{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T01:23:01Z" }, "path": "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe", "raw": { "v": "5", "fs": [ { "f": "O(Er)H(Db₂)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "checksum_valid": 0.0, "resource_count": 3.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 1097578.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 1076224.0, "entropy": 6.94, "size_bytes": 1076224.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.04, "string_count": 9913.0, "entropy_variance": 8.04, "avg_string_length": 10.03, "max_string_length": 480.0, "code_to_data_ratio": 1.0, "string_length_stddev": 15.31, "largest_section_ratio": 0.93, "sentence_string_count": 809.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 1006080.0, "entropy_max": 7.04, "entropy_mean": 3.67, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 50336, "u8", "kr17" ], [ 118696, "u8", "wr17" ], [ 120309, "u8", "pB[}" ], [ 225038, "u8", "*.rOp" ], [ 385852, "u8", "BSJB" ], [ 387374, "u8", "vSkPA" ], [ 387416, "u8", "7ekPA" ], [ 387430, "u8", "WKkPA" ], [ 387458, "u8", "3AkPA" ], [ 387486, "u8", "SCkPA" ], [ 387612, "u8", "7BkPA" ], [ 387682, "u8", "FekPA" ], [ 427253, "u8", "label100" ], [ 427262, "u8", "label110" ], [ 427271, "u8", "\u003cattendance\u003eb__50_10" ], [ 427292, "u8", "\u003cadjst_leave\u003eb__83_10" ], [ 427338, "u8", "\u003cadjst_leave\u003eb__84_10" ], [ 427405, "u8", "\u003cload2\u003eb__10" ], [ 427430, "u8", "\u003cattendance\u003eb__10" ], [ 427448, "u8", "\u003cfillsal\u003eb__10" ], [ 427463, "u8", "\u003cgetleaves\u003eb__10" ], [ 427491, "u8", "\u003cimport\u003eb__10" ], [ 427505, "u8", "\u003cgethistory\u003eb__10" ], [ 427523, "u8", "linkLabel10" ], [ 427535, "u8", "label10" ], [ 427543, "u8", "panel10" ], [ 427551, "u8", "richTextBox10" ], [ 427565, "u8", "textBox10" ], [ 427575, "u8", "label120" ], [ 427584, "u8", "\u003cattendance\u003eb__50_20" ], [ 427605, "u8", "\u003cattendance\u003eb__62_20" ], [ 427634, "u8", "\u003cload2\u003eb__20" ], [ 427647, "u8", "\u003cattendance\u003eb__20" ], [ 427665, "u8", "\u003cgetleaves\u003eb__20" ], [ 427682, "u8", "linkLabel20" ], [ 427694, "u8", "label20" ], [ 427702, "u8", "panel20" ], [ 427710, "u8", "textBox20" ], [ 427720, "u8", "label130" ], [ 427729, "u8", "\u003cattendance\u003eb__62_30" ], [ 427750, "u8", "\u003cattendance\u003eb__30" ], [ 427768, "u8", "label30" ], [ 427776, "u8", "textBox30" ], [ 427786, "u8", "\u003cattendance\u003eb__50_40" ], [ 427807, "u8", "\u003cattendance\u003eb__80_40" ], [ 427828, "u8", "\u003cattendance\u003eb__62_40" ], [ 427849, "u8", "\u003cattendance\u003eb__82_40" ], [ 427870, "u8", "label40" ], [ 427878, "u8", "\u003cattendance\u003eb__50" ], [ 427896, "u8", "label50" ], [ 427904, "u8", "\u003cattendance\u003eb__60" ], [ 427922, "u8", "label60" ], [ 427930, "u8", "\u003cattendance\u003eb__80_70" ], [ 427951, "u8", "\u003cattendance\u003eb__62_70" ], [ 427972, "u8", "\u003cattendance\u003eb__82_70" ], [ 427993, "u8", "label70" ], [ 428001, "u8", "\u003cattendance\u003eb__80_80" ], [ 428022, "u8", "\u003cattendance\u003eb__62_80" ], [ 428043, "u8", "\u003cattendance\u003eb__82_80" ], [ 428064, "u8", "label80" ], [ 428072, "u8", "label90" ], [ 428080, "u8", "\u003c\u003ec__DisplayClass10_0" ], [ 428102, "u8", "\u003c\u003ec__DisplayClass20_0" ], [ 428124, "u8", "\u003clinkLabel13_LinkClicked\u003eb__30_0" ], [ 428219, "u8", "\u003clinkLabel13_LinkClicked\u003eb__50_0" ], [ 428252, "u8", "\u003cattendance\u003eb__50_0" ], [ 428272, "u8", "\u003c\u003ec__DisplayClass50_0" ], [ 428294, "u8", "\u003cattendance\u003eb__80_0" ], [ 428314, "u8", "\u003c\u003ec__DisplayClass80_0" ], [ 428336, "u8", "\u003clinkLabel18_LinkClicked\u003eb__90_0" ], [ 428384, "u8", "\u003c\u003ec__DisplayClass11_0" ], [ 428406, "u8", "\u003clinkLabel14_LinkClicked\u003eb__31_0" ], [ 428439, "u8", "\u003clinkLabel15_LinkClicked\u003eb__31_0" ], [ 428504, "u8", "\u003clinkLabel14_LinkClicked\u003eb__51_0" ], [ 428537, "u8", "\u003clinkLabel17_LinkClicked\u003eb__61_0" ], [ 428570, "u8", "\u003c\u003ec__DisplayClass91_0" ], [ 428592, "u8", "\u003cload2\u003eb__12_0" ], [ 