{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.7817023992538452, "class": 0 } ], "prob": 0.7817024, "class": 0, "models": [ { "m": "az", "prob": 0.7817024, "class": 0 }, { "m": "az/native", "prob": 0.0021164021, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T14:30:54Z" }, "path": "13ddf7cfbac1ec64f6007d84fe29bc8bc7186d9567b0afcf04ce3d2a1564e012.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₂Si)", "k": { "hash.imp": "834f2561f73332d18efb21c00b04a238", "pe.timestamp": 1694400699, "hash.authenti": "7368f9b28ed65f6a5bad322312e406566c204cde41d43be3fd22f91e4821955e", "debug.pdb_path": "D:\\bld\\getopt-win32_1694400468396\\work\\x64\\Release\\getopt.pdb", "pe.codeview.age": 1, "hash.rich_header": "8eb303500eef7ad85f695e4917c58629c2604b757365dd22f1ffbe93056fbede", "pe.codeview.guid": "5BFF73FC-4864-44AB-A758-B673F7BC3AE4", "build.target_arch": "x86_64", "pe.linker_version": "14.35", "pe.resource_types[0]": "RT_MANIFEST", "pe.rich_header.xor_key": "0xd4538816", "pe.debug_entries[0].size": 86, "pe.debug_entries[0].type": "codeview", "pe.debug_entries[1].size": 20, "pe.debug_entries[1].type": "vc_feature", "pe.debug_entries[2].size": 600, "pe.debug_entries[2].type": "pogo", "pe.debug_entries[3].type": "iltcg", "pe.data_directories[0].rva": 20176, "pe.data_directories[1].rva": 20460, "pe.data_directories[2].rva": 32768, "pe.data_directories[3].rva": 28672, "pe.data_directories[4].rva": 36864, "pe.data_directories[5].rva": 18704, "pe.data_directories[6].rva": 18384, "pe.data_directories[7].rva": 16384, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 284, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 140, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 480, "pe.data_directories[3].name": "exception", "pe.data_directories[3].size": 612, "pe.data_directories[4].name": "base_relocation", "pe.data_directories[4].size": 44, "pe.data_directories[5].name": "debug", "pe.data_directories[5].size": 112, "pe.data_directories[6].name": "load_config", "pe.data_directories[6].size": 320, "pe.data_directories[7].name": "iat", "pe.data_directories[7].size": 352, "pe.debug_directory_types[0]": 2, "pe.debug_directory_types[1]": 12, "pe.debug_directory_types[2]": 13, "pe.debug_directory_types[3]": 14, "pe.debug_entries[0].timestamp": 1694400699, "pe.debug_entries[1].timestamp": 1694400699, "pe.debug_entries[2].timestamp": 1694400699, "pe.debug_entries[3].timestamp": 1694400699, "pe.load_config.cfg_check_func": "0x180004160", "pe.load_config.cfg_guard_flags": "0x100", "pe.load_config.security_cookie": "0x180006008", "pe.rich_header_compids[0].count": 8, "pe.rich_header_compids[1].count": 3, "pe.rich_header_compids[2].count": 12, "pe.rich_header_compids[3].count": 8, "pe.rich_header_compids[4].count": 3, "pe.rich_header_compids[5].count": 2, "pe.rich_header_compids[6].count": 46, "pe.rich_header_compids[7].count": 1, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "binary.top_complex_unnamed[0].cc": 118, "binary.top_complex_unnamed[1].cc": 118, "binary.top_complex_unnamed[2].cc": 2, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 9664521, "pe.rich_header_compids[10].count": 1, "pe.rich_header_compids[1].compid": 16874687, "pe.rich_header_compids[2].compid": 17136831, "pe.rich_header_compids[3].compid": 17071295, "pe.rich_header_compids[4].compid": 17005759, "pe.rich_header_compids[5].compid": 16873547, "pe.rich_header_compids[6].compid": 65536, "pe.rich_header_compids[7].compid": 17333721, "pe.rich_header_compids[8].compid": 16809433, "pe.rich_header_compids[9].compid": 16743897, "binary.top_complex_unnamed[0].bbs": 205, "binary.top_complex_unnamed[1].bbs": 202, "binary.top_complex_unnamed[2].bbs": 3, "pe.rich_header_compids[10].compid": 16940505, "pe.rich_header_compids[6].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x180001df0", "binary.top_complex_unnamed[0].size": 2885, "binary.top_complex_unnamed[1].addr": "0x1800011b0", "binary.top_complex_unnamed[1].size": 2770, "binary.top_complex_unnamed[2].addr": "0x180002fb1", "binary.top_complex_unnamed[2].size": 167, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".pdata", "pe.section_characteristics[4].name": ".rsrc", "pe.section_characteristics[5].