{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9181916117668152, "class": 0 } ], "prob": 0.9181916, "class": 0, "models": [ { "m": "az", "prob": 0.9181916, "class": 0 }, { "m": "az/native", "prob": 0.42151162, "class": 0 }, { "m": "az/pe", "prob": 0.14003295, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-12T00:37:07Z" }, "path": "479523", "raw": { "v": "4", "fs": [ { "f": "H₂(DsPo)Md₂(BiSi)", "k": { "hash.imp": "c99feeb622c16f83e869055ff066cae2", "hash.rich_header": "f8daa21c6294920b959e9cdde44c2ef2686cedbe20eb7bb63776fd4a693266cf", "pe.resources.timestamp": 1550733054, "pe.rich_header.xor_key": "0x8897fe31", "pe.version_info.company_name": "PhIlIPS", "pe.version_info.file_version": "1.00", "pe.version_info.product_name": "yaHoO, INC. ", "pe.version_info.internal_name": "symphysiotomybretagnersstormskadeers", "pe.version_info.legal_copyright": "HP, inC. ", "pe.version_info.product_version": "1.00", "binary.top_complex_unnamed[0].cc": 93, "binary.top_complex_unnamed[1].cc": 17, "binary.top_complex_unnamed[2].cc": 12, "binary.top_complex_unnamed[3].cc": 6, "binary.top_complex_unnamed[4].cc": 6, "binary.top_complex_unnamed[5].cc": 3, "binary.top_complex_unnamed[6].cc": 2, "binary.top_complex_unnamed[7].cc": 2, "pe.version_info.file_description": "PIrIfORM LtD ", "pe.version_info.legal_trademarks": "LItEcOIn prOJect ", "binary.top_complex_unnamed[0].bbs": 278, "binary.top_complex_unnamed[1].bbs": 50, "binary.top_complex_unnamed[2].bbs": 29, "binary.top_complex_unnamed[3].bbs": 18, "binary.top_complex_unnamed[4].bbs": 13, "binary.top_complex_unnamed[5].bbs": 8, "binary.top_complex_unnamed[6].bbs": 4, "binary.top_complex_unnamed[7].bbs": 4, "pe.version_info.original_filename": "symphysiotomybretagnersstormskadeers.exe", "binary.top_complex_unnamed[0].addr": "0x45f59e", "binary.top_complex_unnamed[0].size": 17535, "binary.top_complex_unnamed[1].addr": "0x463a30", "binary.top_complex_unnamed[1].size": 1719, "binary.top_complex_unnamed[2].addr": "0x45ed01", "binary.top_complex_unnamed[2].size": 1908, "binary.top_complex_unnamed[3].addr": "0x4643eb", "binary.top_complex_unnamed[3].size": 790, "binary.top_complex_unnamed[4].addr": "0x4640fa", "binary.top_complex_unnamed[4].size": 714, "binary.top_complex_unnamed[5].addr": "0x45ec3a", "binary.top_complex_unnamed[5].size": 180, "binary.top_complex_unnamed[6].addr": "0x45f510", "binary.top_complex_unnamed[6].size": 142, "binary.top_complex_unnamed[7].addr": "0x45f4c6", "binary.top_complex_unnamed[7].size": 74, "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 1, "pe.rich_header.entries[2].use_count": 1, "pe.rich_header.entries[0].product_id": 14, "pe.rich_header.entries[1].product_id": 9, "pe.rich_header.entries[2].product_id": 13, "pe.rich_header.entries[0].build_number": 7299, "pe.rich_header.entries[0].product_name": "Export_VC2003", "pe.rich_header.entries[1].build_number": 8783, "pe.rich_header.entries[1].product_name": "Cvt_Omf_VS_v6_or_earlier", "pe.rich_header.entries[2].build_number": 9782, "pe.rich_header.entries[2].product_name": "Linker_v7" }, "x": 6, "id": 0, "is": [ "vbaR8FixI4", "vbaVarSub", "vbaStrI2", "CIcos", "adj_fptan", "vbaFreeVar", "vbaStrVarMove", "vbaLenBstr", "rtcVarBstrFromByte", "vbaFreeVarList", "adj_fdiv_m64", "rtcLeftVar", "vbaFreeObjList", "rtcAnsiValueBstr", "adj_fprem1", "rtcMidBstr", "vbaStrCat", "rtcVarFromFormatVar", "vbaSetSystemError", "vbaRecDestruct", "vbaHresultCheckObj", "adj_fdiv_m32", "vbaExitProc", "vbaObjSet", "vbaOnError", "rtcMsgBox", "adj_fdiv_m16i", "vbaObjSetAddref", "adj_fdivr_m16i", "CIsin", "rtcMidCharBstr", "rtcInStrRev", "rtcSpaceBstr", "vbaChkstk", "EVENT_SINK_AddRef", "vbaStrCmp", "DllFunctionCall", "vbaVarLateMemSt", "adj_fpatan", "EVENT_SINK_Release", "rtcShell", "vbaUI1I2", "CIsqrt", "EVENT_SINK_QueryInterface", "vbaExceptHandler", "vbaStrToUnicode", "adj_fprem", "adj_fdivr_m64", "rtcStringVar", "rtcVarBstrFromAnsi", "rtcMakeDir", "vbaFPException", "vbaInStrVar", "vbaStrVarVal", "rtcBstrFromAnsi", "rtcPackDate", "rtcDir", "CIlog", "vbaErrorOverflow", "rtcPackTime", "vbaNew2", "vbaInStr", "adj_fdiv_m32i", "rtcHexBstrFromVar", "adj_fdivr_m32i", "vbaStrCopy", "vbaFreeStrList", "adj_fdivr_m32", "adj_fdiv_r", "rtcErrObj", "ThunRTMain", "vbaVarTstNe", "vbaI4Var", "vbaStrToAnsi", "vbaVarDup", "rtcVarStrFromVar", "CIatan", "vbaStrMove", "allmul", "CItan", "CIexp", "vbaFreeObj", "vbaFreeStr", "rtcR8ValFromBstr" ], "ms": { "file": { "size": 446464.0 }, "binary": { "code_size": 409600.0, "func_count": 15.0, "func_density": 0.04, "import_count": 84.0, "string_count": 269.0, "avg_func_size": 1615.27, "section_count": 3.0, "avg_complexity": 12.13, "import_density": 0.21, "max_complexity": 93.0, "string_density": 0.67, "overall_entropy": 6.83, "avg_basic_blocks": 32.0, "avg_section_size": 147456.0, "avg_string_length": 15.38, "complexity_per_kb": 0.03, "max_string_length": 168.0, "wide_string_count": 29.0, "avg_string_entropy": 2.83, "code_section_ratio": 0.33, "code_to_data_ratio": 12.5, "data_to_file_ratio": 0.01, "rsrc_to_file_ratio": 0.06, "text_to_file_ratio": 0.92, "total_basic_blocks": 480.0, "func_analysis_depth": 2.0, "section_name_entropy": 3.01, "string_length_stddev": 15.68, "largest_section_ratio": 0.92, "sentence_string_count": 3.0, "sentence_string_ratio": 0.01, "writable_section_count": 1.0, "has_malformed_structure": true, "normalized_import_count": 0.13, "executable_section_count": 1.0, "normalized_section_count": 0.16, "high_complexity_func_count": 1.0, "unnamed_complex_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 432, ".text" ], [ 512, ".rsrc" ], [ 568, "MSVBVM60.DLL" ], [ 5156, "ungeometricsgenglernesspilopmagervej" ], [ 5300, "glasnetrecirkuleresleukmiensbegribel" ], [ 5341, "kuleshushandelsuncommonnessguardedly" ], [ 5736, "''zzzr\"'" ], [ 5754, "wwww'\"'" ], [ 7464, "xxxxx%%" ], [ 7890, "EUVVU" ], [ 31326, "nonsegregatedtambermorbrtrfortissimi" ], [ 31376, "proportionableaffyrendesbremsereremp" ], [ 31425, "forlngernesoverlappetunoppositeakuti" ], [ 31484, "statusoptllingerspandehulesmcmahonge" ], [ 31532, "wide", "$tailfilibusterenegatorejerskifternep" ], [ 31619, "tailfilibusterenegatorejerskifternep" ], [ 31674, "miljlovovertrdelsernedemichamfronbar" ], [ 31736, "bezelslillefingresskyggetilvrelsersa" ], [ 31795, "sacrificeablepermanganicvizirshipkan" ], [ 31854, "calamagrostisnonamenablypossumsforfe" ], [ 31895, "markarbejdersrephosphorisationbrowns" ], [ 31953, "nringsfrihedenaandsarbejderenscoleyd" ], [ 32012, "beckettscandalouslgelftetdisposition" ], [ 32053, "produktionssystemtragedicalridsenaal" ], [ 32111, "switchelmcmahongennemtrngerelectroth" ], [ 32246, "hakkeordenersejerskifterneprereforms" ], [ 32301, "promethazinesnyderierneuromagertrist" ], [ 