{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9961137771606445, "class": 1 } ], "prob": 0.9961138, "class": 1, "oprob": 0.9959816, "models": [ { "m": "az", "prob": 0.9898162, "class": 0 }, { "m": "az/native", "prob": 0.9959816, "class": 0 }, { "m": "az/pe", "prob": 0.99366647, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T06:50:12Z" }, "path": "21097", "raw": { "v": "4", "fs": [ { "f": "O₅(As₈AlC₃CoEr₃)H₅(FMgPo₃CmDs)Md₃(Bi₇SiPa)", "k": { "pe.timestamp": 1313192269, "hashes.imphash": "f897f930c2cf4d47199445b8aa68ffc7", "build.target_arch": "x86", "pe.linker_version": "7.10", "pe.rich_header.xor_key": "0x28103a25", "hashes.rich_header_hash": "40e1cbc7956277e52e3e9e5e1b861dae0d036df5cae41ce90a732259c09965c7", "pe.load_config.security_cookie": "0x406e10", "binary.top_complex_unnamed[0].cc": 47, "binary.top_complex_unnamed[1].cc": 47, "binary.top_complex_unnamed[2].cc": 45, "binary.top_complex_unnamed[3].cc": 37, "binary.top_complex_unnamed[4].cc": 34, "binary.top_complex_unnamed[5].cc": 28, "binary.top_complex_unnamed[6].cc": 28, "binary.top_complex_unnamed[7].cc": 21, "binary.top_complex_unnamed[0].bbs": 33, "binary.top_complex_unnamed[1].bbs": 33, "binary.top_complex_unnamed[2].bbs": 59, "binary.top_complex_unnamed[3].bbs": 63, "binary.top_complex_unnamed[4].bbs": 60, "binary.top_complex_unnamed[5].bbs": 50, "binary.top_complex_unnamed[6].bbs": 54, "binary.top_complex_unnamed[7].bbs": 42, "binary.top_complex_unnamed[0].addr": "0x404360", "binary.top_complex_unnamed[0].size": 829, "binary.top_complex_unnamed[1].addr": "0x404b10", "binary.top_complex_unnamed[1].size": 829, "binary.top_complex_unnamed[2].addr": "0x4035ea", "binary.top_complex_unnamed[2].size": 553, "binary.top_complex_unnamed[3].addr": "0x404055", "binary.top_complex_unnamed[3].size": 764, "binary.top_complex_unnamed[4].addr": "0x402b27", "binary.top_complex_unnamed[4].size": 364, "binary.top_complex_unnamed[5].addr": "0x4038a1", "binary.top_complex_unnamed[5].size": 792, "binary.top_complex_unnamed[6].addr": "0x403d76", "binary.top_complex_unnamed[6].size": 735, "binary.top_complex_unnamed[7].addr": "0x4048fd", "binary.top_complex_unnamed[7].size": 486, "pe.rich_header.entries[0].use_count": 38, "pe.rich_header.entries[1].use_count": 11, "pe.rich_header.entries[2].use_count": 3, "pe.rich_header.entries[3].use_count": 49, "pe.rich_header.entries[4].use_count": 5, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[0].product_id": 95, "pe.rich_header.entries[1].product_id": 15, "pe.rich_header.entries[2].product_id": 93, "pe.rich_header.entries[3].product_id": 1, "pe.rich_header.entries[4].product_id": 96, "pe.rich_header.entries[5].product_id": 90, "pe.rich_header.entries[0].build_number": 3077, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 3077, "pe.rich_header.entries[1].product_name": "Imp_VC2003", "pe.rich_header.entries[2].build_number": 2179, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[4].build_number": 3077, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 3077, "pe.rich_header.entries[5].product_name": "C_VS2005_LTCG" }, "x": 47, "id": 0, "is": [ "GetProcAddress", "LoadLibraryA", "ExitProcess", "GetModuleHandleA", "GetStartupInfoA", "GetCommandLineA", "GetVersionExA", "QueryPerformanceCounter", "GetTickCount", "GetCurrentThreadId", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "GetModuleFileNameA", "HeapReAlloc", "HeapAlloc", "TerminateProcess", "GetCurrentProcess", "HeapSize", "WriteFile", "GetStdHandle", "UnhandledExceptionFilter", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetLastError", "GetEnvironmentStringsW", "SetHandleCount", "GetFileType", "HeapDestroy", "HeapCreate", "VirtualFree", "HeapFree", "RtlUnwind", "InterlockedExchange", "VirtualQuery", "VirtualAlloc", "GetACP", "GetOEMCP", "GetCPInfo", "LCMapStringA", "MultiByteToWideChar", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "VirtualProtect", "GetSystemInfo" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "timestamp": 1313192269.0, "image_base": 4194304.0, "entry_section": ".text", "size_of_image": 36864.0, "timestamp_day": 12.0, "file_alignment": 512.0, "timestamp_year": 2011.0, "characteristics": 271.0, "entry_point_rva": 7754.0, "security_cookie": 4222480.0, "size_of_headers": 1024.0, "timestamp_month": 8.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 1.0, "computed_checksum": 62311.0, "section_alignment": 4096.0, "number_of_sections": 3.0, "resource_timestamp": 0.0, "rich_header_present": true, "linker_major_version": 7.0, "linker_minor_version": 10.