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 8, "pe.rich_header.entries[1].use_count": 3, "pe.rich_header.entries[2].use_count": 12, "pe.rich_header.entries[3].use_count": 8, "pe.rich_header.entries[4].use_count": 3, "pe.rich_header.entries[5].use_count": 2, "pe.rich_header.entries[6].use_count": 46, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 147, "pe.rich_header.entries[10].use_count": 1, "pe.rich_header.entries[1].product_id": 257, "pe.rich_header.entries[2].product_id": 261, "pe.rich_header.entries[3].product_id": 260, "pe.rich_header.entries[4].product_id": 259, "pe.rich_header.entries[5].product_id": 257, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 264, "pe.rich_header.entries[8].product_id": 256, "pe.rich_header.entries[9].product_id": 255, "pe.load_config.cfg_flags.instrumented": true, "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[10].product_id": 258, "pe.dll_characteristics.high_entropy_va": true, "pe.rich_header.entries[0].build_number": 30729, "pe.rich_header.entries[0].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[1].build_number": 31935, "pe.rich_header.entries[1].product_name": "Linker_VS2013", "pe.rich_header.entries[2].build_number": 31935, "pe.rich_header.entries[2].product_name": "Cpp_VS2015", "pe.rich_header.entries[3].build_number": 31935, "pe.rich_header.entries[3].product_name": "C_VS2015", "pe.rich_header.entries[4].build_number": 31935, "pe.rich_header.entries[4].product_name": "Cvtres_VS2013", "pe.rich_header.entries[5].build_number": 30795, "pe.rich_header.entries[5].product_name": "Linker_VS2013", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 32217, "pe.rich_header.entries[7].product_name": "Cvtres_VS2015", "pe.rich_header.entries[8].build_number": 32217, "pe.rich_header.entries[8].product_name": "Cpp_VS2013", "pe.rich_header.entries[9].build_number": 32217, "pe.rich_header.entries[9].product_name": "C_VS2013", "pe.section_characteristics[0].raw_size": 10752, "pe.section_characteristics[1].raw_size": 5632, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[3].raw_size": 1024, "pe.section_characteristics[4].raw_size": 512, "pe.section_characteristics[5].raw_size": 512, "pe.rich_header.entries[10].build_number": 32217, "pe.rich_header.entries[10].product_name": "Linker_VS2013_LTCG", "pe.section_characteristics[0].virtual_size": 10520, "pe.section_characteristics[1].virtual_size": 5490, "pe.section_characteristics[2].virtual_size": 1720, "pe.section_characteristics[3].virtual_size": 612, "pe.section_characteristics[4].virtual_size": 480, "pe.section_characteristics[5].virtual_size": 44, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 16384, "pe.section_characteristics[2].virtual_address": 24576, "pe.section_characteristics[3].virtual_address": 28672, "pe.section_characteristics[4].virtual_address": 32768, "pe.section_characteristics[5].virtual_address": 36864, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "40000040", "pe.section_characteristics[5].characteristics_hex": "42000040" }, "x": 7, "id": 0, "is": [ "std_type_info_destroy_list", "C_specific_handler", "strchr", "wcschr", "memset", "memcpy", "fputc", "acrt_iob_func", "stdio_common_vfprintf", "stdio_common_vfwprintf", "fputwc", "wcsncmp", "strncmp", "wgetenv", "getenv", "cexit", "execute_onexit_table", "initialize_onexit_table", "initialize_narrow_environment", "configure_narrow_argv", "seh_filter_dll", "initterm_e", "initterm", "DisableThreadLibraryCalls", "RtlLookupFunctionEntry", "RtlVirtualUnwind", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "IsProcessorFeaturePresent", "IsDebuggerPresent", "InitializeSListHead", "RtlCaptureContext", "GetSystemTimeAsFileTime", "GetCurrentThreadId", "GetCurrentProcessId", "QueryPerformanceCounter" ], "ms": { "pe": { "entry": 11760.0, "machine": 34404.0, "checksum": 0.0, "has_pogo": true, "pdb_path": "D:\\bld\\getopt-win32_1694400468396\\work\\x64\\Release\\getopt.pdb", "has_iltcg": true, "rsrc_size": 512.0, "subsystem": 3.0, "timestamp": 1694400699.0, "image_base": 6442450944.0, "codeview_age": 1.0, "has_manifest": true, "rsrc_entropy": 4.7, "codeview_guid": "5BFF73FC-4864-44AB-A758-B673F7BC3AE4", "entry_section": ".text", "size_of_image": 40960.0, "cfg_check_func": 6442467680.0, "file_alignment": 512.0, "has_vc_feature": true, "resource_count": 1.0, "resource_types": [ "RT_MANIFEST" ], "cfg_guard_flags": 256.0, "characteristics": 8226.0, "has_rich_header": true, "security_cookie": 6442475528.0, "size_of_headers": 1024.0, "export_timestamp": 4294967295.0, "import_dll_count": 6.0, "computed_checksum": 49801.