428607, "u8", "\u003c\u003ec__DisplayClass12_0" ], [ 428682, "u8", "\u003clinkLabel12_LinkClicked\u003eb__52_0" ], [ 428715, "u8", "\u003c\u003ec__DisplayClass52_0" ], [ 428737, "u8", "\u003cattendance\u003eb__62_0" ], [ 428757, "u8", "\u003c\u003ec__DisplayClass62_0" ], [ 428779, "u8", "\u003cattendance\u003eb__82_0" ], [ 428799, "u8", "\u003c\u003ec__DisplayClass82_0" ], [ 428821, "u8", "\u003c\u003ec__DisplayClass13_0" ], [ 428875, "u8", "\u003c\u003ec__DisplayClass33_0" ], [ 428943, "u8", "\u003c\u003ec__DisplayClass53_0" ], [ 428965, "u8", "\u003c\u003ec__DisplayClass63_0" ], [ 428987, "u8", "\u003cadjst_leave\u003eb__83_0" ], [ 429008, "u8", "\u003c\u003ec__DisplayClass93_0" ], [ 429094, "u8", "\u003c\u003ec__DisplayClass34_0" ], [ 429116, "u8", "\u003clinkLabel13_LinkClicked\u003eb__64_0" ], [ 429188, "u8", "\u003c\u003ec__DisplayClass64_0" ], [ 429210, "u8", "\u003cadjst_leave\u003eb__84_0" ], [ 429323, "u8", "\u003c\u003ec__DisplayClass25_0" ], [ 429375, "u8", "\u003clinkLabel14_LinkClicked\u003eb__65_0" ], [ 429408, "u8", "\u003clinkLabel10_LinkClicked\u003eb__26_0" ], [ 429473, "u8", "\u003c\u003ec__DisplayClass46_0" ], [ 429530, "u8", "\u003c\u003ec__DisplayClass86_0" ], [ 429591, "u8", "\u003clinkLabel11_LinkClicked\u003eb__27_0" ], [ 429688, "u8", "\u003clinkLabel15_LinkClicked\u003eb__47_0" ], [ 429721, "u8", "\u003clinkLabel11_LinkClicked\u003eb__57_0" ], [ 429754, "u8", "\u003c\u003ec__DisplayClass87_0" ], [ 429790, "u8", "\u003clinkLabel12_LinkClicked\u003eb__28_0" ], [ 429885, "u8", "\u003capproval\u003eb__38_0" ], [ 429903, "u8", "\u003c\u003ec__DisplayClass38_0" ], [ 429925, "u8", "\u003clinkLabel10_LinkClicked\u003eb__48_0" ], [ 429958, "u8", "\u003clinkLabel17_LinkClicked\u003eb__48_0" ], [ 429991, "u8", "\u003cgetleaves\u003eb__48_0" ], [ 430010, "u8", "\u003c\u003ec__DisplayClass48_0" ], [ 430032, "u8", "\u003cgetleaves\u003eb__58_0" ], [ 430051, "u8", "\u003c\u003ec__DisplayClass58_0" ], [ 430073, "u8", "\u003c\u003ec__DisplayClass68_0" ], [ 430095, "u8", "\u003c\u003ec__DisplayClass8_0" ], [ 430116, "u8", "\u003clinkLabel12_LinkClicked\u003eb__19_0" ], [ 430149, "u8", "\u003clinkLabel14_LinkClicked\u003eb__29_0" ], [ 430214, "u8", "\u003cgethistory\u003eb__29_0" ], [ 430234, "u8", "\u003c\u003ec__DisplayClass29_0" ], [ 430256, "u8", "\u003ccancel_approval\u003eb__39_0" ], [ 430281, "u8", "\u003c\u003ec__DisplayClass39_0" ], [ 430303, "u8", "\u003clinkLabel16_LinkClicked\u003eb__49_0" ], [ 430350, "u8", "\u003c\u003ec__DisplayClass59_0" ], [ 430372, "u8", "\u003clinkLabel10_LinkClicked\u003eb__79_0" ], [ 430448, "u8", "\u003c\u003ec__DisplayClass9_0" ], [ 430487, "u8", "\u003cwebload\u003eb__0" ], [ 430501, "u8", "\u003cupload\u003eb__0" ], [ 430514, "u8", "\u003clinkLabel2_LinkClicked\u003eb__0" ], [ 430543, "u8", "\u003ctextappend\u003eb__0" ], [ 430560, "u8", "\u003ccancel_date_time\u003eb__0" ], [ 430583, "u8", "\u003crateupdate\u003eb__0" ], [ 430600, "u8", "\u003cattach\u003eb__0" ], [ 430633, "u8", "\u003cfillsal\u003eb__0" ], [ 430647, "u8", "\u003cimport\u003eb__0" ], [ 430660, "u8", "label101" ], [ 430669, "u8", "label111" ], [ 430678, "u8", "\u003cattendance\u003eb__50_11" ], [ 430699, "u8", "\u003cattendance\u003eb__80_11" ], [ 430720, "u8", "\u003cattendance\u003eb__62_11" ], [ 430741, "u8", "\u003cattendance\u003eb__82_11" ], [ 430762, "u8", "\u003cadjst_leave\u003eb__83_11" ], [ 430808, "u8", "\u003cadjst_leave\u003eb__84_11" ], [ 430875, "u8", "\u003cload2\u003eb__11" ], [ 430900, "u8", "\u003cfillsal\u003eb__11" ], [ 430915, "u8", "\u003cgetleaves\u003eb__11" ], [ 430932, "u8", "\u003cimport\u003eb__11" ], [ 430946, "u8", "\u003cgethistory\u003eb__11" ], [ 430964, "u8", "linkLabel11" ], [ 430976, "u8", "label11" ], [ 430984, "u8", "panel11" ], [ 430992, "u8", "richTextBox11" ], [ 431006, "u8", "textBox11" ], [ 431016, "u8", "label121" ], [ 431025, "u8", "\u003cattendance\u003eb__80_21" ], [ 431046, "u8", "\u003cattendance\u003eb__62_21" ], [ 431067, "u8", "\u003cattendance\u003eb__82_21" ], [ 431096, "u8", "\u003cload2\u003eb__21" ], [ 431109, "u8", "\u003cattendance\u003eb__21" ], [ 431127, "u8", "\u003cgetleaves\u003eb__21" ], [ 431144, "u8", "label21" ], [ 