{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999681711196899, "class": 2 } ], "prob": 0.9999682, "class": 2, "models": [ { "m": "az", "prob": 0.9996921, "class": 2 }, { "m": "az/native", "prob": 0.99984396, "class": 0 }, { "m": "az/pe", "prob": 0.9999682, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T23:44:33Z" }, "path": "virussign.com_7dae0846d142496727dc8e5be666e830.vir", "raw": { "v": "4", "fs": [ { "f": "KO₄(As₆C₅ErS)H₄(Cm₂DsFDb)Md₄(Bi₈BkSiPt)", "k": { "hash.imp": "d0c4602a48867105e712860c451917c3", "pe.checksum": "0x0007d6dd", "pe.timestamp": 1547904896, "hash.authenti": "44007b816b62f6fe1f30ede2e2179da1401c8af2002bffb49166e7aa6e563b23", "hash.rich_header": "f8daa21c6294920b959e9cdde44c2ef2686cedbe20eb7bb63776fd4a693266cf", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.resources.timestamp": 1547904896, "pe.rich_header.xor_key": "0x8897fe31", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 176292, "pe.data_directories[1].rva": 184320, "pe.data_directories[2].rva": 552, "pe.data_directories[3].rva": 4096, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 293368, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 272, "pe.version_info.company_name": "UEFI", "pe.version_info.file_version": "1.00", "pe.version_info.product_name": "Kawaii-Unicorn", "pe.version_info.internal_name": "Kawaii-Unicorn", "pe.rich_header_compids[0].count": 1, "pe.rich_header_compids[1].count": 1, "pe.rich_header_compids[2].count": 1, "pe.version_info.product_version": "1.00", "binary.top_complex_unnamed[0].cc": 17, "binary.top_complex_unnamed[1].cc": 10, "binary.top_complex_unnamed[2].cc": 10, "binary.top_complex_unnamed[3].cc": 5, "pe.rich_header_compids[0].compid": 924803, "pe.rich_header_compids[1].compid": 598607, "pe.rich_header_compids[2].compid": 861750, "binary.top_complex_unnamed[0].bbs": 39, "binary.top_complex_unnamed[1].bbs": 24, "binary.top_complex_unnamed[2].bbs": 30, "binary.top_complex_unnamed[3].bbs": 13, "pe.version_info.original_filename": "Kawaii-Unicorn.exe", "binary.top_complex_unnamed[0].addr": "0x42a0d0", "binary.top_complex_unnamed[0].size": 169244, "binary.top_complex_unnamed[1].addr": "0x42a770", "binary.top_complex_unnamed[1].size": 1219, "binary.top_complex_unnamed[2].addr": "0x42ac40", "binary.top_complex_unnamed[2].size": 1086, "binary.top_complex_unnamed[3].addr": "0x429eb0", "binary.top_complex_unnamed[3].size": 544, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".data", "pe.section_characteristics[2].name": ".rsrc", "pe.bound_imports[0].time_date_stamp": 1247533676, "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 1, "pe.rich_header.entries[2].use_count": 1, "pe.rich_header.entries[0].product_id": 14, "pe.rich_header.entries[1].product_id": 9, "pe.rich_header.entries[2].product_id": 13, "pe.rich_header.entries[0].build_number": 7299, "pe.rich_header.entries[0].product_name": "Export_VC2003", "pe.rich_header.entries[1].build_number": 