{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9713566899299622 } ], "prob": 0.9713567, "models": [ { "m": "az", "raw": 0.9713567, "prob": 0.9713567, "class": 0 }, { "m": "az/native", "raw": 0.21905193, "prob": 0.21905193, "class": 0 }, { "m": "az/pe", "raw": 0.29932404, "prob": 0.29932404, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T02:09:09Z" }, "path": "ScreenLocker.dll", "raw": { "v": "6", "fs": [ { "f": "O(As)H(Db)", "x": 42, "ff": { "i": [ [ "mscoree", "CorDllMain" ] ], "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 66347.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 39424.0, "entropy": 7.51, "size_bytes": 39424.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.68, "string_count": 704.0, "overall_entropy": 7.51, "entropy_variance": 9.83, "avg_string_length": 9.12, "max_string_length": 44.0, "code_to_data_ratio": 1.0, "string_length_stddev": 6.92, "largest_section_ratio": 0.95, "sentence_string_count": 2.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 37376.0, "entropy_max": 7.68, "entropy_mean": 3.54, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 2648, "u8", "GT0N" ], [ 2953, "u8", "bRci" ], [ 3054, "u8", "MWO2" ], [ 3514, "u8", "f631" ], [ 4943, "u8", "QCREqE" ], [ 6537, "u8", "7rik" ], [ 6713, "u8", "xn4fe" ], [ 7592, "u8", "LOOfuCsf" ], [ 10501, "u8", "MIy8h" ], [ 10691, "u8", "LIGD" ], [ 10733, "u8", "h23b" ], [ 14984, "u8", "m1h5" ], [ 15647, "u8", "Zddb" ], [ 16923, "u8", "gC2EM" ], [ 17871, "u8", "u3yh" ], [ 20791, "u8", "qBXI5" ], [ 24064, "u8", "5kjT5L" ], [ 25828, "u8", "dQagW" ], [ 26421, "u8", "6r2x" ], [ 27178, "u8", "I1AR3" ], [ 27360, "u8", "C3MB6" ], [ 27383, "u8", "LH3G" ], [ 27894, "u8", "C4LUJ" ], [ 28516, "u8", "ZKKJ" ], [ 28960, "u8", "BSJB" ], [ 32001, "u8", "SetAero10" ], [ 32011, "u8", "user32" ], [ 32018, "u8", "Dictionary`2" ], [ 32031, "u8", "\u003cModule\u003e" ], [ 32040, "u8", "WCA_EXCLUDED_FROM_DDA" ], [ 32062, "u8", "WCA_HOLOGRAPHIC" ], [ 32078, "u8", "WCA_EVER_UNCLOAKED" ], [ 32097, "u8", "WCA_CLOAKED" ], [ 32109, "u8", "WCA_NCRENDERING_ENABLED" ], [ 32133, "u8", "WCA_TRANSITIONS_FORCEDISABLED" ], [ 32163, "u8", "ACCENT_DISABLED" ], [ 32179, "u8", "WCA_NCRENDERING_EXILED" ], [ 32202, "u8", "WCA_UNDEFINED" ], [ 32216, "u8", "WM_APPCOMMAND" ], [ 32230, "u8", "WM_SYSCOMMAND" ], [ 32244, "u8", "ACCENT_ENABLE_ACRYLICBLURBEHIND" ], [ 32276, "u8", "ACCENT_ENABLE_BLURBEHIND" ], [ 32301, "u8", "WCA_FORCE_ACTIVEWINDOW_APPEARANCE" ], [ 32335, "u8", "WCA_PASSIVEUPDATEMODE" ], [ 32357, "u8", "NONE" ], [ 32362, "u8", "SC_RESTORE" ], [ 32373, "u8", "SWP_DEFERERASE" ], [ 32388, "u8", "SC_CLOSE" ], [ 32397, "u8", "WM_CLOSE" ], [ 32406, "u8", "ACCENT_INVALID_STATE" ], [ 32427, "u8", "WCA_VIDEO_OVERLAY_ACTIVE" ], [ 32452, "u8", "SWP_NOMOVE" ], [ 32463, "u8", "SC_MINIMIZE" ], [ 32475, "u8", "SC_MAXIMIZE" ], [ 32487, "u8", "SWP_NOSIZE" ], [ 32498, "u8", "SizeF" ], [ 32504, "u8", "LoadingAPI" ], [ 32515, "u8", "loadingAPI" ], [ 32526, "u8", "WCA_CLOAK" ], [ 32536, "u8", "WCA_DISALLOW_PEEK" ], [ 32554, "u8", "HWND_BOTTOM" ], [ 32566, "u8", "WCA_FORCE_ICONIC_REPRESENTATION" ], [ 32598, "u8", "WCA_FREEZE_REPRESENTATION" ], [ 32624, "u8", "WCA_NCADORNMENTINFO" ], [ 32644, "u8", "System.IO" ], [ 32654, "u8", "WCA_HAS_ICONIC_BITMAP" ], [ 32676, "u8", "ACCENT_ENABLE_HOSTBACKDROP" ], [ 32703, "u8", "HWND_TOP" ], [ 32712, "u8", "WCA_VISUAL_OWNER" ], [ 