{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999412298202515, "class": 2 }, { "id": 1, "prob": 0.9977509379386902, "class": 0 }, { "id": 2, "prob": 0.9301451444625854, "class": 0 } ], "prob": 0.99994123, "class": 2, "models": [ { "m": "az", "prob": 0.9989157, "class": 1 }, { "m": "az/native", "prob": 0.9999404, "class": 2 }, { "m": "az/pe", "prob": 0.99994123, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-02T22:30:54Z" }, "path": "111896", "raw": { "v": "4", "fs": [ { "f": "K₃O₁₀(Al₄S₅As₁₀C₅I₅CoEr₄LaP₂Xe)H₆(Cm₄F₅Os₅Po₆DbDs)Md₄(Bi₇BkPa₂)", "x": 171, "id": 0, "is": [ "ORDINAL 9", "ORDINAL 2", "SendMessageA", "SetTimer", "DialogBoxParamW", "DialogBoxParamA", "SetWindowLongA", "GetWindowLongA", "SetWindowTextW", "LoadIconA", "LoadStringW", "LoadStringA", "CharUpperW", "CharUpperA", "DestroyWindow", "EndDialog", "PostMessageA", "ShowWindow", "MessageBoxW", "GetDlgItem", "KillTimer", "SetWindowTextA", "ShellExecuteExA", "GetStringTypeW", "GetStringTypeA", "LCMapStringW", "LCMapStringA", "InterlockedIncrement", "InterlockedDecrement", "GetProcAddress", "GetOEMCP", "GetACP", "GetCPInfo", "IsBadCodePtr", "IsBadReadPtr", "GetFileType", "SetHandleCount", "GetEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "FreeEnvironmentStringsA", "UnhandledExceptionFilter", "HeapSize", "GetCurrentProcess", "TerminateProcess", "IsBadWritePtr", "HeapCreate", "HeapDestroy", "GetEnvironmentVariableA", "SetUnhandledExceptionFilter", "TlsAlloc", "ExitProcess", "GetVersion", "GetCommandLineA", "GetStartupInfoA", "GetModuleHandleA", "WaitForSingleObject", "CloseHandle", "CreateProcessA", "SetCurrentDirectoryA", "GetCommandLineW", "GetVersionExA", "LeaveCriticalSection", "EnterCriticalSection", "DeleteCriticalSection", "MultiByteToWideChar", "WideCharToMultiByte", "GetLastError", "LoadLibraryA", "AreFileApisANSI", "GetModuleFileNameA", "GetModuleFileNameW", "LocalFree", "FormatMessageA", "FormatMessageW", "GetWindowsDirectoryA", "SetFileTime", "CreateFileW", "SetLastError", "SetFileAttributesA", "RemoveDirectoryA", "SetFileAttributesW", "RemoveDirectoryW", "CreateDirectoryA", "CreateDirectoryW", "DeleteFileA", "DeleteFileW", "lstrlenA", "GetFullPathNameA", "GetFullPathNameW", "GetCurrentDirectoryA", "GetTempPathA", "GetTempFileNameA", "FindClose", "FindFirstFileA", "FindFirstFileW", "FindNextFileA", "CreateFileA", "GetFileSize", "SetFilePointer", "ReadFile", "WriteFile", "SetEndOfFile", "GetStdHandle", "WaitForMultipleObjects", "Sleep", "VirtualAlloc", "VirtualFree", "CreateEventA", "SetEvent", "ResetEvent", "InitializeCriticalSection", "RtlUnwind", "RaiseException", "HeapAlloc", "HeapFree", "HeapReAlloc", "CreateThread", "GetCurrentThreadId", "TlsSetValue", "TlsGetValue", "ExitThread" ], "ms": { "pe": { "machine": 332.0, "checksum": 153019.0, "rsrc_size": 4096.0, "subsystem": 2.0, "timestamp": 1290097655.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.89, "entry_section": ".text", "size_of_image": 163840.0, "timestamp_day": 18.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2010.0, "characteristics": 271.0, "entry_point_rva": 84740.0, "size_of_headers": 1024.0, "timestamp_month": 11.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 4.0, "manifest_present": true, "checksum_mismatch": true, "computed_checksum": 762730.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "rich_header_present": true, "linker_major_version": 6.0, "version_info_present": true, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 104960.0, "file_size": 742874.0, "entry_point": 84740.0, "has_overlay": true, "code_entropy": 6.61, "data_entropy": 1.92, "import_count": 122.0, "overlay_size": 601562.0, "string_count": 1531.0, "overlay_ratio": 0.81, "section_count": 5.0, "avg_complexity": 7.04, "function_count": 224.0, "import_density": 1.19, "max_complexity": 47.0, "string_density": 14.94, "overall_entropy": 3.45, "overlay_entropy": 6.11, "avg_basic_blocks": 11.17, "avg_section_size": 28057.6, "dependency_count": 4.0, "entropy_variance": 2.41, "function_density": 2.19, "avg_function_size": 194.02, "avg_string_length": 41.45, "complexity_per_kb": 0.07, "max_string_length": 6975.0, "wide_string_count": 584.0, "writable_sections": 2.0, "avg_string_entropy": 3.48, "code_to_data_ratio": 2.97, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.14, "total_basic_blocks": 2503.0, "embedded_file_count": 2.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 204.23, "embedded_binary_count": 2.0, "largest_section_ratio": 0.14, "sentence_string_count": 411.0, "sentence_string_ratio": 0.27, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".sxdata" ], [ 640, ".rsrc" ], [ 3195, "PSSSSSS" ], [ 4227, "QSVW" ], [ 5276, "QQVW" ], [ 10672, "QQSV" ], [ 11836, "FSWF" ], [ 11946, "QQS3" ], [ 12111, "QSUVW" ], [ 13706, "SVW3" ], [ 13759, "AABB" ], [ 14512, "5P1B" ], [ 15101, "PPRPQPh" ], [ 15883, "f98t" ], [ 17107, "f99t" ], [ 21960, "t09u" ], [ 22067, "5D1B" ], [ 24041, "FXQWP" ], [ 24586, "FHPPQ" ], [ 27570, "RPSV" ], [ 28084, "t\\IItEIt2IIt!It" ], [ 31347, "VVVVP" ], [ 32012, "QQSV3" ], [ 36080, "SHVH" ], [ 42368, "G 90" ], [ 46121, "VRQW" ], [ 49658, "QQSVW" ], [ 59674, "QQSUV" ], [ 72371, "SUVW" ], [ 76481, "4SVW" ], [ 78725, "54ZB" ], [ 81458, "SVWU" ], [ 81699, "XSVW" ], [ 83791, "YYPW" ], [ 91909, "PSSW" ], [ 96443, "HSVHWtgHHtF" ], [ 98752, "FGQPS" ], [ 106773, "15.23.35.193:105" ], [ 108648, "__GLOBAL_HEAP_SELECTED" ], [ 108672, "__MSVCRT_HEAP_SELECT" ], [ 108744, "runtime error" ], [ 108764, "TLOSS error" ], [ 108780, "SING error" ], [ 108796, "DOMAIN error" ], [ 108812, "R6028\r\n- unable to initialize heap" ], [ 108819, "- unable to initialize heap" ], [ 108852, "R6027\r\n- not enough space for lowio initialization" ], [ 108859, "- not enough space for lowio initialization" ], [ 108908, "R6026\r\n- not enough space for stdio initialization" ], [ 108915, "- not enough space for stdio initialization" ], [ 108964, "R6025\r\n- pure virtual function call" ], [ 108971, "- pure virtual function call" ], [ 109004, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 109011, "- not enough space for _onexit/atexit table" ], [ 109060, "R6019\r\n- unable to open console device" ], [ 109067, "- unable to open console device" ], [ 109104, "R6018\r\n- unexpected heap error" ], [ 109111, "- unexpected heap error" ], [ 109140, "R6017\r\n- unexpected multithread lock error" ], [ 109147, "- unexpected multithread lock error" ], [ 109188, "R6016\r\n- not enough space for thread data" ], [ 109195, "- not enough space for thread data" ], [ 109232, "abnormal program termination" ], [ 109268, "R6009\r\n- not enough space for environment" ], [ 109275, "- not enough space for environment" ], [ 109312, "R6008\r\n- not enough space for arguments" ], [ 109319, "- not enough space for arguments" ], [ 109356, "R6002\r\n- floating point not loaded" ], [ 109363, "- floating point not loaded" ], [ 109396, "Microsoft Visual C++ Runtime Library" ], [ 109440, "Runtime Error!\n\nProgram:" ], [ 109472, "\u003cprogram name unknown\u003e" ], [ 109496, "GetLastActivePopup" ], [ 109516, "GetActiveWindow" ], [ 109532, "MessageBoxA" ], [ 109544, "user32.dll" ], [ 109612, "dddd, MMMM dd, yyyy" ], [ 109648, "December" ], [ 109660, "November" ], [ 109672, "October" ], [ 109680, "September" ], [ 109692, "August" ], [ 109700, "July" ], [ 109708, "June" ], [ 109716, "April" ], [ 109724, "March" ], [ 109732, "February" ], [ 109744, "January" ], [ 109800, "Saturday" ], [ 109812, "Friday" ], [ 109820, "Thursday" ], [ 109832, "Wednesday" ], [ 109844, "Tuesday" ], [ 109852, "Monday" ], [ 109860, "Sunday" ], [ 109896, "SunMonTueWedThuFriSat" ], [ 109920, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 121408, "OLEAUT32.dll" ], [ 121424, "MessageBoxW" ], [ 121438, "ShowWindow" ], [ 121452, "PostMessageA" ], [ 121468, "EndDialog" ], [ 121480, "DestroyWindow" ], [ 121496, "CharUpperA" ], [ 121510, "CharUpperW" ], [ 121524, "LoadStringA" ], [ 121538, "LoadStringW" ], [ 121552, "SetWindowTextA" ], [ 121570, "SetWindowTextW" ], [ 121588, "GetWindowLongA" ], [ 121606, "SetWindowLongA" ], [ 121624, "DialogBoxParamA" ], [ 121642, "DialogBoxParamW" ], [ 121660, "SetTimer" ], [ 121672, "SendMessageA" ], [ 121714, "KillTimer" ], [ 121724, "USER32.dll" ], [ 121738, "ShellExecuteExA" ], [ 121754, "SHELL32.dll" ], [ 121768, "WaitForSingleObject" ], [ 121790, "CloseHandle" ], [ 121804, "CreateProcessA" ], [ 121822, "SetCurrentDirectoryA" ], [ 121846, "GetCommandLineW" ], [ 121864, "GetVersionExA" ], [ 121880, "LeaveCriticalSection" ], [ 121904, "EnterCriticalSection" ], [ 121928, "DeleteCriticalSection" ], [ 121952, "MultiByteToWideChar" ], [ 121974, "WideCharToMultiByte" ], [ 121996, "GetLastError" ], [ 122012, "LoadLibraryA" ], [ 122028, "AreFileApisANSI" ], [ 122046, "GetModuleFileNameA" ], [ 122068, "GetModuleFileNameW" ], [ 122090, "LocalFree" ], [ 122102, "FormatMessageA" ], [ 122120, "FormatMessageW" ], [ 122138, "GetWindowsDirectoryA" ], [ 122162, "SetFileTime" ], [ 122176, "CreateFileW" ], [ 122190, "SetLastError" ], [ 122206, "SetFileAttributesA" ], [ 122228, "RemoveDirectoryA" ], [ 122248, "SetFileAttributesW" ], [ 122270, "RemoveDirectoryW" ], [ 122290, "CreateDirectoryA" ], [ 122310, "CreateDirectoryW" ], [ 122330, "DeleteFileA" ], [ 122344, "DeleteFileW" ], [ 122358, "lstrlenA" ], [ 122370, "GetFullPathNameA" ], [ 122390, "GetFullPathNameW" ], [ 122410, "GetCurrentDirectoryA" ], [ 122434, "GetTempPathA" ], [ 122450, "GetTempFileNameA" ], [ 122470, "FindClose" ], [ 122482, "FindFirstFileA" ], [ 122500, "FindFirstFileW" ], [ 122518, "FindNextFileA" ], [ 122534, "CreateFileA" ], [ 122548, "GetFileSize" ], [ 122562, "SetFilePointer" ], [ 122580, "ReadFile" ], [ 122592, "WriteFile" ], [ 122604, "SetEndOfFile" ], [ 122620, "GetStdHandle" ], [ 122636, "WaitForMultipleObjects" ], [ 122662, "Sleep" ], [ 122670, "VirtualAlloc" ], [ 122686, "VirtualFree" ], [ 122700, "CreateEventA" ], [ 122716, "SetEvent" ], [ 122728, "ResetEvent" ], [ 122742, "InitializeCriticalSection" ], [ 122770, "RtlUnwind" ], [ 122782, "RaiseException" ], [ 122800, "HeapAlloc" ], [ 122812, "HeapFree" ], [ 122824, "HeapReAlloc" ], [ 122838, "CreateThread" ], [ 122854, "GetCurrentThreadId" ], [ 122876, "TlsSetValue" ], [ 122890, "TlsGetValue" ], [ 122904, "ExitThread" ], [ 122918, "GetModuleHandleA" ], [ 122938, "GetStartupInfoA" ], [ 122956, "GetCommandLineA" ], [ 122974, "GetVersion" ], [ 122988, "ExitProcess" ], [ 123002, "TlsAlloc" ], [ 123014, "SetUnhandledExceptionFilter" ], [ 123044, "GetEnvironmentVariableA" ], [ 123070, "HeapDestroy" ], [ 123084, "HeapCreate" ], [ 123098, "IsBadWritePtr" ], [ 123114, "TerminateProcess" ], [ 123134, "GetCurrentProcess" ], [ 123154, "HeapSize" ], [ 123166, "UnhandledExceptionFilter" ], [ 123194, "FreeEnvironmentStringsA" ], [ 123220, "FreeEnvironmentStringsW" ], [ 123246, "GetEnvironmentStrings" ], [ 123270, "GetEnvironmentStringsW" ], [ 123296, "SetHandleCount" ], [ 123314, "GetFileType" ], [ 123328, "IsBadReadPtr" ], [ 123344, "IsBadCodePtr" ], [ 123360, "GetCPInfo" ], [ 123382, "GetOEMCP" ], [ 123394, "GetProcAddress" ], [ 123412, "InterlockedDecrement" ], [ 123436, "InterlockedIncrement" ], [ 123460, "LCMapStringA" ], [ 123476, "LCMapStringW" ], [ 123492, "GetStringTypeA" ], [ 123510, "GetStringTypeW" ], [ 123526, "KERNEL32.dll" ], [ 124004, ",!@Install@!UTF-8!" ], [ 124024, ",!@InstallEnd@!" ], [ 124064, "wide", "Can not find setup.exe" ], [ 124112, "wide", "setup.exe" ], [ 124132, "wide", "Can not open file" ], [ 124168, "wide", "Can not load codecs" ], [ 124208, "wide", "Can not create temp folder archive" ], [ 124280, "wide", "ExecuteParameters" ], [ 124316, "wide", "ExecuteFile" ], [ 124340, "wide", "RunProgram" ], [ 124364, "wide", "Directory" ], [ 124392, "wide", "Progress" ], [ 124412, "wide", "BeginPrompt" ], [ 124436, "wide", "Title" ], [ 124448, "wide", "Config failed" ], [ 124484, "wide", "Can't load config info" ], [ 124550, "wide", "BUnsupported Method" ], [ 124592, "wide", "Can not open output file" ], [ 124644, "wide", "Can not delete output file" ], [ 124706, "wide", "BCan not open the file as archive" ], [ 124776, "wide", "Can not find archive file" ], [ 124828, "wide", "Default" ], [ 124912, ".?AVCNewException@@" ], [ 125028, "out of memory" ], [ 125056, ".?AUCSystemException@@" ], [ 125088, ".?AUCInBufferException@@" ], [ 125128, ".?AUCOutBufferException@@" ], [ 125164, "wide", "Unknown error" ], [ 125208, "wide", "Are you sure you want to cancel?" ], [ 125296, ".?AVCInArchiveException@N7z@NArchive@@" ], [ 125424, "wide", "BCJ2" ], [ 125512, "wide", "Copy" ], [ 125568, "wide", "LZMA2" ], [ 125624, "wide", "LZMA" ] ], "sz": 742874, "ts": [ { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 511.