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1694400699.0, "debug_timestamp_min": 1694400699.0, "dll_characteristics": 352.0, "has_export_timestamp": true, "linker_major_version": 14.0, "linker_minor_version": 35.0, "debug_directory_types": [ 2.0, 12.0, 13.0, 14.0 ], "has_resource_timestamp": false, "debug_directory_entries": 4.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 4.0 }, "file": { "size": 19968.0 }, "binary": { "code_size": 10752.0, "func_count": 10.0, "code_entropy": 6.18, "data_entropy": 2.46, "export_count": 11.0, "func_density": 0.95, "import_count": 38.0, "string_count": 113.0, "avg_func_size": 685.3, "section_count": 6.0, "avg_complexity": 25.9, "import_density": 3.62, "max_complexity": 118.0, "string_density": 10.76, "overall_entropy": 3.14, "avg_basic_blocks": 44.0, "avg_section_size": 3157.33, "dependency_count": 6.0, "entropy_variance": 2.12, "avg_string_length": 20.34, "complexity_per_kb": 2.47, "max_string_length": 73.0, "wide_string_count": 13.0, "avg_string_entropy": 3.19, "code_to_data_ratio": 1.31, "data_to_file_ratio": 0.03, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.54, "total_basic_blocks": 440.0, "func_analysis_depth": 2.0, "string_length_stddev": 14.99, "debug_reference_count": 4.0, "largest_section_ratio": 0.54, "sentence_string_count": 26.0, "sentence_string_ratio": 0.23, "writable_section_count": 1.0, "executable_section_count": 1.0, "high_complexity_func_count": 2.0, "unnamed_complex_func_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 232, "Rich" ], [ 520, ".text" ], [ 599, "@.data" ], [ 640, ".pdata" ], [ 679, "@.rsrc" ], [ 719, "@.reloc" ], [ 1456, "@UATAUAVAWH" ], [ 5731, "F fff" ], [ 8398, "VWAVH" ], [ 9212, "M H1E" ], [ 10718, "stack", "ntelineI" ], [ 10748, "stack", "Genu" ], [ 10751, "Genu" ], [ 12304, "POSIXLY_CORRECT" ], [ 12320, "%s: option '%s' is ambiguous; possibilities:" ], [ 12368, "'--%s'" ], [ 12376, "%s: option '--%s' doesn't allow an argument" ], [ 12424, "%s: option '%c%s' doesn't allow an argument" ], [ 12472, "%s: option '--%s' requires an argument" ], [ 12512, "%s: unrecognized option '--%s'" ], [ 12544, "%s: unrecognized option '%c%s'" ], [ 12584, "%s: invalid option -- '%c'" ], [ 12616, "%s: option requires an argument -- '%c'" ], [ 12664, "%s: option '-W %s' is ambiguous" ], [ 12704, "%s: option '-W %s' doesn't allow an argument" ], [ 12752, "%s: option '-W %s' requires an argument" ], [ 12800, "wide", "POSIXLY_CORRECT" ], [ 12832, "wide", "%s: option '%s' is ambiguous; possibilities:" ], [ 12928, "wide", "'--%s'" ], [ 12944, "wide", "%s: option '--%s' doesn't allow an argument" ], [ 13040, "wide", "%s: option '%c%s' doesn't allow an argument" ], [ 13136, "wide", "%s: option '--%s' requires an argument" ], [ 13216, "wide", "%s: unrecognized option '--%s'" ], [ 13280, "wide", "%s: unrecognized option '%c%s'" ], [ 13352, "wide", "%s: invalid option -- '%c'" ], [ 13408, "wide", "%s: option requires an argument -- '%c'" ], [ 13504, "wide", "%s: option '-W %s' is ambiguous" ], [ 13584, "wide", "%s: option '-W %s' doesn't allow an argument" ], [ 13680, "wide", "%s: option '-W %s' requires an argument" ], [ 14300, "RSDS" ], [ 14324, "unicode-escape", "D:\\bld\\getopt-win32_1694400468396\\workd\\Release\\getopt.pdb" ], [ 14408, "GCTL" ], [ 14672, ".rdata" ], [ 14688, ".rdata$voltmd" ], [ 14712, ".rdata$zzzdbg" ], [ 14816, ".xdata" ], [ 14832, ".edata" ], [ 14928, ".data" ], [ 14944, ".bss" ], [ 15718, "getopt.dll" ], [ 15729, "getopt_a" ], [ 15738, "getopt_long_a" ], [ 15752, "getopt_long_only_a" ], [ 15771, "getopt_long_only_w" ], [ 15790, "getopt_long_w" ], [ 15804, "getopt_w" ], [ 15813, "optarg_a" ], [ 15822, "optarg_w" ], [ 15831, "opterr" ], [ 15838, "optind" ], [ 15845, "optopt" ], [ 16366, "__C_specific_handler" ], [ 16390, "__std_type_info_destroy_list" ], [ 16422, "memset" ], [ 16430, "base64", "T$T52\f\u0013^4" ], [ 16458, "__acrt_iob_func" ], [ 