{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8344548940658569, "class": 0 } ], "prob": 0.8344549, "class": 0, "models": [ { "m": "az", "prob": 0.8344549, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T16:37:21Z" }, "path": "08e4d0b17b0f69a45d759ba1b6ff05b77d3b4a3547dfd4a25a8b9c899a384186.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "b90be2aaad684e3946ac11c1ba3a42ac", "pe.timestamp": 1764834438, "hash.authenti": "938b49d86c0cb56126dd846617569cb7eda682f68d8dd21e60e0fdc51c89a36a", "hash.rich_header": "afcd87fdc1df0784295952977ad9fdd66468e3ba8342a783688f0582281a388b", "build.target_arch": "x86_64", "pe.linker_version": "14.44", "pe.rich_header.xor_key": "0x6fcbc9d0", "pe.debug_entries[0].size": 1108, "pe.debug_entries[0].type": "pogo", "pe.debug_entries[1].type": "iltcg", "pe.data_directories[0].rva": 113760, "pe.data_directories[1].rva": 113840, "pe.data_directories[2].rva": 126976, "pe.data_directories[3].rva": 135168, "pe.data_directories[4].rva": 97808, "pe.data_directories[5].rva": 97920, "pe.data_directories[6].rva": 97488, "pe.data_directories[7].rva": 77824, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 60, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 5436, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 836, "pe.data_directories[4].name": "debug", "pe.data_directories[4].size": 56, "pe.data_directories[5].name": "tls", "pe.data_directories[5].size": 40, "pe.data_directories[6].name": "load_config", "pe.data_directories[6].size": 320, "pe.data_directories[7].name": "iat", "pe.data_directories[7].size": 888, "pe.debug_directory_types[0]": 13, "pe.debug_directory_types[1]": 14, "pe.debug_entries[0].timestamp": 1764834438, "pe.debug_entries[1].timestamp": 1764834438, "pe.load_config.cfg_check_func": "0x180013378", "pe.load_config.cfg_guard_flags": "0x100", "pe.load_config.security_cookie": "0x18001d180", "pe.rich_header_compids[0].count": 5, "pe.rich_header_compids[1].count": 7, "pe.rich_header_compids[2].count": 6, "pe.rich_header_compids[3].count": 2, "pe.rich_header_compids[4].count": 34, "pe.rich_header_compids[5].count": 6, "pe.rich_header_compids[6].count": 8, "pe.rich_header_compids[7].count": 59, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 31, "binary.top_complex_unnamed[0].cc": 3, "binary.top_complex_unnamed[1].cc": 2, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 17066772, "pe.rich_header_compids[10].count": 306, "pe.rich_header_compids[11].count": 1, "pe.rich_header_compids[12].count": 2, "pe.rich_header_compids[13].count": 1, "pe.rich_header_compids[14].count": 1, "pe.rich_header_compids[1].compid": 17132308, "pe.rich_header_compids[2].compid": 13082782, "pe.rich_header_compids[3].compid": 16877963, "pe.rich_header_compids[4].compid": 17140107, "pe.rich_header_compids[5].compid": 17009031, "pe.rich_header_compids[6].compid": 17074567, "pe.rich_header_compids[7].compid": 17140103, "pe.rich_header_compids[8].compid": 17072505, "pe.rich_header_compids[9].compid": 16875897, "binary.top_complex_unnamed[0].bbs": 4, "binary.top_complex_unnamed[1].bbs": 3, "pe.rich_header_compids[10].compid": 65536, "pe.rich_header_compids[11].compid": 17139704, "pe.rich_header_compids[12].compid": 17402261, "pe.rich_header_compids[13].compid": 16812437, "pe.rich_header_compids[14].compid": 16943509, "binary.top_complex_unnamed[0].addr": "0x180009cad", "binary.top_complex_unnamed[0].size": 160, "binary.top_complex_unnamed[1].addr": "0x18000cc3d", "binary.top_complex_unnamed[1].size": 170, "pe.rich_header_compids[10].product": "Unknown", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".pdata", "pe.section_characteristics[4].