{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.8905742, "class": 0 }, { "m": "az/pe", "prob": 0.020304568, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T12:16:16Z" }, "path": "168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 5, "ff": { "i": [ [ "msvbvm60", "CIcos" ], [ "msvbvm60", "adj_fptan" ], [ "msvbvm60", "vbaVarMove" ], [ "msvbvm60", "ORDINAL 693" ], [ "msvbvm60", "vbaFreeVar" ], [ "msvbvm60", "vbaStrVarMove" ], [ "msvbvm60", "vbaFreeVarList" ], [ "msvbvm60", "vbaEnd" ], [ "msvbvm60", "adj_fdiv_m64" ], [ "msvbvm60", "vbaFreeObjList" ], [ "msvbvm60", "adj_fprem1" ], [ "msvbvm60", "vbaRecAnsiToUni" ], [ "msvbvm60", "ORDINAL 552" ], [ "msvbvm60", "vbaSetSystemError" ], [ "msvbvm60", "ORDINAL 554" ], [ "msvbvm60", "vbaHresultCheckObj" ], [ "msvbvm60", "adj_fdiv_m32" ], [ "msvbvm60", "vbaAryDestruct" ], [ "msvbvm60", "ORDINAL 591" ], [ "msvbvm60", "ORDINAL 593" ], [ "msvbvm60", "ORDINAL 594" ], [ "msvbvm60", "vbaObjSet" ], [ "msvbvm60", "vbaOnError" ], [ "msvbvm60", "ORDINAL 596" ], [ "msvbvm60", "adj_fdiv_m16i" ], [ "msvbvm60", "vbaObjSetAddref" ], [ "msvbvm60", "ORDINAL 702" ], [ "msvbvm60", "adj_fdivr_m16i" ], [ "msvbvm60", "ORDINAL 598" ], [ "msvbvm60", "ORDINAL 703" ], [ "msvbvm60", "vbaVarTstLt" ], [ "msvbvm60", "vbaFpR8" ], [ "msvbvm60", "ORDINAL 523" ], [ "msvbvm60", "CIsin" ], [ "msvbvm60", "vbaChkstk" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "vbaGenerateBoundsError" ], [ "msvbvm60", "ORDINAL 529" ], [ "msvbvm60", "vbaStrCmp" ], [ "msvbvm60", "vbaAryConstruct2" ], [ "msvbvm60", "vbaObjVar" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "ORDINAL 671" ], [ "msvbvm60", "adj_fpatan" ], [ "msvbvm60", "ORDINAL 675" ], [ "msvbvm60", "vbaLateIdCallLd" ], [ "msvbvm60", "ORDINAL 569" ], [ "msvbvm60", "ORDINAL 676" ], [ "msvbvm60", "vbaRedim" ], [ "msvbvm60", "ORDINAL 677" ], [ "msvbvm60", "vbaRecUniToAnsi" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "ORDINAL 600" ], [ "msvbvm60", "CIsqrt" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "adj_fprem" ], [ "msvbvm60", "adj_fdivr_m64" ], [ "msvbvm60", "ORDINAL 714" ], [ "msvbvm60", "ORDINAL 716" ], [ "msvbvm60", "ORDINAL 531" ], [ "msvbvm60", "vbaFPException" ], [ "msvbvm60", "ORDINAL 717" ], [ "msvbvm60", "ORDINAL 535" ], [ "msvbvm60", "CIlog" ], [ "msvbvm60", "ORDINAL 539" ], [ "msvbvm60", "ORDINAL 646" ], [ "msvbvm60", "vbaFileOpen" ], [ "msvbvm60", "vbaNew2" ], [ "msvbvm60", "ORDINAL 648" ], [ "msvbvm60", "ORDINAL 570" ], [ "msvbvm60", "ORDINAL 571" ], [ "msvbvm60", "adj_fdiv_m32i" ], [ "msvbvm60", "adj_fdivr_m32i" ], [ "msvbvm60", "vbaStrCopy" ], [ "msvbvm60", "ORDINAL 680" ], [ "msvbvm60", "vbaFreeStrList" ], [ "msvbvm60", "ORDINAL 682" ], [ "msvbvm60", "ORDINAL 575" ], [ "msvbvm60", "vbaDerefAry1" ], [ "msvbvm60", "adj_fdivr_m32" ], [ "msvbvm60", "adj_fdiv_r" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "vbaVarTstNe" ], [ "msvbvm60", "vbaI4Var" ], [ "msvbvm60", "ORDINAL 610" ], [ "msvbvm60", "vbaVarAdd" ], [ "msvbvm60", "vbaLateMemCall" ], [ "msvbvm60", "ORDINAL 611" ], [ "msvbvm60", "vbaVarDup" ], [ "msvbvm60", "vbaStrToAnsi" ], [ "msvbvm60", "vbaStrComp" ], [ "msvbvm60", "ORDINAL 612" ], [ "msvbvm60", "ORDINAL 613" ], [ "msvbvm60", "CIatan" ], [ "msvbvm60", "vbaStrMove" ], [ "msvbvm60", "vbaCastObj" ], [ "msvbvm60", "ORDINAL 541" ], [ "msvbvm60", "ORDINAL 542" ], [ "msvbvm60", "allmul" ], [ "msvbvm60", "vbaLateIdSt" ], [ "msvbvm60", "ORDINAL 544" ], [ "msvbvm60", "ORDINAL 652" ], [ "msvbvm60", "ORDINAL 545" ], [ "msvbvm60", "CItan" ], [ "msvbvm60", "ORDINAL 546" ], [ "msvbvm60", "ORDINAL 547" ], [ "msvbvm60", "CIexp" ], [ "msvbvm60", "vbaFreeObj" ], [ "msvbvm60", "vbaFreeStr" ] ], "m": { "pe": { "checksum": 254478.0, "checksum_valid": 1.0, "computed_checksum": 254478.0, "bound_import_count": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 2622450629.0 }, "file": { "size": 208896.0, "entropy": 5.74, "size_bytes": 208896.