431152, "u8", "panel21" ], [ 431160, "u8", "textBox21" ], [ 431170, "u8", "label131" ], [ 431179, "u8", "\u003cattendance\u003eb__80_31" ], [ 431200, "u8", "\u003cattendance\u003eb__62_31" ], [ 431221, "u8", "\u003cattendance\u003eb__82_31" ], [ 431242, "u8", "\u003cattendance\u003eb__31" ], [ 431260, "u8", "label31" ], [ 431268, "u8", "textBox31" ], [ 431278, "u8", "\u003cattendance\u003eb__50_41" ], [ 431299, "u8", "\u003cattendance\u003eb__80_41" ], [ 431320, "u8", "\u003cattendance\u003eb__62_41" ], [ 431341, "u8", "\u003cattendance\u003eb__82_41" ], [ 431362, "u8", "label41" ], [ 431378, "u8", "\u003cattendance\u003eb__51" ], [ 431396, "u8", "label51" ], [ 431412, "u8", "\u003cattendance\u003eb__61" ], [ 431430, "u8", "label61" ], [ 431438, "u8", "\u003cattendance\u003eb__80_71" ], [ 431459, "u8", "\u003cattendance\u003eb__62_71" ], [ 431480, "u8", "\u003cattendance\u003eb__82_71" ], [ 431501, "u8", "label71" ], [ 431509, "u8", "\u003cattendance\u003eb__80_81" ], [ 431530, "u8", "\u003cattendance\u003eb__62_81" ], [ 431551, "u8", "\u003cattendance\u003eb__82_81" ], [ 431572, "u8", "label81" ], [ 431580, "u8", "label91" ], [ 431588, "u8", "\u003cattendance\u003eb__50_1" ], [ 431608, "u8", "\u003c\u003ec__DisplayClass50_1" ], [ 431630, "u8", "\u003cattendance\u003eb__80_1" ], [ 431650, "u8", "\u003c\u003ec__DisplayClass80_1" ], [ 431687, "u8", "\u003c\u003ec__DisplayClass11_1" ], [ 431709, "u8", "\u003c\u003ec__DisplayClass91_1" ], [ 431731, "u8", "\u003cload2\u003eb__12_1" ], [ 431746, "u8", "\u003c\u003ec__DisplayClass12_1" ], [ 431768, "u8", "\u003cattendance\u003eb__62_1" ], [ 431788, "u8", "\u003c\u003ec__DisplayClass62_1" ], [ 431810, "u8", "\u003cattendance\u003eb__82_1" ], [ 431830, "u8", "\u003c\u003ec__DisplayClass82_1" ], [ 431883, "u8", "\u003c\u003ec__DisplayClass53_1" ], [ 431905, "u8", "\u003c\u003ec__DisplayClass63_1" ], [ 431927, "u8", "\u003cadjst_leave\u003eb__83_1" ], [ 431971, "u8", "\u003c\u003ec__DisplayClass93_1" ], [ 431993, "u8", "\u003c\u003ec__DisplayClass34_1" ], [ 432015, "u8", "\u003cadjst_leave\u003eb__84_1" ], [ 432050, "u8", "\u003c\u003ec__DisplayClass25_1" ], [ 432102, "u8", "\u003cwebload\u003eb__86_1" ], [ 432119, "u8", "\u003c\u003ec__DisplayClass87_1" ], [ 432171, "u8", "\u003cgetleaves\u003eb__48_1" ], [ 432190, "u8", "\u003c\u003ec__DisplayClass48_1" ], [ 432212, "u8", "\u003cgetleaves\u003eb__58_1" ], [ 432231, "u8", "\u003c\u003ec__DisplayClass58_1" ], [ 432276, "u8", "\u003c\u003ec__DisplayClass68_1" ], [ 432314, "u8", "\u003cgethistory\u003eb__29_1" ], [ 432334, "u8", "\u003c\u003ec__DisplayClass29_1" ], [ 432370, "u8", "\u003c\u003ec__DisplayClass59_1" ], [ 432404, "u8", "\u003c\u003ec__DisplayClass9_1" ], [ 432443, "u8", "\u003cupload\u003eb__1" ], [ 432456, "u8", "\u003ctextappend\u003eb__1" ], [ 432473, "u8", "\u003ccancel_date_time\u003eb__1" ], [ 432496, "u8", "\u003crateupdate\u003eb__1" ], [ 432513, "u8", "\u003cattach\u003eb__1" ], [ 432526, "u8", "\u003ccalsal\u003eb__1" ], [ 432539, "u8", "\u003cfillsal\u003eb__1" ], [ 432553, "u8", "\u003capproval\u003eb__1" ], [ 432568, "u8", "\u003ccancel_approval\u003eb__1" ], [ 432590, "u8", "\u003cimport\u003eb__1" ], [ 432603, "u8", "linkLabel11_LinkClicked_1" ], [ 432629, "u8", "linkLabel4_LinkClicked_1" ], [ 432654, "u8", "button2_Click_1" ], [ 432670, "u8", "dateTimePicker4_CloseUp_1" ], [ 432696, "u8", "IEnumerable`1" ], [ 432710, "u8", "EnumerableRowCollection`1" ], [ 432746, "u8", "load1" ], [ 432758, "u8", "tabPage1" ], [ 432767, "u8", "date1" ], [ 432773, "u8", "rate1" ], [ 432782, "u8", "saveFileDialog1" ], [ 432798, "u8", "openFileDialog1" ], [ 432814, "u8", "linkLabel1" ], [ 432825, "u8", "label1" ], [ 432832, "u8", "tableLayoutPanel1" ], [ 432850, "u8", "panel1" ], [ 432857, "u8", "tabControl1" ], [ 432869, "u8", "Form1" ], [ 432875, "u8", "radioButton1" ], [ 432888, "u8", "button1" ], [ 432896, "u8", "temp1" ], [ 432902, "u8", "dateTimePicker1" ], [ 432918, "u8", "timer1" ], [ 432925, "u8", "webBrowser1" ], [ 432937, "u8", "CS$\u003c\u003e8__locals1" ], [ 432953, "u8", "dataGridView1" ], [ 