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 5, "pe.rich_header.entries[1].use_count": 7, "pe.rich_header.entries[2].use_count": 6, "pe.rich_header.entries[3].use_count": 2, "pe.rich_header.entries[4].use_count": 34, "pe.rich_header.entries[5].use_count": 6, "pe.rich_header.entries[6].use_count": 8, "pe.rich_header.entries[7].use_count": 59, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 31, "pe.rich_header.entries[0].product_id": 260, "pe.rich_header.entries[10].use_count": 306, "pe.rich_header.entries[11].use_count": 1, "pe.rich_header.entries[12].use_count": 2, "pe.rich_header.entries[13].use_count": 1, "pe.rich_header.entries[14].use_count": 1, "pe.rich_header.entries[1].product_id": 261, "pe.rich_header.entries[2].product_id": 199, "pe.rich_header.entries[3].product_id": 257, "pe.rich_header.entries[4].product_id": 261, "pe.rich_header.entries[5].product_id": 259, "pe.rich_header.entries[6].product_id": 260, "pe.rich_header.entries[7].product_id": 261, "pe.rich_header.entries[8].product_id": 260, "pe.rich_header.entries[9].product_id": 257, "pe.load_config.cfg_flags.instrumented": true, "pe.rich_header.entries[10].product_id": 1, "pe.rich_header.entries[11].product_id": 261, "pe.rich_header.entries[12].product_id": 265, "pe.rich_header.entries[13].product_id": 256, "pe.rich_header.entries[14].product_id": 258, "pe.dll_characteristics.high_entropy_va": true, "pe.rich_header.entries[0].build_number": 27412, "pe.rich_header.entries[0].product_name": "C_VS2015", "pe.rich_header.entries[1].build_number": 27412, "pe.rich_header.entries[1].product_name": "Cpp_VS2015", "pe.rich_header.entries[2].build_number": 41118, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 35211, "pe.rich_header.entries[3].product_name": "Linker_VS2013", "pe.rich_header.entries[4].build_number": 35211, "pe.rich_header.entries[4].product_name": "Cpp_VS2015", "pe.rich_header.entries[5].build_number": 35207, "pe.rich_header.entries[5].product_name": "Cvtres_VS2013", "pe.rich_header.entries[6].build_number": 35207, "pe.rich_header.entries[6].product_name": "C_VS2015", "pe.rich_header.entries[7].build_number": 35207, "pe.rich_header.entries[7].product_name": "Cpp_VS2015", "pe.rich_header.entries[8].build_number": 33145, "pe.rich_header.entries[8].product_name": "C_VS2015", "pe.rich_header.entries[9].build_number": 33145, "pe.rich_header.entries[9].product_name": "Linker_VS2013", "pe.section_characteristics[0].raw_size": 71168, "pe.section_characteristics[1].raw_size": 38912, "pe.section_characteristics[2].raw_size": 2560, "pe.section_characteristics[3].raw_size": 5632, "pe.section_characteristics[4].raw_size": 1024, "pe.rich_header.entries[10].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[11].build_number": 34808, "pe.rich_header.entries[11].product_name": "Cpp_VS2015", "pe.rich_header.entries[12].build_number": 35221, "pe.rich_header.entries[12].product_name": "unknown", "pe.rich_header.entries[13].build_number": 35221, "pe.rich_header.entries[13].product_name": "Cpp_VS2013", "pe.rich_header.entries[14].build_number": 35221, "pe.rich_header.entries[14].product_name": "Linker_VS2013_LTCG", "pe.section_characteristics[0].virtual_size": 71072, "pe.section_characteristics[1].virtual_size": 38766, "pe.section_characteristics[2].virtual_size": 6576, "pe.section_characteristics[3].virtual_size": 5436, "pe.section_characteristics[4].virtual_size": 836, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 77824, "pe.section_characteristics[2].virtual_address": 118784, "pe.section_characteristics[3].virtual_address": 126976, "pe.section_characteristics[4].virtual_address": 135168, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 8, "id": 0, "is": [ "HeapFree", "ReleaseSRWLockShared", "AcquireSRWLockShared", "Sleep", "GetCurrentProcess", "GetCurrentProcessId", "TerminateProcess", "GetCurrentThreadId", "IsProcessorFeaturePresent", "GetSystemInfo", "GetSystemTimeAsFileTime", "GetTickCount64", "GetSystemDirectoryW", "VirtualAlloc", "VirtualQuery", "CreateFileMappingW", "MapViewOfFile", "UnmapViewOfFile", "FreeLibrary", "GetModuleHandleW", "GetProcAddress", "LocalFree", "HeapReAlloc", "MultiByteToWideChar", "LCIDToLocaleName", "ExitProcess", "FreeConsole", "CreateFileW", "GetModuleHandleExW", "InterlockedFlushSList", "RtlUnwindEx", "InitializeSListHead", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "IsDebuggerPresent", "RtlVirtualUnwind", "RtlLookupFunctionEntry", "RtlCaptureContext", "LCMapStringEx", "DecodePointer", "EncodePointer", "DeleteCriticalSection", "InitializeCriticalSectionEx", "LeaveCriticalSection", "EnterCriticalSection", "GetFileInformationByHandleEx", "HeapAlloc", "QueryPerformanceCounter", "SetLastError", "GetLastError", "RaiseException", "AreFileApisANSI", "FindFirstFileW", "GetFileAttributesExW", "FormatMessageA", "GetLocaleInfoEx", "WideCharToMultiByte", "FindClose", "FindNextFileW", "strcmp", "strncnt", "initterm", "initterm_e", "callnewh", "strcpy_s", "iob", "lock", "unlock", "lc_handle_func", "CppXcptFilter", "getmainargs", "msize", "?terminate@@YAXXZ", "isatty", "fileno", "realloc", "fseek", "fsopen", "strlen", "abort", "islower", "wcsrchr", "strchr", "errno", "wcsdup", "lc_codepage_func", "isupper", "pctype_func", "fclose", "fread", "fgetpos", "fseeki64", "fsetpos", "setvbuf", "fflush", "ungetc", "fgetc", "calloc", "malloc", "free", "local_unwind", "DestructExceptionObject", "CxxFrameHandler3", "amsg_exit", "CxxThrowException", "memset", "memmove", "memcpy", "C_specific_handler" ], "ms": { "pe": { "entry": 50672.0, "machine": 34404.0, "checksum": 0.0, "has_pogo": true, "has_iltcg": true, "subsystem": 2.0, "timestamp": 1764834438.0, "image_base": 6442450944.0, "entry_section": ".text", "size_of_image": 139264.0, "cfg_check_func": 6442529656.0, "file_alignment": 512.0, "cfg_guard_flags": 256.0, "characteristics": 8226.0, "has_rich_header": true, "security_cookie": 6442570112.0, "size_of_headers": 1024.0, "export_timestamp": 4294967295.0, "import_dll_count": 2.0, "computed_checksum": 146170.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1764834438.0, "debug_timestamp_min": 1764834438.0, "dll_characteristics": 352.0, "has_export_timestamp": true, "linker_major_version": 14.0, "linker_minor_version": 44.0, "debug_directory_types": [ 13.0, 14.0 ], "has_resource_timestamp": false, "debug_directory_entries": 2.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "api_hashing_indicator_count": 1.0, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 2.0 }, "file": { "size": 120320.0 }, "binary": { "code_size": 71168.0, "func_count": 453.0, "code_entropy": 6.28, "data_entropy": 4.37, "export_count": 2.0, "func_density": 6.52, "import_count": 109.0, "string_count": 338.0, "avg_func_size": 172.5, "section_count": 5.0, "avg_complexity": 5.25, "import_density": 1.57, "max_complexity": 15.0, "string_density": 4.86, "aliased_exports": 2.0, "overall_entropy": 4.85, "avg_basic_blocks": 8.5, "avg_section_size": 23859.2, "dependency_count": 2.0, "entropy_variance": 0.87, "avg_string_length": 15.57, "complexity_per_kb": 0.08, "max_string_length": 60.0, "wide_string_count": 49.0, "avg_string_entropy": 3.12, "code_to_data_ratio": 1.48, "data_to_file_ratio": 0.02, "text_to_file_ratio": 0.59, "total_basic_blocks": 34.0, "func_analysis_depth": 2.0, "string_length_stddev": 9.58, "debug_reference_count": 2.0, "largest_section_ratio": 0.59, "sentence_string_count": 57.0, "sentence_string_ratio": 0.17, "writable_section_count": 1.0, "behavioral_import_ratio": 0.03, "executable_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 552, ".text" ], [ 631, "@.data" ], [ 672, ".pdata" ], [ 711, "@.reloc" ], [ 