32351, "sultelnningerneblondehovedformaaletc" ], [ 32400, "intoxicantlykemiundervisningudsynene" ], [ 32441, "transporterensdevocalizedmiljlovover" ], [ 32499, "markiserssubstitutionsreglermerocyte" ], [ 32549, "slackenersyntacticallyoxygenationfre" ], [ 32598, "survivabilitypanterettighedenponeper" ], [ 32657, "vehfteaircrewmaninconnectiongallamid" ], [ 32707, "uplandermediateketsudlaansafdelinger" ], [ 32756, "akkviescerebyraadetblackflyreaktions" ], [ 32813, "puncturationwhiteheartresistansernel" ], [ 32872, "tiltrdelsersvigtetudbombetruminantst" ], [ 32929, "forureningsraadspecificizedribbedunp" ], [ 32988, "henrikahematinicundershoretamburmajo" ], [ 33047, "ungingledmerocyteberberisseshastighe" ], [ 33088, "rdgrnblindhedenoxygenationfredlyserp" ], [ 33146, "jukeboxperforantfarveskalaerstheclaw" ], [ 33187, "dummyernestricyclerunconspicuouslysu" ], [ 33245, "hmoriderneskeycardeksercerpladsernes" ], [ 34809, "3FOJ" ], [ 39327, "Zdctr" ], [ 42923, "/kH!B7V" ], [ 67898, "Xoml" ], [ 68592, "Mbnd" ], [ 69425, "V93T" ], [ 71836, "Exbwg" ], [ 79347, "/U9M" ], [ 79510, "Pvrc" ], [ 83271, "XK2I" ], [ 84645, "GS7K" ], [ 84752, "Y0HB" ], [ 100984, "QDST" ], [ 101667, "Tamw" ], [ 111073, "AHBV" ], [ 115028, "/rHZ" ], [ 115185, "RFWO" ], [ 115818, "WWS7" ], [ 118730, "5WER" ], [ 133175, "/3qC" ], [ 133380, "/AKc" ], [ 136850, "VDEF" ], [ 141416, "Xbvs" ], [ 159349, "LX3O" ], [ 163458, "pv40" ], [ 170526, "CKR5" ], [ 176769, "Cvtc" ], [ 193671, "UDLC" ], [ 201614, "U96o.V 8" ], [ 204887, "IL6X" ], [ 205998, "3HFW" ], [ 213951, "KJE1" ], [ 222061, "5F3R" ], [ 222733, "/nGB" ], [ 223053, "o6ji" ], [ 227045, "GBK6" ], [ 229599, "K8KK" ], [ 231218, "2F I" ], [ 238359, "Esgm" ], [ 242846, "S7IO" ], [ 250317, "/Dzj7zA" ], [ 251700, "Ib.d" ], [ 251780, "6u4x" ], [ 256035, "m72t4" ], [ 256203, "9TUV" ], [ 261983, "Skhj" ], [ 266862, "G392" ], [ 269227, "UVBP" ], [ 275540, "WJ9K" ], [ 276988, "/6sh" ], [ 278119, "T\"N0Gv.9LT" ], [ 278207, "Fiyz" ], [ 278584, "8u9d" ], [ 280215, "Votz" ], [ 281319, "D2OE" ], [ 281829, "GYCR" ], [ 284504, "UIIR" ], [ 284546, "Z6ZWR" ], [ 285539, "OXS8R" ], [ 285690, "DS5W" ], [ 290119, "3nuh" ], [ 290718, "g1as" ], [ 293997, "cp.f" ], [ 296619, "ca9l" ], [ 300637, "YEZ1" ], [ 306013, "B3QN" ], [ 309963, "LYJM" ], [ 313304, "YS6TZ" ], [ 323027, "Uq.r" ], [ 325745, "OVKD" ], [ 328035, "d432" ], [ 328435, "QOJ0" ], [ 334746, "A3EM" ], [ 335629, "n3x4" ], [ 344708, "BRO6" ], [ 346883, "AFJKHDFHLSFJHDJKLGHKJFJIDHGUISDHFUISDHFUISDHFUIHF78E45YT78WHJUIFERHFUHSDJKFHSDFJKFHSDF78FHUIFHSDUIFHSJKHSDFJKHGSDFUIOGHUIDFHGSUI" ], [ 347085, "W_W_" ], [ 347199, "W_NF" ], [ 347215, "XW_NF" ], [ 347255, "W_W_NF" ], [ 347290, "CW_9" ], [ 347314, "SNFS" ], [ 347320, "SW_TNFj" ], [ 347336, "W_RW_QNFT" ], [ 347519, "W_IIIW_" ], [ 347613, "MapViewOfFile" ], [ 347680, "Shell_NotifyIconW" ], [ 375143, "LRFB" ], [ 376728, "granitiformsvenskekongenssnyderierne" ], [ 376769, "flannelaldolizationblondehovedformaa" ], [ 376827, "komponeringeroversoldulogiskeheptoic" ], [ 376868, "vandkrftersstuvningernesshelteragekn" ], [ 376926, "mellemklassekrigslistenshireablepukl" ], [ 376993, "truppeakutindlagtspagatundelayedbesi" ], [ 377049, "alvinastermodynamikkenhalserknalleri" ], [ 377105, "dimplieroldtidsfodfolkdeamidategrimr" ], [ 377172, "semicolonsnonoxidizingskalkulerended" ], [ 377213, "doobbovbladescoeditkraftigstebysenop" ], [ 