{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.96840656, "rte": "az", "prob": 0.96840656 }, { "cls": 0, "raw": 0.95745015, "rte": "az/native", "prob": 0.95745015 }, { "cls": 0, "raw": 0.9864461, "rte": "az/pe", "prob": 0.9864461 } ], "prob": 0.96840656, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.9684065580368042, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-14T23:01:49Z" }, "path": "1f68682f037b5964da035112cfcaac453d8a51ce7912128937e10f843de8dbac.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 3, "d": "Manifest is MyApplication template name", "i": "metadata/build/manifest::pe-manifest-myapplication-template", "o": 0, "z": 1 } ], "x": true }, { "b": "00B2n0v!6H8H+S=00B+Klq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "l": 7760, "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 7776, "z": 4 } ], "x": true }, { "b": "z/6Dcy?mS=wPz%dv}xYYzf6i9A+]D004}=6z/L?Uz!S.Zq*ACawO?AszGEV\u002606$WEwO\u003e))", "l": 14581, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 14597, "z": 8 } ], "x": true }, { "b": "B97#ge(Dm)y?m9#x(v\u003e?q/)4]zF5@oz/oD6vqV6yB-8qnzdM7Mze-{9x\u003c$^)x([R^BAv", "l": 14661, "n": [ { "c": 3, "d": ".NET HTTP request client", "i": "micro-behaviors/communications/http/client/managed::request", "o": 14677, "z": 6 } ], "x": true }, { "b": "x(^#$y?k[OBAh88B-.f{q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026wB.LwLBAzLqvS=^707fyDe[Gos06A$]wozZ1j]/!Eh/p{bpCU\u003cZxM!h(rb\u003c-.0bb[L", "l": 14964, "n": [ { "c": 2, "d": "Runtime interop services", "i": "metadata/lang/compiler/managed::runtime-interop", "o": 14980, "z": 30 }, { "c": 2, "d": "Contains Windows executable file path", "i": "micro-behaviors/data/text/path::exe-extension-string", "o": 15028, "z": 4 } ], "x": true }, { "b": "wO#P#BzkVhl$HEGx(4\u0026ODQQj/gb.6Jiw0lGmMq$Rl]W1Pk@yzQeJkKzi5i(ZfGy*Df)%4euSh5PBzkkJA=LPlnP5l:rc-B]q!ZL?jU!X\u003er:+", "l": 19722, "n": [ { "c": 1, "d": "GUID-formatted token", "i": "micro-behaviors/process/sync/mutex::guid-mutex", "o": 19738, "z": 38 } ], "x": true }, { "b": "z/]J9wDkUxB$^-jrb\u003c.{s7L\u0026dy?WD#Bo2l+B97#ge(2#1077%MwDkbpCw.knvpR=mByte}r765elW7v$lVNc1pC+ynB]V+#z=pZppG6X$rzA", "l": 19973, "n": [ { "c": 3, "d": "WebClient.DownloadData method", "i": "micro-behaviors/communications/http/client/managed::downloaddata", "o": 20015, "z": 12 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 19999, "z": 10 }, { "c": 2, "d": "System.Net.WebClient class usage", "i": "micro-behaviors/communications/http/client/managed::webclient", "o": 19989, "z": 9 } ], "x": true }, { "b": "y*7)Xnn?K6pgV}mpbt@KxjVf(nm=juwPz?(s7L\u0026iwNPaXAZK+Yy?m9#x(v\u003e?B9QD3lt5i0qeF3#lO\u0026mcq!MeavqPNRvqH6$lVl^SwN/*@z/bLND2[7sz7Xg]y\u00260V)BzkVhB1QygwN/B.y?Xibwb(", "l": 20069, "n": [ { "c": 3, "d": "Usage of NameValueCollection (headers/params)", "i": "micro-behaviors/communications/http/server/managed::name-value-collection", "o": 20136, "z": 19 }, { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "o": 20085, "z": 11 } ], "x": true }, { "b": "iCXW\u0026wO(vaC#F*9wNPAQq*ACawO\u003c4\u003epxi?3v@C)(zF5@FD2[7sz7X!0CYS{QwPQ\u003c)A+PA70b2\u003e+uRC3Gxlm!!lVl\u003c=wPz\u003e)rbU9GBy+CKz:wz:", "l": 20630, "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 20646, "z": 9 }, { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "o": 20677, "z": 9 } ], "x": true }, { "b": "ADB@%hb!vlnn7zjnm\u003el\u0026q/#L\u003cBAh8kx8\u003eUns:itKyEhcxghGZcqeYfN08)#WwNPAQwo.S+Ar", "l": 20988, "n": [ { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "o": 21004, "z": 9 } ], "x": true }, { "b": "o*%nwpJXDJo/LNWB4x+iC(RC*lR6T1pI%]xq/Ccww[%X5gYO^DzdN*5z!7LDhzu*sfFJ", "l": 23295, "n": [ { "c": 2, "d": "Windows path-like string pattern", "i": "micro-behaviors/data/text/path::windows-path-like-string", "o": 23311, "z": 6 } ], "x": true }, { "b": "ASvV\u003ek(+J$wDlPFBn#qLo-P8iDh}TVyYFnKve}}XgYPcdfAri}c\u0026=QmzVBROz#:qDBo31PvGpiAwDj^(aokEyx-J2Jwb{JFCk#W:aokdpq#!3vh2]lef-Tonaoh", "l": 23448, "n": [ { "c": 2, "d": "Old Mozilla 4.0 User-Agent", "i": "micro-behaviors/communications/http/headers::ua-mozilla-old", "o": 23464, "z": 50 } ], "x": true }, { "b": "zD7p\u0026z*cm610vNAm/-Pde(1\u0026mmSI{OwP@6kyB\u0026H$A=U@kzASe1e?