4618, "UWAVH" ], [ 6225, "/uQI" ], [ 6247, "/tEH" ], [ 6836, "/tCH" ], [ 7045, "UVWATAUAVAWH" ], [ 7219, "/u\tH" ], [ 7261, "/u\tI" ], [ 8583, "t$ UWATAVAWH" ], [ 11669, "UVWH" ], [ 12193, "User32.dll" ], [ 18218, "VWAVH" ], [ 22384, "M7H3" ], [ 26243, "SUVAVH" ], [ 30595, "SUVAWH" ], [ 34034, "L9AHA" ], [ 37104, "8H1E" ], [ 48214, "stack", "ntelineIGenu" ], [ 48237, "Genu" ], [ 50829, "p WAVAWH" ], [ 54256, "@USVWATAUAVAWH" ], [ 56835, "M8H3" ], [ 58464, "@SVWATAUAVAWH" ], [ 66138, "SVWATAUAVAWH" ], [ 74008, "wide", "kernel32" ], [ 74032, "wide", "kernelbase" ], [ 74096, "wide", "dwmapi" ], [ 74112, "wide", "d3d9" ], [ 74128, "wide", "d3d11" ], [ 74144, "wide", "d3d12" ], [ 74160, "wide", "dbghelp" ], [ 74192, "wide", "dwrite" ], [ 74208, "wide", "dxva2" ], [ 74224, "wide", "esent" ], [ 74240, "wide", "uxtheme" ], [ 74256, "wide", "uiautomationcore" ], [ 74296, "wide", "psapi" ], [ 74320, "wide", "version" ], [ 74336, "wide", "advapi32" ], [ 74376, "wide", "bcryptprimitives" ], [ 74416, "wide", "user32" ], [ 74432, "wide", "ws2_32" ], [ 74448, "wide", "shell32" ], [ 74464, "wide", "shcore" ], [ 74480, "wide", "shlwapi" ], [ 74496, "wide", "setupapi" ], [ 74520, "wide", "ole32" ], [ 74536, "wide", "iphlpapi" ], [ 74560, "wide", "userenv" ], [ 74584, "wide", "mfplat" ], [ 74600, "wide", "mfreadwrite" ], [ 74624, "wide", "mmdevapi" ], [ 74648, "wide", "ndfapi" ], [ 74664, "wide", "bluetoothapis" ], [ 74696, "wide", "netapi32" ], [ 74720, "wide", "powrprof" ], [ 74744, "wide", "propsys" ], [ 74760, "wide", "wevtapi" ], [ 74776, "wide", "winhttp" ], [ 74792, "wide", "winusb" ], [ 74808, "wide", "zipfldr" ], [ 74824, "wide", "api-ms-win-core-handle-l1-1-0" ], [ 74896, "wide", "api-ms-win-core-realtime-l1-1-1" ], [ 74960, "wide", "api-ms-win-core-winrt-l1-1-0" ], [ 75024, "wide", "api-ms-win-core-winrt-string-l1-1-0" ], [ 75104, "wide", "api-ms-win-core-winrt-error-l1-1-0" ], [ 75184, "wide", "api-ms-win-core-winrt-error-l1-1-1" ], [ 75256, "wide", "api-ms-win-core-path-l1-1-0" ], [ 75312, "wide", "api-ms-win-core-synch-l1-2-0" ], [ 75432, "RtlDllShutdownInProgress" ], [ 75488, "AddDllDirectory" ], [ 75528, "CloseHandle" ], [ 75568, "CompareObjectHandles" ], [ 75616, "FindFirstFileExW" ], [ 75664, "LoadLibraryExW" ], [ 75680, "wide", "YY_ThunksSharedData_53302349-F6BE-49C4-AC98-DA275C0CE653_" ], [ 75864, "bad allocation" ], [ 76240, "wide", "!x-sys-default-locale" ], [ 78224, "success" ], [ 78232, "address family not supported" ], [ 78264, "address in use" ], [ 78280, "address not available" ], [ 78304, "already connected" ], [ 78328, "argument list too long" ], [ 78352, "argument out of domain" ], [ 78376, "bad address" ], [ 78392, "bad file descriptor" ], [ 78416, "bad message" ], [ 78432, "broken pipe" ], [ 78448, "connection aborted" ], [ 78472, "connection already in progress" ], [ 78504, "connection refused" ], [ 78528, "connection reset" ], [ 78552, "cross device link" ], [ 78576, "destination address required" ], [ 78608, "device or resource busy" ], [ 78632, "directory not empty" ], [ 78656, "executable format error" ], [ 78680, "file exists" ], [ 78696, "file too large" ], [ 78712, "filename too long" ], [ 78736, "function not supported" ], [ 78760, "host unreachable" ], [ 78784, "identifier removed" ], [ 78808, "illegal byte sequence" ], [ 78832, "inappropriate io control operation" ], [ 78872, "interrupted" ], [ 78888, "invalid argument" ], [ 78912, "invalid seek" ], [ 78928, "io error" ], [ 78944, "is a directory" ], [ 78960, "message size" ], [ 78976, "network down" ], [ 78992, "network reset" ], [ 79008, "network unreachable" ], [ 79032, "no buffer space" ], [ 79048, "no child process" ], [ 79072, "no link" ], [ 79080, "no lock available" ], [ 79104, "no message available" ], [ 79128, "no