377271, "rundkredseillustrationersoverwilling" ], [ 377676, "symphysiotomybretagnersstormskadeers" ], [ 377713, "viceregentfjumsedeshurtigttrrendeudl" ], [ 383104, "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 383372, "Form" ], [ 384124, "VBA6.DLL" ], [ 384644, "MYOCX2.OCX" ], [ 384660, "faremomenterkonfektioneringenbrazenf" ], [ 384756, "ddssfgfdgf" ], [ 384772, "SetThreadPriority" ], [ 384848, "dsdxssdsd" ], [ 384864, "SetPriorityClass" ], [ 384940, "ddsfgsfdgf" ], [ 384956, "GetThreadPriority" ], [ 385032, "dsdxdsdsd" ], [ 385048, "GetPriorityClass" ], [ 385124, "ddsfsgfdgf" ], [ 385140, "GetCurrentThread" ], [ 385216, "GetCurrentProcess" ], [ 385292, "msxsvsvsfw32.dll" ], [ 385316, "GetOpenFileNamePreview" ], [ 385396, "msxsssvvfw32.dll" ], [ 385420, "GetSaveFileNamePreviewA" ], [ 385500, "ksexvsrnsel32" ], [ 385520, "CloseHandle" ], [ 385588, "winspool.drv" ], [ 385608, "OpenPrinterA" ], [ 385680, "GetPrinterA" ], [ 385748, "ClosePrinter" ], [ 385820, "KERNEL32.DLL" ], [ 385840, "RtlMovCCeMemory" ], [ 385912, "IsBaCCdStringPtrA" ], [ 386004, "advapi32" ], [ 386020, "RegOpenKeyExA" ], [ 386092, "RegQueryValueExA" ], [ 386168, "advxapi32" ], [ 386184, "RegCloseKey" ], [ 386248, "GetKeyValue" ], [ 386260, "StringFromPointer" ], [ 386280, "StartSysInfo" ], [ 386396, "wide", "rkebispernesniscrapessmalningersenga" ], [ 386476, "wide", "ripstopspdbrnenepaikingdavtalfuskimi" ], [ 386572, "wide", "pantsttelsenattraachooseslammerkinle" ], [ 386652, "wide", "About" ], [ 386672, "wide", "Version" ], [ 386700, "wide", "Caption" ], [ 386740, "wide", "System Information Is Unavailable At This Time" ], [ 386836, "__vbaExitProc" ], [ 386876, "__vbaOnError" ], [ 386948, "__vbaLenBstr" ], [ 386964, "__vbaFreeObjList" ], [ 387016, "__vbaRecDestruct" ], [ 387084, "__vbaErrorOverflow" ], [ 387116, "__vbaStrCopy" ], [ 387144, "__vbaFreeVar" ], [ 387160, "__vbaFreeStrList" ], [ 387180, "__vbaFreeVarList" ], [ 387216, "__vbaStrMove" ], [ 387248, "__vbaFreeStr" ], [ 387264, "__vbaStrToUnicode" ], [ 387284, "__vbaSetSystemError" ], [ 387320, "__vbaFreeObj" ], [ 387336, "__vbaObjSetAddref" ], [ 387368, "__vbaHresultCheckObj" ], [ 388016, "KeyRoot" ], [ 388024, "KeyName" ], [ 388052, "lpString" ], [ 388064, "lMaxLength" ], [ 411878, "_adj_fptan" ], [ 411998, "_adj_fprem1" ], [ 412220, "__vbaChkstk" ], [ 412234, "EVENT_SINK_AddRef" ], [ 412268, "DllFunctionCall" ], [ 412306, "_adj_fpatan" ], [ 412320, "EVENT_SINK_Release" ], [ 412356, "_CIsqrt" ], [ 412366, "EVENT_SINK_QueryInterface" ], [ 412394, "__vbaExceptHandler" ], [ 412436, "_adj_fprem" ], [ 412450, "_adj_fdivr_m64" ], [ 412468, "__vbaFPException" ], [ 412652, "_adj_fdivr_m32" ], [ 412670, "_adj_fdiv_r" ], [ 412746, "_CIatan" ], [ 412772, "_allmul" ], [ 418482, "wide", "DARED" ], [ 418494, "wide", "FRECX" ], [ 418518, "wide", "VS_VERSION_INFO" ], [ 418610, "wide", "VarFileInfo" ], [ 418642, "wide", "Translation" ], [ 418678, "wide", "StringFileInfo" ], [ 418738, "wide", "CompanyName" ], [ 418764, "wide", "PhIlIPS" ], [ 418786, "wide", "FileDescription" ], [ 418820, "wide", "PIrIfORM LtD" ], [ 418854, "wide", "LegalCopyright" ], [ 418918, "wide", "LegalTrademarks" ], [ 418952, "wide", "LItEcOIn prOJect" ], [ 418994, "wide", "ProductName" ], [ 419054, "wide", "FileVersion" ], [ 419080, "wide", "1.00" ], [ 419098, "wide", "ProductVersion" ], [ 419146, "wide", "InternalName" ], [ 