^qar1oQiA:-/@Cw?Iql${ZYy*?P:vqPM!e(1\u0026mavV", "l": 23810, "n": [ { "c": 2, "d": ".NET Framework reference", "i": "metadata/lang/compiler/managed::framework-reference", "o": 23826, "z": 26 } ], "x": true }, { "b": "0SSi20@@r31onA41POJ5g?nELiwrcvfF+ypfFCgmfF\u003eEqfFCgmw[CT!fFCgmvMl4}fFCgmfFCgmfFCgmg+ZQqfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmfFCgmi503ufFCgmfL8$JvQQ%4fFD@)fGASNgbik$fFLy]v}mtHh8EiJ", "l": 24728, "n": [ { "c": 3, "d": "Large hexadecimal encoded blob", "i": "micro-behaviors/data/encode/payload::large-hex-payload", "o": 24744, "z": 128 } ], "x": true }, { "b": "AZ+j:o\u003c}:N0bV^!z/PA2e[w^m000000rjtBav2]b0000000000000000000000000", "l": 712933, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 712949, "z": 4 } ], "x": true }, { "b": "000000eTJEm?2!z3ig5a4m%8UqucW#0000200\u0026=e008Uo!CodBauA7Zk#-90)a)8C", "l": 713515, "n": [ { "c": 2, "d": "PNG and manifest in resources", "i": "metadata/binary/resource::png-and-manifest-rsrc", "o": 713531, "z": 4 } ], "x": true }, { "b": "0rskxB07C.0SW(QgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rtZ(0000", "l": 721838, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 721854, "z": 15 } ], "x": true }, { "b": "x-IYAzua+U002aY4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg002{$x-I#IzVBUPaokvvve$xHxAhDvz2:Lo003Kf9SMivmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$qVGt*ec3^)q#*F", "l": 722142, "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 722158, "z": 11 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 722218, "z": 15 } ], "x": true }, { "b": "x-IYAzua+U001?Q2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=W*ggYPcdfArZ9fAq7M001XM2MK(9nDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^o8}rVe=YC.CMqpP003*n", "l": 722302, "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 722318, "z": 11 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 722370, "z": 12 }, { "c": 1, "d": "PE FileVersion resembles IPv4", "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "o": 722344, "z": 8 } ], "x": true }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vf-Tilirg#reDvKafAr\u003cdfA", "l": 722432, "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 722448, "z": 9 } ], "x": true }, { "b": "xAhDvz2=f*001$U2MK(9pxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^o8}rVe=YC.CMqpP001$U3\u0026*qdpYLIozVBqFBPt[KBo25ove$cAwDhYg002*}BPtwvq#*53aolD.BPuaQBo2\u003eL001$U2(\u003c#apYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=W*ggYPcdfArZ9fAq7M002aY2(\u003c#ak(+%aA@Y+Kz2!2ByYB", "l": 722510, "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 722526, "z": 16 }, { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 722582, "z": 11 }, { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 722638, "z": 14 }, { "c": 1, "d": "PE ProductVersion resembles IPv4", "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "o": 722668, "z": 8 } ], "x": true }, { "b": "Bs?0vz8#9Dz7Y#/b0DCyarR^HarR^HjAt1MB.bSowN[kOwN/\u003e8x(v(.wP?T3az+RjwO:HNvrk1TC5IecAV#SGx*DlswPI]Qb4+n1B7DKGj}d\u0026warR^HauRq$wPq\u003c7B97#7p\u0026Zn[x-", "l": 723075, "n": [ { "c": 2, "d": "asInvoker manifest tag in resources", "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "o": 723091, "z": 61 } ], "x": true }, { "b": "000000000000000000000pQr}3\u0026*nc06ZC-000000000000000000000000000000000", "l": 723440, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 723456, "z": 6 } ], "x": true } ], "idn": { "name": { "value": "CKC.exe", "source": "pe.version.original_filename", "verified": false }, "trust": "unsigned", "project": { "value": "PuTTY suite", "source": "pe.version.product_name", "verified": false }, "version": { "value": "0.74.0.0", "source": "pe.version.file_version", "verified": false }, "organization": { "value": "Simon Tatham", "source": "pe.version.company", "verified": false } }, "mol": "H₂(Cm₂Db)Md(Bk)", "sha": "1f68682f037b5964da035112cfcaac453d8a51ce7912128937e10f843de8dbac", "fact": { "id": "pe", "imp": [ [ "mscoree", "CorExeMain" ] ], "met": { "pe": { "checksum": 0.0, "icon_count": 2.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 4.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 727171.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.17, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.02 }, "file": { "size": 723968.0, "entropy": 4.04, "size_bytes": 723968.0 }, "binary": { "is_pie": 1.0, "code_entropy": 3.92, "string_count": 577.0, "overall_entropy": 4.04, "entropy_variance": 8.23, "avg_string_length": 1209.21, "max_string_length": 688128.0, "code_to_data_ratio": 1.0, "string_length_stddev": 28621.62, "largest_section_ratio": 0.98, "sentence_string_count": 12.