message" ], [ 79144, "no protocol option" ], [ 79168, "no space on device" ], [ 79192, "no stream resources" ], [ 79216, "no such device or address" ], [ 79248, "no such device" ], [ 79264, "no such file or directory" ], [ 79296, "no such process" ], [ 79312, "not a directory" ], [ 79328, "not a socket" ], [ 79344, "not a stream" ], [ 79360, "not connected" ], [ 79376, "not enough memory" ], [ 79400, "not supported" ], [ 79416, "operation canceled" ], [ 79440, "operation in progress" ], [ 79464, "operation not permitted" ], [ 79488, "operation not supported" ], [ 79512, "operation would block" ], [ 79536, "owner dead" ], [ 79552, "permission denied" ], [ 79576, "protocol error" ], [ 79592, "protocol not supported" ], [ 79616, "read only file system" ], [ 79640, "resource deadlock would occur" ], [ 79672, "resource unavailable try again" ], [ 79704, "result out of range" ], [ 79728, "state not recoverable" ], [ 79752, "stream timeout" ], [ 79768, "text file busy" ], [ 79784, "timed out" ], [ 79800, "too many files open in system" ], [ 79832, "too many files open" ], [ 79856, "too many links" ], [ 79872, "too many symbolic link levels" ], [ 79904, "value too large" ], [ 79920, "wrong protocol type" ], [ 79944, "unknown error" ], [ 90496, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 90912, "bad exception" ], [ 90936, "fwrite" ], [ 90944, "setlocale" ], [ 91000, "wide", "mscoree.dll" ], [ 91024, "CorExitProcess" ], [ 91136, "wide", "msvcrt.dll" ], [ 91184, "Unknown exception" ], [ 91208, "bad array new length" ], [ 91232, "string too long" ], [ 91256, "generic" ], [ 91264, "iostream" ], [ 91276, "system" ], [ 91288, "bad cast" ], [ 91304, "bad locale name" ], [ 91328, "ios_base::badbit set" ], [ 91352, "ios_base::failbit set" ], [ 91376, "ios_base::eofbit set" ], [ 91416, "directory_entry::status" ], [ 91448, "directory_iterator::directory_iterator" ], [ 91488, "directory_iterator::operator++" ], [ 91520, "vector too long" ], [ 91536, "invalid string position" ], [ 91736, "iostream stream error" ], [ 97460, "GCTL" ], [ 98004, ".rdata" ], [ 98060, ".rdata$voltmd" ], [ 98084, ".rdata$zzzdbg" ], [ 98188, ".tls" ], [ 98240, ".xdata" ], [ 98276, ".edata" ], [ 98492, ".data" ], [ 98544, ".bss" ], [ 104976, "25.45.13.85:19458" ], [ 108194, "Handler" ], [ 109162, "CreateFileW" ], [ 109176, "FindFirstFileW" ], [ 109194, "AreFileApisANSI" ], [ 109212, "RaiseException" ], [ 109230, "GetLastError" ], [ 109246, "SetLastError" ], [ 109262, "QueryPerformanceCounter" ], [ 109288, "HeapAlloc" ], [ 109300, "HeapReAlloc" ], [ 109314, "HeapFree" ], [ 109326, "ReleaseSRWLockShared" ], [ 109350, "AcquireSRWLockShared" ], [ 109374, "Sleep" ], [ 109382, "GetCurrentProcess" ], [ 109402, "GetCurrentProcessId" ], [ 109424, "TerminateProcess" ], [ 109444, "GetCurrentThreadId" ], [ 109466, "IsProcessorFeaturePresent" ], [ 109494, "GetSystemInfo" ], [ 109510, "GetSystemTimeAsFileTime" ], [ 109536, "GetTickCount64" ], [ 109554, "GetSystemDirectoryW" ], [ 109576, "VirtualAlloc" ], [ 109592, "VirtualQuery" ], [ 109608, "CreateFileMappingW" ], [ 109630, "MapViewOfFile" ], [ 109646, "UnmapViewOfFile" ], [ 109664, "FreeLibrary" ], [ 109678, "GetModuleHandleW" ], [ 109698, "GetProcAddress" ], [ 109716, "LocalFree" ], [ 109728, "MultiByteToWideChar" ], [ 109750, "LCIDToLocaleName" ], [ 109770, "ExitProcess" ], [ 109784, "FreeConsole" ], [ 109796, "KERNEL32.dll" ], [ 109812, "__C_specific_handler" ], [ 109836, "memcpy" ], [ 109846, "memmove" ], [ 109856, "memset" ], [ 109866, "_CxxThrowException" ], [ 109886, "msvcrt.dll" ], [ 109900, "_amsg_exit" ], [ 109914, "__DestructExceptionObject" ], [ 109942, "_local_unwind" ], [ 109958, "free" ], [ 109966, "malloc" ], [ 109976, "calloc" ], [ 109994, "ungetc" ], [ 110004, "fflush" ], [ 