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "d": "JSON.stringify call", "e": [ "JSON.stringify" ], "i": "micro-behaviors/data/serialize/json::json-stringify-call", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny JavaScript sidecar loader", "e": [ "text.total_lines = 1.00" ], "i": "objectives/supply-chain/hidden-payload/encoding::tiny-loader-lines", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "a": "T1195.002", "c": 0.9700000286102295, "d": "Empty catch hides loader errors", "e": [ "catch(e){}" ], "i": "objectives/supply-chain/trojanized/library::swallowed-loader-errors", "l": 1 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(e){}" ], "i": "objectives/supply-chain/install-hook/dropper::top-level-try-catch-empty", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "111896##plain@0x24cab" ], "i": "objectives/supply-chain/metadata-anomaly/markers/npm::small-file-5k", "l": 1 }, { "c": 1.0, "d": "javascript code embedded in string", "e": [ "Detected javascript at offset 0x24cab" ], "i": "metadata/lang/embedded::javascript", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "Embedded PE binary at file offset 0x2772a (~372736 bytes)", "e": [ "kind=Pe32 estimated_size=372736", "kind=Pe32 estimated_size=249856" ], "i": "binary/embedded/pe", "l": 3 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4e", "40", "40", "47", "46", "4a", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (CharCode)", "e": [ "…\u00263)\u003c\u003c6|g,b=b+String.fromCharCode(d\u003c\u003c2|e\u003e\u003e4);64!=f\u0026\u00260\u003ch\u0026\u0026…", "…;if(128\u003ed)b+=String.fromCharCode(d),c++;else if(191\u003cd\u0026\u00262…", "…eAt(c+2),b=b+String.fromCharCode((d\u002615)\u003c\u003c12|(e\u002663)\u003c\u003c6|f\u0026…", "…;if(128\u003ed)b+=String.fromCharCode(d),", "…=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003ci\u0026\u0026(b+=Str…", "…=g\u0026\u00260\u003ci\u0026\u0026(b+=String.fromCharCode(i))}return this._utf8_d…", "(b+=String.fromCharCode(j))}return this._utf8_d…", "…=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003cj\u0026\u0026", "…eAt(c+1),b=b+String.fromCharCode((d\u002631)\u003c\u003c6|e\u002663),c=c+2;e…" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-charcode", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "FbiRat keylogger output filename", "e": [ "log.txt" ], "i": "well-known/malware/rat/fbirat::keylog-output-file", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Transacted registry API name", "e": [ "RegOpenKeyTransactedW", "RegCreateKeyTransactedW" ], "i": "well-known/malware/trojan/elex::transacted-registry-api-name", "l": 1 }, { "c": 0.7599999904632568, "d": "Browser extension manifest file", "e": [ "manifest.json" ], "i": "micro-behaviors/fs/path/sensitive/browser::browser-extension-manifest-json", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "crxdrop_exe.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1531.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.04" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": ".js extension", "e": [ "\"xB.js\"" ], "i": "objectives/command-and-control/dropper/builder::js-ext", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.61)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.6800000071525574, "d": "Chromium Preferences file", "e": [ "Preferences" ], "i": "micro-behaviors/fs/path/sensitive/browser::chromium-preferences-file", "l": 1 }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\System32\\\\ directory path", "e": [ "C:\\Windows\\System32\\" ], "i": "micro-behaviors/fs/path/system::windows-system32", "l": 3, "m": "E1083" }, { "c": 0.8500000238418579, "d": "File API ANSI check", "e": [ "AreFileApisANSI" ], "i": "micro-behaviors/os/env/access::are-file-apis-ansi", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with dense string corpus", "e": [ "binary.string_density = 14.94" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-string-density-large-pe", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "SQLite extension", "e": [ ".sqlite", ".sqlite", ".sqlite", ".sqlite", ".sqlite" ], "i": "objectives/collection/file-targeting/filter::sqlite-extension", "l": 1, "m": "B0024" }, { "c": 0.6000000238418579, "d": "System32 substring reference", "e": [ "C:\\Windows\\System32\\msiexec.exe" ], "i": "micro-behaviors/fs/path/system::system32-substr", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Registry value named \"scode\"", "e": [ "scode", "scode", "scode", "scode", "scode", "scode", "scode", "scode", "scode", "scode", "scode", "scode", "scode", "scode" ], "i": "objectives/anti-static/obfuscation/payload::scode-value-name", "l": 3, "m": "B0032" }, { "c": 0.9399999976158142, "d": "7-Zip BCJ2 method string", "e": [ "BCJ2" ], "i": "metadata/binary/installer/sfx::7zip-bcj2-method", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 2503.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.800000011920929, "d": "Manifest requests highest available privileges", "e": [ "\u003crequestedExecutionLevel level=\"highestAvailable" ], "i": "micro-behaviors/os/privilege/manifest::highest-available", "l": 3 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "USERPROFILE", "USERNAME", "SOFTWARE", "SECURITY", "REGISTRY", "JPICONFDATA" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "WinDbg debugger", "e": [ "windbg.exe" ], "i": "objectives/anti-analysis/tool-detect/process::windbg-process", "l": 3, "m": "B0013" }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "7z SFX installer config marker", "e": [ "…XPADDINGPADDINGXXPADDING;!@Install@!UTF-8!" ], "i": "objectives/anti-static/obfuscation/binary-metrics::7zsfx-config-marker", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadReadPtr anti-debug style probe", "e": [ "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-read-ptr", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1499", "c": 0.8999999761581421, "d": "Shutdown prank markers", "e": [ "Shutdown" ], "i": "objectives/impact/ui/manipulation::shutdown-prank-markers", "l": 3 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetModuleFileNameExA dynamic resolve", "e": [ "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::get-module-filename-ex-string", "l": 1 }, { "a": "T1005", "c": 0.30000001192092896, "d": "JSON file extension", "e": [ ".json" ], "i": "objectives/collection/file-targeting/filter::json-extension", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 742874.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1531.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "d": "DELETE FROM SQL keyword", "e": [ "delete from" ], "i": "micro-behaviors/data/db/conn/sql::sql-delete", "l": 2 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Port 80 (HTTP)", "e": [ ":80" ], "i": "objectives/command-and-control/infrastructure/ip::port-80", "l": 1, "m": "C0002" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…ssembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "d": "CREATE TABLE SQL keyword", "e": [ "CREATE TABLE", "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-create-table", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT * FROM", "SELECT url,scode,epoch FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 2 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 2 }, { "c": 0.20000000298023224, "d": "Function to execute remote commands", "e": [ "ExecuteCommand", "ExecuteCommand", "ExecuteCommand" ], "i": "objectives/command-and-control/remote-command/protocol::generic-dup", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4096.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 163840.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "open the file as archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.30000001192092896, "d": "lzma compression reference", "e": [ "LZMA" ], "i": "micro-behaviors/dylib/library::lzma-ref", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetProcessImageFileNameA dynamic resolve", "e": [ "GetProcessImageFileNameA" ], "i": "micro-behaviors/process/enumerate/psapi::get-process-image-filename-string", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "CExecuteProgram::Start: empty command", "CGlobalContext::OnQuestion: Execution command-list '%s' not-found or empty", "CGlobalContext::ExecuteCommand: Unknown command '%s'", "CGlobalContext::ExecuteCommands: no commands to execute (%d)", "mini::ini_section::set_from_command_line: (lpCmdLine==NULL)" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "d": "USERPROFILE environment variable", "e": [ "USERPROFILE" ], "i": "micro-behaviors/os/env/vars/user-info::userprofile-var", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "d": "Windows directory path reference", "e": [ "C:\\Windows\\System32" ], "i": "micro-behaviors/fs/path/system::windows-dir", "l": 2 }, { "a": "T1005", "c": 0.550000011920929, "d": "Generic database extension", "e": [ ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db" ], "i": "objectives/collection/file-targeting/filter::db-extension", "l": 1, "m": "B0024" }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 742874.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "d": "USERNAME environment variable", "e": [ "USERNAME" ], "i": "micro-behaviors/os/env/vars/user-info::username-var", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://syncerjpi.com/", "http://syncerjpi.com/" ], "i": "objectives/command-and-control/infrastructure/domain::http-url-binary", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "JavaScript function keyword in non-code file", "e": [ "function include(", "function loadIntoWindow(", "function unloadFromWindow(", "function startup(", "function shutdown(", "function install(", "function uninstall(" ], "i": "objectives/anti-static/obfuscation/payload::js-function-in-noncode", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel", "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 12800)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8399999737739563, "d": "ATL NoRemove registry directive", "e": [ "NoRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-noremove-directive", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll", "Advapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims Wireshark", "e": [ "wireshark", "wireshark", "wireshark", "wireshark" ], "i": "metadata/package/tooling::tool-identity-wireshark", "l": 1 }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1290097655.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Principal", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.45" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1518.001", "c": 0.800000011920929, "d": "Wireshark network analyzer process", "e": [ "wireshark.exe" ], "i": "objectives/anti-analysis/tool-detect/process::wireshark-process", "l": 3, "m": "B0013" }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "a": "T1518.001", "c": 0.800000011920929, "d": "Fiddler HTTP debugger process", "e": [ "fiddler.exe" ], "i": "objectives/anti-analysis/tool-detect/process::fiddler-process", "l": 3, "m": "B0013" }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.27" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.45" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 122.