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 712704.0, "entropy_max": 7.1, "entropy_mean": 3.7, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 512, 712704, 3.92, "r-x" ], [ ".rsrc", 713216, 10240, 7.1, "r--" ], [ ".reloc", 723456, 512, 0.08, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 7776, "u8", "BSJB" ], [ 14533, "u8", "CompilationRelaxationsAttribute" ], [ 14565, "u8", "System.Runtime.CompilerServices" ], [ 14597, "u8", "mscorlib" ], [ 14606, "u8", ".ctor" ], [ 14612, "u8", "Void" ], [ 14617, "u8", "System" ], [ 14624, "u8", "Int32" ], [ 14630, "u8", "AssemblyFileVersionAttribute" ], [ 14659, "u8", "System.Reflection" ], [ 14677, "u8", "String" ], [ 14684, "u8", "Boolean" ], [ 14692, "u8", "RuntimeCompatibilityAttribute" ], [ 14722, "u8", "TargetFrameworkAttribute" ], [ 14747, "u8", "System.Runtime.Versioning" ], [ 14773, "u8", "AssemblyTitleAttribute" ], [ 14796, "u8", "AssemblyDescriptionAttribute" ], [ 14825, "u8", "AssemblyConfigurationAttribute" ], [ 14856, "u8", "AssemblyCompanyAttribute" ], [ 14881, "u8", "AssemblyProductAttribute" ], [ 14906, "u8", "AssemblyCopyrightAttribute" ], [ 14933, "u8", "AssemblyTrademarkAttribute" ], [ 14960, "u8", "ComVisibleAttribute" ], [ 14980, "u8", "System.Runtime.InteropServices" ], [ 15011, "u8", "GuidAttribute" ], [ 15025, "u8", "CKC.exe" ], [ 15033, "u8", "\u003cModule\u003e" ], [ 15042, "u8", "wr7nAyO3QihvlUTq4D" ], [ 15061, "u8", "hdbStZ0wtINl5pCr6D" ], [ 15080, "u8", "Object" ], [ 15087, "u8", "f1R39lsd3poAPCe5dJ" ], [ 15106, "u8", "UulpnRH5pt6b7ySFOJ" ], [ 15125, "u8", "Y5Mo136spiEFY3nGdy" ], [ 15144, "u8", "pd1QRfgX4t3iprWwum" ], [ 15163, "u8", "QlOWIeJAWjYSZ7qyRR" ], [ 15182, "u8", "hOuDdMEBE4da0ELkbT" ], [ 15201, "u8", "ncMiLW85QT385Dl4W3" ], [ 15220, "u8", "VDbeIykGEnntbVETfx" ], [ 15239, "u8", "skWV5lrbUIuBInfRQF" ], [ 15258, "u8", "sVykBDlXYi10BPuRiX" ], [ 15277, "u8", "pqnoikNuwvnFmo98f4" ], [ 15296, "u8", "FToXurhe2Lsf2o9W7s" ], [ 15315, "u8", "GhrSUxnjEA7Vilu0lM" ], [ 15334, "u8", "oREnSgc9eMGhuZJg0S" ], [ 15353, "u8", "Cs8geQKX6vCGstECgD" ], [ 15372, "u8", "fUhwy0R1bg4mtXAF39" ], [ 15391, "u8", "psMQ2qpjKdPLKrPVCR" ], [ 15410, "u8", "AJPBX8dgWYvJ8vuEne" ], [ 15429, "u8", "woGl2b7OxGq976ZyGu" ], [ 15448, "u8", "Hr4N9ZtqRuq19TfrS1" ], [ 15467, "u8", "ly5vFhvssXfJVrdf32" ], [ 15486, "u8", "cJdTR7mB96Y9YdvChB" ], [ 15505, "u8", "SSfc3mDMRnjQiDyZLv" ], [ 15524, "u8", "zhfyLN5XLQv9MRL4uU" ], [ 15543, "u8", "KW4ThwGG7a6ANda684" ], [ 15562, "u8", "SknaZ1Y7ZFuCkk576C" ], [ 15581, "u8", "APw8DtbDdTI7VUMppm" ], [ 15600, "u8", "WkL2iIA2IunKxJlTmb" ], [ 15619, "u8", "O4hGha1kApEpIyBPkJ" ], [ 15638, "u8", "p7fnOrxMBL18hx1Jcp" ], [ 15657, "u8", "Xyblh04o4lMNLNGI3a" ], [ 15676, "u8", "bfKKJ2j0HCAoEV9JrQ" ], [ 15695, "u8", "NcQVwAUktWI98domSV" ], [ 15714, "u8", "bGpv6SwrsI0jamjoxK" ], [ 15733, "u8", "rDKH9guEOQg8EU1963" ], [ 15752, "u8", "Hy5oV0QW7y6QXutJct" ], [ 15771, "u8", "b99SRvMZ0wWCymr3mb" ], [ 15790, "u8", "E8gffP93gd1dWZxy9g" ], [ 15809, "u8", "aJWiNkWa6EFaAQOKMn" ], [ 15828, "u8", "L8q8kPqUMTyYqu0QR7" ], [ 15847, "u8", "xJ9SPb3Nlvn66IUbkl" ], [ 15866, "u8", "H25akBSGQ0L3uTEx8b" ], [ 15885, "u8", "PbLg2cPJhI3UxgHx5X" ], [ 15904, "u8", "HOITmZoncJwaJmZfHJ" ], [ 15923, "u8", "XHXqDqXN0gEP2NJts5" ], [ 15942, "u8", "UtFvsbeO2tsTMUERJF" ], [ 15961, "u8", "FrMBXFTQt8DMT7rKOv" ], [ 15980, "u8", "dPI1XsBTHvAwYSK4Iv" ], [ 15999, "u8", "uLHDSU2IsDtQY1hsGL" ], [ 16018, "u8", "Nmh13LiCqnauM5x9C4" ], [ 16037, "u8", "vNAHYQFIBaHn2INuEs" ], [ 16056, "u8", "NDdcqHZc5nsLvGcA1A" ], [ 16075, "u8", "xlVSVdfoIrj9xY9RxI" ], [ 16094, "u8", "hXaJ9VL0h3wEFfohqY" ], [ 16113, "u8", "B77UZlVeRPSKGIWZ30" ], [ 16132, "u8", "BON0pSCpbPGDg0hwiq" ], [ 16151, "u8", "FyuOK1ymlXDDNmewcV" ], [ 16170, "u8", "mlBMjca5wsiODpuLhj" ], [ 16189, "u8", "DAOLIEzyyBaQCJXh31" ], [ 16208, "u8", "CD6xdgOICq4tkNjlcyy" ], [ 16228, "u8", "smUJhcOOWbxMktiLJ6D" ], [ 16248, "u8", "ljrRUYO08r7D2AJAtoh" ], [ 16268, "u8", "fvO0gJOs6pYbDKvQUsf" ], [ 16288, "u8", "NRfsrIOHfeDDYWuCFaH" ], [ 16308, "u8", "HXXAXHO654WlNHh5hfF" ], [ 16328, "u8", "rDtYT1OgNl0G6lHWS5V" ], [ 16348, "u8", "MX0dFyOJe3HvWS7S8MA" ], [ 16368, "u8", "JUamXTOE4WcZPGDkDhK" ], [ 16388, "u8", "OwJhnxO8cBM6HfBEapJ" ], [ 16408, "u8", "FIgHQ5OkPfZC0LW52uu" ], [ 16428, "u8", "amYrBbOrrNsal69Dcd1" ], [ 16448, "u8", "mSsRoaOl38s0Yyt0ZOG" ], [ 16468, "u8", "W824ipONZmtJN5PcqGQ" ], [ 16488, "u8", "jWusQBOhbmMb6Z3Pa7P" ], [ 16508, "u8", "cXKx7pOnfhRCOtIeuxs" ], [ 16528, "u8", "QvUBpeOcva51BdSkqVR" ], [ 16548, "u8", "wjpAHqOKfhKdPUH4aJB" ], [ 16568, "u8", "P6XMCtORttvBOJ9SQ0P" ], [ 16588, "u8", "yVxGomOpSp9I52mcPwj" ], [ 