{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9961373209953308, "class": 1 } ], "prob": 0.9961373, "class": 1, "oprob": 0.8484849, "models": [ { "m": "az", "prob": 0.8484849, "class": 0 }, { "m": "az/native", "prob": 0.774942, "class": 0 }, { "m": "az/pe", "prob": 0.81875, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-13T03:23:45Z" }, "path": "0ee2698d2bfd76bb41ba18dfdff7e38a7cd25f99021a37c26a1ae4b442bb5e3b.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₂Si)", "k": { "hash.imp": "dfdebb2e73c16b991e07a8bd413b9db6", "pe.timestamp": 1597769144, "hash.authenti": "7ecc7d2760efbb8ef7f72e6a677424db83bb2cfecd9beed22de1834caebf403d", "hash.rich_header": "34677c1061a4d3427f9a7171b07c53622f0c5b8692d030cf9b112ca9ac0d59be", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.resource_types[0]": "RT_BITMAP", "pe.resource_types[1]": "RT_ICON", "pe.resource_types[2]": "RT_DIALOG", "pe.resource_types[3]": "RT_STRING", "pe.resource_types[4]": "RT_RCDATA", "pe.resource_types[5]": "RT_GROUP_ICON", "pe.resource_types[6]": "RT_VERSION", "pe.rich_header.xor_key": "0xe5fab43d", "pe.data_directories[0].rva": 27824, "pe.data_directories[1].rva": 36864, "pe.data_directories[2].rva": 24576, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 140, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 38440, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 748, "pe.version_info.company_name": "Z\u0019\u0001FileDescription", "pe.version_info.file_version": "1, 0, 0, 1", "pe.version_info.product_name": "Application TimeTest", "pe.version_info.internal_name": "TimeTest", "pe.rich_header_compids[0].count": 6, "pe.rich_header_compids[1].count": 2, "pe.rich_header_compids[2].count": 11, "pe.rich_header_compids[3].count": 7, "pe.rich_header_compids[4].count": 181, "pe.rich_header_compids[5].count": 7, "pe.rich_header_compids[6].count": 1, "pe.version_info.legal_copyright": "Copyright (C) 2002", "pe.version_info.product_version": "1, 0, 0, 1", "binary.top_complex_unnamed[0].cc": 31, "binary.top_complex_unnamed[1].cc": 27, "binary.top_complex_unnamed[2].cc": 15, "binary.top_complex_unnamed[3].cc": 14, "binary.top_complex_unnamed[4].cc": 10, "binary.top_complex_unnamed[5].cc": 9, "binary.top_complex_unnamed[6].cc": 8, "binary.top_complex_unnamed[7].cc": 6, "pe.rich_header_compids[0].compid": 1253218, "pe.rich_header_compids[1].compid": 924803, "pe.rich_header_compids[2].compid": 663528, "pe.rich_header_compids[3].compid": 270312, "pe.rich_header_compids[4].compid": 65536, "pe.rich_header_compids[5].compid": 729064, "pe.rich_header_compids[6].compid": 394936, "pe.version_info.file_description": "Application MFC TimeTest", "pe.version_info.legal_trademarks": "B\r\u0001OriginalFilename", "binary.top_complex_unnamed[0].bbs": 34, "binary.top_complex_unnamed[1].bbs": 70, "binary.top_complex_unnamed[2].bbs": 27, "binary.top_complex_unnamed[3].bbs": 31, "binary.top_complex_unnamed[4].bbs": 13, "binary.top_complex_unnamed[5].bbs": 24, "binary.top_complex_unnamed[6].bbs": 14, "binary.top_complex_unnamed[7].bbs": 10, "pe.rich_header_compids[4].product": "Unknown", "pe.version_info.original_filename": "TimeTest.EXE", "binary.top_complex_unnamed[0].addr": "0x404900", "binary.top_complex_unnamed[0].size": 760, "binary.top_complex_unnamed[1].addr": "0x40260b", "binary.top_complex_unnamed[1].size": 3071, "binary.top_complex_unnamed[2].addr": "0x403551", "binary.top_complex_unnamed[2].size": 969, "binary.top_complex_unnamed[3].addr": "0x40392a", "binary.top_complex_unnamed[3].size": 1952, "binary.top_complex_unnamed[4].addr": "0x403288", "binary.top_complex_unnamed[4].size": 693, "binary.top_complex_unnamed[5].addr": "0x4041d2", "binary.top_complex_unnamed[5].size": 405, "binary.top_complex_unnamed[6].addr": "0x401a10", "binary.top_complex_unnamed[6].size": 785, "binary.top_complex_unnamed[7].addr": "0x40185e", "binary.top_complex_unnamed[7].size": 156, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.rich_header.entries[0].use_count": 6, "pe.rich_header.entries[1].use_count": 2, "pe.rich_header.entries[2].use_count": 11, "pe.rich_header.entries[3].use_count": 7, "pe.rich_header.entries[4].use_count": 181, "pe.rich_header.entries[5].use_count": 7, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 19, "pe.rich_header.entries[1].product_id": 14, "pe.rich_header.entries[2].product_id": 10, "pe.rich_header.entries[3].product_id": 4, "pe.rich_header.entries[4].product_id": 1, "pe.rich_header.entries[5].product_id": 11, "pe.rich_header.entries[6].product_id": 6, "pe.rich_header.entries[0].build_number": 8034, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 7299, "pe.rich_header.entries[1].product_name": "Export_VC2003", "pe.rich_header.entries[2].build_number": 8168, "pe.rich_header.entries[2].product_name": "Linker_v6", "pe.rich_header.entries[3].build_number": 8168, "pe.rich_header.entries[3].product_name": "Linker_VS_v6_or_earlier", "pe.rich_header.entries[4].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[5].build_number": 8168, "pe.rich_header.entries[5].product_name": "Cvt_Omf", "pe.rich_header.entries[6].build_number": 1720, "pe.rich_header.entries[6].product_name": "Cvt_Pgo_VS_v6_or_earlier", "pe.section_characteristics[0].raw_size": 20480, "pe.section_characteristics[1].raw_size": 8192, "pe.section_characteristics[2].raw_size": 4096, "pe.section_characteristics[3].raw_size": 40960, "pe.section_characteristics[0].virtual_size": 19507, "pe.section_characteristics[1].virtual_size": 5250, "pe.section_characteristics[2].virtual_size": 872, "pe.section_characteristics[3].virtual_size": 38440, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 24576, "pe.section_characteristics[2].virtual_address": 32768, "pe.section_characteristics[3].virtual_address": 36864, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040" }, "x": 65, "id": 0, "is": [ "ORDINAL 3922", "ORDINAL 1089", "ORDINAL 5199", "ORDINAL 2396", "ORDINAL 3346", "ORDINAL 5300", "ORDINAL 5302", "ORDINAL 2725", "ORDINAL 4079", "ORDINAL 4698", "ORDINAL 5307", "ORDINAL 5289", "ORDINAL 5714", "ORDINAL 2982", "ORDINAL 3147", "ORDINAL 3259", "ORDINAL 4465", "ORDINAL 3136", "ORDINAL 3262", "ORDINAL 2985", "ORDINAL 3081", "ORDINAL 2976", "ORDINAL 3830", "ORDINAL 3831", "ORDINAL 3825", "ORDINAL 3079", "ORDINAL 4080", "ORDINAL 4622", "ORDINAL 4424", "ORDINAL 3738", "ORDINAL 561", "ORDINAL 815", "ORDINAL 2514", "ORDINAL 2621", "ORDINAL 1134", "ORDINAL 641", "ORDINAL 825", "ORDINAL 5265", "ORDINAL 4376", "ORDINAL 4853", "ORDINAL 4998", "ORDINAL 4710", "ORDINAL 6052", "ORDINAL 4078", "ORDINAL 1775", "ORDINAL 4407", "ORDINAL 5241", "ORDINAL 2385", "ORDINAL 5163", "ORDINAL 6374", "ORDINAL 4353", "ORDINAL 5280", "ORDINAL 3798", "ORDINAL 4837", "ORDINAL 4441", "ORDINAL 2648", "ORDINAL 2055", "ORDINAL 6376", "ORDINAL 3749", "ORDINAL 5731", "ORDINAL 1727", "ORDINAL 5261", "ORDINAL 2446", "ORDINAL 2124", "ORDINAL 5277", "ORDINAL 4627", "ORDINAL 4425", "ORDINAL 3597", "ORDINAL 324", "ORDINAL 4234", "ORDINAL 2302", "ORDINAL 1168", "ORDINAL 860", "ORDINAL 800", "ORDINAL 4160", "ORDINAL 540", "ORDINAL 755", "ORDINAL 470", "ORDINAL 2863", "ORDINAL 2379", "ORDINAL 1146", "ORDINAL 2575", "ORDINAL 6055", "ORDINAL 1776", "ORDINAL 4396", "ORDINAL 5290", "ORDINAL 3574", "ORDINAL 609", "ORDINAL 4275", "ORDINAL 3742", "ORDINAL 818", "ORDINAL 567", "ORDINAL 2414", "ORDINAL 537", "ORDINAL 5875", "ORDINAL 4133", "ORDINAL 4297", "ORDINAL 5788", "ORDINAL 472", "ORDINAL 3920", "ORDINAL 283", "ORDINAL 2078", "ORDINAL 5789", "ORDINAL 6880", "ORDINAL 4317", "ORDINAL 535", "ORDINAL 2818", "ORDINAL 6119", "ORDINAL 2381", "ORDINAL 3693", "ORDINAL 3626", "ORDINAL 3663", "ORDINAL 3573", "ORDINAL 3619", "ORDINAL 1641", "ORDINAL 4299", "ORDINAL 2859", "ORDINAL 2864", "ORDINAL 3402", "ORDINAL 2512", "ORDINAL 2554", "ORDINAL 4486", "ORDINAL 6375", "ORDINAL 