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.9399999976158142, "d": "7-Zip LZMA2 method string", "e": [ "LZMA2" ], "i": "metadata/binary/installer/sfx::7zip-lzma2-method", "l": 1 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "urlmon library reference", "e": [ "urlmon.dll" ], "i": "micro-behaviors/communications/http/get::urlmon-dll-reference", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8399999737739563, "d": "ATL ForceRemove registry directive", "e": [ "ForceRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-forceremove-directive", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "GetFolder", "GetFolder" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "c": 0.8999999761581421, "d": "Wireshark analyzer", "e": [ "$:hlen:wireshark", "$:hlen:the wireshark network analyzer", "$:hlen:wireshark network analyzer", "$:hash:wireshark.exe" ], "i": "micro-behaviors/communications/capture/wireshark::wireshark", "l": 3 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Can not delete output file", "Can not open output file" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CExecuteProgram::Start: : CreateProcess E:0x%0x", "CreateProcessW", "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1562.001", "c": 0.9800000190734863, "d": "AMSI scan buffer memory patch bytes (E_INVALIDARG)", "e": [ "b8 57 00 07 80 c3", "b8 57 00 07 80 c3" ], "i": "objectives/evasion/anti-av/platform::amsi-memory-patch-hex-bytes", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.8999999761581421, "d": "Two or more embedded PE headers", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::multiple-pe-embedded", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1496", "c": 0.8500000238418579, "d": "Process Monitor check", "e": [ "procmon.exe" ], "i": "objectives/impact/cryptojacking/miner::procmon-check", "l": 1, "m": "B0004" }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 1.0, "d": "Makefile all target", "e": [ "CFireFoxInstaller::Uninstall: : No extension ID defined", "CIEInstaller::Install: : Fail to copy DLL", "CFireFoxInstaller::Install: : No extension ID defined", "DCIEInstaller::Install: E copy TLB", "DCIEInstaller::Install: E copy INI", "DCIEInstaller::Uninstall: : No extension ID defined", "CFireFoxInstaller::Install: : ActiveProfileFolder(%s) not found and m_bAutoEnable==YES", "CFireFoxInstaller::Install: : ExtensionSourcePath (%s) not found", "CFireFoxInstaller::Install: %s; install target '%s'; %s (E:%d)", "CFireFoxInstaller::Install: final install target '%s'; %s (E:%d)", "CIEInstaller::Install: : empty ModuleFileName to install", "CFireFoxInstaller::Install: alt install target '%s'; %s (E:%d)" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1497", "c": 0.6000000238418579, "d": "Fiddler tooling reference", "e": [ "fiddler.exe" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::fiddler", "l": 2, "m": "B0007" }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.81" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::CreatePath: CRegistryUtils\u003cclass mini::e...", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::CreatePath: CRegistryUtils\u003cclass mini::e...", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::WriteString: (%s,%s): E:%d open key", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::RecurseDeleteKey: : E:%d open key '%s'", "mini::vector\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::push_back: E resize failed", "mini::vector\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::operator []: access out of bounds index %d...", "mini::vector\u003cclass CChromeBrandInstaller::CChromeProfile\u003e::push_back: E resize failed", "mini::vector\u003cclass CChromeBrandInstaller::CChromeProfile\u003e::operator []: access out of bounds index %...", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::RegDeleteKeyValueW: : E:%d open key '%s'", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::WriteDWORD: CRegistryUtils\u003cclass mini::e...", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::WriteDWORD: CRegistryUtils\u003cclass mini::e...", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::WriteDWORD: (%s,%s): E:%d open key", "mini::vector\u003cclass mini::ini_section\u003e::push_back: E resize failed", "mini::vector\u003cclass mini::ini_section\u003e::operator []: access out of bounds index %d not in 0..%d", "TODO: \u003cProduct name\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadWritePtr anti-debug style probe", "e": [ "IsBadWritePtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-write-ptr", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 601562.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "$:hlen:process explorer" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.9950000047683716, "d": "japproxy sync C2 URL", "e": [ "…drEpdsFqTrFpjw9qGhSCH9F;http://japproxy.net/sync/?q=hfZ9ojC9rdk8hchEAen0qHaE…" ], "i": "well-known/malware/trojan/elex/dropper::japproxy-sync-c2", "l": 4 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "a": "T1115", "c": 0.8500000238418579, "d": "Chromium extension file pair", "e": [ "manifest.json", "content.js" ], "i": "objectives/impact/crypto-manipulation/clipboard::chromium-extension-files", "l": 1 }, { "c": 0.9800000190734863, "d": "zycript custom alphabet", "e": [ "….url})}},zycript={xlat:\"abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/\",", "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/", "….url})}},zycript={xlat:\"abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/\",decode:function(a){for…" ], "i": "well-known/malware/trojan/elex/dropper::zycript-custom-alphabet", "l": 4 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.4000000059604645, "d": "HKLM registry hive reference", "e": [ "HKLM" ], "i": "micro-behaviors/os/registry/access::hklm-hive", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "a": "T1496", "c": 0.8500000238418579, "d": "Process Explorer check", "e": [ "procexp.exe" ], "i": "objectives/impact/cryptojacking/miner::procexp-check", "l": 1, "m": "B0004" }, { "d": "INSERT INTO SQL keyword", "e": [ "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\ directory path", "e": [ "C:\\Windows\\System32\\msiexec" ], "i": "micro-behaviors/fs/path/system::windows-root", "l": 2, "m": "E1083" }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA", "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (romChar)", "e": [ "…=(f\u00263)\u003c\u003c6|g,b=b+String.fromCharCode(d\u003c\u003c2|e\u003e\u003e4);64!=f\u0026\u00260…", "…64!=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003cj\u0026\u0026", "…(c);if(128\u003ed)b+=String.fromCharCode(d),", "…CodeAt(c+1),b=b+String.fromCharCode((d\u002631)\u003c\u003c6|e\u002663),c=c…", "…64!=g\u0026\u00260\u003ci\u0026\u0026(b+=String.fromCharCode(i))}return this._ut…", "…(c);if(128\u003ed)b+=String.fromCharCode(d),c++;else if(191\u003c…", "…64!=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003ci\u0026\u0026(b+…", "(b+=String.fromCharCode(j))}return this._ut…", "…CodeAt(c+2),b=b+String.fromCharCode((d\u002615)\u003c\u003c12|(e\u002663)\u003c\u003c…" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-romchar", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "FireFox", "Firefox", "Firefox", "Firefox", "Firefox", "Firefox", "Firefox", "FireFox", "FireFox", "FireFox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.48" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Makefile install target", "e": [ "DCIEInstaller::Uninstall: : No extension ID defined", "CFireFoxInstaller::Uninstall: : No extension ID defined" ], "i": "metadata/build/make::install-target-assignment", "l": 1 }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "Process Hacker tool", "e": [ "processhacker.exe" ], "i": "objectives/anti-analysis/tool-detect/process::process-hacker-dup", "l": 3, "m": "B0013" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.699999988079071, "d": "Chromium Extensions directory", "e": [ "Extensions" ], "i": "micro-behaviors/fs/path/sensitive/browser::chromium-extensions-directory", "l": 1 }, { "a": "T1059.003", "c": 0.8999999761581421, "d": "ShellExecuteExA ANSI extended API", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/system::shell-execute-ex-a", "l": 3, "m": "E1059.003" }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "NetUserEnum remote user enumeration", "e": [ "NetUserEnum" ], "i": "micro-behaviors/os/service/remote::net-user-enum-source", "l": 3 }, { "c": 1.0, "d": "Compatibility alias", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex-a", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1531.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry delete API lookup", "e": [ "RegDeleteKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-delete-key-transacted-name", "l": 3 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1497", "c": 0.6000000238418579, "d": "OllyDbg debugger", "e": [ "ollydbg" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::ollydbg", "l": 2, "m": "B0007" }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 601562.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 601562.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "e4 b1 41 00", "b0 b0 41 00", "1c b1 41 00", "20 b1 41 00", "30 b1 41 00", "b0 b0 41 00", "6c b0 41 00", "24 b0 41 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1518.001", "c": 0.8999999761581421, "d": "OllyDbg debugger", "e": [ "ollydbg.exe" ], "i": "objectives/anti-analysis/tool-detect/process::ollydbg-process", "l": 3, "m": "B0013" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8500000238418579, "d": "PE contains 2+ embedded PE binaries", "e": [ "binary.embedded_binary_count = 2.00" ], "i": "metadata/binary/metrics::embedded-pe-multi", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SetCurrentDirectoryA", "MultiByteToWideChar", "WideCharToMultiByte", "GetModuleFileNameA", "GetModuleFileNameW", "GetWindowsDirectoryA", "GetCurrentDirectoryA", "InitializeCriticalSection", "SetUnhandledExceptionFilter", "GetEnvironmentVariableA", "UnhandledExceptionFilter", "InterlockedDecrement", "InterlockedIncrement", "GenuineIntelAuthenticAMDCentaurHauls" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{62D82EC1-0D3A-DF54-8E3E-07E1337A5311}", "{E82BE161-861B-FA3A-27B0-49533F4C83A5}", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "….working=1,this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",a,!…" ], "i": "micro-behaviors/communications/http/request::xmlhttprequest-word", "l": 3 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1497.001", "d": "VBOX string detection", "e": [ "vbox" ], "i": "objectives/anti-analysis/emulator-detect::vbox-string", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableA" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "15.23.35.193:105" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry open API lookup", "e": [ "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-transacted-name", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1497", "c": 0.6000000238418579, "d": "Process Monitor tool", "e": [ "procmon" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::procmon", "l": 2, "m": "B0007" }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "Process Monitor (Sysinternals)", "e": [ "procexp.exe", "procmon.exe" ], "i": "objectives/anti-analysis/tool-detect/process::procmon-process", "l": 3, "m": "B0013" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "a": "T1057", "d": "Browser app iexplore", "e": [ "iexplore" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-iexplore", "l": 3, "m": "E1592" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.81" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry create API lookup", "e": [ "RegCreateKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-transacted-name", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1497.001", "c": 0.6000000238418579, "d": "VirtualBox hypervisor vendor string", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/vm-detect::vendor-virtualbox", "l": 1 }, { "a": "T1497.001", "d": "VirtualBox string detection", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/emulator-detect::virtualbox-word", "l": 1, "m": "B0009" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 122.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, ... +94 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 9, ORDINAL 2)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteExA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, ... +15 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetModuleFileNameA", "CreateFileA", "CreateFileW", "ReadFile", "GetFileSize" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "VS_VERSION_INFO", "FileVersion", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "GetModuleFileNameW", "FindFirstFileW", "SetFileTime", "CreateFileA", "WriteFile", "GetModuleFileNameA", "CreateFileW" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.8600000143051147, "d": "Chromium extension profile files", "e": [ "Preferences", "manifest.json", "Extensions" ], "i": "micro-behaviors/fs/path/sensitive/browser::chromium-profile-extension-files", "l": 3 }, { "a": "T1057", "c": 0.8799999952316284, "d": "Dynamic PSAPI API resolution strings", "e": [ "PSAPI", "GetProcessImageFileNameA", "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dynamic-resolve", "l": 3 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathA", "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindNextFileA", "FindClose", "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "c": 0.9800000190734863, "d": "7-Zip self-extracting archive profile", "e": [ "LZMA2", "BCJ2" ], "i": "metadata/binary/installer/sfx::7zip-sfx-archive-profile", "l": 3 }, { "d": "SQL statement keywords", "e": [ "SELECT * FROM", "delete from", "CREATE TABLE", "SELECT url,scode,epoch FROM", "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 122.