16608, "u8", "Y34PvxOdkyGqHJ7uwjH" ], [ 16628, "u8", "rOFusaO76VCwP0pK7cw" ], [ 16648, "u8", "mTkI7jOtBGN8aRT5gNo" ], [ 16668, "u8", "Hy2yydOvxDsv1aR4rSl" ], [ 16688, "u8", "FAStjjOmBs73eNLCPHd" ], [ 16708, "u8", "XMljX9ODD1vgw3ldtrv" ], [ 16728, "u8", "oJuQ9kO5PEC1HOsg4PN" ], [ 16748, "u8", "ijlS4POGKMPJRUEymy2" ], [ 16768, "u8", "XSfsmfOYFFgZvRsR5mU" ], [ 16788, "u8", "ECfc30ObsmSr43JqI8m" ], [ 16808, "u8", "Jm8wdFOA4C1LLDOsC2A" ], [ 16828, "u8", "cDJTSqO1eU5By6YrAtn" ], [ 16848, "u8", "FXCjwBOx3L6Mq3w6nCw" ], [ 16868, "u8", "LAOR5FO4YIbqi9gYiKX" ], [ 16888, "u8", "IFSR1tOjtPkxG3AbKiW" ], [ 16908, "u8", "gmugl2OU5tcDv6F3S2l" ], [ 16928, "u8", "OB4nSqOwUR7wEvkrcyo" ], [ 16948, "u8", "Ht0EEYOum3x808RvYG4" ], [ 16968, "u8", "mEYZw8OQH3om77YwZS7" ], [ 16988, "u8", "wLTxpKOMUIrkQbB6lNC" ], [ 17008, "u8", "UVS0NZO9bcgdDb54FQl" ], [ 17028, "u8", "UqjFcDOW8MfVVGnqrqY" ], [ 17048, "u8", "sG0S6XOqUoBX0srZYfE" ], [ 17068, "u8", "O4nQqwO3n1NcWcI8Pvk" ], [ 17088, "u8", "TjTwfuOS6Fj5c51bQmw" ], [ 17108, "u8", "QxXxUBOPGQoZvlD7jpH" ], [ 17128, "u8", "qHIa3nOoCjOjAMploEm" ], [ 17148, "u8", "r6rmc0OXrIrbb0oMFgJ" ], [ 17168, "u8", "dLr9iEOeOiUA24KXO0j" ], [ 17188, "u8", "bC4YLnOTDgW7Vn9PqY4" ], [ 17208, "u8", "SuNbppOBIUVjbXBXeiV" ], [ 17228, "u8", "Su3Ba2O28y5ibNDUlZa" ], [ 17248, "u8", "hsR1m9OiCepGUQ2JnCv" ], [ 17268, "u8", "ubGvOuOFwnbru6aK9tj" ], [ 17288, "u8", "mIGIRQOZa9xlWxguWlj" ], [ 17308, "u8", "HRR0POOf0PW8iEtsCSZ" ], [ 17328, "u8", "XMbMymOLK2NufpdmxZ0" ], [ 17348, "u8", "cRxOfgOVrWTl1J3n6o4" ], [ 17368, "u8", "wdaphQOCmXOIDFliIdZ" ], [ 17388, "u8", "F1m6dBOyiCgqyl2cE3o" ], [ 17408, "u8", "Mef5dwOaJGRXCTApItP" ], [ 17428, "u8", "Nd5oa4Ozy3ehyRTCx3u" ], [ 17448, "u8", "N32dFi0IWqgJoInti6A" ], [ 17468, "u8", "r7MYgp0OAFrU8DiLkod" ], [ 17488, "u8", "vAWu6g008PFdGGIZ8A8" ], [ 17508, "u8", "Q3Ndqo0sxODK6VwrPd2" ], [ 17528, "u8", "mAWFwn0H0Eyw6VYEBN7" ], [ 17548, "u8", "YoogYF06HFfyASO8tkQ" ], [ 17568, "u8", "zjfZvD0gchmfOuaoEyS" ], [ 17588, "u8", "zKnBSS0JWMwTrVW1in7" ], [ 17608, "u8", "W3P3XV0Eb31DqtuYWt5" ], [ 17628, "u8", "OvrvA508r6QnZP2N4FM" ], [ 17648, "u8", "rcV5uX0kbdFCWL0rvIt" ], [ 17668, "u8", "RjJbQM0roUuqcUkkNDn" ], [ 17688, "u8", "g1TNhY0luhrTlo6vxAj" ], [ 17708, "u8", "PQrYXM0NXXK3cwcGjvt" ], [ 17728, "u8", "SRuWjp0hQyynSNXFrfv" ], [ 17748, "u8", "Ht4xox0n3pOTV50COLm" ], [ 17768, "u8", "Sxq53j0cxlaKdpAOpS3" ], [ 17788, "u8", "EFBY220KXl58ZtjkFXv" ], [ 17808, "u8", "yeVB6j0RGpURAAMZA47" ], [ 17828, "u8", "rtxpDd0pgMYBbHFNa3p" ], [ 17848, "u8", "tGIpvJ0dV5x8knUdu2Q" ], [ 17868, "u8", "G5kbQ707ZT8K4kh78Ho" ], [ 17888, "u8", "rLDxSW0tvfsrAveI8ak" ], [ 17908, "u8", "NNrbES0vhytyK7IDyhR" ], [ 17928, "u8", "yB2Kho0mxOconAuIiy5" ], [ 17948, "u8", "Sqr5lP0DQ6VmWIsooNe" ], [ 17968, "u8", "rXKFoA05Hl1n49gEOC4" ], [ 17988, "u8", "qNrjBH0GnrHcueFYO6Q" ], [ 18008, "u8", "ocxvUN0YoPHMb4fMDLX" ], [ 18028, "u8", "SZMPiX0bhtkAGjhNPKQ" ], [ 18048, "u8", "hiqZ950Acyjbqq8cii4" ], [ 18068, "u8", "Afr2aU018CpEXtY8lu6" ], [ 18088, "u8", "hcAYiW0xPYYrVgsA5L8" ], [ 18108, "u8", "dE6liu042tZ0UOMifUF" ], [ 18128, "u8", "kPXgCt0jm3BXXDEajgK" ], [ 18148, "u8", "iGYcXl0U3Cmp7bMSwJf" ], [ 18168, "u8", "eDpooF0wCM5Peg6oqJw" ], [ 18188, "u8", "QZ3aU30uiMMMcvY4Yuc" ], [ 18208, "u8", "CdTa5D0Qklh605u8mvj" ], [ 18228, "u8", "AVR3110MnMj7WGaoD1v" ], [ 18248, "u8", "Xu62e109AT72ZYRj7Ex" ], [ 18268, "u8", "sjDCv30WmY3d6CSwIJM" ], [ 18288, "u8", "o2KJVH0qajEsDpgy4Df" ], [ 18308, "u8", "yA9vjg03oYhg1ecPEAR" ], [ 18328, "u8", "naHWTI0S1MbZL9NMqiT" ], [ 18348, "u8", "aiBla20Pl50lZyAT0xd" ], [ 18368, "u8", "MII5tO0o9flf1cqm25E" ], [ 18388, "u8", "I7kNaf0XnVqDEYTyqPC" ], [ 18408, "u8", "r1jc3N0eE04vVhQVtRN" ], [ 18428, "u8", "PYSVKZ0T9tFGpXXe2cM" ], [ 18448, "u8", "lEhjJC0Bt5F9f39KuWj" ], [ 18468, "u8", "rSerHm024Xt96dGhwvc" ], [ 18488, "u8", "gOMPLk0ieEwtfFcDPAU" ], [ 18508, "u8", "eA413d0FeAIuhpWMhaR" ], [ 18528, "u8", "hUZqoH0ZsqyJBemHZGJ" ], [ 18548, "u8", "M4Dk8x0fmN1p2UX5b1n" ], [ 18568, "u8", "Ltsg0l0LDfvPWYM38eU" ], [ 18588, "u8", "Qh2NF80VeqOP60L4CqK" ], [ 18608, "u8", "BDiu1p0Cuhs0px0rbrf" ], [ 18628, "u8", "M0ljnY0ybo0It6OeL41" ], [ 18648, "u8", "UsBhFm0aOxCeogZZH5L" ], [ 18668, "u8", "o0e5mL0zvP3ByCiyB8U" ], [ 18688, "u8", "KGH0y5sIRt4wW7Z7SrY" ], [ 18708, "u8", "ljvLpnsOxnN5lE15h6l" ], [ 18728, "u8", "BZ4lOQs00bWGIscXB4g" ], [ 18748, "u8", "pqN7K1ssLKyikiBVQtK" ], [ 18768, "u8", "FLjo4vsHmTf9MhsyTtS" ], [ 18788, "u8", "riD7sss6hJ7JIE9Kh11" ], [ 18808, "u8", "nMdWkosg0wY15nWeruv" ], [ 18828, "u8", "tV5ZfDsJndAKmOfWSEe" ], [ 18848, "u8", "ufH09isETCOdFabSXrk" ], [ 