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.92, "data_entropy": 0.0, "string_count": 898.0, "entropy_variance": 6.03, "avg_string_length": 10.32, "max_string_length": 59.0, "code_to_data_ratio": 0.98, "string_length_stddev": 5.0, "largest_section_ratio": 0.94, "sentence_string_count": 4.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 110.0 }, "sections": { "count": 3.0, "code_size": 196608.0, "entropy_max": 5.92, "entropy_mean": 2.65, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 168, "u8", "Rich" ], [ 432, "u8", ".text" ], [ 512, "u8", ".rsrc" ], [ 568, "u8", "MSVBVM60.DLL" ], [ 7632, "u8", "INDDKNING" ], [ 7752, "u8", "superciliosity" ], [ 7771, "u8", "Livers" ], [ 7825, "u8", "Command2" ], [ 7838, "u8", "NSELYD" ], [ 7866, "u8", "Command1" ], [ 7879, "u8", "avanceringers" ], [ 7914, "u8", "Text2" ], [ 7933, "u8", "Gartneriarbejdere" ], [ 7963, "u8", "Text1" ], [ 7982, "u8", "barie" ], [ 8000, "u8", "Frame1" ], [ 8011, "u8", "Digraf4" ], [ 8040, "u8", "Frame5" ], [ 8051, "u8", "dewlike" ], [ 8300, "u8", "Knudepunkternes2" ], [ 8317, "u8", "Snniken6" ], [ 11296, "u8", "Spiritusannoncernes3" ], [ 11324, "wide", "angakokkeragelastzofiep" ], [ 11376, "wide", "tonishbankanal" ], [ 11412, "wide", "FYRSTEDMMEDAGPRAGTSTJERNER" ], [ 11628, "u8", "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 11828, "u8", "Form" ], [ 11908, "u8", "user32.dll" ], [ 11924, "u8", "MonitorFromRect" ], [ 11996, "u8", "icmp.dll" ], [ 12012, "u8", "IcmpCloseHandle" ], [ 12032, "u8", "kernel32" ], [ 12048, "u8", "GetCurrentThread" ], [ 12124, "u8", "user32" ], [ 12136, "u8", "TrackMouseEvent" ], [ 12208, "u8", "CreateFileA" ], [ 12276, "u8", "CreatePipe" ], [ 12344, "u8", "kernel32.dll" ], [ 12364, "u8", "CopyFileExA" ], [ 12432, "u8", "DrawEdge" ], [ 12504, "u8", "shell32.dll" ], [ 12520, "u8", "SHGetFileInfoA" ], [ 12592, "u8", "advapi32.dll" ], [ 12612, "u8", "RegCloseKey" ], [ 12680, "u8", "ShowCaret" ], [ 12748, "u8", "iphlpapi.dll" ], [ 12768, "u8", "GetTcpTable" ], [ 12832, "u8", "LOFTSREGELEN" ], [ 12848, "u8", "UDSDEN" ], [ 12856, "u8", "surfperches" ], [ 12868, "u8", "EYEWITNESSES" ], [ 12884, "u8", "MITHRIAC" ], [ 12896, "u8", "HAREBUR" ], [ 12904, "u8", "MELBOURNE" ], [ 12916, "u8", "Ddstille4" ], [ 13040, "wide", "Unclementness8" ], [ 13108, "wide", "Verdenshjrnet6" ], [ 13144, "wide", "Linjenumres5" ], [ 13176, "wide", "Underflame" ], [ 13204, "wide", "Palest" ], [ 13224, "wide", "SKRAALERIS" ], [ 13252, "wide", "Canyonens7" ], [ 13280, "wide", "Strandvejenes3" ], [ 13316, "wide", "Mindstebelbenes6" ], [ 13356, "wide", "Bidetang" ], [ 13380, "wide", "MOVABLE" ], [ 13400, "wide", "lightninglike" ], [ 13448, "wide", "21:21:21" ], [ 13488, "wide", "Edifyingly" ], [ 13516, "wide", "unretrievable" ], [ 13548, "wide", "Ungkreatur6" ], [ 13576, "wide", "Sesammens7" ], [ 13604, "wide", "Copiopia8" ], [ 13628, "wide", "stoerrelse" ], [ 13656, "wide", "Omrre8" ], [ 13676, "wide", "FORSYNEENES" ], [ 13704, "wide", "BEETLEHEADEDNESS" ], [ 