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1548.002", "c": 0.8500000238418579, "d": "Admin manifest with network activity", "e": [ "\u003crequestedExecutionLevel level=\"highestAvailable", "….working=1,this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",a,!…" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass/manifest::admin-manifest-network", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameW", "DeleteFileA", "DeleteFileW", "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1518.001", "c": 0.8999999761581421, "d": "Multiple analysis tools enumerated", "e": [ "PSAPI", "fiddler.exe", "GetProcessImageFileNameA", "procmon.exe", "processhacker.exe", "procexp.exe", "wireshark.exe", "GetModuleFileNameExA", "windbg.exe", "ollydbg.exe" ], "i": "objectives/anti-analysis/tool-detect/process::analysis-tool-enumeration", "l": 4, "m": "B0013" }, { "a": "T1497", "c": 0.6600000262260437, "d": "Sandbox detection techniques", "e": [ "ollydbg", "PSAPI", "procmon", "GetProcessImageFileNameA", "GetModuleFileNameExA", "$:hash:wireshark.exe", "$:hlen:the wireshark network analyzer", "$:hlen:wireshark network analyzer", "$:hlen:wireshark" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::sandbox", "l": 4, "m": "B0007" }, { "a": "T1622", "c": 0.8999999761581421, "d": "SEH with bad pointer debug probes", "e": [ "OutputDebugStringW", "SetUnhandledExceptionFilter", "IsBadWritePtr", "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::seh-pointer-probe-anti-debug", "l": 2, "m": "B0001" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry API fallback chain", "e": [ "RegDeleteKeyTransactedW", "RegOpenKeyTransactedW", "RegCreateKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::registry-transacted-api-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "GetFileSize", "CreateFileW", "GetModuleFileNameA", "CreateFileA", "ReadFile", "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 3, "m": "B0032" }, { "a": "T1497", "c": 0.8999999761581421, "d": "Multi-tool analyst-name catalog (debugger + sandbox + monitor)", "e": [ "fiddler.exe", "$:hlen:wireshark network analyzer", "$:hlen:wireshark", "procmon", "$:hash:wireshark.exe", "ollydbg", "$:hlen:the wireshark network analyzer" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::analyst-tool-name-cluster", "l": 4, "m": "B0007" }, { "c": 0.8999999761581421, "d": "Trojanized system utility or hardware monitor dropper", "e": [ "wireshark", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::trojanized-system-utility-dropper", "l": 4 } ], "sha": "0ce35cf896478a387c71482ada0d7bb8d0379805a1dc1554ae0806b2b84e79ff", "path": "111896", "type": "pe" }, { "f": "K₂O₁₀(Al₆SAs₈Er₈I₅PrC₂CoP₂Xe)H₇(Cm₂F₄Os₃Po₅UDbDs)Md₅(SiBi₃BkPa)", "x": 169, "dp": 1, "id": 1, "is": [ "GetSystemTimeAsFileTime", "SetFileTime", "LoadLibraryW", "CopyFileW", "GetFileAttributesW", "GetLastError", "SetLastError", "GetProcAddress", "MoveFileW", "FindClose", "RemoveDirectoryW", "FindNextFileW", "DeleteFileW", "GetSystemTime", "ExpandEnvironmentStringsW", "CreateProcessW", "GetPrivateProfileStringW", "GetPrivateProfileIntW", "SetFilePointer", "FreeLibrary", "GetCurrentProcess", "WaitForSingleObject", "OpenProcess", "GetVersionExW", "TerminateProcess", "GetModuleFileNameW", "GetShortPathNameA", "GetCurrentDirectoryW", "GetLongPathNameA", "LoadLibraryA", "GetCurrentProcessId", "GetCommandLineW", "CreateMutexW", "MapViewOfFile", "UnmapViewOfFile", "FlushFileBuffers", "OpenMutexW", "DisableThreadLibraryCalls", "GlobalFree", "CreateFileMappingW", "OpenFileMappingW", "ReleaseMutex", "InterlockedIncrement", "GetProcessHeap", "InterlockedCompareExchange", "Sleep", "VirtualProtect", "GetModuleHandleExW", "GetCommandLineA", "LeaveCriticalSection", "EnterCriticalSection", "GetModuleFileNameA", "DeleteCriticalSection", "WriteConsoleW", "SetStdHandle", "SetFilePointerEx", "OutputDebugStringW", "LoadLibraryExW", "GetModuleHandleW", "CreateDirectoryW", "HeapFree", "MoveFileExW", "SystemTimeToFileTime", "HeapAlloc", "SetEndOfFile", "FindFirstFileW", "HeapReAlloc", "GetEnvironmentVariableW", "lstrcpyW", "LocalFree", "CloseHandle", "lstrcatW", "lstrcmpiW", "LocalAlloc", "lstrlenW", "MultiByteToWideChar", "lstrcmpW", "CreateFileW", "ReadFile", "WideCharToMultiByte", "WriteFile", "InterlockedDecrement", "GetFileSize", "LCMapStringW", "RtlUnwind", "GetConsoleMode", "GetConsoleCP", "GetStringTypeW", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "IsDebuggerPresent", "IsProcessorFeaturePresent", "IsValidCodePage", "GetACP", "GetOEMCP", "GetCPInfo", "GetCurrentThreadId", "ExitProcess", "HeapSize", "GetStdHandle", "RaiseException", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "InitializeCriticalSectionAndSpinCount", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "GetStartupInfoW", "GetFileType", "QueryPerformanceCounter", "GetTickCount", "MessageBoxW", "GetWindowThreadProcessId", "PostMessageW", "GetParent", "ExitWindowsEx", "EnumWindows", "GetDesktopWindow", "SetSecurityDescriptorDacl", "InitializeSecurityDescriptor", "AdjustTokenPrivileges", "LookupPrivilegeValueW", "OpenProcessToken", "RegDeleteValueW", "RegSetValueExW", "RegCloseKey", "RegEnumKeyExW", "RegOpenKeyExW", "IsValidSid", "LookupAccountNameW", "RegDeleteKeyW", "RegQueryValueExW", "RegCreateKeyExW", "ShellExecuteExW", "CommandLineToArgvW", "ORDINAL 2", "ORDINAL 6", "NetApiBufferFree", "NetUserEnum", "NetUserGetInfo", "GetFileVersionInfoSizeW", "VerQueryValueW", "GetFileVersionInfoW", "PathRemoveFileSpecW" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "pdb_path": "C:\\Development\\extension-setup_2013\\bin\\Win32\\Release\\crxdrop_exe.pdb", "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1378135730.0, "image_base": 4194304.0, "codeview_age": 1.0, "rsrc_entropy": 3.62, "codeview_guid": "FFCB93F6-BE6E-4B54-9E63-23595619DD1F", "entry_section": ".text", "size_of_image": 372736.0, "timestamp_day": 2.0, "file_alignment": 512.0, "has_vc_feature": true, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 258.0, "entry_point_rva": 108898.0, "size_of_headers": 1024.0, "timestamp_month": 9.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 8.0, "manifest_present": true, "computed_checksum": 379297.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1378135730.0, "debug_timestamp_min": 1378135730.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 11.0, "version_info_present": true, "debug_directory_types": [ 2.0, 12.0 ], "api_hashing_indicators": 1.0, "debug_directory_entries": 2.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 2.0 }, "binary": { "code_size": 198144.0, "file_size": 372736.0, "entry_point": 108898.0, "has_overlay": true, "code_entropy": 6.44, "data_entropy": 4.16, "import_count": 145.0, "overlay_size": 30720.0, "string_count": 1076.0, "overlay_ratio": 0.08, "section_count": 5.0, "avg_complexity": 6.45, "function_count": 791.0, "import_density": 0.75, "max_complexity": 384.0, "string_density": 5.56, "overall_entropy": 4.17, "overlay_entropy": 5.87, "avg_basic_blocks": 10.79, "avg_section_size": 68198.4, "dependency_count": 8.0, "entropy_variance": 1.31, "function_density": 4.09, "avg_function_size": 261.38, "avg_string_length": 27.8, "complexity_per_kb": 0.03, "max_string_length": 246.0, "wide_string_count": 236.0, "writable_sections": 1.0, "avg_string_entropy": 3.45, "code_to_data_ratio": 1.39, "data_to_file_ratio": 0.09, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.53, "total_basic_blocks": 8532.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 26.13, "debug_reference_count": 2.0, "largest_section_ratio": 0.53, "sentence_string_count": 294.0, "sentence_string_ratio": 0.27, "behavioral_import_ratio": 0.05, "function_analysis_depth": 2.0, "high_complexity_functions": 11.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 240, "Richkj" ], [ 520, ".text" ], [ 599, "@.data" ], [ 640, ".rsrc" ], [ 679, "@.reloc" ], [ 24207, "Pj.j" ], [ 80246, "LSVW" ], [ 97059, "QSVW" ], [ 113808, "Genuu_" ], [ 119060, "HHtXHHt" ], [ 120360, "RPWQ" ], [ 122556, "PSSV" ], [ 123608, "FVWPP" ], [ 123646, "SVWPP" ], [ 128848, "WVS3" ], [ 131637, "SVW3" ], [ 131661, "9E WW" ], [ 140786, "UVWS" ], [ 145515, "QRSW" ], [ 147168, "QQSV" ], [ 147764, "YYPW" ], [ 147876, "8RCC" ], [ 147884, "8MOC" ], [ 148777, "UQPXY]Y[" ], [ 173782, "v6j0" ], [ 173967, "PRSQ" ], [ 175056, "PSVW" ], [ 177297, "SSSSV" ], [ 177888, "WVU3" ], [ 178311, "Huzj" ], [ 182198, "HAO8" ], [ 200204, "bad allocation" ], [ 200240, "Unknown exception" ], [ 200352, "Sunday" ], [ 200360, "Monday" ], [ 200368, "Tuesday" ], [ 200376, "Wednesday" ], [ 200388, "Thursday" ], [ 200400, "Friday" ], [ 200408, "Saturday" ], [ 200468, "January" ], [ 200476, "February" ], [ 200488, "March" ], [ 200496, "April" ], [ 200504, "June" ], [ 200512, "July" ], [ 200520, "August" ], [ 200528, "September" ], [ 200540, "October" ], [ 200548, "November" ], [ 200560, "December" ], [ 200580, "MM/dd/yy" ], [ 200592, "dddd, MMMM dd, yyyy" ], [ 200680, "wide", "Sunday" ], [ 200696, "wide", "Monday" ], [ 200712, "Tuesday" ], [ 200728, "Wednesday" ], [ 200748, "Thursday" ], [ 200768, "wide", "Friday" ], [ 200784, "Saturday" ], [ 200900, "wide", "January" ], [ 200916, "February" ], [ 200936, "March" ], [ 200948, "April" ], [ 200960, "June" ], [ 200972, "wide", "July" ], [ 200984, "August" ], [ 201000, "September" ], [ 201020, "October" ], [ 201036, "wide", "November" ], [ 201056, "December" ], [ 201092, "wide", "MM/dd/yy" ], [ 201112, "wide", "dddd, MMMM dd, yyyy" ], [ 201215, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 201312, "wide", "mscoree.dll" ], [ 201336, "CorExitProcess" ], [ 201352, "R6008\r\n- not enough space for arguments\r\n" ], [ 201440, "R6009\r\n- not enough space for environment\r\n" ], [ 201528, "R6010\r\n- abort() has been called\r\n" ], [ 201600, "R6016\r\n- not enough space for thread data\r\n" ], [ 201688, "R6017\r\n- unexpected multithread lock error\r\n" ], [ 201784, "R6018\r\n- unexpected heap error\r\n" ], [ 201856, "R6019\r\n- unable to open console device\r\n" ], [ 201944, "R6024\r\n- not enough space for _onexit/atexit table\r\n" ], [ 202056, "R6025\r\n- pure virtual function call\r\n" ], [ 202136, "R6026\r\n- not enough space for stdio initialization\r\n" ], [ 202248, "R6027\r\n- not enough space for lowio initialization\r\n" ], [ 202360, "R6028\r\n- unable to initialize heap\r\n" ], [ 202436, "R6030\r\n- CRT not initialized\r\n" ], [ 202504, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application.\r\n" ], [ 202704, "R6032\r\n- not enough space for locale information\r\n" ], [ 202808, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 203304, "R6034\r\n- inconsistent onexit begin-end variables\r\n" ], [ 203408, "DOMAIN error\r\n" ], [ 203440, "wide", "SING error" ], [ 203468, "wide", "TLOSS error" ], [ 203496, "runtime error " ], [ 203710, "CR6002\r\n- floating point support not loaded\r\n" ], [ 203804, "Runtime Error!