18868, "u8", "Um4AgFs8PuwOpiII7Z5" ], [ 18888, "u8", "D1qOiUsk56ctWfiMoLZ" ], [ 18908, "u8", "jNQHDlsrppASw5MqdT2" ], [ 18928, "u8", "XevyJPslGXYkdGrXIZT" ], [ 18948, "u8", "o1r35ysNshS9fM1CiBh" ], [ 18968, "u8", "hbbDc9shQATINEv3qdN" ], [ 18988, "u8", "DIQDGEsnjvudF1BZiJp" ], [ 19008, "u8", "fSVXbPscZFbUmjpnK7f" ], [ 19028, "u8", "JrRFvwsK3ess2u8JPax" ], [ 19048, "u8", "ey5ZyasR8TDB3083Brp" ], [ 19068, "u8", "eSuoa7splZ8ebgibsbx" ], [ 19088, "u8", "tiygHOsdDD46grLpUVN" ], [ 19108, "u8", "v9jvITs7BwfLDq6HZjI" ], [ 19128, "u8", "zMJjOfstaDsVy7mkSAt" ], [ 19148, "u8", "MHpeWTsvGbULrs3paxJ" ], [ 19168, "u8", "L6BNx7smu3ZwZncc7aM" ], [ 19188, "u8", "x5wnLesDt7g1afT1F39" ], [ 19208, "u8", "TIEOSxs5UAK8hUjW0y9" ], [ 19228, "u8", "osEPr0sG18aTvj3QU3F" ], [ 19248, "u8", "QFIN0hsY1XCDiG75VFl" ], [ 19268, "u8", "xw8Z95sbQDb0IY3FwG6" ], [ 19288, "u8", "FSn2IksArLxxOHo7oOr" ], [ 19308, "u8", "QAhofDs1TDINl98jbw5" ], [ 19328, "u8", "FZYCwGsxMhylfV8Zaea" ], [ 19348, "u8", "uDaoW8s4ti22B2a2aSv" ], [ 19368, "u8", "HhDWu4sjcElP6eqwIJ6" ], [ 19388, "u8", "A0wfBPsULjZGjFVns2K" ], [ 19408, "u8", "bcSdffswLHvTbVm9CiL" ], [ 19428, "u8", "EB6OBUsuIf2j2WLte1r" ], [ 19448, "u8", "b2ePrZsQ5HrcIfLo0XV" ], [ 19468, "u8", "jnIGUEsMGv0tm40gNqY" ] ], "val": { "file.stem": "1f68682f037b5964da035112cfcaac453d8a51ce7912128937e10f843de8dbac", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1604397476, "file.basename": "1f68682f037b5964da035112cfcaac453d8a51ce7912128937e10f843de8dbac.exe", "pe.image_base": 4194304, "pe.image_size": 745472, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 720638, "pe.headers_size": 512, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "4c98012c0ae3b1c79f2eb66502381397cb53cecd", "pe.version.company": "Simon Tatham", "pe.version.comments": "SSH, Telnet and Rlogin client", "pe.image_hash.sha256": "26e18ff1d6746aee2db6579dd4c99da351c24c30efbfa75a5c3e381796044a43", "pe.image_hash.sha384": "a3000c6ad63f4f47a36bef0ab7f8bb763ff627cf070d1fd412c0ec42a9661e9769337ef8b9a5156bcaca17339b29f2c0", "pe.image_hash.sha512": "ccc9ed889eb25773177e1655132ef1244c4073ce8a9c674968fd50d5358470542f6fdcdd91b148e96936e235c04bf5665cc09dfadd034813ab6cb03ee74ea35c", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.resource_types[3]": "RT_MANIFEST", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright © 1997-2020 Simon Tatham.", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 270, "pe.clr.runtime_version": "2.5", "pe.version.description": "SSH, Telnet and Rlogin client", "pe.linker_major_version": 11, "pe.version.file_version": "0.74.0.0", "pe.version.product_name": "PuTTY suite", "pe.version.internal_name": "CKC.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.version.company_offset": 722184, "pe.data_directories[0].rva": 720560, "pe.data_directories[1].rva": 720896, "pe.data_directories[2].rva": 737280, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.version.comments_offset": 722092, "pe.version.product_version": "0.74.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 10024, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.version.copyright_offset": 722448, "pe.version.original_filename": "CKC.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.version.description_offset": 722252, "pe.version.file_version_offset": 722344, "pe.version.product_name_offset": 722608, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.version.internal_name_offset": 722396, "pe.base_relocations.padding_count": 1, "pe.version.product_version_offset": 722668, "pe.manifest.assembly_identity.name": "MyApplication.app", "pe.version.original_filename_offset": 722560, "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "asInvoker" } }, "find": [ { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "metadata/package/tooling::tool-identity-putty", "conf": 0.8999999761581421, "crit": 1, "desc": "Tool identity claims PuTTY" }, { "id": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "conf": 0.8999999761581421, "crit": 1, "desc": "PE has under ten imports" }, { "id": "objectives/anti-static/pack/runtime::dotnet-interop-services-string", "atk": "T1027.002", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 1, "desc": "Embedded System.Runtime.InteropServices name" }, { "id": "metadata/binary/resource::pe-resource-icon-list", "conf": 1.0, "crit": 2, "desc": "PE has RT_ICON in resources list" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/resource::asinvoker-resource-manifest-flex", "conf": 