13744, "wide", "Delmodigere7" ], [ 13776, "wide", "plotteres" ], [ 13800, "wide", "Perturbingly" ], [ 13832, "wide", "Discontiguity" ], [ 13860, "wide", "NzSFYenQKqEQxOnd96m0EcC72" ], [ 13984, "wide", "Afsvrgede1" ], [ 14012, "wide", "Out of string space" ], [ 14056, "wide", "Electrotypy" ], [ 14116, "wide", "Skalpellers" ], [ 14144, "wide", "Migratations" ], [ 14176, "wide", "Dalstrgenes" ], [ 14204, "wide", "rheumiest" ], [ 14228, "wide", "metro" ], [ 14248, "wide", "Afkriminaliseret" ], [ 14288, "wide", "Unpetalled1" ], [ 14316, "wide", "Maanedskortets" ], [ 14352, "wide", "Hoverer" ], [ 14372, "wide", "Forsnkningen" ], [ 14404, "wide", "Dogwatch" ], [ 14428, "wide", "Skiametry2" ], [ 14456, "wide", "Retsplejens7" ], [ 14488, "wide", "defeaters" ], [ 14512, "wide", "SENTIMENTALIZERS" ], [ 14552, "wide", "educive" ], [ 14572, "wide", "BESGSFREMGANG" ], [ 14604, "wide", "Partitioning" ], [ 14636, "wide", "TEQUILA" ], [ 14656, "wide", "Kartouchernes4" ], [ 14692, "wide", "Halvmaanes" ], [ 14720, "wide", "Nameling" ], [ 14744, "wide", "Tabloidavisers7" ], [ 14780, "wide", "omskiftelse" ], [ 14808, "wide", "pdofile" ], [ 14828, "wide", "Illustratorer3" ], [ 14864, "wide", "Selectman1" ], [ 14892, "wide", "Supplementbindet7" ], [ 14932, "wide", "TRINDELE" ], [ 14956, "wide", "uninsistently" ], [ 14988, "wide", "Raastoftilfrsler8" ], [ 15028, "wide", "Victualage" ], [ 15056, "wide", "HAUSTELLATED" ], [ 15088, "wide", "sannies" ], [ 15108, "wide", "discover" ], [ 15132, "wide", "Selvhvdelsens" ], [ 15164, "wide", "Dachshund" ], [ 15188, "wide", "quillagua" ], [ 15212, "wide", "MALTLLETS" ], [ 15236, "wide", "hrfrerne" ], [ 15260, "wide", "gutenberghus" ], [ 15292, "wide", "AGONS" ], [ 15308, "wide", "Expansive" ], [ 15332, "wide", "Dyretmmerens" ], [ 15364, "wide", "CALQUE" ], [ 15384, "wide", "Benkam" ], [ 15404, "wide", "Bugan" ], [ 15420, "wide", "OVERWOMANLY" ], [ 15448, "wide", "Tidsnoed8" ], [ 15472, "wide", "niggardising" ], [ 15504, "wide", "audibles" ], [ 15544, "wide", "MENOXENIA" ], [ 15572, "wide", "KONFIGURER" ], [ 15600, "wide", "BRNDEMRKENDES" ], [ 15632, "wide", "PREGNABLE" ], [ 15656, "wide", "Celtdom" ], [ 15676, "wide", "Druelighed" ], [ 15704, "wide", "bededags" ], [ 15728, "wide", "Gerah" ], [ 15744, "wide", "Standardrutinernes" ], [ 15788, "wide", "Stoftilfrslerne6" ], [ 15828, "wide", "Prinsgemaler5" ], [ 15860, "wide", "Dermoskeleton" ], [ 15892, "wide", "kortblgens" ], [ 15920, "wide", "Bigheads" ], [ 15944, "wide", "Diode" ], [ 15960, "wide", "LACERTA" ], [ 15980, "wide", "Haimsucken" ], [ 16008, "wide", "Tattooerne" ], [ 16036, "wide", "INDFRELSERNE" ], [ 16068, "wide", "Anstdsstens5" ], [ 16100, "wide", "spandril" ], [ 16124, "wide", "Posturist" ], [ 16148, "wide", "DEKANESSERNE" ], [ 16180, "wide", "Emissionerne" ], [ 16212, "wide", "nedfotograferedes" ], [ 16252, "wide", "laticostate" ], [ 16280, "wide", "Ultranonsensical" ], [ 16320, "wide", "FOSSULAE" ], [ 16344, "wide", "troubleshooted" ], [ 16380, "wide", "generationsklfter" ], [ 16420, "wide", "phenomenalness" ], [ 16456, "wide", "Sjakalhamps2" ], [ 16488, "wide", "HELTALLIGE" ], [ 16516, "wide", "Aidas4" ], [ 16536, "wide", "MINERALOLIEPRODUKTERS" ], [ 16584, "wide", "sturdily" ], [ 16608, "wide", "Heterocera4" ], [ 16636, "wide", "Toupeternes" ], [ 16664, "wide", "STEMBOK" ], [ 16684, "wide", "Bunkres2" ], [ 16708, "wide", "overskudsamfundets" ], [ 16752, "wide", "TRANSITIVE" ], [ 16780, "wide", "Toprope5" ], [ 16804, "wide", "LINNED" ], [ 