4274", "ORDINAL 5065", "ORDINAL 4673", "ORDINAL 1576", "controlfp", "XcptFilter", "except_handler3", "onexit", "dllonexit", "setmbcp", "set_app_type", "p__fmode", "p__commode", "adjust_fdiv", "setusermatherr", "initterm", "getmainargs", "acmdln", "exit", "exit", "CxxFrameHandler", "wcslwr", "malloc", "GetStartupInfoA", "ExitProcess", "GetModuleHandleA", "FrameRect", "DrawEdge", "DrawFocusRect", "GetWindowRect", "GetDC", "ReleaseDC", "RedrawWindow", "GetParent", "FillRect", "UnionRect", "PtInRect", "LoadIconA", "EnableWindow", "GetClientRect", "IsIconic", "GetSystemMenu", "SendMessageA", "AppendMenuA", "DrawIcon", "GetSystemMetrics", "ShowWindow", "IsWindow", "GetTextExtentPoint32A", "CreateFontA", "??1Init@ios_base@std@@QAE@XZ", "??0_Winit@std@@QAE@XZ", "??1_Winit@std@@QAE@XZ", "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z", "??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z", "?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A", "?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z", "??0Init@ios_base@std@@QAE@XZ" ], "ms": { "pe": { "entry": 22527.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 40960.0, "subsystem": 2.0, "timestamp": 1597769144.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 7.54, "entry_section": ".text", "size_of_image": 77824.0, "file_alignment": 4096.0, "resource_count": 7.0, "resource_types": [ "RT_BITMAP", "RT_ICON", "RT_DIALOG", "RT_STRING", "RT_RCDATA", "RT_GROUP_ICON", "RT_VERSION" ], "characteristics": 271.0, "has_rich_header": true, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 6.0, "computed_checksum": 93327.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 77824.0 }, "binary": { "code_size": 20480.0, "func_count": 187.0, "code_entropy": 5.71, "data_entropy": 2.39, "func_density": 9.35, "import_count": 181.0, "string_count": 129.0, "avg_func_size": 93.04, "section_count": 4.0, "avg_complexity": 1.91, "import_density": 9.05, "max_complexity": 31.0, "string_density": 6.45, "overall_entropy": 4.51, "avg_basic_blocks": 2.89, "avg_section_size": 18432.0, "dependency_count": 6.0, "entropy_variance": 2.37, "avg_string_length": 13.29, "complexity_per_kb": 0.1, "max_string_length": 76.0, "wide_string_count": 24.0, "avg_string_entropy": 2.87, "code_to_data_ratio": 0.38, "data_to_file_ratio": 0.05, "rsrc_to_file_ratio": 0.53, "text_to_file_ratio": 0.26, "total_basic_blocks": 541.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 13.67, "largest_section_ratio": 0.53, "sentence_string_count": 8.0, "sentence_string_ratio": 0.06, "writable_section_count": 1.0, "executable_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".rsrc" ], [ 5040, "QSVW" ], [ 22818, "XPVSS" ], [ 28712, "MFC42.DLL" ], [ 28724, "__CxxFrameHandler" ], [ 28744, "_wcslwr" ], [ 28754, "malloc" ], [ 28764, "__dllonexit" ], [ 28778, "_onexit" ], [ 28786, "MSVCRT.dll" ], [ 28808, "_XcptFilter" ], [ 28822, "exit" ], [ 28830, "_acmdln" ], [ 28840, "__getmainargs" ], [ 28856, "_initterm" ], [ 28868, "__setusermatherr" ], [ 28888, "_adjust_fdiv" ], [ 28904, "__p__commode" ], [ 28920, "__p__fmode" ], [ 28934, "__set_app_type" ], [ 28952, "_except_handler3" ], [ 28972, "_controlfp" ], [ 28986, "ExitProcess" ], [ 29000, "GetModuleHandleA" ], [ 29020, "GetStartupInfoA" ], [ 29036, "KERNEL32.dll" ], [ 29052, "ShowWindow" ], [ 29066, "GetSystemMetrics" ], [ 29086, "DrawIcon" ], [ 29098, "AppendMenuA" ], [ 29112, "SendMessageA" ], [ 29128, "GetSystemMenu" ], [ 29144, "IsIconic" ], [ 29156, "GetClientRect" ], [ 29172, "EnableWindow" ], [ 29200, "IsWindow" ], [ 29224, "UnionRect" ], [ 29236, "FillRect" ], [ 29248, "FrameRect" ], [ 29260, "DrawEdge" ], [ 29272, "DrawFocusRect" ], [ 29288, "GetWindowRect" ], [ 29312, "ReleaseDC" ], [ 29324, "RedrawWindow" ], [ 29340, "GetParent" ], [ 29350, "USER32.dll" ], [ 29364, "CreateFontA" ], [ 29378, "GetTextExtentPoint32A" ], [ 29400, "GDI32.dll" ], [ 29412, "??0Init@ios_base@std@@QAE@XZ" ], [ 29444, "??1Init@ios_base@std@@QAE@XZ" ], [ 29524, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z" ], [ 29604, "??