110014, "setvbuf" ], [ 110024, "fsetpos" ], [ 110034, "_fseeki64" ], [ 110046, "fgetpos" ], [ 110056, "fread" ], [ 110064, "fclose" ], [ 110074, "__pctype_func" ], [ 110090, "isupper" ], [ 110100, "___lc_codepage_func" ] ], "sz": 120320, "ts": [ { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 2560)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "String comparison", "e": [ "strcmp" ], "i": "micro-behaviors/data/string/library::strcmp", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.699999988079071, "d": "Read stream (fread)", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.25" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 109.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1764834438.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.85" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Locale-aware string mapping", "e": [ "LCMapStringEx" ], "i": "micro-behaviors/os/env/access::lcmap-string-ex", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SVWATAUAVAWH", "UVWATAUAVAWH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "String length", "e": [ "strlen" ], "i": "micro-behaviors/data/string/library::strlen", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 109.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 453.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-winrt-error-l1-1-1", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-winrt-string-l1-1-0", "api-ms-win-core-handle-l1-1-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-winrt-error-l1-1-0", "api-ms-win-core-realtime-l1-1-1", "api-ms-win-core-path-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 109.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8500000238418579, "d": "File API ANSI check", "e": [ "AreFileApisANSI" ], "i": "micro-behaviors/os/env/access::are-file-apis-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionEx" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "UDS-Trojan.Win32.DLLhijack.abtv-08e4d0b17b0f69a45d759ba1b6ff05b77d3b4a3547dfd4a25a8b9c899a384186" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Close stdio file", "e": [ "fclose" ], "i": "micro-behaviors/os/stdio::fclose", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 453.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 109.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 139264.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/metrics/structural::minimal-exports", "l": 3 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 109.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.800000011920929, "d": "Query file attributes and timestamps", "e": [ "GetFileAttributesExW" ], "i": "micro-behaviors/fs/file/timestamp::get-file-attributes-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "a": "T1070", "c": 0.6000000238418579, "d": "Vectorized zero-fill blocks (xorps + movups stores)", "e": [ "0F 57 C0 0F 11" ], "i": "objectives/evasion/indicator-removal/cleanup::vectorized-zero-density", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 109.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.02" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.12" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 109.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.85" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "53302349-F6BE-49C4-AC98-DA275C0CE653" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 338.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 1.0, "d": "Incremental link-time codegen (ILTCG)", "e": [ "pe.has_iltcg = 1.00" ], "i": "metadata/build/reproducible::pe-incremental-ltcg", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "string too long", "invalid string position", "api-ms-win-core-winrt-string-l1-1-0", "LCMapStringEx" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.12" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 453.