16824, "wide", "SALINAS" ], [ 16844, "wide", "thrawneen" ], [ 16868, "wide", "jawbreaking" ], [ 16896, "wide", "synantherologist" ], [ 16936, "wide", "andalusierens" ], [ 16968, "wide", "Noncitizen3" ], [ 16996, "wide", "Unforgivably" ], [ 17028, "wide", "Actinons" ], [ 17052, "wide", "Wrastle" ], [ 17072, "wide", "landet" ], [ 17092, "wide", "Alpinistens" ], [ 17120, "wide", "gahnites" ], [ 17144, "wide", "GRATULERE" ], [ 17168, "wide", "KVIKKEDE" ], [ 17192, "wide", "GLORIA" ], [ 17212, "wide", "espanoles" ], [ 17236, "wide", "panuelos" ], [ 17260, "wide", "shockproof" ], [ 17288, "wide", "HOODOOED" ], [ 17312, "wide", "polyplastic" ], [ 17340, "wide", "maveonde" ], [ 17364, "wide", "CENTRIFUGERNE" ], [ 17396, "wide", "rendyrkningerne" ], [ 17432, "wide", "Sudaminal4" ], [ 17460, "wide", "yurucari" ], [ 17500, "wide", "15:15:15" ], [ 17524, "wide", "Parcellate" ], [ 17552, "wide", "TUNICA" ], [ 17572, "wide", "Delve" ], [ 17588, "wide", "Uncommemorated" ], [ 17624, "wide", "Numinousness" ], [ 17656, "wide", "statsraadets" ], [ 17688, "wide", "Garishness" ], [ 17716, "wide", "Synliggjorte6" ], [ 17748, "wide", "Langsdon6" ], [ 17772, "wide", "ridderligst" ], [ 17800, "wide", "Frige2" ], [ 17820, "wide", "Garantibetaling9" ], [ 17860, "wide", "vitrioline" ], [ 17888, "wide", "Outwick" ], [ 17908, "wide", "baandoptagelsen" ], [ 17944, "wide", "Hubbing3" ], [ 17968, "wide", "Chloroethene3" ], [ 18000, "wide", "magteslsere" ], [ 18028, "wide", "JAMAICANSKES" ], [ 18060, "wide", "Vandflade3" ], [ 18088, "wide", "SNUPTAGSLSNING" ], [ 18124, "wide", "MUNIFICENTNESS" ], [ 18160, "wide", "RECIPIENTTILSYNENES" ], [ 18204, "wide", "Unlush" ], [ 18224, "wide", "Supraordinary7" ], [ 18260, "wide", "Izak5" ], [ 18276, "wide", "Cantered2" ], [ 18300, "wide", "Filantropen" ], [ 18328, "wide", "urinstinkters" ], [ 18360, "wide", "Riotously" ], [ 18384, "wide", "Sandeltrer8" ], [ 18412, "wide", "IMBRACERY" ], [ 18436, "wide", "Boracic1" ], [ 18476, "wide", "Konsultationstidens8" ], [ 18524, "wide", "Angiospastic8" ], [ 18556, "wide", "forudbestemmendes" ], [ 18596, "wide", "SLOBBERCHOPS" ], [ 18628, "wide", "separatfred" ], [ 18656, "wide", "Amoralitet4" ], [ 18684, "wide", "unsuicidal" ], [ 18712, "wide", "Krestens" ], [ 18736, "wide", "PREARMED" ], [ 18760, "wide", "Rekrutterne6" ], [ 18792, "wide", "PAWKIEST" ], [ 18816, "wide", "Quizets" ], [ 18836, "wide", "Middlings" ], [ 18860, "wide", "Settlings4" ], [ 18888, "wide", "Buketrosernes8" ], [ 18924, "wide", "Pluralist6" ] ], "v": { "file.stem": "168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77", "pe.imphash": "82db0a1dceabac7a5117322f20266048", "pe.machine": "i386", "pe.rich.key": 2292859599, "pe.rich.hash": "8854d3ec095906a7589b343a26214183", "pe.subsystem": "windows_gui", "pe.timestamp": 1618982508, "file.basename": "168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77.exe", "pe.image_base": 4194304, "pe.image_size": 212992, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 7572, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "357f18105a17383296e1691681b9b5c2ce43f733", "pe.image_hash.sha256": "dec86a34a58c014fcd7d21146fb830f6d6529af2dcfb65f273a4ae43cfc33b84", "pe.image_hash.sha384": "2d269eb2a98942a54c119d06e119efca44c64c8c336afb36b7c4c38c39b89af2a29838f645cde76df6196cf5b81d54f3", "pe.image_hash.sha512": "42e5b188358296556a6616c336d8a4f40bd23c87e6a88a92b0e4ee2d4b971012dbdc4b3dd2de9cb5d28361d8ade377e70c4dbb8d79dfb620ba97091929a5b673", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 195172, "pe.data_directories[1].rva": 208896, "pe.data_directories[2].rva": 552, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2392, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 444, "pe.rich.entries[0].build_id": 14, "pe.rich.entries[1].build_id": 9, "pe.rich.entries[2].