32729, "u8", "WCA_EXTENDED_FRAME_BOUNDS" ], [ 32755, "u8", "WCA_CAPTION_BUTTON_BOUNDS" ], [ 32781, "u8", "WCA_THEME_ATTRIBUTES" ], [ 32802, "u8", "MARGINS" ], [ 32810, "u8", "ACCENT_ENABLE_TRANSPARENTGRADIENT" ], [ 32844, "u8", "ACCENT_ENABLE_GRADIENT" ], [ 32867, "u8", "WCA_ALLOW_NCPAINT" ], [ 32885, "u8", "WCA_LAST" ], [ 32894, "u8", "HWND_NOTOPMOST" ], [ 32909, "u8", "HWND_TOPMOST" ], [ 32922, "u8", "WCA_NONCLIENT_RTL_LAYOUT" ], [ 32947, "u8", "WM_SETTEXT" ], [ 32958, "u8", "SWP_NOREDRAW" ], [ 32971, "u8", "WCA_EXCLUDED_FROM_LIVEPREVIEW" ], [ 33007, "u8", "WCA_NCRENDERING_POLICY" ], [ 33030, "u8", "WCA_ACCENT_POLICY" ], [ 33048, "u8", "WM_DESTROY" ], [ 33065, "u8", "value__" ], [ 33073, "u8", "Costura" ], [ 33081, "u8", "WindowCompositionAttributeData" ], [ 33112, "u8", "SizeOfData" ], [ 33123, "u8", "data" ], [ 33128, "u8", "PacketLib" ], [ 33138, "u8", "mscorlib" ], [ 33147, "u8", "System.Collections.Generic" ], [ 33174, "u8", "AnimationId" ], [ 33186, "u8", "Read" ], [ 33215, "u8", "isAttached" ], [ 33226, "u8", "Interlocked" ], [ 33238, "u8", "costura.costura.dll.compressed" ], [ 33269, "u8", "costura.packetlib.dll.compressed" ], [ 33302, "u8", "costura.hookhardware.dll.compressed" ], [ 33338, "u8", "hWnd" ], [ 33348, "u8", "HookKeyboard" ], [ 33361, "u8", "source" ], [ 33368, "u8", "set_AutoScaleMode" ], [ 33386, "u8", "CompressionMode" ], [ 33402, "u8", "SC_Message" ], [ 33413, "u8", "WM_Message" ], [ 33424, "u8", "PostMessage" ], [ 33436, "u8", "Exchange" ], [ 33445, "u8", "nullCache" ], [ 33455, "u8", "IDisposable" ], [ 33467, "u8", "get_Handle" ], [ 33478, "u8", "Rectangle" ], [ 33488, "u8", "set_FormBorderStyle" ], [ 33508, "u8", "get_ClassStyle" ], [ 33523, "u8", "set_ClassStyle" ], [ 33538, "u8", "get_Name" ], [ 33547, "u8", "set_Name" ], [ 33556, "u8", "fullName" ], [ 33565, "u8", "screenLockerName" ], [ 33582, "u8", "GetName" ], [ 33590, "u8", "requestedAssemblyName" ], [ 33612, "u8", "name" ], [ 33617, "u8", "ValueType" ], [ 33627, "u8", "PacketType" ], [ 33638, "u8", "get_packetType" ], [ 33653, "u8", "HookHardware" ], [ 33666, "u8", "culture" ], [ 33674, "u8", "Dispose" ], [ 33682, "u8", "AccentState" ], [ 33694, "u8", "set_WindowState" ], [ 33710, "u8", "FormWindowState" ], [ 33726, "u8", "Write" ], [ 33732, "u8", "CompilerGeneratedAttribute" ], [ 33759, "u8", "GuidAttribute" ], [ 33773, "u8", "DebuggableAttribute" ], [ 33793, "u8", "ComVisibleAttribute" ], [ 33813, "u8", "AssemblyTitleAttribute" ], [ 33836, "u8", "AssemblyTrademarkAttribute" ], [ 33863, "u8", "TargetFrameworkAttribute" ], [ 33888, "u8", "AssemblyFileVersionAttribute" ], [ 33917, "u8", "AssemblyConfigurationAttribute" ], [ 33948, "u8", "SetWindowCompositionAttribute" ], [ 33978, "u8", "AssemblyDescriptionAttribute" ], [ 34007, "u8", "CompilationRelaxationsAttribute" ], [ 34039, "u8", "AssemblyProductAttribute" ], [ 34064, "u8", "AssemblyCopyrightAttribute" ], [ 34091, "u8", "AssemblyCompanyAttribute" ], [ 34116, "u8", "RuntimeCompatibilityAttribute" ], [ 34146, "u8", "Byte" ], [ 34151, "u8", "TryGetValue" ], [ 34163, "u8", "add_AssemblyResolve" ], [ 34183, "u8", "set_ClientSize" ], [ 34198, "u8", "SizeOf" ], [ 34205, "u8", "System.Threading" ], [ 34222, "u8", "System.Runtime.Versioning" ], [ 34248, "u8", "CultureToString" ], [ 34264, "u8", "disposing" ], [ 34274, "u8", "System.Drawing" ], [ 