419172, "wide", "symphysiotomybretagnersstormskadeers" ], [ 419254, "wide", "OriginalFilename" ], [ 419288, "wide", "symphysiotomybretagnersstormskadeers.exe" ], [ 445208, "db 251" ], [ 445216, "db 195" ], [ 445224, "db 41" ], [ 445231, "db 201" ], [ 445239, "db 156" ], [ 445247, "db 224" ] ], "sz": 446464, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE header too corrupted to parse: Malformed entity: ResourceString value_len (100) exceeds available bytes (0)", "e": [ "Malformed entity: ResourceString value_len (100) exceeds available bytes (0)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 269.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "VB6 rtcVarBstrFromAnsi string builder", "e": [ "rtcVarBstrFromAnsi" ], "i": "micro-behaviors/data/string/runtime::vb6-string-construction-bstr", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.00" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 0.00" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "VB6 substring extraction helper", "e": [ "rtcMidCharBstr" ], "i": "micro-behaviors/data/string/runtime::vb6-substring-helper", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 6.83" ], "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 12.13" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingW" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "HP, inC. " ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.83" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 480.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 84.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 15.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFromPointer", "lpString", "IsBaCCdStringPtrA", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "VB6 runtime entrypoint marker", "e": [ "ThunRTMain" ], "i": "metadata/binary/framework::vb6-runtime-entry", "l": 2 }, { "c": 0.8999999761581421, "d": "VB6 directory enumeration helper", "e": [ "rtcDir" ], "i": "micro-behaviors/fs/directory/readdir::vb6-rtcdir", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "479523" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1059", "c": 0.949999988079071, "d": "VB6 rtcShell command execution", "e": [ "rtcShell" ], "i": "micro-behaviors/process/create/shell/lang::vb6-rtcshell", "l": 3, "m": "E1059" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "PIrIfORM LtD " ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 84.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "yaHoO, INC. " ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.83" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".rsrc (size: 28672, entropy: 0.00, perms: -r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "binary.has_malformed_structure = 1.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSaveFileNamePreviewA", "GetOpenFileNamePreview" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links MSVBVM60.DLL (vbaR8FixI4, vbaVarSub, vbaStrI2, CIcos, adj_fptan, ... +79 more)", "e": [ "MSVBVM60.DLL" ], "i": "metadata/dylib::msvbvm60/dll", "l": 2 }, { "c": 0.949999988079071, "d": "VB6 shell execution primitive", "e": [ "rtcShell", "ThunRTMain" ], "i": "micro-behaviors/process/create/shell/lang::vb6-shell-execution", "l": 3 } ], "sha": "17010ce4058b4b46656bca1c68ee7cc191b57c9253b9be268e7b1c9582b8d70f", "path": "479523", "type": "pe" } ], "tv": "46790" } }