0.8600000143051147, "crit": 2, "desc": "asInvoker manifest tag in resources" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE InternalName metadata field" }, { "id": "metadata/lang/compiler/managed::runtime-interop", "conf": 0.75, "crit": 2, "desc": "Runtime interop services" }, { "id": "objectives/anti-static/pack/section-anomaly::reloc-overhang-ratio-high", "atk": "T1027", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "Reloc section mostly non-relocation bytes" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-4", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/communications/http/server/managed::name-value-collection", "conf": 1.0, "crit": 3, "desc": "Usage of NameValueCollection (headers/params)" }, { "id": "objectives/supply-chain/trojanized/app/monitor::putty-identity-string", "conf": 0.8500000238418579, "crit": 1, "desc": "PuTTY identity string" }, { "id": "micro-behaviors/communications/http/server/managed::http-headers-getter", "conf": 1.0, "crit": 1, "desc": "Access to Headers getter" }, { "id": "metadata/binary/symbols/imports::pe-imports-max-six", "conf": 0.699999988079071, "crit": 1, "desc": "PE with six or fewer imports" }, { "id": "metadata/package/versioning::pe-productname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductName metadata field" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "conf": 0.6499999761581421, "crit": 1, "desc": "AppDomain class token" }, { "id": "metadata/lang/compiler/managed::framework-reference", "conf": 0.8500000238418579, "crit": 2, "desc": ".NET Framework reference" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference" }, { "id": "metadata/file/extension::exe", "conf": 1.0, "crit": 2, "desc": "Windows executable extension" }, { "id": "metadata/binary/framework::exe-extension", "conf": 0.8999999761581421, "crit": 1, "desc": "PE file uses .exe extension" }, { "id": "metadata/binary/resource::pe-resource-group-icon-list", "conf": 1.0, "crit": 2, "desc": "PE has RT_GROUP_ICON in resources list" }, { "id": "micro-behaviors/process/create/spawn::start-method-token-dotnet", "conf": 0.550000011920929, "crit": 1, "desc": ".NET Start method token" }, { "id": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "atk": "T1071.001", "mbc": "B0030", "conf": 0.8600000143051147, "crit": 1, "desc": "UUID formatted route segment" }, { "id": "metadata/hardening/mitigation::pe-aslr", "conf": 1.0, "crit": 2, "desc": "ASLR enabled (DYNAMIC_BASE)" }, { "id": "metadata/binary/layout::legacy-few-sections", "conf": 0.699999988079071, "crit": 2, "desc": "PE has few sections" }, { "id": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "conf": 0.8999999761581421, "crit": 1, "desc": "Binary has low overall entropy" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token", "conf": 0.8199999928474426, "crit": 1, "desc": "Type.InvokeMember reflection token" }, { "id": "metadata/binary/resource::png-resource-marker", "conf": 0.8399999737739563, "crit": 2, "desc": "PNG image data in PE resources" }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items" }, { "id": "metadata/binary/section/names::pe-runtime-standard-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE standard runtime section" }, { "id": "metadata/binary/framework::is-binary", "conf": 1.0, "crit": 1, "desc": "File is a compiled binary" }, { "id": "metadata/hardening/mitigation::pe-no-seh", "conf": 1.0, "crit": 2, "desc": "NO_SEH (SafeSEH not used)" }, { "id": "metadata/package/files::exe-extension-basename", "conf": 0.949999988079071, "crit": 1, "desc": "Filename ends with .exe" }, { "id": "metadata/build/manifest::pe-manifest-myapplication-template", "conf": 0.8999999761581421, "crit": 3, "desc": "Manifest is MyApplication template name" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "conf": 0.6200000047683716, "crit": 1, "desc": "Assembly Load method token" }, { "id": "objectives/evasion/masquerade/identity/fabricated::identity-nondegenerate-entropy", "atk": "T1036.005", "conf": 0.6000000238418579, "crit": 1, "desc": "identity nondegenerate entropy" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)" }, { "id": "metadata/package/license::copyright-word", "conf": 0.6000000238418579, "crit": 2, "desc": "Copyright notice" }, { "id": "metadata/binary/section/names::pe-code-data-standard-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE standard code/data section" }, { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "conf": 0.6000000238418579, "crit": 1, "desc": "AppDomain.CurrentDomain