16476, "fputwc" ], [ 16486, "__stdio_common_vfwprintf" ], [ 16514, "__stdio_common_vfprintf" ], [ 16540, "strncmp" ], [ 16550, "_wgetenv" ], [ 16562, "getenv" ], [ 16572, "wcsncmp" ], [ 16582, "_initterm" ], [ 16594, "_initterm_e" ], [ 16608, "_seh_filter_dll" ], [ 16626, "_configure_narrow_argv" ], [ 16652, "_initialize_narrow_environment" ], [ 16686, "_initialize_onexit_table" ], [ 16714, "_execute_onexit_table" ], [ 16738, "_cexit" ], [ 16746, "api-ms-win-crt-stdio-l1-1-0.dll" ], [ 16778, "api-ms-win-crt-string-l1-1-0.dll" ], [ 16812, "api-ms-win-crt-environment-l1-1-0.dll" ], [ 16850, "api-ms-win-crt-runtime-l1-1-0.dll" ], [ 16886, "RtlCaptureContext" ], [ 16906, "RtlLookupFunctionEntry" ], [ 16932, "RtlVirtualUnwind" ], [ 16952, "UnhandledExceptionFilter" ], [ 16980, "SetUnhandledExceptionFilter" ], [ 17010, "GetCurrentProcess" ], [ 17030, "TerminateProcess" ], [ 17050, "IsProcessorFeaturePresent" ], [ 17078, "QueryPerformanceCounter" ], [ 17104, "GetCurrentProcessId" ], [ 17126, "GetCurrentThreadId" ], [ 17148, "GetSystemTimeAsFileTime" ], [ 17174, "DisableThreadLibraryCalls" ], [ 17202, "InitializeSListHead" ], [ 17224, "IsDebuggerPresent" ], [ 17242, "KERNEL32.dll" ], [ 17258, "memcpy" ], [ 19040, "\u003c?xml version='1.0' encoding='UTF-8' standalone='yes'?\u003e" ], [ 19097, "\u003cassembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'\u003e" ], [ 19172, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 19228, "\u003csecurity\u003e" ], [ 19244, "\u003crequestedPrivileges\u003e" ], [ 19273, "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], [ 19345, "\u003c/requestedPrivileges\u003e" ], [ 19375, "\u003c/security\u003e" ], [ 19392, "\u003c/trustInfo\u003e" ], [ 19408, "\u003c/assembly\u003e" ] ], "sz": 19968, "ts": [ { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 0.8399999737739563, "d": "asInvoker execution manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 1.0, "d": "Incremental link-time codegen (ILTCG)", "e": [ "pe.has_iltcg = 1.00" ], "i": "metadata/build/reproducible::pe-incremental-ltcg", "l": 2 }, { "d": "Visual Studio build path", "e": [ "D:\\bld\\getopt-win32_1694400468396\\work\\x64\\Release\\getopt.pdb" ], "i": "metadata/binary/debug::pdb-visual-studio", "l": 3 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.7200000286102295, "d": "Short lowercase export name", "e": [ "optopt", "opterr", "optind" ], "i": "metadata/binary/symbols/exports::short-lowercase-export-name", "l": 1 }, { "c": 0.8399999737739563, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 1.0, "d": "PGO-trained release build (POGO)", "e": [ "pe.has_pogo = 1.00" ], "i": "metadata/build/reproducible::pe-pgo-trained", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 11.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "D:\\bld\\getopt-win32_1694400468396\\work\\x64\\Release\\getopt.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.23" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.func_count = 10.00" ], "i": "metadata/binary/metrics/structural::few-functions", "l": 3 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 40960.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 512.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "getopt.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1694400699.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports ten to twenty-five APIs", "e": [ "binary.export_count = 11.00" ], "i": "metadata/binary/symbols/exports::sideload-export-cluster-size-10-25", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.03" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 10.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "13ddf7cfbac1ec64f6007d84fe29bc8bc7186d9567b0afcf04ce3d2a1564e012.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.14" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "13ddf7cfbac1ec64f6007d84fe29bc8bc7186d9567b0afcf04ce3d2a1564e012.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1694400699.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 38.