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 26112.0 }, "binary": { "code_size": 18944.0, "func_count": 49.0, "entry_point": 7754.0, "code_entropy": 6.6, "data_entropy": 3.34, "func_density": 2.65, "import_count": 48.0, "string_count": 121.0, "avg_func_size": 250.12, "section_count": 3.0, "avg_complexity": 10.35, "import_density": 2.59, "max_complexity": 47.0, "string_density": 6.54, "overall_entropy": 4.42, "avg_basic_blocks": 17.78, "avg_section_size": 8362.67, "dependency_count": 1.0, "entropy_variance": 1.81, "avg_string_length": 27.33, "complexity_per_kb": 0.56, "max_string_length": 175.0, "wide_string_count": 1.0, "writable_sections": 1.0, "avg_string_entropy": 3.43, "code_to_data_ratio": 3.08, "data_to_file_ratio": 0.04, "entry_point_is_rva": true, "text_to_file_ratio": 0.73, "total_basic_blocks": 871.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "string_length_stddev": 28.82, "largest_section_ratio": 0.73, "sentence_string_count": 40.0, "sentence_string_ratio": 0.33, "behavioral_import_ratio": 0.08 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 464, ".text" ], [ 543, "@.data" ], [ 5678, "SVWU" ], [ 8342, "QQSVW3" ], [ 8508, "SUVW" ], [ 18739, "6PWS" ], [ 18883, "WWWWVSW" ], [ 20168, "comuyese" ], [ 20180, "yheipitioibikgvfpfdijiri" ], [ 20208, "ngricikiphyhfihiohriwi" ], [ 20232, "rfdgkgchbjuheijishzggirioikghgtfag" ], [ 20268, "kglimiyioirgeidirhlici" ], [ 20292, "ogeirifhsibiiichwhzici" ], [ 20316, "aheirifhsibiiizgciiilizioihi" ], [ 20348, "zgeiyhjijhyhpiuh" ], [ 20368, "ehrigizioipgmibish" ], [ 20388, "zhsirixiviuhrikg" ], [ 20408, "oglimihikibiygbizhoiai" ], [ 20432, "oglimihikibidhhishei" ], [ 20484, "Microsoft Visual C++ Runtime Library" ], [ 20544, "\u003cprogram name unknown\u003e" ], [ 20568, "A buffer overrun has been detected which has corrupted the program's\ninternal state. The program cannot safely continue executi" ], [ 20637, "internal state. The program cannot safely continue execution and must" ], [ 20708, "now be terminated." ], [ 20728, "Buffer overrun detected!" ], [ 20760, "A security error of unknown cause has been detected which has\ncorrupted the program's internal state. The program cannot safely" ], [ 20822, "corrupted the program's internal state. The program cannot safely" ], [ 20889, "continue execution and must now be terminated." ], [ 20940, "Unknown security failure detected!" ], [ 20988, "CorExitProcess" ], [ 21004, "mscoree.dll" ], [ 21016, "runtime error" ], [ 21036, "TLOSS error" ], [ 21052, "SING error" ], [ 21068, "DOMAIN error" ], [ 21088, "R6029\r\n- This application cannot run using the active version of the Microsoft .NET Runtime\nPlease contact the application's sup" ], [ 21095, "- This application cannot run using the active version of the Microsoft .NET Runtime" ], [ 21180, "Please contact the application's support team for more information." ], [ 21252, "R6028\r\n- unable to initialize heap" ], [ 21259, "- unable to initialize heap" ], [ 21292, "R6027\r\n- not enough space for lowio initialization" ], [ 21299, "- not enough space for lowio initialization" ], [ 21348, "R6026\r\n- not enough space for stdio initialization" ], [ 21355, "- not enough space for stdio initialization" ], [ 21404, "R6025\r\n- pure virtual function call" ], [ 21411, "- pure virtual function call" ], [ 21444, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 21451, "- not enough space for _onexit/atexit table" ], [ 21500, "R6019\r\n- unable to open console device" ], [ 21507, "- unable to open console device" ], [ 21544, "R6018\r\n- unexpected heap error" ], [ 21551, "- unexpected heap error" ], [ 21580, "R6017\r\n- unexpected multithread lock error" ], [ 21587, "- unexpected multithread lock error" ], [ 21628, "R6016\r\n- not enough space for thread data" ], [ 21635, "- not enough space for thread data" ], [ 21672, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 21674, "This application has requested the Runtime to terminate it in an unusual way." ], [ 21824, "R6009\r\n- not enough space for environment" ], [ 21831, "- not enough space for environment" ], [ 21868, "R6008\r\n- not enough space for arguments" ], [ 21875, "- not enough space for arguments" ], [ 21912, "R6002\r\n- floating point not loaded" ], [ 21919, "- floating point not loaded" ], [ 21952, "Runtime Error!