\n\nProgram: " ], [ 203856, "\u003cprogram name unknown\u003e" ], [ 203920, "wide", "Microsoft Visual C++ Runtime Library" ], [ 204028, "wide", "kernel32.dll" ], [ 204056, "FlsAlloc" ], [ 204068, "FlsFree" ], [ 204076, "FlsGetValue" ], [ 204088, "FlsSetValue" ], [ 204100, "InitializeCriticalSectionEx" ], [ 204128, "CreateSemaphoreExW" ], [ 204148, "SetThreadStackGuarantee" ], [ 204172, "CreateThreadpoolTimer" ], [ 204196, "SetThreadpoolTimer" ], [ 204216, "WaitForThreadpoolTimerCallbacks" ], [ 204248, "CloseThreadpoolTimer" ], [ 204272, "CreateThreadpoolWait" ], [ 204296, "SetThreadpoolWait" ], [ 204316, "CloseThreadpoolWait" ], [ 204336, "FlushProcessWriteBuffers" ], [ 204364, "FreeLibraryWhenCallbackReturns" ], [ 204396, "GetCurrentProcessorNumber" ], [ 204424, "GetLogicalProcessorInformation" ], [ 204456, "CreateSymbolicLinkW" ], [ 204476, "SetDefaultDllDirectories" ], [ 204504, "EnumSystemLocalesEx" ], [ 204524, "CompareStringEx" ], [ 204540, "GetDateFormatEx" ], [ 204556, "GetLocaleInfoEx" ], [ 204572, "GetTimeFormatEx" ], [ 204588, "GetUserDefaultLocaleName" ], [ 204616, "IsValidLocaleName" ], [ 204636, "LCMapStringEx" ], [ 204652, "GetCurrentPackageId" ], [ 204832, "(null)" ], [ 204881, "700WP" ], [ 204897, "`h````" ], [ 204982, "700PP" ], [ 205040, "UTF-16LE" ], [ 205052, "UNICODE" ], [ 205060, "SunMonTueWedThuFriSat" ], [ 205084, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 205898, " h(((( H" ], [ 206576, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 206960, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 213608, "wide", "az-az-cyrl" ], [ 213632, "wide", "az-az-latn" ], [ 213692, "bs-ba-latn" ], [ 213824, "div-mv" ], [ 214560, "kok-in" ], [ 214828, "quz-bo" ], [ 214844, "quz-ec" ], [ 214860, "quz-pe" ], [ 214972, "wide", "sma-no" ], [ 214988, "sma-se" ], [ 215004, "wide", "smj-no" ], [ 215020, "wide", "smj-se" ], [ 215036, "wide", "smn-fi" ], [ 215052, "sms-fi" ], [ 215080, "wide", "sr-ba-cyrl" ], [ 215104, "sr-ba-latn" ], [ 215128, "wide", "sr-sp-cyrl" ], [ 215152, "sr-sp-latn" ], [ 215212, "syr-sy" ], [ 215324, "wide", "uz-uz-cyrl" ], [ 215348, "wide", "uz-uz-latn" ], [ 215396, "zh-chs" ], [ 215412, "zh-cht" ], [ 215500, "USER32.DLL" ], [ 215524, "GetActiveWindow" ], [ 215540, "GetLastActivePopup" ], [ 215560, "GetUserObjectInformationW" ], [ 215588, "GetProcessWindowStation" ], [ 216020, "__cdecl" ], [ 216028, "__pascal" ], [ 216040, "__stdcall" ], [ 216052, "__thiscall" ], [ 216064, "__fastcall" ], [ 216076, "__clrcall" ], [ 216088, "__eabi" ], [ 216104, "__restrict" ], [ 216116, "__unaligned" ], [ 216128, "restrict(" ], [ 216148, "delete" ], [ 216184, "operator" ], [ 216364, "`local static guard'" ], [ 216400, "`vbase destructor'" ], [ 216420, "`vector deleting destructor'" ], [ 216452, "`default constructor closure'" ], [ 216484, "`scalar deleting destructor'" ], [ 216516, "`vector constructor iterator'" ], [ 216548, "`vector destructor iterator'" ], [ 216580, "`vector vbase constructor iterator'" ], [ 216616, "`virtual displacement map'" ], [ 216644, "`eh vector constructor iterator'" ], [ 216680, "`eh vector destructor iterator'" ], [ 216712, "`eh vector vbase constructor iterator'" ], [ 216752, "`copy constructor closure'" ], [ 216780, "`udt returning'" ], [ 216808, "`local vftable'" ], [ 216824, "`local vftable constructor closure'" ], [ 216868, "delete[]" ], [ 216880, "`omni callsig'" ], [ 216896, "`placement delete closure'" ], [ 216924, "`placement delete[] closure'" ], [ 216956, "`managed vector constructor iterator'" ], [ 216996, "`managed vector destructor iterator'" ], [ 217036, "`eh vector copy constructor iterator'" ], [ 217076, "`eh vector vbase copy constructor iterator'" ], [ 217120, "`dynamic initializer for '" ], [ 217148, "`dynamic atexit destructor for '" ], [ 217184, "`vector copy constructor iterator'" ], [ 217220, "`vector vbase copy constructor iterator'" ], [ 217264, "`managed vector copy constructor iterator'" ], [ 217308, "`local static thread guard'" ], [ 217336, " Type Descriptor'" ], [ 217356, " Base Class Descriptor at (" ], [ 217384, " Base Class Array'" ], [ 217404, " Class Hierarchy Descriptor'" ], [ 217436, " Complete Object Locator'" ], [ 217480, "bad exception" ], [ 218744, "permission denied" ], [ 218764, "file exists" ], [ 218776, "no such device" ], [ 218792, "filename too long" ], [ 218812, "device or resource busy" ], [ 218836, "io error" ], [ 218848, "directory not empty" ], [ 218868, "invalid argument" ], [ 218888, "no space on device" ], [ 218908, "no such file or directory" ], [ 218936, "function not supported" ], [ 218960, "no lock available" ], [ 218980, "not enough memory" ], [ 219000, "resource unavailable try again" ], [ 219032, "cross device link" ], [ 219052, "operation canceled" ], [ 219072, "too many files open" ], [ 219092, "permission_denied" ], [ 219112, "address_in_use" ], [ 219128, "address_not_available" ], [ 219152, "address_family_not_supported" ], [ 219184, "connection_already_in_progress" ], [ 219216, "bad_file_descriptor" ], [ 219236, "connection_aborted" ], [ 219256, "connection_refused" ], [ 219276, "connection_reset" ], [ 219296, "destination_address_required" ], [ 219328, "bad_address" ], [ 219340, "host_unreachable" ], [ 219360, "operation_in_progress" ], [ 219384, "interrupted" ], [ 219396, "invalid_argument" ], [ 219416, "already_connected" ], [ 219436, "too_many_files_open" ], [ 219456, "message_size" ], [ 219472, "filename_too_long" ], [ 219492, "network_down" ] ], "sz": 372736, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "48", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.7599999904632568, "d": "Browser extension manifest file", "e": [ "manifest.json" ], "i": "micro-behaviors/fs/path/sensitive/browser::browser-extension-manifest-json", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "crxdrop_exe.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1076.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.45" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.44)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.6800000071525574, "d": "Chromium Preferences file", "e": [ "Preferences" ], "i": "micro-behaviors/fs/path/sensitive/browser::chromium-preferences-file", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\System32\\\\ directory path", "e": [ "C:\\Windows\\System32\\" ], "i": "micro-behaviors/fs/path/system::windows-system32", "l": 3, "m": "E1083" }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.6000000238418579, "d": "System32 substring reference", "e": [ "C:\\Windows\\System32\\msiexec.exe" ], "i": "micro-behaviors/fs/path/system::system32-substr", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 8532.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "USERPROFILE", "USERNAME", "SOFTWARE" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileW" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.8500000238418579, "d": "OpenMutex API call", "e": [ "OpenMutexW" ], "i": "micro-behaviors/process/sync/mutex::open-mutex", "l": 2, "m": "C0042" }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "WinDbg debugger", "e": [ "windbg.exe" ], "i": "objectives/anti-analysis/tool-detect/process::windbg-process", "l": 3, "m": "B0013" }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1499", "c": 0.8999999761581421, "d": "Shutdown prank markers", "e": [ "Shutdown" ], "i": "objectives/impact/ui/manipulation::shutdown-prank-markers", "l": 3 }, { "c": 0.699999988079071, "d": "Read INI integer value", "e": [ "GetPrivateProfileIntW" ], "i": "micro-behaviors/fs/config/system::read-private-profile-int", "l": 2 }, { "a": "T1036.005", "c": 0.8799999952316284, "d": "Two dotted-quad version strings", "e": [ "1.0.0.1", "1.0.0.1" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetModuleFileNameExA dynamic resolve", "e": [ "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::get-module-filename-ex-string", "l": 1 }, { "a": "T1005", "c": 0.30000001192092896, "d": "JSON file extension", "e": [ ".json" ], "i": "objectives/collection/file-targeting/filter::json-extension", "l": 1, "m": "B0024" }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 791.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage::get-window-thread-process-id", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 372736.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1076.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8399999737739563, "d": "asInvoker execution manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.8999999761581421, "d": "Modbus write single register frame", "e": [ "00 08" ], "i": "micro-behaviors/communications/modbus::write-single-register", "l": 1 }, { "a": "T1106", "c": 0.8500000238418579, "d": "CreateProcessW API string", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w-string", "l": 2 }, { "c": 0.20000000298023224, "d": "Function to execute remote commands", "e": [ "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand", "ExecuteCommand" ], "i": "objectives/command-and-control/remote-command/protocol::generic-dup", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 372736.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "C:\\Development\\extension-setup_2013\\bin\\Win32\\Release\\crxdrop_exe.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetProcessImageFileNameA dynamic resolve", "e": [ "GetProcessImageFileNameA" ], "i": "micro-behaviors/process/enumerate/psapi::get-process-image-filename-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "CExecuteProgram::Start: empty command", "CGlobalContext::ExecuteCommand: Unknown command '%s'", "CGlobalContext::OnQuestion: Execution command-list '%s' not-found or empty", "CGlobalContext::ExecuteCommands: no commands to execute (%d)", "mini::ini_section::set_from_command_line: (lpCmdLine==NULL)" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExW" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 2, "m": "B0032" }, { "d": "USERPROFILE environment variable", "e": [ "USERPROFILE" ], "i": "micro-behaviors/os/env/vars/user-info::userprofile-var", "l": 2 }, { "d": "Windows directory path reference", "e": [ "C:\\Windows\\System32" ], "i": "micro-behaviors/fs/path/system::windows-dir", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "d": "USERNAME environment variable", "e": [ "USERNAME" ], "i": "micro-behaviors/os/env/vars/user-info::username-var", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense short mixed-case data tokens", "e": [ "Copyright", "Default", "ChromeID", "ChromeVer", "ChromeKey", "ChromeExt", "Profiles", "Google", "Standard", "Internal", "Component", "Registry", "Brand", "Brand", "Install", "Failed" ], "i": "objectives/anti-static/obfuscation/string::dense-short-mixedcase-data-tokens", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve account name to SID", "e": [ "LookupAccountNameW" ], "i": "micro-behaviors/os/user/lookup::lookup-account-name", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Tool identity claims Wireshark", "e": [ "wireshark", "wireshark", "wireshark", "wireshark" ], "i": "metadata/package/tooling::tool-identity-wireshark", "l": 1 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Unfilled TODO product name in version resource", "e": [ "TODO: \u003cProduct name\u003e" ], "i": "objectives/evasion/masquerade/version-resource::todo-product-name-placeholder", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1378135730.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window (Unicode)", "e": [ "PostMessageW" ], "i": "micro-behaviors/os/message/queue::post-message-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.17" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage::enum-windows", "l": 2 }, { "a": "T1518.001", "c": 0.800000011920929, "d": "Wireshark network analyzer process", "e": [ "wireshark.exe" ], "i": "objectives/anti-analysis/tool-detect/process::wireshark-process", "l": 3, "m": "B0013" }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "a": "T1518.001", "c": 0.800000011920929, "d": "Fiddler HTTP debugger process", "e": [ "fiddler.exe" ], "i": "objectives/anti-analysis/tool-detect/process::fiddler-process", "l": 3, "m": "B0013" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.27" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.17" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 145.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "GetFolder", "GetFolder" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat", ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 791.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Wireshark analyzer", "e": [ "$:hash:wireshark.exe", "$:hlen:wireshark", "$:hlen:the wireshark network analyzer", "$:hlen:wireshark network analyzer" ], "i": "micro-behaviors/communications/capture/wireshark::wireshark", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 791.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessW", "CExecuteProgram::Start: : CreateProcess E:0x%0x" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1496", "c": 0.8500000238418579, "d": "Process Monitor check", "e": [ "procmon.exe" ], "i": "objectives/impact/cryptojacking/miner::procmon-check", "l": 1, "m": "B0004" }, { "c": 0.6499999761581421, "d": "Read from INI config file", "e": [ "GetPrivateProfileStringW" ], "i": "micro-behaviors/fs/config/system::read-private-profile", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 1.0, "d": "Makefile all target", "e": [ "CIEInstaller::Install: : empty ModuleFileName to install", "CIEInstaller::Install: : Fail to copy DLL", "DCIEInstaller::Install: E copy INI", "DCIEInstaller::Uninstall: : No extension ID defined", "DCIEInstaller::Install: E copy TLB", "CFireFoxInstaller::Uninstall: : No extension ID defined", "CFireFoxInstaller::Install: : ExtensionSourcePath (%s) not found", "CFireFoxInstaller::Install: : ActiveProfileFolder(%s) not found and m_bAutoEnable==YES", "CFireFoxInstaller::Install: : No extension ID defined", "CFireFoxInstaller::Install: %s; install target '%s'; %s (E:%d)", "CFireFoxInstaller::Install: alt install target '%s'; %s (E:%d)", "CFireFoxInstaller::Install: final install target '%s'; %s (E:%d)" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1497", "c": 0.6000000238418579, "d": "Fiddler tooling reference", "e": [ "fiddler.exe" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::fiddler", "l": 2, "m": "B0007" }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::CreatePath: CRegistryUtils\u003cclass mini::e...", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::WriteString: (%s,%s): E:%d open key", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::RecurseDeleteKey: : E:%d open key '%s'", "mini::vector\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::push_back: E resize failed", "mini::vector\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::operator []: access out of bounds index %d...", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::WriteDWORD: CRegistryUtils\u003cclass mini::e...", "CRegistryUtils\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::WriteDWORD: (%s,%s): E:%d open key", "mini::vector\u003cclass mini::ini_section\u003e::operator []: access out of bounds index %d not in 0..