34289, "u8", "ShowDialog" ], [ 34304, "u8", "Attach" ], [ 34311, "u8", "Launch" ], [ 34318, "u8", "get_Length" ], [ 34329, "u8", "EndsWith" ], [ 34338, "u8", "get_Black" ], [ 34348, "u8", "nullCacheLock" ], [ 34362, "u8", "AllocHGlobal" ], [ 34375, "u8", "FreeHGlobal" ], [ 34387, "u8", "Marshal" ], [ 34395, "u8", "System.ComponentModel" ], [ 34417, "u8", "user32.dll" ], [ 34428, "u8", "ScreenLocker.dll" ], [ 34445, "u8", "ContainerControl" ], [ 34462, "u8", "ReadStream" ], [ 34473, "u8", "LoadStream" ], [ 34484, "u8", "GetManifestResourceStream" ], [ 34510, "u8", "DeflateStream" ], [ 34524, "u8", "MemoryStream" ], [ 34537, "u8", "stream" ], [ 34544, "u8", "lParam" ], [ 34551, "u8", "wParam" ], [ 34558, "u8", "get_Item" ], [ 34567, "u8", "set_Item" ], [ 34576, "u8", "System" ], [ 34583, "u8", "Bottom" ], [ 34590, "u8", "Form" ], [ 34595, "u8", "Enum" ], [ 34600, "u8", "get_PrimaryScreen" ], [ 34618, "u8", "Main" ], [ 34623, "u8", "AppDomain" ], [ 34633, "u8", "get_CurrentDomain" ], [ 34651, "u8", "Plugin" ], [ 34658, "u8", "set_ShowIcon" ], [ 34671, "u8", "FodyVersion" ], [ 34683, "u8", "System.IO.Compression" ], [ 34705, "u8", "Application" ], [ 34717, "u8", "destination" ], [ 34729, "u8", "System.Globalization" ], [ 34750, "u8", "System.Reflection" ], [ 34768, "u8", "FormCollection" ], [ 34783, "u8", "set_Position" ], [ 34796, "u8", "StringComparison" ], [ 34813, "u8", "CopyTo" ], [ 34820, "u8", "get_CultureInfo" ], [ 34836, "u8", "Zero" ], [ 34845, "u8", "set_ShowInTaskbar" ], [ 34863, "u8", "AssemblyLoader" ], [ 34878, "u8", "sender" ], [ 34885, "u8", "StopScreenLocker" ], [ 34902, "u8", "StartScreenLocker" ], [ 34920, "u8", "ResolveEventHandler" ], [ 34940, "u8", "IContainer" ], [ 34951, "u8", "hWndInsertAfter" ], [ 34967, "u8", "Enter" ], [ 34973, "u8", "set_BackColor" ], [ 34987, "u8", "GradientColor" ], [ 35001, "u8", ".ctor" ], [ 35007, "u8", ".cctor" ], [ 35014, "u8", "Monitor" ], [ 35022, "u8", "StructureToPtr" ], [ 35037, "u8", "IntPtr" ], [ 35044, "u8", "System.Diagnostics" ], [ 35063, "u8", "get_Bounds" ], [ 35074, "u8", "System.Runtime.InteropServices" ], [ 35105, "u8", "System.Runtime.CompilerServices" ], [ 35137, "u8", "ReadFromEmbeddedResources" ], [ 35163, "u8", "DebuggingModes" ], [ 35178, "u8", "GetAssemblies" ], [ 35192, "u8", "resourceNames" ], [ 35206, "u8", "symbolNames" ], [ 35218, "u8", "assemblyNames" ], [ 35232, "u8", "get_Flags" ], [ 35242, "u8", "AssemblyNameFlags" ], [ 35260, "u8", "AccentFlags" ], [ 35272, "u8", "uFlags" ], [ 35279, "u8", "ResolveEventArgs" ], [ 35296, "u8", "Equals" ], [ 35303, "u8", "PacketLib.Utils" ], [ 35319, "u8", "get_CreateParams" ], [ 35336, "u8", "System.Windows.Forms" ], [ 35357, "u8", "get_OpenForms" ], [ 35371, "u8", "set_AutoScaleDimensions" ], [ 35395, "u8", "SetWindowPos" ], [ 35408, "u8", "Helpers" ], [ 35416, "u8", "components" ], [ 35427, "u8", "Imports" ], [ 35435, "u8", "Miscellaneous" ], [ 35449, "u8", "Concat" ], [ 35456, "u8", "Object" ], [ 35463, "u8", "PacketLib.Packet" ], [ 35480, "u8", "IPacket" ], [ 35488, "u8", "get_currentPacket" ] ], "v": { "file.stem": "ScreenLocker", "pe.imphash": "dae02f32a21e03ce65412f6e56942daa", "pe.machine": "i386", "pe.subsystem": "windows_cui", "pe.timestamp": 3371761057, "file.basename": "ScreenLocker.dll", "pe.image_base": 4194304, "pe.image_size": 65536, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 