8783, "pe.rich_header.entries[1].product_name": "Cvt_Omf_VS_v6_or_earlier", "pe.rich_header.entries[2].build_number": 9782, "pe.rich_header.entries[2].product_name": "Linker_v7", "pe.section_characteristics[0].raw_size": 176128, "pe.section_characteristics[1].raw_size": 4096, "pe.section_characteristics[2].raw_size": 294912, "pe.section_characteristics[0].virtual_size": 173508, "pe.section_characteristics[1].virtual_size": 2592, "pe.section_characteristics[2].virtual_size": 293368, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 180224, "pe.section_characteristics[2].virtual_address": 184320, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "40000040" }, "x": 119, "id": 0, "is": [ "CIcos", "adj_fptan", "vbaVarMove", "vbaFreeVar", "ORDINAL 588", "vbaFreeVarList", "vbaEnd", "adj_fdiv_m64", "vbaFreeObjList", "adj_fprem1", "vbaStrCat", "vbaSetSystemError", "vbaHresultCheckObj", "adj_fdiv_m32", "vbaAryDestruct", "ORDINAL 593", "ORDINAL 594", "vbaOnError", "vbaObjSet", "adj_fdiv_m16i", "adj_fdivr_m16i", "CIsin", "vbaChkstk", "vbaFileClose", "EVENT_SINK_AddRef", "vbaGenerateBoundsError", "vbaPutOwner3", "DllFunctionCall", "adj_fpatan", "vbaRedim", "vbaStrR8", "EVENT_SINK_Release", "ORDINAL 600", "vbaUI1I2", "CIsqrt", "EVENT_SINK_QueryInterface", "vbaExceptHandler", "adj_fprem", "adj_fdivr_m64", "vbaFPException", "vbaGetOwner3", "vbaUbound", "vbaStrVarVal", "vbaVarCat", "CIlog", "vbaErrorOverflow", "vbaFileOpen", "vbaNew2", "ORDINAL 570", "vbaR8Str", "adj_fdiv_m32i", "adj_fdivr_m32i", "vbaFreeStrList", "adj_fdivr_m32", "adj_fdiv_r", "ORDINAL 100", "vbaI4Var", "vbaVarMod", "CIatan", "vbaStrMove", "allmul", "CItan", "vbaFPInt", "vbaUI1Var", "CIexp", "vbaFreeStr", "vbaFreeObj" ], "ms": { "pe": { "entry": 5076.0, "machine": 332.0, "checksum": 513757.0, "rsrc_size": 294912.0, "subsystem": 2.0, "timestamp": 1547904896.0, "icon_count": 2.0, "image_base": 4194304.0, "has_checksum": true, "rsrc_entropy": 2.46, "bound_imports": [ { "name": "MSVBVM60.DLL", "time_date_stamp": 1247533676.0, "forwarder_ref_count": 0.0 } ], "entry_section": ".text", "size_of_image": 479232.0, "file_alignment": 4096.0, "resource_count": 3.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON", "RT_VERSION" ], "characteristics": 271.0, "has_rich_header": true, "overlay_padding": 529.0, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 1.0, "computed_checksum": 528117.0, "dos_stub_modified": true, "section_alignment": 4096.0, "resource_timestamp": 1547904896.0, "has_export_timestamp": false, "linker_major_version": 6.0, "bound_imports_checksum": 1243922264.0, "has_resource_timestamp": true, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 479761.0 }, "binary": { "code_size": 176128.0, "func_count": 8.0, "has_overlay": true, "code_entropy": 6.63, "data_entropy": 0.02, "func_density": 0.05, "import_count": 67.0, "overlay_size": 529.0, "string_count": 225.0, "avg_func_size": 