432967, "u8", "treeView1" ] ], "v": { "file.stem": "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1722298148, "file.basename": "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe", "pe.image_base": 4194304, "pe.image_size": 1097728, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 1014098, "pe.headers_size": 512, "pe.version.type": "app", "pe.debug.pdb.age": 1, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.debug.pdb.guid": "6cde6545-4000-4f93-8e51-e362ffe78ab3", "pe.debug.pdb.path": "okaT.pdb", "pe.debug.pdb.stem": "okaT", "pe.file_alignment": 512, "pe.image_hash.sha1": "e48d9889f7e7e1e006ad49e7bfa6a877d37b5b8c", "pe.image_hash.sha256": "0b88133dafd4d7fe7bd55294da1688f699577c24e0137fab9b319b47c692cb7a", "pe.image_hash.sha384": "ea64c061e9623d3f61c246d8c866e21d1adbe431f733c855f83df5603a123a9860ce1954fb6d0754a7f009fe6c848a81", "pe.image_hash.sha512": "0f3464f401eea29cb292d2dec55c3ff78dddbb0185ffd058c0f0321982c584f7f50e313136cd366e94788b2ab4b84187648836e94ecd85aec94cacb50e4932b6", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright © 2015", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.debug.pdb.basename": "okaT.pdb", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.debug.pdb.timestamp": 2526369621, "pe.version.description": "Login", "pe.linker_major_version": 48, "pe.version.file_version": "1.0.0.0", "pe.version.product_name": "Login", "pe.debug.entries[0].type": "codeview", "pe.debug.entries[1].type": "other", "pe.debug.entries[2].type": "other", "pe.version.internal_name": "okaT.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 1014016, "pe.data_directories[1].rva": 1015808, "pe.data_directories[2].rva": 1089536, "pe.data_directories[3].rva": 963980, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1.0.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 79, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 68640, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 84, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.debug.entries[0].type_id": 2, "pe.debug.entries[1].type_id": 19, "pe.debug.entries[2].type_id": 17, "pe.version.original_filename": "okaT.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.debug.entries[0].size_bytes": 284, "pe.debug.entries[1].size_bytes": 39, "pe.debug.entries[2].size_bytes": 49629, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1, "pe.debug.entries[0].timestamp_unix": 2526369621 }, "id": "pe", "sc": [ [ ".text", 512, 1006080, 7.04, "r-x" ], [ ".rsrc", 1006592, 69120, 3.88, "r--" ], [ ".reloc", 1075712, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 1076224, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x5e33c" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x5e33c" ] }, { "c": 0.6000000238418579, "d": "GetTypes method reference", "e": [ "GetTypes" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-gettypes-token", "l": 1, "el": [ "0x6e101" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x6e20f" ] }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x7bf8c" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x10652a" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "download", "Download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105", "el": [ "0x6c23d", "0x6f422" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "okaT.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "0xe97f8" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "ce" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0x86613" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Downloaded Successfully !!! ", "Download Copy", "Check Salary / Download", "Download", "download" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1, "el": [ "0x6f422", "0x7354a", "0x78753", "0x6f608", "0x6c23d" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.699999988079071, "d": "ExecuteNonQuery method", "e": [ "ExecuteNonQuery" ], "i": "micro-behaviors/data/db/access::execute-nonquery", "l": 3, "el": [ "0x6eaa3" ] }, { "c": 0.6000000238418579, "d": "DataAdapter class", "e": [ "MySqlDataAdapter", "OleDbDataAdapter" ], "i": "micro-behaviors/data/db/access::data-adapter-class", "l": 3, "el": [ "0x6dc93", "0x6dc82" ] }, { "c": 0.8999999761581421, "d": "WCF generated code attribute", "e": [ "GeneratedCodeAttribute" ], "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute", "l": 1, "el": [ "0x6ccbc" ] }, { "c": 0.699999988079071, "d": "ConnectionString property", "e": [ "set_ConnectionString" ], "i": "micro-behaviors/data/db/access::connection-string-singular", "l": 3, "el": [ "0x6cfec" ] }, { "c": 0.699999988079071, "d": "DbCommand class", "e": [ "OleDbCommand" ], "i": "micro-behaviors/data/db/access::db-command-class", "l": 3, "el": [ "0x6c6bb" ] }, { "a": "T1027.003", "c": 0.8199999928474426, "d": ".NET Bitmap type reference", "e": [ "System.Drawing.Bitmap" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-bitmap-type-token", "l": 1, "m": "F0001.006", "el": [ "0x89210" ] }, { "a": "T1552.001", "c": 0.4000000059604645, "d": "Credentials filename context", "e": [ "credentials" ], "i": "objectives/supply-chain/credential-theft/registry::credentials-file-basename-context", "l": 1, "el": [ "0x758d3" ] }, { "a": "T1552.001", "c": 0.30000001192092896, "d": "\"password\" keyword", "e": [ "password" ], "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword", "l": 1, "el": [ "0x6c72b" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.6000000238418579, "d": "SqlParameter class", "e": [ "MySqlParameterCollection", "MySqlParameter" ], "i": "micro-behaviors/data/db/access::sql-parameter-class", "l": 3, "el": [ "0x6d75c", "0x6dc50" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x106646" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO", "System.Security" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x6c106", "0x6ea47" ] }, { "a": "T1567", "c": 1.0, "d": "Regex component marker", "e": [ "update users set password = '", "select * from users where username ='" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "l": 1, "el": [ "0x768ba", "0x75863" ] }, { "c": 0.6000000238418579, "d": "SqlDataAdapter class", "e": [ "MySqlDataAdapter" ], "i": "micro-behaviors/data/db/access::sql-data-adapter-class", "l": 3, "el": [ "0x6dc93" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x7bf8c" ] }, { "c": 0.6000000238418579, "d": "GetMethods call reference", "e": [ "GetMethods" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-methods-call", "l": 1, "el": [ "0x6ddad" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ ".ID ", " ID,", " ID ", " ID", " ID.", "-ID:", "-ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0x78249", "0x730ea", "0x6f562", "0x73fa0", "0x7124c", "0x752c2", "0x7012f" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.04" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "AddWithValue method", "e": [ "AddWithValue" ], "i": "micro-behaviors/data/db/access::add-with-value", "l": 3, "el": [ "0x6cefa" ] }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x6f628" ] }, { "c": 0.7200000286102295, "d": "Directory name helper token", "e": [ "GetDirectoryName" ], "i": "micro-behaviors/fs/temp/directory::directory-name-token", "l": 1, "el": [ "0x6ca07" ] }, { "c": 0.699999988079071, "d": "LINQ query operations", "e": [ "System.Linq" ], "i": "micro-behaviors/data/db/linq::linq-queries", "l": 3, "el": [ "0x6da1f" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Login" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "a": "T1027.009", "c": 0.7200000286102295, "d": ".NET resource GetObject token", "e": [ "GetObject" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getobject-token", "l": 1, "el": [ "0x6e59e" ] }, { "d": "password keyword", "e": [ "password", "Password Change", "Icorrect Password !!!", "Passwords do not match !!!", "set_UseSystemPasswordChar", "Change Password", "set_PasswordChar", "Password Change Information", "Confirm Password :", "New Password :", "Password :", "Password has been changed successfully !!!", "update users set password = '", "Please enter a password and reconfirm it!!!", "server=127.0.0.1;Port=3306;UID=root;Password =root;database=ems_data", "Login.password.resources" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1, "el": [ "0x6c72b", "0x76a60", "0x759d6", "0x76a2a", "0x6da68", "0x72d92", "0x6da57", "0x76976", "0x76af6", "0x76ad8", "0x75af2", "0x76920", "0x768ba", "0x76a80", "0x75b59", "0x6dec3" ] }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1, "el": [ "0x6c8a4" ] }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0x7be83" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x4886" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0xf5b42" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x106622" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x6cf26" ] }, { "c": 0.8999999761581421, "d": "PNG image magic in text section", "e": [ "89 50 4E 47 0D 0A 1A 0A" ], "i": "metadata/binary/resource::png-magic-in-text", "l": 1, "el": [ "0x7cb36" ] }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1, "el": [ "0x106820", "0x106820", "0x106820" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "0x6dd9a" ] }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "get_ResourceManager", "ComponentResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x6db23", "0x6db37" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "sqlstring", "StringBuilder", "set_ConnectionString", "ToShortDateString", "StringFileInfo", "ToShortTimeString", "ToString", "cmndstring" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x6d015", "0x6dae4", "0x6cfec", "0x6cfda", "0x1065ca", "0x6cfc8", "0x6d001", "0x6d00a" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 9913.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.7200000286102295, "d": "WinForms Timer control token", "e": [ "Timer" ], "i": "micro-behaviors/ui/controls/widget::winforms-timer", "l": 1, "el": [ "0x6dc0c" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x7be34" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025", "el": [ "0x6dae4" ] }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "0x75ace" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 9913.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 2015" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x6c175", "0x7bf8c" ] }, { "d": "INSERT INTO SQL keyword", "e": [ "Insert into", "insert into" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 3, "el": [ "0x6ed7b", "0x6f488" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.7200000286102295, "d": "Path combination helper token", "e": [ "Combine" ], "i": "micro-behaviors/fs/temp/directory::path-combine-token", "l": 1, "el": [ "0x6ca9e" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "set_ConnectionString", "set_Connection", "OleDbConnection", "Internet Connection Error !!!", "MySqlConnection" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012", "el": [ "0x6cfec", "0x6d7dc", "0x6d7eb", "0x6ec50", "0x6d7fb" ] }, { "c": 0.699999988079071, "d": "OleDbConnection class", "e": [ "OleDbConnection" ], "i": "micro-behaviors/data/db/access::oledb-connection-class", "l": 3, "el": [ "0x6d7eb" ] }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic", "Microsoft.VisualBasic.CompilerServices" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x6c1a1", "0x6ddd7" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.08" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 9913.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "d": "UPDATE SQL keyword", "e": [ "update empwork set", "update cancel_leave set", "update emp_leave set", "update users set", "update empdailyreport set", "Update empdetails set" ], "i": "micro-behaviors/data/db/conn/sql::sql-update", "l": 3, "el": [ "0x7940d", "0x7a10a", "0x79e1f", "0x768ba", "0x799e8", "0x77445" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x6d675" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AM token", "e": [ " AM " ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-am", "l": 1, "m": "B0007.003", "el": [ "0x73cb6" ] }, { "a": "T1041", "c": 0.8600000143051147, "d": "Notification config wording", "e": [ "sender" ], "i": "objectives/exfiltration/messaging/webhook::notification-config-word", "l": 1, "m": "B0030", "el": [ "0x6daf2" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Uploaded Successfully", "Upload Failed", "\u003cupload\u003eb__2", "Upload", "\u003cupload\u003eb__3", "\u003cupload\u003eb__1", "Uploading...", "upload", "rowuploadstatus", "Upload / Update", "\u003cupload\u003eb__0" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-8", "l": 1, "el": [ "0x7a966", "0x7a992", "0x6a0cf", "0x6f118", "0x6a708", "0x6993b", "0x7a94c", "0x6c246", "0x6e4a6", "0x6f5d2", "0x691a5" ] }, { "a": "T1046", "c": 0.699999988079071, "d": "MySQL port 3306", "e": [ "3306" ], "i": "objectives/discovery/network/scan/internal-port::mysql-port", "l": 1, "m": "E1046", "el": [ "0x75b59" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x6e20f" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "DbConnection class", "e": [ "OleDbConnection" ], "i": "micro-behaviors/data/db/access::db-connection-class", "l": 3, "el": [ "0x6d7eb" ] }, { "a": "T1027", "c": 0.8799999952316284, "d": ".NET MD5CryptoServiceProvider use", "e": [ "MD5CryptoServiceProvider" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-md5-crypto-service", "l": 1, "el": [ "0x6dacb" ] }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin", "Admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028", "el": [ "0x758c7", "0x740e0" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Login" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CodeDom compiler access", "e": [ "System.CodeDom.Compiler" ], "i": "metadata/lang/compiler/managed::codedom-compiler", "l": 2, "el": [ "0x6dbf4" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "DataGridViewColumnHeadersHeightSizeMode", "set_ColumnHeadersHeightSizeMode" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1, "el": [ "0x6c7d3", "0x6c7b3" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.6000000238418579, "d": "DbParameter class", "e": [ "DbParameter" ], "i": "micro-behaviors/data/db/access::db-parameter-class", "l": 3, "el": [ "0x6dc44" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xc34a" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "SqlCommand class", "e": [ "MySqlCommand" ], "i": "micro-behaviors/data/db/access::sql-command-class", "l": 3, "el": [ "0x6c6c8" ] }, { "c": 0.6000000238418579, "d": ".NET Process class token", "e": [ "Process" ], "i": "micro-behaviors/process/create/spawn::process-class-token-dotnet", "l": 1, "el": [ "0x6e3b0" ] }, { "c": 0.8600000143051147, "d": "VB late binding token", "e": [ "LateCall" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-latecall-token", "l": 1, "el": [ "0x6d40a" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x6ddb8" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "credentials" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-2", "l": 1, "el": [ "0x758d3" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.9399999976158142, "d": "Dominant largest PE section", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "metadata/binary/layout::large-dominant-section", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Stagecomp approved status", "e": [ "approved" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::stagecomp-approved-status", "l": 1, "m": "B0024", "el": [ "0x79f2a" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "a": "T1486", "c": 1.0, "d": "PDF file extension", "e": [ ".pdf" ], "i": "objectives/impact/ransom/native::ext-pdf", "l": 1, "m": "C0027", "el": [ "0x75075" ] }, { "c": 0.699999988079071, "d": "SqlConnection class", "e": [ "MySqlConnection" ], "i": "micro-behaviors/data/db/access::sql-connection-class", "l": 3, "el": [ "0x6d7fb" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x1066aa" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x106752" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "dateTimePicker5_ValueChanged", "value", "dateTimePicker1_ValueChanged", "insert into empdailyreport (emp_number,idempwork,rate,comment,date,time,dropreason) values(", "dateTimePicker4_ValueChanged", "insert into compdocs (did,data) values (", "dateTimePicker3_ValueChanged", "insert into empdailyreport (emp_number,idempwork,rate,comment,date,time) values(", "add_ValueChanged", "AddWithValue", "insert into empdailyreport (emp_number,idempwork,rate,comment,date,time) value(", "get_Value", "dateTimePicker2_ValueChanged", "Insert into attend_log (emp_number,emp_name,intime,outtime,wd,ot,totald,status,date,day,month,year) Values (@empno,@empname,@int", "set_Value", "ValueType" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x6c324", "0x6cf07", "0x6c2b0", "0x7020c", "0x6c307", "0x6f488", "0x6c2ea", "0x70635", "0x6c341", "0x6cefa", "0x6ff45", "0x6cee6", "0x6c2cd", "0x6ed7b", "0x6cef0", "0x6cac2" ] }, { "a": "T1113", "c": 0.699999988079071, "d": "System.Drawing.Bitmap class reference", "e": [ "Bitmap" ], "i": "micro-behaviors/hardware/display/screen::bitmap-fromscratch-str", "l": 1, "m": "C0014", "el": [ "0x6d9fb" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 9913.