accessor" }, { "id": "metadata/lang/compiler/managed::mscorlib", "conf": 0.8999999761581421, "crit": 2, "desc": "mscorlib reference" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "metadata/package/versioning::pe-product-name-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE ProductName field is populated" }, { "id": "metadata/lang/compiler/managed::system-namespace", "conf": 0.800000011920929, "crit": 2, "desc": "System namespace reference" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "micro-behaviors/communications/http/client/managed::downloaddata", "conf": 0.800000011920929, "crit": 3, "desc": "WebClient.DownloadData method" }, { "id": "metadata/package/versioning::pe-file-description-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE FileDescription field is populated" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "conf": 0.699999988079071, "crit": 1, "desc": "Reflection method namespace token" }, { "id": "micro-behaviors/communications/http/headers::ua-mozilla-old", "atk": "T1071.001", "mbc": "C0002", "crit": 2, "desc": "Old Mozilla 4.0 User-Agent" }, { "id": "metadata/binary/section/names::reloc-section-presence", "conf": 0.8999999761581421, "crit": 2, "desc": "PE .reloc section presence" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.699999988079071, "crit": 1, "desc": "PE import table has exactly one entry" }, { "id": "metadata/package/versioning::pe-originalfilename-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE OriginalFilename metadata field" }, { "id": "metadata/binary/layout::low-overall-entropy", "conf": 0.699999988079071, "crit": 2, "desc": "PE has low overall entropy" }, { "id": "metadata/hardening/mitigation::pe-dep", "conf": 1.0, "crit": 2, "desc": "DEP / NX enabled (NX_COMPAT)" }, { "id": "objectives/anti-static/obfuscation/tools/managed::reactor-private-implementation-details-guid", "atk": "T1027", "conf": 0.8999999761581421, "crit": 1, "desc": "Reactor PrivateImplementationDetails GUID" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE CompanyName metadata field" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "atk": "T1027", "mbc": "B0032", "conf": 0.9900000095367432, "crit": 1, "desc": "PE version resource text" }, { "id": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "atk": "T1620", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "mscoree DLL string reference" }, { "id": "metadata/package/versioning::pe-legal-copyright-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE LegalCopyright field is populated" }, { "id": "metadata/build/manifest::pe-has-manifest", "conf": 1.0, "crit": 2, "desc": "PE carries side-by-side assembly manifest" }, { "id": "metadata/package/versioning::pe-file-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE FileVersion resembles IPv4" }, { "id": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "atk": "T1027", "mbc": "B0032", "conf": 0.8399999737739563, "crit": 1, "desc": "VB6 PE with three sections" }, { "id": "metadata/binary/layout::many-readable-strings", "conf": 0.699999988079071, "crit": 2, "desc": "PE has many readable strings" }, { "id": "metadata/binary/anomaly/format::version-info-file-version-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE version info numeric fields present" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileDescription metadata field" }, { "id": "metadata/binary/section/names::pe-resource-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE resource section" }, { "id": "metadata/binary/metrics/threshold::large-binary-500k", "conf": 1.0, "crit": 1, "desc": "Binary is 500KB+" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" }, { "id": "micro-behaviors/data/encode/payload::large-hex-payload", "atk": "T1140", "mbc": "C0043", "conf": 0.800000011920929, "crit": 3, "desc": "Large hexadecimal encoded blob" }, { "id": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "atk": "T1485", "mbc": "C0047", "conf": 0.8999999761581421, "crit": 1, "desc": "Preserves .exe .gho .bak files" }, { "id": "metadata/build/manifest::pe-as-invoker", "conf": 1.0, "crit": 2, "desc": "requestedExecutionLevel is asInvoker" }, { "id": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "atk": "T1562.001", "mbc": "B0047", "conf": 0.949999988079071, "crit": 1, "desc": "MOTW stream value component" }, { "id": "micro-behaviors/data/text/path::windows-path-like-string", "conf": 1.0, "crit": 2, "desc": "Windows path-like string pattern" }, { "id": "metadata/binary/framework::bsjb-marker", "conf": 