21629.38, "overlay_ratio": 0.0, "section_count": 3.0, "avg_complexity": 12.0, "import_density": 0.39, "max_complexity": 42.0, "string_density": 1.31, "overall_entropy": 3.04, "avg_basic_blocks": 26.0, "avg_section_size": 158378.67, "dependency_count": 1.0, "entropy_variance": 2.73, "avg_string_length": 16.19, "complexity_per_kb": 0.07, "max_string_length": 1105.0, "wide_string_count": 19.0, "avg_string_entropy": 2.87, "code_to_data_ratio": 0.59, "data_to_file_ratio": 0.01, "rsrc_to_file_ratio": 0.61, "text_to_file_ratio": 0.37, "total_basic_blocks": 208.0, "func_analysis_depth": 2.0, "string_length_stddev": 73.19, "largest_section_ratio": 0.61, "sentence_string_count": 11.0, "sentence_string_ratio": 0.05, "writable_section_count": 1.0, "executable_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS pode." ], [ 432, ".text" ], [ 512, ".rsrc" ], [ 568, "MSVBVM60.DLL" ], [ 5248, "Unicorn" ], [ 5421, "Adobe Photoshop CC 2018 (Windows)" ], [ 5455, "2019:01:07 19:44:27" ], [ 5618, "Adobe_CM" ], [ 5633, "Adobe" ], [ 5912, "b34r" ], [ 6534, "Blqm" ], [ 8568, "3b5q" ], [ 9227, "\\Photoshop 3.0" ], [ 9242, "8BIM" ], [ 9297, "N8BIM" ], [ 9324, "printOutput" ], [ 9343, "PstSbool" ], [ 9356, "Inteenum" ], [ 9368, "Inte" ], [ 9376, "Clrm" ], [ 9384, "printSixteenBitbool" ], [ 9408, "printerNameTEXT" ], [ 9433, "printProofSetupObjc" ], [ 9483, "proofSetup" ], [ 9502, "Bltnenum" ], [ 9513, "builtinProof" ], [ 9529, "proofCMYK" ], [ 9566, "printOutputOptions" ], [ 9592, "Cptnbool" ], [ 9605, "Clbrbool" ], [ 9618, "RgsMbool" ], [ 9644, "CntCbool" ], [ 9657, "Lblsbool" ], [ 9670, "Ngtvbool" ], [ 9683, "EmlDbool" ], [ 9696, "Intrbool" ], [ 9709, "BckgObjc" ], [ 9727, "RGBC" ], [ 9799, "BrdTUntF#Rlt" ], [ 9823, "Bld UntF#Rlt" ], [ 9847, "RsltUntF#Pxl@b" ], [ 9871, "vectorDatabool" ], [ 9890, "PgPsenum" ], [ 9918, "LeftUntF#Rlt" ], [ 9942, "Top UntF#Rlt" ], [ 9966, "Scl UntF#Prc@Y" ], [ 9990, "cropWhenPrintingbool" ], [ 10015, "cropRectBottomlong" ], [ 10040, "cropRectLeftlong" ], [ 10064, "cropRectRightlong" ], [ 10090, "cropRectToplong" ], [ 10677, "null" ], [ 10689, "boundsObjc" ], [ 10721, "Top long" ], [ 10737, "Leftlong" ], [ 10753, "Btomlong" ], [ 10769, "Rghtlong" ], [ 10785, "slicesVlLs" ], [ 10799, "Objc" ], [ 10813, "slice" ], [ 10826, "sliceIDlong" ], [ 10845, "groupIDlong" ], [ 10864, "originenum" ], [ 10877, "ESliceOrigin" ], [ 10893, "autoGenerated" ], [ 10911, "Typeenum" ], [ 10922, "ESliceType" ], [ 11041, "urlTEXT" ], [ 11058, "nullTEXT" ], [ 11076, "MsgeTEXT" ], [ 11094, "altTagTEXT" ], [ 11114, "cellTextIsHTMLbool" ], [ 11137, "cellTextTEXT" ], [ 11158, "horzAlignenum" ], [ 11176, "ESliceHorzAlign" ], [ 11195, "default" ], [ 11205, "vertAlignenum" ], [ 11223, "ESliceVertAlign" ], [ 11253, "bgColorTypeenum" ], [ 11272, "ESliceBGColorType" ], [ 11293, "None" ], [ 11300, "topOutsetlong" ], [ 11321, "leftOutsetlong" ], [ 11343, "bottomOutsetlong" ], [ 11368, "rightOutsetlong" ], [ 15102, "wide", "Adobe Photoshop" ], [ 15136, "wide", "Adobe Photoshop CC 2018" ], [ 15209, "zhttp://ns.adobe.com/xap/1.0/" ], [ 15239, "\u003c?xpacket begin=\"" ], [ 15951, "tadataDate=\"2019-01-07T19:44:27+08:00\" dc:format=\"image/jpeg\" photoshop:ColorMode=\"3\" photoshop:ICCProfile=\"sRGB IEC61966-2.1\" x" ], [ 18769, "\u003c?xpacket end=\"w\"?