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8199999928474426, "d": "Type.InvokeMember reflection token", "e": [ "InvokeMember" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token", "l": 1, "el": [ "0x6da91" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0xd2c0" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xf5b42" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.04)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.7799999713897705, "d": "Assembly accessor token (get_Assembly)", "e": [ "get_Assembly" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token", "l": 1, "el": [ "0x6ea64" ] }, { "c": 0.6399999856948853, "d": "System Action delegate token", "e": [ "Action" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::action-delegate-token", "l": 1, "el": [ "0x6d65f" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x10678e" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 1006080, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 9913.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "Select idempwork,ticket_status from", "select code from", "Select emp_number,emp_fname,emp_mname,emp_lname,bank_name,ifsc_code,acc_number,bank_address,acc_name from", "Select * from", "select rate from" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 3, "el": [ "0x6fcec", "0x6fbd2", "0x7109d", "0x6ecfa", "0x701a5" ] }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1036.005", "c": 0.8500000238418579, "d": "PE stem disagrees with embedded PDB stem", "e": [ "file.stem != pe.debug.pdb.stem (\"19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6\" != \"okat\")" ], "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "l": 3, "el": [ "value:file.stem" ] }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "Password =root" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1, "el": [ "0x75b59" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x6cf26" ] }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "DataGridViewCellStyle", "DataGridViewColumnHeadersHeightSizeMode", "DebuggerBrowsableAttribute", "DataGridViewColumnSortMode", "DebuggerNonUserCodeAttribute", "TableLayoutPanelCellBorderStyle", "GeneratedCodeAttribute", "ApplicationSettingsBase", "InternalDataCollectionBase", "CompilerGeneratedAttribute", "AssemblyTrademarkAttribute", "AssemblyTitleAttribute", "EnumerableRowCollection", "DebuggableAttribute", "ComVisibleAttribute", "EditorBrowsableAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x6c96b", "0x6c7d3", "0x6cd04", "0x6c808", "0x6ccd3", "0x6c9b1", "0x6ccbc", "0x6cb51", "0x6cb2b", "0x6cc93", "0x6cd63", "0x6cd4c", "0x69a46", "0x6ccf0", "0x6cd38", "0x6cd1f" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "d": "SQL statement keywords", "e": [ "Select * from", "select code from", "select rate from", "Select emp_number,emp_fname,emp_mname,emp_lname,bank_name,ifsc_code,acc_number,bank_address,acc_name from", "Select idempwork,ticket_status from" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 3, "el": [ "0x6ecfa", "0x6fbd2", "0x701a5", "0x7109d", "0x6fcec" ] }, { "a": "T1027.002", "c": 0.8500000238418579, "d": ".NET assembly with single import (packed)", "e": [ "imports.count = 1.00", "binary.code_entropy = 7.04", "BSJB" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-single-import", "l": 1 }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.002", "c": 0.8999999761581421, "d": ".NET assembly with bootstrap-only imports", "e": [ "binary.code_entropy = 7.04", "BSJB", "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-bootstrap-imports", "l": 1 }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6", "path": "19beaa481d4538a01e7156ab1d065d010056be23f81edcc4056629f8aacb46d6.exe", "type": "pe" } ], "tv": "52045" } }