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "d": "Detect if running in terminal (isatty)", "e": [ "isatty" ], "i": "micro-behaviors/process/tty/terminal::isatty", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 109.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount64" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW shared lock read", "e": [ "AcquireSRWLockShared", "ReleaseSRWLockShared" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-shared", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.28" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PGO-trained release build (POGO)", "e": [ "pe.has_pogo = 1.00" ], "i": "metadata/build/reproducible::pe-pgo-trained", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc", ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "fseeki64", "fseek" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Find character in string", "e": [ "strchr" ], "i": "micro-behaviors/data/string/library::strchr", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Reallocate memory", "e": [ "realloc" ], "i": "micro-behaviors/mem/c-runtime/functions::realloc", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug directory timestamp is 2025 or newer", "e": [ "pe.debug_timestamp_min = 1764834438.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamp-post-2024", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Allocate zeroed memory", "e": [ "calloc" ], "i": "micro-behaviors/mem/c-runtime/functions::calloc", "l": 2 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "25.45.13.85:19458" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 4294967295.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 453.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "09 00 70 6d", "09 00 b0 6c", "06 00 d0 fa" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "c": 0.9300000071525574, "d": "External IPv4:port literal in rdata", "e": [ "25.45.13.85:19458" ], "i": "objectives/command-and-control/infrastructure/ip-port::external-ipv4-port-rdata-large", "l": 1 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "25.45.13.85:19458" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "RtlDllShutdownInProgress", "GetCurrentProcessId", "MultiByteToWideChar", "InitializeCriticalSectionEx", "RtlLookupFunctionEntry", "UnhandledExceptionFilter", "ReleaseSRWLockShared", "GetFileInformationByHandleEx", "GetModuleHandleExW", "GetSystemTimeAsFileTime", "InterlockedFlushSList", "GetSystemDirectoryW", "SetUnhandledExceptionFilter", "AcquireSRWLockShared", "InitializeSListHead", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (HeapFree, ReleaseSRWLockShared, AcquireSRWLockShared, Sleep, GetCurrentProcess, ... +54 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (strcmp, strncnt, initterm, initterm_e, callnewh, ... +45 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.has_rich_header = 1.00", "binary.import_count = 109.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindFirstFileW", "FindNextFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW", "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InitializeSListHead", "InterlockedFlushSList" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "Sleep", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindNextFileW", "FindFirstFileW" ], "i": "objectives/collection/file-targeting/enumeration::file-enumeration-targeting", "l": 1, "m": "C0000" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "08e4d0b17b0f69a45d759ba1b6ff05b77d3b4a3547dfd4a25a8b9c899a384186", "path": "UDS-Trojan.Win32.DLLhijack.abtv-08e4d0b17b0f69a45d759ba1b6ff05b77d3b4a3547dfd4a25a8b9c899a384186", "type": "pe" } ], "tv": "46790" } }