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z" ], [ 29674, "?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A" ], [ 29734, "?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z" ], [ 29802, "MSVCP60.dll" ], [ 29816, "_setmbcp" ], [ 32864, "am7A9pQ4pMFSD819W02xYNOkFCSrMcRxo1XsSW8tT7xKsMms01ejyTar3lSlY5A9cM0uGMGLL" ], [ 32940, "fgdsfghgfdhafdweqdeghfewdghfgj" ], [ 32972, "M@~JSRPu@Pa5sM?V2I5SLdDdRWxqxHiq~n68nP0#B~V0M2izw6?q6G0A*2JjxAqt}cd820D#8tk" ], [ 33048, "Autorised connection" ], [ 33072, "Refused connection" ], [ 33136, "%d %d %d %d" ], [ 33172, "Tous" ], [ 33180, "AREA ALL Down" ], [ 33196, "AREA ALL up" ], [ 33216, "Sunday" ], [ 33224, "Saturday" ], [ 33236, "Friday" ], [ 33244, "Thursday" ], [ 33256, "Wednesday" ], [ 33268, "Tuesday" ], [ 33276, "Monday" ], [ 33284, "Vendredi" ], [ 33296, "Jeudi" ], [ 33304, "Mercredi" ], [ 33316, "Mardi" ], [ 33324, "Lundi" ], [ 33332, "Dimanche" ], [ 33344, "Samedi" ], [ 37972, "DDLLDDDL" ], [ 37988, "LLDDLD" ], [ 38022, "DDLDLD" ], [ 38036, "LDDDDDDD" ], [ 38732, "aj4t" ], [ 40702, "X7ZR" ], [ 41521, "ARV5" ], [ 42966, "564W" ], [ 43815, "iw1v" ], [ 44174, "70rv" ], [ 45995, "6 IEL" ], [ 48249, "l8w1" ], [ 53185, "Cnib" ], [ 62385, "QWXVA" ], [ 63554, "NauRsHMNAA" ], [ 63765, "NRBS" ], [ 65893, "VOV4" ], [ 69600, "7YMA" ], [ 70566, "ulr'\"x" ], [ 71488, "xs9i" ], [ 71593, "82xx" ], [ 72603, "vubac" ], [ 72710, "wide", "A propos de TimeTest" ], [ 72754, "wide", "MS Sans Serif" ], [ 72834, "wide", "TimeTest version 1.0" ], [ 72902, "wide", "Copyright (C) 2002" ], [ 73006, "wide", "TimeTest" ], [ 73124, "wide", "Annuler" ], [ 73172, "wide", "Static" ], [ 73198, "wide", "VS_VERSION_INFO" ], [ 73290, "wide", "StringFileInfo" ], [ 73350, "wide", "CompanyName" ], [ 73382, "wide", "FileDescription" ], [ 73416, "wide", "Application MFC TimeTest" ], [ 73474, "wide", "FileVersion" ], [ 73530, "wide", "InternalName" ], [ 73582, "wide", "LegalCopyright" ], [ 73658, "wide", "LegalTrademarks" ], [ 73698, "wide", "OriginalFilename" ], [ 73732, "wide", "TimeTest.EXE" ], [ 73766, "wide", "ProductName" ], [ 73792, "wide", "Application TimeTest" ], [ 73842, "wide", "ProductVersion" ], [ 73902, "wide", "VarFileInfo" ], [ 73934, "wide", "Translation" ], [ 75236, "wide", "\u0026A propos de TimeTest..." ] ], "sz": 77824, "ts": [ { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 129.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 187.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 187.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 40960, entropy: 7.54)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_DIALOG, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 181.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1597769144.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage/control::is-window", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 181.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright (C) 2002" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1, 0, 0, 1" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "LDDDDDDD", "DDLLDDDL" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 181.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 181.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage/control::get-dc", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 181.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.87" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 187.