45070, "pe.headers_size": 512, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "76ab08d14bb10186cf6b9464909479dd512fcc03", "pe.image_hash.sha256": "a54807fa34e9dad7b1272be29f7c41d7b0fe6e8d1e665daa7c396315af2538db", "pe.image_hash.sha384": "e873682dc1cfee4d3d2d4339b4656f8e9532441655975066d0e6a056bf451ac58fbb46544fbbd41d87049f77c56873b6", "pe.image_hash.sha512": "35805129ad9fe3d66efba99630e71b8fc3afc15bd3b0b8d5282fab1f9f76c93c5ce0ddba57584245458f24098e34edd0e187c2dc9317fed9321f08d38f8931a6", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "6.0", "pe.version.copyright": "Copyright © 2022", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8450, "pe.clr.runtime_version": "2.5", "pe.version.description": "ScreenLocker", "pe.linker_major_version": 48, "pe.version.file_version": "1.0.0.0", "pe.version.product_name": "ScreenLocker", "pe.debug.entries[0].type": "repro", "pe.version.internal_name": "ScreenLocker.dll", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "no_seh", "pe.dll_characteristics[4]": "terminal_server_aware", "pe.data_directories[0].rva": 44980, "pe.data_directories[1].rva": 49152, "pe.data_directories[2].rva": 57344, "pe.data_directories[3].rva": 44952, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34144, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1.0.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 920, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.debug.entries[0].type_id": 16, "pe.version.original_filename": "ScreenLocker.dll", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1 }, "id": "pe", "sc": [ [ ".text", 512, 37376, 7.68, "r-x" ], [ ".rsrc", 37888, 1024, 2.88, "r--" ], [ ".reloc", 38912, 512, 0.08, "r--" ] ] }, "id": 0, "sz": 39424, "ts": [ { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2, "el": [ "95be" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "8902" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "ScreenLocker" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "AppDomain.CurrentDomain accessor", "e": [ "get_CurrentDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "l": 1, "el": [ "8749" ] }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2, "el": [ "972e" ] }, { "c": 1.0, "d": "Modification of HTTP context items", "e": [ "set_Item" ], "i": "micro-behaviors/communications/http/server/managed::http-item-setter", "l": 1, "el": [ "8707" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "91fe" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "88e4" ] }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2, "el": [ "945e" ] }, { "c": 1.0, "d": "DLL filename extension present", "e": [ "ScreenLocker.dll" ], "i": "metadata/file/extension::dll-basename", "l": 2 }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "8a08" ] }, { "a": "T1027.009", "c": 0.8500000238418579, "d": ".NET manifest resource stream access", "e": [ "GetManifestResourceStream" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getmanifestresourcestream", "l": 2, "el": [ "86b4" ] }, { "c": 1.0, "d": "Costura bundled .NET dependency marker", "e": [ "costura.hookhardware.dll.compressed", "costura.costura.dll.compressed", "costura.packetlib.dll.compressed" ], "i": "objectives/anti-static/pack/entropy::dotnet-costura-bundle-marker", "l": 1, "el": [ "8216", "81d6", "81f5" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 2022" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.8199999928474426, "d": "Post message to window", "e": [ "PostMessage" ], "i": "micro-behaviors/os/message/queue::post-message-text", "l": 2, "el": [ "8290" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.68)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "9556" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "/data/samples/bad/projects/EagleMonitorRAT/Remote Access Tool/Plugins/ScreenLocker/obj/Debug/ScreenLocker.