1.0, "crit": 1, "desc": ".NET BSJB metadata marker" }, { "id": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "atk": "T1027", "mbc": "B0032", "conf": 0.699999988079071, "crit": 1, "desc": "Code section dominates file layout" }, { "id": "objectives/command-and-control/infrastructure/config::max-sections-4", "conf": 1.0, "crit": 1, "desc": "Binary has 4 or fewer sections" }, { "id": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "conf": 0.949999988079071, "crit": 1, "desc": "Filename has EXE extension" }, { "id": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "atk": "T1612", "mbc": "B0023", "conf": 0.8500000238418579, "crit": 1, "desc": "PE has few icon resources" }, { "id": "objectives/impact/services/stop::versioned-service-stop-context", "atk": "T1489", "conf": 0.699999988079071, "crit": 1, "desc": "Versioned service stop context" }, { "id": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric", "atk": "T1485", "conf": 0.8999999761581421, "crit": 1, "desc": "Giant embedded string blob metric" }, { "id": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "atk": "T1027", "conf": 0.800000011920929, "crit": 1, "desc": "Few PE resource entries" }, { "id": "metadata/package/metrics::import-count-under-80", "conf": 0.8399999737739563, "crit": 2, "desc": "Large binary with few DLL dependencies" }, { "id": "micro-behaviors/process/sync/mutex::guid-mutex", "mbc": "C0042", "conf": 0.800000011920929, "crit": 1, "desc": "GUID-formatted token" }, { "id": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "atk": "T1105", "mbc": "E1105", "conf": 0.800000011920929, "crit": 1, "desc": "Compact PE import table" }, { "id": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "atk": "T1055", "mbc": "C0041", "conf": 0.9200000166893005, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/fs/path/extension::exe-dup", "crit": 1, "desc": ".exe extension reference" }, { "id": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "conf": 0.8999999761581421, "crit": 1, "desc": "SOCKS5 client greeting bytes" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 1, "desc": "Sparse import table" }, { "id": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "atk": "T1027", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/anti-static/obfuscation/payload/loader::native-clr-benign-context", "atk": "T1620", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Benign CLR host context" }, { "id": "metadata/binary/metrics/pe-details::dotnet-normal-entropy-profile", "conf": 0.699999988079071, "crit": 1, "desc": ".NET assembly with normal (unpacked) code entropy" }, { "id": "metadata/package/versioning::version-resource-metadata", "conf": 0.8999999761581421, "crit": 2, "desc": "PE version resource metadata" }, { "id": "micro-behaviors/communications/http/client/managed::webclient", "conf": 1.0, "crit": 2, "desc": "System.Net.WebClient class usage" }, { "id": "metadata/package/versioning::version-number-ipv4-metadata", "conf": 0.949999988079071, "crit": 1, "desc": "PE version numbers look like IPv4" }, { "id": "metadata/package/quality::versioned", "conf": 0.8500000238418579, "crit": 2, "desc": "Contains version information" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)" }, { "id": "metadata/binary/resource::png-and-manifest-rsrc", "conf": 0.8600000143051147, "crit": 2, "desc": "PNG and manifest in resources" }, { "id": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "atk": "T1036.005", "conf": 0.9399999976158142, "crit": 1, "desc": "Two dotted-quad version strings" }, { "id": "micro-behaviors/communications/http/client/managed::request", "conf": 0.8600000143051147, "crit": 3, "desc": ".NET HTTP request client" }, { "id": "metadata/package/versioning::dotnet-versioned-assembly", "conf": 0.699999988079071, "crit": 2, "desc": "Versioned .NET assembly structure" }, { "id": "objectives/command-and-control/beacon/mutex::mutex-guid-crypto-http-coordination", "atk": "B0030", "conf": 0.9300000071525574, "crit": 1, "desc": "GUID mutex with crypto and network" }, { "id": "micro-behaviors/data/text/path::exe-extension-string", "conf": 1.0, "crit": 2, "desc": "Contains Windows executable file path" }, { "id": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "atk": "T1036.005", "conf": 0.8199999928474426, "crit": 1, "desc": "Low-import PE without dominant resources" } ], "path": "1f68682f037b5964da035112cfcaac453d8a51ce7912128937e10f843de8dbac.exe", "risk": 6, "size": 723968, "type": "pe" } ] } }