%d" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Strip filename from path", "e": [ "PathRemoveFileSpecW" ], "i": "micro-behaviors/fs/path/check::path-remove-file-spec", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "$:hlen:process explorer" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c0" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1106", "c": 0.6000000238418579, "d": "EnumWindows / EnumChildWindows API", "e": [ "EnumWindows" ], "i": "objectives/evasion/process/injection::enum-windows-callback", "l": 3, "m": "E1106" }, { "c": 0.9800000190734863, "d": "zycript custom alphabet", "e": [ "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/" ], "i": "well-known/malware/trojan/elex/dropper::zycript-custom-alphabet", "l": 4 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (Unicode)", "e": [ "CreateProcessW" ], "i": "micro-behaviors/process/create/spawn::create-process-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 145.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1496", "c": 0.8500000238418579, "d": "Process Explorer check", "e": [ "procexp.exe" ], "i": "objectives/impact/cryptojacking/miner::procexp-check", "l": 1, "m": "B0004" }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "GetEnvironmentVariableW import", "e": [ "GetEnvironmentVariableW" ], "i": "well-known/malware/trojan/hijack-gen::get-environment-variable-w-import", "l": 1 }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\ directory path", "e": [ "C:\\Windows\\System32\\msiexec" ], "i": "micro-behaviors/fs/path/system::windows-root", "l": 2, "m": "E1083" }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "FireFox", "Firefox", "Firefox", "Firefox", "Firefox", "Firefox", "Firefox", "Firefox", "FireFox", "FireFox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.45" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 1.0, "d": "Makefile install target", "e": [ "CFireFoxInstaller::Uninstall: : No extension ID defined", "DCIEInstaller::Uninstall: : No extension ID defined" ], "i": "metadata/build/make::install-target-assignment", "l": 1 }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "Process Hacker tool", "e": [ "processhacker.exe" ], "i": "objectives/anti-analysis/tool-detect/process::process-hacker-dup", "l": 3, "m": "B0013" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.699999988079071, "d": "Chromium Extensions directory", "e": [ "Extensions" ], "i": "micro-behaviors/fs/path/sensitive/browser::chromium-extensions-directory", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 791.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.6600000262260437, "d": "Copy files", "e": [ "CopyFileW" ], "i": "micro-behaviors/fs/file/copy::copyfile-w", "l": 3 }, { "c": 0.8999999761581421, "d": "NetUserEnum remote user enumeration", "e": [ "NetUserEnum" ], "i": "micro-behaviors/os/service/remote::net-user-enum-source", "l": 3 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1076.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 791.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1497", "c": 0.6000000238418579, "d": "OllyDbg debugger", "e": [ "ollydbg" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::ollydbg", "l": 2, "m": "B0007" }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "68 20 43 00", "50 20 43 00", "44 22 43 00", "80 21 43 00", "80 21 43 00", "80 21 43 00", "80 21 43 00", "80 21 43 00", "80 21 43 00", "e8 20 43 00", "54 20 43 00", "54 20 43 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1518.001", "c": 0.8999999761581421, "d": "OllyDbg debugger", "e": [ "ollydbg.exe" ], "i": "objectives/anti-analysis/tool-detect/process::ollydbg-process", "l": 3, "m": "B0013" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeCriticalSectionEx", "SetThreadStackGuarantee", "WaitForThreadpoolTimerCallbacks", "FlushProcessWriteBuffers", "FreeLibraryWhenCallbackReturns", "GetCurrentProcessorNumber", "GetLogicalProcessorInformation", "SetDefaultDllDirectories", "EnumSystemLocalesEx", "GetUserDefaultLocaleName", "GetCurrentPackageId", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetUserObjectInformationW", "GetProcessWindowStation", "GetUserAppDataFolderPath" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1497.001", "d": "VBOX string detection", "e": [ "vbox" ], "i": "objectives/anti-analysis/emulator-detect::vbox-string", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableW" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueW" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1497", "c": 0.6000000238418579, "d": "Process Monitor tool", "e": [ "procmon" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::procmon", "l": 2, "m": "B0007" }, { "a": "T1518.001", "c": 0.8500000238418579, "d": "Process Monitor (Sysinternals)", "e": [ "procexp.exe", "procmon.exe" ], "i": "objectives/anti-analysis/tool-detect/process::procmon-process", "l": 3, "m": "B0013" }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Registry blob wipe API", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 3, "m": "F0007" }, { "a": "T1057", "d": "Browser app iexplore", "e": [ "iexplore" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-iexplore", "l": 3, "m": "E1592" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1497.001", "c": 0.6000000238418579, "d": "VirtualBox hypervisor vendor string", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/vm-detect::vendor-virtualbox", "l": 1 }, { "a": "T1497.001", "d": "VirtualBox string detection", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/emulator-detect::virtualbox-word", "l": 1, "m": "B0009" }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteExW, CommandLineToArgvW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetSystemTimeAsFileTime, SetFileTime, LoadLibraryW, CopyFileW, GetFileAttributesW, ... +107 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, ... +10 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (MessageBoxW, GetWindowThreadProcessId, PostMessageW, GetParent, ExitWindowsEx, ... +2 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links NETAPI32.dll (NetApiBufferFree, NetUserEnum, NetUserGetInfo)", "e": [ "NETAPI32.dll" ], "i": "metadata/dylib::netapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathRemoveFileSpecW)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 2, ORDINAL 6)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "ReadFile", "SetFilePointerEx", "GetFileSize", "CreateFileW", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "CreateFileW", "FindFirstFileW", "GetModuleFileNameA", "GetModuleFileNameW", "SetFileTime", "WriteFile" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "c": 0.800000011920929, "d": "Has file operation capabilities", "e": [ "FindFirstFileW", "MoveFileExW" ], "i": "objectives/impact/ransom/file-operations::has-file-operations", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "68 20 43 00", "e8 20 43 00", "50 20 43 00", "44 22 43 00", "80 21 43 00", "54 20 43 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1129", "c": 0.9399999976158142, "d": "Self copy append and relaunch", "e": [ "GetTickCount", "DeleteFileW", "SetFilePointer", "CreateProcessW", "GetModuleFileNameW", "CopyFileW", "GetModuleFileNameA", "WriteFile", "CreateFileW" ], "i": "objectives/command-and-control/dropper/execution/loader::self-copy-relaunch-loader", "l": 2, "m": "B0030" }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindFirstFileW", "FindNextFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "c": 0.8600000143051147, "d": "Chromium extension profile files", "e": [ "Extensions", "manifest.json", "Preferences" ], "i": "micro-behaviors/fs/path/sensitive/browser::chromium-profile-extension-files", "l": 3 }, { "a": "T1057", "c": 0.8799999952316284, "d": "Dynamic PSAPI API resolution strings", "e": [ "PSAPI", "GetModuleFileNameExA", "GetProcessImageFileNameA" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dynamic-resolve", "l": 3 }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetProcessWindowStation", "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 145.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyExW", "RegSetValueExW", "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "CreateMutexW", "ExitProcess", "OpenMutexW" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1518.001", "c": 0.8999999761581421, "d": "Multiple analysis tools enumerated", "e": [ "procexp.exe", "GetModuleFileNameExA", "processhacker.exe", "ollydbg.exe", "wireshark.exe", "PSAPI", "procmon.exe", "fiddler.exe", "GetProcessImageFileNameA", "windbg.exe" ], "i": "objectives/anti-analysis/tool-detect/process::analysis-tool-enumeration", "l": 4, "m": "B0013" }, { "a": "T1497", "c": 0.6600000262260437, "d": "Sandbox detection techniques", "e": [ "$:hlen:the wireshark network analyzer", "GetModuleFileNameExA", "$:hlen:wireshark network analyzer", "$:hash:wireshark.exe", "GetProcessImageFileNameA", "ollydbg", "procmon", "$:hlen:wireshark", "PSAPI" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::sandbox", "l": 4, "m": "B0007" }, { "a": "T1529", "c": 0.9399999976158142, "d": "Privilege-enabled reboot API use", "e": [ "ExitWindowsEx", "LookupPrivilegeValueW", "SeShutdownPrivilege", "AdjustTokenPrivileges" ], "i": "objectives/impact/system/shutdown::shutdown-privilege-reboot-api", "l": 3, "m": "B0029" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1204", "c": 0.8999999761581421, "d": "Self-mapping dropper extracts and executes payload", "e": [ "GetModuleFileNameA", "WriteFile", "GetModuleFileNameW", "ShellExecuteExW", "CreateProcessW", "MapViewOfFile" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "IsDebuggerPresent", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "USERNAME", "SOFTWARE", "OpenMutexW", "CreateMutexW", "USERPROFILE" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "ReadFile", "CreateFileW", "SetFilePointerEx", "GetModuleFileNameA", "GetFileSize", "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.overall_entropy = 4.17", "binary.function_count = 791.