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.9900000095367432, "d": "High overall binary entropy", "e": [ "binary.overall_entropy = 7.51" ], "i": "objectives/command-and-control/dropper/elex-loader::high-entropy-binary", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.68" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Costura embedded assembly bundle marker", "e": [ "costura.costura.dll.compressed" ], "i": "micro-behaviors/data/embedded/payload/resource::costura-bundle-marker", "l": 1, "el": [ "81d6" ] }, { "c": 0.8999999761581421, "d": "user32 module name string in code section", "e": [ "user32" ], "i": "micro-behaviors/ui/window/manage/control::user32-module-string", "l": 2, "el": [ "7d0b" ] }, { "a": "T1113", "c": 0.800000011920929, "d": "Screen.PrimaryScreen access (P/Invoke reference)", "e": [ "get_PrimaryScreen" ], "i": "micro-behaviors/hardware/display/screen::screen-primaryscreen-str", "l": 1, "m": "C0014", "el": [ "8728" ] }, { "c": 1.0, "d": "Windows DLL extension", "e": [ "ScreenLocker.dll" ], "i": "metadata/file/extension::dll", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.949999988079071, "d": "Filename ends with .dll", "e": [ "ScreenLocker.dll" ], "i": "metadata/package/files::dll-extension-basename", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 704.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.75, "d": "System.IO.Compression namespace reference", "e": [ "System.IO.Compression" ], "i": "micro-behaviors/data/compress/library::system-io-compression", "l": 1, "el": [ "877b" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "957a" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "7c2f" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "7f84" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "96f2" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "96a6" ] }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1, "el": [ "873f" ] }, { "c": 0.8999999761581421, "d": "Binary has high overall entropy (packed/encrypted)", "e": [ "binary.overall_entropy = 7.51" ], "i": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "l": 1 }, { "c": 0.949999988079071, "d": "AssemblyResolve event registration", "e": [ "add_AssemblyResolve" ], "i": "micro-behaviors/data/embedded/payload/resource::assemblyresolve-hook", "l": 3, "el": [ "8573" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "c": 0.8399999737739563, "d": "Minimal resource section footprint", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/section/metrics::tiny-rsrc-section", "l": 1 }, { "c": 0.8600000143051147, "d": "notify/sender vocabulary word", "e": [ "sender" ], "i": "micro-behaviors/data/text/keywords/lexicon::notification-config-word", "l": 1, "el": [ "883e" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringComparison", "CultureToString", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "87ec", "85c8", "94fe" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.5" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "914f" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "8172" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "9100" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "95ee" ] }, { "a": "T1140", "c": 0.8799999952316284, "d": "ResolveEventHandler delegate token", "e": [ "ResolveEventHandler" ], "i": "objectives/command-and-control/dropper/staging/embedded::resolveeventhandler-token", "l": 1, "m": "B0030", "el": [ "8868" ] }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "value__", "ValueType", "TryGetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "8129", "8351", "8567" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.68" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "metadata/library/wpf::wpf-namespace-ref", "l": 1, "el": [ "8a08" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "945e" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "ScreenLocker" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "87be" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "81d6" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1, "el": [ "945e" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "High overall file entropy", "e": [ "binary.overall_entropy = 7.51" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-overall-entropy", "l": 3, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyDescriptionAttribute", "AssemblyTrademarkAttribute", "DebuggableAttribute", "CompilerGeneratedAttribute", "WindowCompositionAttributeData", "AssemblyProductAttribute", "RuntimeCompatibilityAttribute", "CompilationRelaxationsAttribute", "AssemblyTitleAttribute", "AssemblyFileVersionAttribute", "AssemblyConfigurationAttribute", "SetWindowCompositionAttribute", "ComVisibleAttribute", "AssemblyCompanyAttribute", "TargetFrameworkAttribute", "AssemblyCopyrightAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "84ba", "842c", "83ed", "83c4", "8139", "84f7", "8544", "84d7", "8415", "8460", "847d", "849c", "8401", "852b", "8447", "8510" ] }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "nullCache", "nullCacheLock" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "82a5", "862c" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "a": "T1045", "c": 0.949999988079071, "d": "Very high overall file entropy", "e": [ "binary.overall_entropy = 7.51" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::very-high-entropy", "l": 4, "m": "B0032" }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.002", "c": 0.8999999761581421, "d": ".NET assembly with bootstrap-only imports", "e": [ "BSJB", "imports.count = 1.00", "binary.code_entropy = 7.68" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-bootstrap-imports", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2, "el": [ "972e", "945e", "95be" ] }, { "a": "T1027.002", "c": 0.8500000238418579, "d": ".NET assembly with single import (packed)", "e": [ "BSJB", "imports.count = 1.00", "binary.code_entropy = 7.68" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-single-import", "l": 1 } ], "sha": "1167efa4e11c953c68bdf7826f1f73eab3dcf8fcc986993b0316375a57934149", "path": "/data/samples/bad/projects/EagleMonitorRAT/Remote Access Tool/Plugins/ScreenLocker/obj/Debug/ScreenLocker.dll", "type": "pe" } ], "tv": "8e9ac" } }