", ".eq.io/fs.PathError", "os.fixLongPath", "*fs.PathError", "io/fs.(*PathError).Error", "runtime.initLongPathSupport", "pkgPath", "appendNameToPath", "saveInfoFromPath", "syscall.GetFullPathName", "io/fs.(*PathError).Unwrap", "path/filepath.cutPath", "runtime.name.pkgPath", "lookPathErr", "syscall.FullPath" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012", "el": [ "0x100ced", "0x100b6e", "0x100060", "0x100b8f", "0xb5997", "0x10001d", "0xf8b61", "0xb3d9a", "0xb6721", "0xb67c3", "0xff516", "0x100036", "0x10195e", "0xfbd08", "0xb5291", "0xfeff4" ] }, { "c": 0.6000000238418579, "d": "TCP connection refused error", "e": [ "connection refused" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-refused", "l": 2, "el": [ "0x4d099e" ] }, { "c": 0.6000000238418579, "d": "TCP connection reset error", "e": [ "connection reset by peer" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-reset", "l": 2, "el": [ "0x4d2896" ] }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2, "el": [ "0x169138" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0xff34b" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 39.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 6254.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP connection timeout error", "e": [ "connection timed out" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-timeout", "l": 2, "el": [ "0x4d1463" ] }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-w", "l": 3, "el": [ "0x169148" ] }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariable" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001", "el": [ "0xff489" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x169168" ] }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2, "el": [ "0x169158" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "SetThreadContext API reference", "e": [ "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/call::set-thread-context-dup", "l": 2, "el": [ "0x17cda2" ] }, { "c": 0.8999999761581421, "d": "Create extended waitable timer", "e": [ "CreateWaitableTimerExW" ], "i": "micro-behaviors/time/schedule/waitable::create-waitable-timer-ex", "l": 2, "el": [ "0x17ceb0" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x17cc28" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x4d269e" ] }, { "a": "T1005", "c": 0.8999999761581421, "d": "GetThreadContext API reference", "e": [ "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/call::get-thread-context-dup", "l": 2, "el": [ "0x17cdb6" ] }, { "c": 0.949999988079071, "d": "links kernel32 (WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, ... +34 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "39 symbols" ] }, { "c": 0.800000011920929, "d": "Get and set context", "e": [ "GetThreadContext", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-set", "l": 1, "el": [ "0x17cdb6", "0x17cda2" ] }, { "c": 0.8999999761581421, "d": "Create and arm waitable timer", "e": [ "CreateWaitableTimerExW", "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::create-and-set-waitable-timer", "l": 1, "el": [ "0x17ceb0", "0x17ccd4" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 1, "el": [ "0x16916c", "0x169174" ] }, { "c": 0.800000011920929, "d": "Set context plus resume", "e": [ "ResumeThread", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-set-resume", "l": 1, "el": [ "0x17cd54", "0x17cda2" ] }, { "c": 0.8799999952316284, "d": "Get set resume thread context", "e": [ "ResumeThread", "SetThreadContext", "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-suspend", "l": 1, "el": [ "0x17cd54", "0x17cda2", "0x17cdb6" ] }, { "c": 0.800000011920929, "d": "Get context plus resume", "e": [ "ResumeThread", "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-resume", "l": 1, "el": [ "0x17cd54", "0x17cdb6" ] }, { "a": "T1059.004", "c": 0.9399999976158142, "d": "Garbled Go remote tasking capability", "e": [ ".ReadFrom", ".WriteByte", "os/exec.skipStdinCopyError", "os/exec.wrappedError.Error", "os/exec.(*Cmd).childStderr", "os/exec", "os/exec.(*Cmd).childStdin.func1", "os/exec.(*Error).Error", ".WriteString", "os/exec.(*Cmd).writerDescriptor", "…c.goos/file_windows.goos/exec_posix.goos/str.goos/e…", ".WriteTo", "…oos/env.goos/error.goos/exec.goos/file_windows.goo…", "os/exec.lookExtensions", "os/exec.(*Error).Unwrap", "os/exec.wrappedError.Unwrap" ], "i": "objectives/command-and-control/remote-command/control::go-garbled-remote-tasking-capability", "l": 1, "el": [ "0x100a7f", "0x1017e5", "0x101ae4", "0x101a2e", "0x101aff", "0xb39b3", "0x101ac4", "0x1019df", "0x101789", "0x101b1a", "0x504100", "0x1013f1", "0x504100", "0x101b73", "0x101a16", "0x101a49" ] } ], "sha": "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd", "path": "05c9a44648cf49061aabf321568fb377683760aa29ae3830b8e2e2412b0702dd.exe", "type": "pe" } ], "tv": "176d6" } }