\n\nProgram:" ], [ 22012, "GetProcessWindowStation" ], [ 22036, "GetUserObjectInformationA" ], [ 22064, "GetLastActivePopup" ], [ 22084, "GetActiveWindow" ], [ 22100, "MessageBoxA" ], [ 22112, "user32.dll" ], [ 22898, "wide", "h(((( H" ], [ 23830, "GetProcAddress" ], [ 23848, "LoadLibraryA" ], [ 23862, "KERNEL32.dll" ], [ 23878, "ExitProcess" ], [ 23892, "GetModuleHandleA" ], [ 23912, "GetStartupInfoA" ], [ 23930, "GetCommandLineA" ], [ 23948, "GetVersionExA" ], [ 23964, "QueryPerformanceCounter" ], [ 23990, "GetTickCount" ], [ 24006, "GetCurrentThreadId" ], [ 24028, "GetCurrentProcessId" ], [ 24050, "GetSystemTimeAsFileTime" ], [ 24076, "GetModuleFileNameA" ], [ 24098, "HeapReAlloc" ], [ 24112, "HeapAlloc" ], [ 24124, "TerminateProcess" ], [ 24144, "GetCurrentProcess" ], [ 24164, "HeapSize" ], [ 24176, "WriteFile" ], [ 24188, "GetStdHandle" ], [ 24204, "UnhandledExceptionFilter" ], [ 24232, "FreeEnvironmentStringsA" ], [ 24258, "GetEnvironmentStrings" ], [ 24282, "FreeEnvironmentStringsW" ], [ 24308, "WideCharToMultiByte" ], [ 24330, "GetLastError" ], [ 24346, "GetEnvironmentStringsW" ], [ 24372, "SetHandleCount" ], [ 24390, "GetFileType" ], [ 24404, "HeapDestroy" ], [ 24418, "HeapCreate" ], [ 24432, "VirtualFree" ], [ 24446, "HeapFree" ], [ 24458, "RtlUnwind" ], [ 24470, "InterlockedExchange" ], [ 24492, "VirtualQuery" ], [ 24508, "VirtualAlloc" ], [ 24534, "GetOEMCP" ], [ 24546, "GetCPInfo" ], [ 24558, "LCMapStringA" ], [ 24574, "MultiByteToWideChar" ], [ 24596, "LCMapStringW" ], [ 24612, "GetStringTypeA" ], [ 24630, "GetStringTypeW" ], [ 24648, "GetLocaleInfoA" ], [ 24666, "VirtualProtect" ], [ 24684, "GetSystemInfo" ] ], "sz": 26112, "ts": [ { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 49.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1313192269.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 48.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 1024)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 36864.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.42" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.60)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "LCMapStringW", "GetStringTypeA", "LCMapStringA", "GetStringTypeW", "FreeEnvironmentStringsA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 121.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 49.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.42" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 10.35" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "21097" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.43" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "a": "T1620", "c": 0.8500000238418579, "d": "mscoree.dll text reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-dll-text-ref", "l": 3, "m": "B0032" }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 3 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.33" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Inline MZ and PE validation", "e": [ "39" ], "i": "micro-behaviors/fs/file/pe-inspect::inline-pe-signature-check", "l": 3 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "9c 60 40 00", "64 60 40 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 48.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemTimeAsFileTime", "GetUserObjectInformationA", "GetCurrentProcessId", "UnhandledExceptionFilter", "MultiByteToWideChar", "GetModuleFileNameA", "WideCharToMultiByte", "GetProcessWindowStation" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::module-stomping-target", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetProcAddress, LoadLibraryA, ExitProcess, GetModuleHandleA, GetStartupInfoA, ... +43 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "GetTickCount", "QueryPerformanceCounter" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "64 60 40 00", "9c 60 40 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 4 }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection/toolkit::unsigned-module-stomping-target", "l": 1 }, { "a": "T1620", "c": 0.9300000071525574, "d": "Native PE loads .NET payload via CLR", "e": [ "LoadLibraryA", "CorExitProcess", "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::native-pe-loads-dotnet-payload", "l": 4, "m": "B0032" } ], "sha": "0b4d31edf54da8cd34f97fab0186efd9bfa39057df6b9f64f4c7a38fbc0aa433", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/21097", "type": "pe" } ], "tv": "84923" } }