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1036", "c": 0.949999988079071, "d": "Trademarks holds OriginalFilename name", "e": [ "B\r\u0001OriginalFilename" ], "i": "objectives/evasion/masquerade/versioninfo::trademarks-origfile-leak", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1612", "c": 0.8999999761581421, "d": "PE resource table contains RT_BITMAP", "e": [ "[RT_BITMAP, RT_ICON, RT_DIALOG, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "objectives/anti-static/obfuscation/payload/resource::rsrc-bitmap-present", "l": 1, "m": "B0023" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.51" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.91" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "0ee2698d2bfd76bb41ba18dfdff7e38a7cd25f99021a37c26a1ae4b442bb5e3b.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.87" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "0ee2698d2bfd76bb41ba18dfdff7e38a7cd25f99021a37c26a1ae4b442bb5e3b.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 77824.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1597769144.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 541.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage/control::release-dc", "l": 2 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 9.05" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 181.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.71" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8500000238418579, "d": "Links legacy MFC42 runtime", "e": [ "MFC42.DLL" ], "i": "micro-behaviors/dylib/library/legacy::mfc42-ref", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 181.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Application TimeTest" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.55)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 181.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage/control::enable-window", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 181.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_DIALOG, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.51" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage/control::get-window-rect", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage/control::send-message-a", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Application MFC TimeTest" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/shell/com::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Small DLL, high-entropy resource", "e": [ ".rsrc (entropy: 7.54)" ], "i": "metadata/binary/section/metrics::high-entropy-resource-small-dll", "l": 4 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.54)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 4, "m": "C0027" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.91" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "0ee2698d2bfd76bb41ba18dfdff7e38a7cd25f99021a37c26a1ae4b442bb5e3b.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetStartupInfoA, ExitProcess, GetModuleHandleA)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCP60.dll (??1Init@ios_base@std@@QAE@XZ, ??0_Winit@std@@QAE@XZ, ??1_Winit@std@@QAE@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z, ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z, ... +3 more)", "e": [ "MSVCP60.dll" ], "i": "metadata/dylib::msvcp60/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetTextExtentPoint32A, CreateFontA)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCRT.dll (controlfp, XcptFilter, except_handler3, onexit, dllonexit, ... +14 more)", "e": [ "MSVCRT.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MFC42.DLL (ORDINAL 3922, ORDINAL 1089, ORDINAL 5199, ORDINAL 2396, ORDINAL 3346, ... +122 more)", "e": [ "MFC42.DLL" ], "i": "metadata/dylib::mfc42/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (FrameRect, DrawEdge, DrawFocusRect, GetWindowRect, GetDC, ... +17 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 181.00", "pe.has_rich_header = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 } ], "sha": "0ee2698d2bfd76bb41ba18dfdff7e38a7cd25f99021a37c26a1ae4b442bb5e3b", "path": "0ee2698d2bfd76bb41ba18dfdff7e38a7cd25f99021a37c26a1ae4b442bb5e3b.exe", "type": "pe" } ], "tv": "92e78" } }