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "AdjustTokenPrivileges", "LookupPrivilegeValueW", "OpenProcessToken" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" }, { "a": "T1497", "c": 0.8999999761581421, "d": "Multi-tool analyst-name catalog (debugger + sandbox + monitor)", "e": [ "$:hlen:wireshark network analyzer", "fiddler.exe", "$:hash:wireshark.exe", "$:hlen:the wireshark network analyzer", "ollydbg", "procmon", "$:hlen:wireshark" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::analyst-tool-name-cluster", "l": 4, "m": "B0007" }, { "c": 0.8999999761581421, "d": "Trojanized system utility or hardware monitor dropper", "e": [ "wireshark", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::trojanized-system-utility-dropper", "l": 4 } ], "sha": "e94683702ab08ccef7e356a6946d0f40fdc1dd07b9def659093e2881a7907349", "path": "111896!!embedded:pe@0x2772a", "type": "pe" }, { "f": "KO₆(C₅Er₅Al₂As₉P₂S)H₅(FOs₂PoCm₄Db)Md₄(SiBiPa)", "x": 52, "dp": 1, "id": 2, "is": [ "SizeofResource", "lstrcmpiW", "LoadLibraryExW", "GetModuleFileNameW", "GetModuleHandleW", "FindResourceW", "MultiByteToWideChar", "HeapAlloc", "HeapReAlloc", "HeapFree", "GetProcessHeap", "DeleteFileW", "MoveFileExW", "LockResource", "GetFileSize", "ReadFile", "CloseHandle", "LoadLibraryW", "FindResourceExW", "CreateDirectoryW", "CreateFileW", "GetCurrentProcessId", "LoadResource", "WaitForSingleObject", "WriteFile", "FlushFileBuffers", "SetEndOfFile", "SetFilePointer", "GetSystemTimeAsFileTime", "MapViewOfFile", "UnmapViewOfFile", "CreateMutexW", "OpenMutexW", "CreateFileMappingW", "OpenFileMappingW", "lstrlenW", "GetPrivateProfileIntW", "GetPrivateProfileStringW", "WritePrivateProfileStringW", "WritePrivateProfileSectionW", "WriteConsoleW", "SetStdHandle", "SetFilePointerEx", "GetConsoleMode", "GetConsoleCP", "DeleteCriticalSection", "InitializeCriticalSectionAndSpinCount", "LeaveCriticalSection", "EnterCriticalSection", "GetLastError", "RaiseException", "GetProcAddress", "DisableThreadLibraryCalls", "FreeLibrary", "InterlockedDecrement", "ReleaseMutex", "InterlockedIncrement", "GetStringTypeW", "GetTickCount", "LCMapStringW", "OutputDebugStringW", "WideCharToMultiByte", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "QueryPerformanceCounter", "GetModuleFileNameA", "GetFileType", "GetCPInfo", "GetOEMCP", "GetACP", "IsValidCodePage", "GetStartupInfoW", "TlsFree", "TlsSetValue", "TlsGetValue", "HeapDestroy", "HeapSize", "IsDebuggerPresent", "IsProcessorFeaturePresent", "RtlUnwind", "GetCommandLineA", "GetCurrentThreadId", "GetStdHandle", "ExitProcess", "GetModuleHandleExW", "Sleep", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "SetLastError", "GetCurrentProcess", "TerminateProcess", "TlsAlloc", "TranslateMessage", "CharNextW", "DispatchMessageW", "GetMessageW", "SetSecurityDescriptorDacl", "InitializeSecurityDescriptor", "RegSetValueExW", "RegQueryInfoKeyW", "RegOpenKeyExW", "RegEnumKeyExW", "RegDeleteValueW", "RegDeleteKeyW", "RegCreateKeyExW", "RegCloseKey", "IsTextUnicode", "CoTaskMemAlloc", "CLSIDFromString", "CoCreateInstance", "StringFromGUID2", "CreateBindCtx", "CoTaskMemFree", "CoTaskMemRealloc", "ORDINAL 161", "ORDINAL 2", "ORDINAL 6", "ORDINAL 7", "ORDINAL 277", "ORDINAL 162", "ORDINAL 163", "ORDINAL 4", "ORDINAL 146", "ORDINAL 9", "ORDINAL 8", "ORDINAL 150", "ORDINAL 149", "ORDINAL 186", "PathRenameExtensionW", "PathFileExistsW", "PathRemoveFileSpecW", "PathCombineW", "CreateURLMoniker" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 3072.0, "subsystem": 2.0, "timestamp": 1378135732.0, "image_base": 268435456.0, "rsrc_entropy": 4.82, "entry_section": ".text", "size_of_image": 249856.0, "timestamp_day": 2.0, "file_alignment": 512.0, "resource_count": 4.0, "timestamp_year": 2013.0, "characteristics": 8450.0, "entry_point_rva": 103020.0, "size_of_headers": 1024.0, "timestamp_month": 9.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1378135732.0, "import_dll_count": 7.0, "manifest_present": true, "computed_checksum": 249126.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 2.0, "linker_major_version": 11.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 9.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 158208.0, "file_size": 239280.0, "entry_point": 103020.0, "has_overlay": true, "code_entropy": 6.32, "data_entropy": 4.34, "export_count": 6.0, "import_count": 133.0, "overlay_size": 11952.0, "string_count": 834.0, "overlay_ratio": 0.05, "section_count": 5.0, "avg_complexity": 4.62, "function_count": 986.0, "import_density": 0.86, "max_complexity": 384.0, "string_density": 5.4, "overall_entropy": 5.02, "overlay_entropy": 6.23, "avg_basic_blocks": 7.19, "avg_section_size": 45260.8, "dependency_count": 7.0, "entropy_variance": 0.78, "function_density": 6.38, "avg_function_size": 155.01, "avg_string_length": 28.54, "complexity_per_kb": 0.03, "max_string_length": 6975.0, "wide_string_count": 74.0, "writable_sections": 1.0, "avg_string_entropy": 3.29, "code_to_data_ratio": 2.32, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.66, "total_basic_blocks": 7093.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 241.53, "largest_section_ratio": 0.66, "sentence_string_count": 141.0, "sentence_string_ratio": 0.17, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0, "high_complexity_functions": 8.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 520, ".text" ], [ 599, "@.data" ], [ 640, ".rsrc" ], [ 679, "@.reloc" ], [ 1131, "Rjfh" ], [ 7622, "SVWP" ], [ 28203, "u1jz" ], [ 48964, "LSVW" ], [ 98418, "6PWQ" ], [ 104633, "Genuu_" ], [ 106747, "QRSW" ], [ 108400, "QQSV" ], [ 108996, "YYPW" ], [ 109108, "8RCC" ], [ 109116, "8MOC" ], [ 113299, "95LQ" ], [ 114891, "HHtXHHt" ], [ 116191, "RPWQ" ], [ 118399, "PSSV" ], [ 119310, "FVWPP" ], [ 119348, "SVWPP" ], [ 120130, "UVWS" ], [ 121343, "SVW3" ], [ 122489, "UQPXY]Y[" ], [ 124925, "9E WW" ], [ 160016, "SMDB" ], [ 160040, "ForceRemove" ], [ 160064, "NoRemove" ], [ 160084, "Delete" ], [ 160100, "res://%s/BOOTSTRAP/BODY" ], [ 160152, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 160272, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 160348, "CLSID" ], [ 160360, "Component Categories" ], [ 160404, "FileType" ], [ 160424, "Interface" ], [ 160444, "Hardware" ], [ 160464, "Mime" ], [ 160484, "SECURITY" ], [ 160504, "wide", "SYSTEM" ], [ 160520, "wide", "Software" ], [ 160540, "TypeLib" ], [ 160800, "wide", "Advapi32.dll" ], [ 160828, "RegOpenKeyTransactedW" ], [ 160852, "RegCreateKeyTransactedW" ], [ 160876, "RegDeleteKeyTransactedW" ], [ 160944, "RegDeleteKeyExW" ], [ 161012, "116.135.2.16:128" ], [ 161068, "16.136.2.16:128" ], [ 161104, "HKCR" ], [ 161116, "wide", "HKCU" ], [ 161128, "wide", "HKLM" ], [ 161148, "wide", "HKPD" ], [ 161184, "wide", "HKEY_CLASSES_ROOT" ], [ 161220, "wide", "HKEY_CURRENT_USER" ], [ 161256, "HKEY_LOCAL_MACHINE" ], [ 161296, "wide", "HKEY_USERS" ], [ 161320, "wide", "HKEY_PERFORMANCE_DATA" ], [ 161364, "HKEY_DYN_DATA" ], [ 161392, "wide", "HKEY_CURRENT_CONFIG" ], [ 161516, "wide", "Module" ], [ 161532, "wide", "Module_Raw" ], [ 161556, "REGISTRY" ], [ 161732, "generic" ], [ 161740, "unknown error" ], [ 161784, "iostream" ], [ 161796, "iostream stream error" ], [ 161848, "system" ], [ 161856, "LALA" ], [ 161868, "wide", "LULU" ], [ 161904, "wide", "APPID" ], [ 162008, "invalid string position" ], [ 162032, "string too long" ], [ 162048, "SMDB" ], [ 162072, "ForceRemove" ], [ 162096, "NoRemove" ], [ 162116, "Delete" ], [ 162132, ".tlb" ], [ 162144, "res://%s/BOOTSTRAP/BODY" ], [ 162192, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 162272, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 162392, "CLSID" ], [ 162404, "Component Categories" ], [ 162448, "FileType" ], [ 162468, "Interface" ], [ 162488, "Hardware" ], [ 162508, "Mime" ], [ 162528, "SECURITY" ], [ 162548, "SYSTEM" ], [ 162564, "Software" ], [ 162584, "TypeLib" ], [ 162624, ".tlb" ], [ 162652, "\\Required Categories" ], [ 162696, "wide", "\\Implemented Categories" ], [ 162744, "OLEAUT32.DLL" ], [ 162772, "UnRegisterTypeLibForUser" ], [ 162800, "RegisterTypeLibForUser" ], [ 162833, "MDBV" ], [ 162856, "ForceRemove" ], [ 162880, "wide", "IEPlugin" ], [ 162900, "NoRemove" ], [ 162920, "Delete" ], [ 162936, "wide", "CIEPluginConfig::GetValue: loaded %d values from '%.80s..'" ], [ 163056, ".dat" ], [ 163068, "wide", "ieframe.dll" ], [ 163092, "IEIsProtectedModeProcess" ], [ 163120, "CIEPluginConfig::GetValue: loaded %d values from '%.80s..'" ], [ 163240, "data" ], [ 163252, "wide", "shell32.dll" ], [ 163276, "SHGetKnownFolderPath" ], [ 163300, "res://%s/BOOTSTRAP/BODY" ], [ 163352, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 163440, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 163516, "CLSID" ], [ 163528, "Component Categories" ], [ 163572, "FileType" ], [ 163592, "Interface" ], [ 163612, "Hardware" ], [ 163632, "Mime" ], [ 163652, "SECURITY" ], [ 163672, "SYSTEM" ], [ 163688, "Software" ], [ 163708, "TypeLib" ], [ 163752, "mini::ini_section::set: E: empty key; ignored" ], [ 163848, "wide", "mini::ini_section::set: %s=NULL" ], [ 163912, "wide", "mini::ini_section::set: %s='%s'" ], [ 163984, "wide", "mini::ini_section::set_from_file: INI base64_decode'd OK '%.80s..'" ], [ 164120, "wide", "mini::ini_section::find: %s=(new)NULL" ], [ 164200, "wide", "mini::ini_section::get: %s=NULL" ], [ 164264, "mini::ini_section::get: %s='%s'" ], [ 164336, "mini::extended_mini_string\u003cwchar_t\u003e::base64_encode: E:%d libcode64::encode" ], [ 164488, "mini::extended_mini_string\u003cwchar_t\u003e::base64_encode: Exception" ], [ 164616, "mini::extended_mini_string\u003cwchar_t\u003e::base64_decode: E:%d libcode64::decode" ], [ 164768, "mini::extended_mini_string\u003cwchar_t\u003e::base64_decode: Exception" ], [ 164896, "mini::vector\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::push_back: E resize failed" ], [ 165072, "mini::vector\u003cclass mini::extended_mini_string\u003cwchar_t\u003e \u003e::operator []: access out of bounds index %d not in 0..%d" ], [ 165304, "SMDB" ], [ 165328, "ForceRemove" ], [ 165352, "NoRemove" ], [ 165372, "Delete" ], [ 165392, "JPICONFDATA" ], [ 165448, "wide", "%s%s%s%s" ], [ 165480, "CEventLogger::LogEventV: vsprintf error %d with pszFormat='%s'" ], [ 165616, "%s%s%s%s" ], [ 165636, "E:%d create memlog" ], [ 165676, "log.txt" ], [ 165684, "LogSourceBHO" ], [ 165702, "OQA INI-file:encrypted INI-enc:new(BASE64X|META)" ], [ 165800, "BHO v%d.%d.%d %s" ], [ 165856, "{\"entry_counter\":\"%d\",\"entry_time\":\"%s\",\"entry_type\":\"%u\",\"message\":\"%.256s\"}," ], [ 166016, "CIEPluginMain::OnBeforeNavigate2: [0x%08x]: m_nPageCounter=%d" ], [ 166140, "wide", "bgscript" ], [ 166160, "CIEPluginMain::OnNavigateComplete2: [0x%08x]: m_nPageCounter=%d (%d)" ], [ 166300, "wide", "%s:%s:%d:%08x: %.512s" ], [ 166352, "CIEPluginMain::OnDocumentComplete: [0x%08x]: Calling ExecContentScript" ], [ 166496, "Log File Created\r\n" ], [ 166536, "CIEPluginMain::OnDownloadBegin: [0x%08x]: m_bRefresh=%d m_nObjCounter=%d m_nPageCounter=%d" ], [ 166720, "CIEPluginMain::OnDownloadComplete: [0x%08x]: m_bRefresh=%d m_nObjCounter=%d {%d}" ], [ 166884, "res://%s/BOOTSTRAP/BODY" ], [ 166936, "CIEPluginMain::OnDownloadComplete: [0x%08x]: Calling ExecContentScript" ], [ 167088, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 167164, "wide", "BgScript" ], [ 167184, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 167260, "wide", "LocalStorage" ], [ 167288, "res://%s/BOOTSTRAP/BODY" ], [ 167348, "CLSID" ], [ 167360, "Component Categories" ], [ 167404, "FileType" ], [ 167424, "Interface" ], [ 167444, "Hardware" ], [ 167464, "Mime" ], [ 167484, "SECURITY" ], [ 167504, "SYSTEM" ], [ 167520, "Software" ], [ 167540, "TypeLib" ], [ 167556, "contentscript" ], [ 167588, "javascript" ], [ 167712, "(null)" ], [ 167816, "ForceRemove" ], [ 167840, "NoRemove" ], [ 167860, "Delete" ], [ 167880, "modulename" ], [ 167908, "shortname" ], [ 167932, "wide", "version" ], [ 167952, "wide", "progid" ], [ 167988, "typelib" ], [ 168004, ".dat" ], [ 168016, "storage" ], [ 168032, "debugmode" ], [ 168052, "PLUGIN_PROGID" ], [ 168080, "CIEPluginModule::AddCommonRGSReplacements: PluginShortName='%s'" ], [ 168208, "CIEPluginModule::AddCommonRGSReplacements: ProgID='%s'" ], [ 168320, "wide", "CIEPluginModule::AddCommonRGSReplacements: CLSID='%s'" ], [ 168428, "PLUGIN_NAME" ], [ 168452, "wide", "PLUGIN_CLSID" ], [ 168480, "PLUGIN_VERSION" ], [ 168512, "Browser Helper Objects" ], [ 168560, "PLUGIN_REGKEY" ], [ 168588, "res://%s/BOOTSTRAP/BODY" ], [ 168640, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 168728, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 168804, "CLSID" ], [ 168816, "Component Categories" ], [ 168860, "FileType" ], [ 168880, "Interface" ], [ 168900, "Hardware" ], [ 168920, "Mime" ], [ 168940, "SECURITY" ], [ 168960, "SYSTEM" ], [ 168976, "Software" ], [ 168996, "TypeLib" ], [ 169024, "SMDB" ], [ 169048, "ForceRemove" ], [ 169072, "NoRemove" ], [ 169092, "Delete" ], [ 169112, "data" ], [ 169128, "wide", "size" ], [ 169168, "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/" ], [ 169236, "wide", "getItem" ], [ 169252, "wide", "setItem" ], [ 169272, "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/" ], [ 169340, "wide", "removeItem" ], [ 169408, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 169484, "res://%s/BOOTSTRAP/BODY" ], [ 169536, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 169624, "wide", "CIEPluginStorage::LogAccess: %s:%s:%s" ], [ 169700, "CLSID" ], [ 169712, "Component Categories" ], [ 169756, "FileType" ], [ 169776, "Interface" ], [ 169796, "Hardware" ], [ 169816, "Mime" ], [ 169836, "SECURITY" ], [ 169856, "SYSTEM" ], [ 169872, "Software" ], [ 169892, "TypeLib" ], [ 170000, "SMDB" ], [ 170024, "ForceRemove" ], [ 170048, "NoRemove" ], [ 170068, "Delete" ], [ 170084, "res://%s/BOOTSTRAP/BODY" ], [ 170148, "CLSID" ], [ 170160, "Component Categories" ], [ 170204, "FileType" ], [ 170224, "Interface" ], [ 170244, "Hardware" ], [ 170264, "Mime" ], [ 170284, "SECURITY" ], [ 170304, "SYSTEM" ], [ 170320, "Software" ], [ 170340, "TypeLib" ], [ 170628, "bad allocation" ], [ 171912, "permission denied" ], [ 171932, "file exists" ], [ 171944, "no such device" ] ], "sz": 239280, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48", "48", "46" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "FbiRat keylogger output filename", "e": [ "log.txt" ], "i": "well-known/malware/rat/fbirat::keylog-output-file", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.699999988079071, "d": "Move to next character", "e": [ "CharNextW" ], "i": "micro-behaviors/ui/window/manage::char-next", "l": 2 }, { "c": 0.8999999761581421, "d": "Transacted registry API name", "e": [ "RegOpenKeyTransactedW", "RegCreateKeyTransactedW" ], "i": "well-known/malware/trojan/elex::transacted-registry-api-name", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.62" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 133.