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.rich.entries[1].use_count": 2, "pe.rich.entries[2].use_count": 1, "pe.coff.dos_header_pe_pointer": 184, "pe.rich.entries[0].product_id": 7299, "pe.rich.entries[1].product_id": 8783, "pe.rich.entries[2].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1236279235 }, "id": "pe", "sc": [ [ ".text", 4096, 196608, 5.92, "r-x" ], [ ".data", 200704, 4096, 0.0, "rw-" ], [ ".rsrc", 204800, 4096, 2.02, "r--" ] ] }, "id": 0, "sz": 208896, "ts": [ { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x32272" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x2fed8" ] }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2, "el": [ "0x2ff4" ] }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x32156" ] }, { "c": 0.9800000190734863, "d": "user32 dynamic dispatch target", "e": [ "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target", "l": 1, "el": [ "0x2f5c" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 110.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x10a4" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x2fe46" ] }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 110.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x3239a" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x323bc" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x32232" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.92" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x2e84" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x12084" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x322ba" ] }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1236279235,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x238" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 110.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 898.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.9300000071525574, "d": "VB6 runtime file open helper", "e": [ "vbaFileOpen" ], "i": "micro-behaviors/fs/file/write/direct::vb6-file-open", "l": 2, "el": [ "0x110c" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x32356" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0x2d6c" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "Out of string space" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x321f6", "0x36bc" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x3038" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x323bc" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x2fb0" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x221b" ] }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x221b" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (CIcos, adj_fptan, vbaVarMove, ORDINAL 693, vbaFreeVar, ... +105 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "110 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "DllFunctionCall", "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x2fe46", "0x238" ] } ], "sha": "168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-04/168ca422e4a4dc429c9fb4a65cdd1b3f1f32119475581b3d00c94ff6e4a82f77.exe", "type": "pe" } ], "tv": "ca5ef" } }