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "d": "PDB path on non-standard drive letter", "e": [ "D:\\bld\\getopt-win32_1694400468396\\work\\x64\\Release\\getopt.pdb" ], "i": "metadata/binary/debug::pdb-nonstandard-drive", "l": 3 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "a": "T1620", "c": 0.8199999928474426, "d": "RegPhantom compact driver size", "e": [ "13ddf7cfbac1ec64f6007d84fe29bc8bc7186d9567b0afcf04ce3d2a1564e012.exe" ], "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.14" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "api-ms-win-crt-string-l1-1-0.dll" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Limited string comparison", "e": [ "strncmp" ], "i": "micro-behaviors/data/string/library::strncmp", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 38.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 25.90" ], "i": "metadata/binary/metrics/anomaly::high-complexity-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata", ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 11.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.18" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 113.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 38.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.03" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 3.62" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 0.8999999761581421, "d": "Find character in string", "e": [ "strchr" ], "i": "micro-behaviors/data/string/library::strchr", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.19" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 38.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 38.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.30000001192092896, "d": "getenv function (read environment variable)", "e": [ "getenv" ], "i": "micro-behaviors/os/env/vars/access::getenv", "l": 2 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 38.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 4294967295.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeSListHead", "GetSystemTimeAsFileTime", "RtlLookupFunctionEntry", "GetCurrentProcessId", "UnhandledExceptionFilter", "DisableThreadLibraryCalls", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "13ddf7cfbac1ec64f6007d84fe29bc8bc7186d9567b0afcf04ce3d2a1564e012.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-stdio-l1-1-0.dll (fputc, acrt_iob_func, stdio_common_vfprintf, stdio_common_vfwprintf, fputwc)", "e": [ "api-ms-win-crt-stdio-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-stdio-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-runtime-l1-1-0.dll (cexit, execute_onexit_table, initialize_onexit_table, initialize_narrow_environment, configure_narrow_argv, ... +3 more)", "e": [ "api-ms-win-crt-runtime-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-runtime-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (DisableThreadLibraryCalls, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, ... +10 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-environment-l1-1-0.dll (wgetenv, getenv)", "e": [ "api-ms-win-crt-environment-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-environment-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VCRUNTIME140.dll (std_type_info_destroy_list, C_specific_handler, strchr, wcschr, memset, ... +1 more)", "e": [ "VCRUNTIME140.dll" ], "i": "metadata/dylib::vcruntime140/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-string-l1-1-0.dll (wcsncmp, strncmp)", "e": [ "api-ms-win-crt-string-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-string-l1-1-0/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 1 }, { "a": "T1622", "c": 0.8999999761581421, "d": "Windows debugger/VM detection (multiple signals)", "e": [ "QueryPerformanceCounter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::win-comprehensive", "l": 2, "m": "B0001" }, { "a": "T1497", "c": 0.9200000166893005, "d": "Anti-analysis fingerprint suite (debugger + locale + timing)", "e": [ "SetUnhandledExceptionFilter", "QueryPerformanceCounter", "IsDebuggerPresent", "IsDebuggerPresent", "UnhandledExceptionFilter" ], "i": "objectives/anti-analysis/sandbox-detect/detection::anti-analysis-fingerprint-suite", "l": 2, "m": "B0007" } ], "sha": "13ddf7cfbac1ec64f6007d84fe29bc8bc7186d9567b0afcf04ce3d2a1564e012", "path": "13ddf7cfbac1ec64f6007d84fe29bc8bc7186d9567b0afcf04ce3d2a1564e012.exe", "type": "pe" } ], "tv": "529a0" } }