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": ".js extension", "e": [ "\"content.js\"" ], "i": "objectives/command-and-control/dropper/builder::js-ext", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.32)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.7599999904632568, "d": "Convert GUID to string", "e": [ "StringFromGUID2" ], "i": "micro-behaviors/os/com/invoke::string-from-guid2", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 7093.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SECURITY", "REGISTRY", "SECURITY", "SECURITY", "JPICONFDATA", "SECURITY", "SECURITY", "SECURITY", "SECURITY" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8500000238418579, "d": "OpenMutex API call", "e": [ "OpenMutexW" ], "i": "micro-behaviors/process/sync/mutex::open-mutex", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 133.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Locate PE resource entry with language", "e": [ "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Read INI integer value", "e": [ "GetPrivateProfileIntW" ], "i": "micro-behaviors/fs/config/system::read-private-profile-int", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 986.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 239280.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Check file existence via SHLWAPI", "e": [ "PathFileExistsW" ], "i": "micro-behaviors/fs/path/check::path-file-exists", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 834.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8399999737739563, "d": "asInvoker execution manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 4 (connect)", "e": [ "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-4", "l": 1 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8999999761581421, "d": "Modbus write single register frame", "e": [ "00 08" ], "i": "micro-behaviors/communications/modbus::write-single-register", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 3072.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 249856.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "c": 0.75, "d": "Write INI section", "e": [ "WritePrivateProfileSectionW" ], "i": "micro-behaviors/fs/config/system::write-profile-section", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8399999737739563, "d": "ATL NoRemove registry directive", "e": [ "NoRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-noremove-directive", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "Advapi32.dll", "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "CreateFileMappingW API call", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 133.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1378135732.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 133.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.949999988079071, "d": "COM unregistration export", "e": [ "DllUnregisterServer" ], "i": "metadata/binary/symbols::export-dll-unregister-server", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.02" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "c": 0.949999988079071, "d": "COM registration export", "e": [ "DllRegisterServer" ], "i": "metadata/binary/symbols::export-dll-register-server", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 133.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 133.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Sparse loader with many wide strings", "e": [ "binary.wide_string_count = 74.00" ], "i": "objectives/evasion/process/injection/vb6::sparse-wide-string-loader-count", "l": 2, "m": "C0041" }, { "a": "T1071.001", "c": 0.800000011920929, "d": "urlmon library reference", "e": [ "urlmon.dll" ], "i": "micro-behaviors/communications/http/get::urlmon-dll-reference", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.8399999737739563, "d": "ATL ForceRemove registry directive", "e": [ "ForceRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-forceremove-directive", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat", ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 986.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.7799999713897705, "d": "Combine filesystem paths via Shlwapi", "e": [ "PathCombineW" ], "i": "micro-behaviors/fs/path/construct::path-combine", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 986.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.6499999761581421, "d": "Read from INI config file", "e": [ "GetPrivateProfileStringW" ], "i": "micro-behaviors/fs/config/system::read-private-profile", "l": 2 }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 6.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Strip filename from path", "e": [ "PathRemoveFileSpecW" ], "i": "micro-behaviors/fs/path/check::path-remove-file-spec", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 150", "e": [ "ORDINAL 150" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-150", "l": 1, "m": "B0025" }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Create a named file-mapping object (wide)", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::create-file-mapping-w", "l": 2 }, { "c": 0.8799999952316284, "d": "ATL module RTTI markers", "e": [ "CAtlException@ATL@@", "CAtlModule@ATL@@", "CComModule@ATL@@", "CComModule@ATL@@" ], "i": "metadata/binary/framework::atl-module-rtti", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c9" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "c": 0.75, "d": "Write to INI config file", "e": [ "WritePrivateProfileStringW" ], "i": "micro-behaviors/fs/config/system::write-private-profile", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.9800000190734863, "d": "zycript custom alphabet", "e": [ "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/" ], "i": "well-known/malware/trojan/elex/dropper::zycript-custom-alphabet", "l": 4 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.949999988079071, "d": "COM unload export present", "e": [ "DllCanUnloadNow" ], "i": "metadata/binary/symbols::export-dll-can-unload-now", "l": 1 }, { "c": 0.4000000059604645, "d": "HKLM registry hive reference", "e": [ "HKLM" ], "i": "micro-behaviors/os/registry/access::hklm-hive", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 133.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "FireFox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.29" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.949999988079071, "d": "COM class factory export", "e": [ "DllGetClassObject" ], "i": "metadata/binary/symbols::export-dll-get-class-object", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 986.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 986.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry delete API lookup", "e": [ "RegDeleteKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-delete-key-transacted-name", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "90 80 02 10", "90 80 02 10", "90 80 02 10", "90 80 02 10", "90 80 02 10", "90 80 02 10", "f4 80 02 10", "f4 80 02 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "RegOpenKeyTransactedW", "RegCreateKeyTransactedW", "RegDeleteKeyTransactedW", "RegisterTypeLibForUser", "AddCommonRGSReplacements", "AddCommonRGSReplacements", "AddCommonRGSReplacements", "InitializeCriticalSectionEx", "SetThreadStackGuarantee", "WaitForThreadpoolTimerCallbacks", "FlushProcessWriteBuffers", "FreeLibraryWhenCallbackReturns", "GetCurrentProcessorNumber", "GetLogicalProcessorInformation", "SetDefaultDllDirectories", "EnumSystemLocalesEx" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{62D82EC1-0D3A-DF54-8E3E-07E1337A5311}", "{E82BE161-861B-FA3A-27B0-49533F4C83A5}", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "DJB2 hash algorithm constant (5381)", "e": [ "05 15 00 00" ], "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "l": 1, "m": "B0032.014" }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "116.135.2.16:128", "16.136.2.16:128" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry open API lookup", "e": [ "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-transacted-name", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "116.135.2.16:128", "16.136.2.16:128" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Registry blob wipe API", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 3, "m": "F0007" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry create API lookup", "e": [ "RegCreateKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-transacted-name", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 161, ORDINAL 2, ORDINAL 6, ORDINAL 7, ORDINAL 277, ... +9 more)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathRenameExtensionW, PathFileExistsW, PathRemoveFileSpecW, PathCombineW)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegSetValueExW, RegQueryInfoKeyW, RegOpenKeyExW, ... +6 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoTaskMemAlloc, CLSIDFromString, CoCreateInstance, StringFromGUID2, CreateBindCtx, ... +2 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links urlmon.dll (CreateURLMoniker)", "e": [ "urlmon.dll" ], "i": "metadata/dylib::urlmon/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (TranslateMessage, CharNextW, DispatchMessageW, GetMessageW)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (SizeofResource, lstrcmpiW, LoadLibraryExW, GetModuleFileNameW, GetModuleHandleW, ... +87 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "SetFilePointerEx", "GetFileSize", "CreateFileW", "ReadFile", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetProcAddress", "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "GetTickCount", "f4 80 02 10", "90 80 02 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.800000011920929, "d": "Reads INI integers and writes config", "e": [ "GetPrivateProfileIntW", "WritePrivateProfileStringW" ], "i": "micro-behaviors/fs/config/system::ini-read-int-write-cycle", "l": 3 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.800000011920929, "d": "Reads and writes to INI configuration files", "e": [ "GetPrivateProfileStringW", "WritePrivateProfileStringW" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle", "l": 3 }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetProcessWindowStation", "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 133.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceW", "LoadResource", "FindResourceExW", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "SizeofResource", "LoadResource", "FindResourceW", "LockResource", "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExW", "RegSetValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "OpenMutexW", "CreateMutexW", "GetLastError", "ExitProcess" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameW", "GetModuleFileNameA", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry API fallback chain", "e": [ "RegOpenKeyTransactedW", "RegCreateKeyTransactedW", "RegDeleteKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::registry-transacted-api-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "Sleep", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "CreateMutexW", "SECURITY", "REGISTRY", "JPICONFDATA", "OpenMutexW" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "c": 0.949999988079071, "d": "Standard COM server export set", "e": [ "DllUnregisterServer", "DllGetClassObject", "DllRegisterServer", "DllCanUnloadNow" ], "i": "metadata/binary/symbols::standard-com-server-exports", "l": 2 } ], "sha": "f3835519fad1f91f09e998276be9b82b1e66b982b0b3751c6f765007b72bae19", "path": "111896!!embedded:pe@0x7af2a", "type": "pe" } ], "tv": "b2c18" } }