\u003e" ], [ 19684, "XICC_PROFILE" ], [ 19712, "mntrRGB XYZ" ], [ 19736, "acspMSFT" ], [ 19748, "IEC sRGB" ], [ 19843, "3desc" ], [ 19940, "vued" ], [ 19952, "view" ], [ 19976, "meas" ], [ 20035, "text" ], [ 20044, "Copyright (c) 1998 Hewlett-Packard Company" ], [ 20100, "sRGB IEC61966-2.1" ], [ 20308, "IEC http://www.iec.ch" ], [ 20419, ".IEC 61966-2.1 Default RGB colour space - sRGB" ], [ 20476, ".IEC 61966-2.1 De]ault RGB colour space - sRGB" ], [ 20555, ",Reference Viewing Condition in IEC61966-2.1" ], [ 20780, "CRT curv" ], [ 23153, "DTsEF7Gc(UVW" ], [ 23186, "u*9:HIJXYZghijvwxyz" ], [ 30234, "VMI_" ], [ 30701, "BIYS" ], [ 30724, "JVWP" ], [ 32184, "%euWFWGP" ], [ 35348, "9555" ], [ 48493, "/ysw" ], [ 55713, "Noqf" ], [ 56636, "CUO42" ], [ 56750, "xa7 4" ], [ 59264, "KOCCGM" ], [ 59272, "MIGI" ], [ 63314, "Rwwu" ], [ 67958, "t8e6" ], [ 68919, "a7tx" ], [ 69651, "YYYI" ], [ 106584, "BKIB" ], [ 109704, "Ocdv" ], [ 113948, "URSR" ], [ 115617, "VQPSMY]44tt" ], [ 117343, "PC_M4" ], [ 118288, "OKWN" ], [ 118293, "IMYK2" ], [ 120251, "YSBMG" ], [ 125183, "Scki" ], [ 133602, "s4pe0" ], [ 133693, "HVJ2" ], [ 136032, "6OWB" ], [ 136150, "AMOSMR" ], [ 138350, "XYIR" ], [ 139830, "74PC-]%5FN" ], [ 141992, "UC_O" ], [ 142818, "/Zmz" ], [ 145206, "j2\u003eG" ], [ 146222, "Wfbi" ], [ 147347, "QUEA" ], [ 148616, "PFEEA" ], [ 151120, "PARA" ], [ 151996, "IMCGO" ], [ 153371, "KJBC" ], [ 156014, "SUL1" ], [ 156734, "5RK4R" ], [ 157588, "U5CU" ], [ 158084, "Gqjv" ], [ 162123, "xur0z" ], [ 162720, "XZ9H" ], [ 165194, "SUMCOQ" ], [ 168292, "MS Sans Serif" ], [ 168420, "VB5!6\u0026vb6chs.dll" ], [ 168555, "Kawaii-Unicorn" ], [ 170256, "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 170400, "Form" ], [ 170444, "user32" ], [ 170456, "SetLayeredWindowAttributes" ], [ 170540, "GetWindowLongA" ], [ 170612, "SetWindowLongA" ], [ 170768, "wide", ".exe" ], [ 170864, "__vbaFreeStrList" ], [ 170888, "wide", "cmd /c rename \"" ], [ 170944, "wide", ".die" ], [ 170956, "VBA6.DLL" ], [ 170968, "__vbaEnd" ], [ 171004, "__vbaFreeVarList" ], [ 171064, "__vbaErrorOve" ], [ 171084, "__vbaAryDestruct" ], [ 171104, "__vbaPutOwner3" ], [ 171120, "__vbaFreeObj" ], [ 171136, "__vbaFreeStr" ], [ 171176, "__vbaGenerateBoundsError" ], [ 171216, "__vbaUbound" ], [ 171228, "__vbaFPInt" ], [ 171240, "__vbaVarMove" ], [ 171256, "__vbaFileClose" ], [ 171272, "__vbaGetOwner3" ], [ 171288, "__vbaRedim" ], [ 171300, "__vbaFreeObjList" ], [ 171352, "__vbaStrMove" ], [ 171368, "__vbaFileOpen" ], [ 171384, "__vbaFreeVar" ], [ 171412, "__vbaSetSysteAError" ], [ 171432, "__vbaHresultCheckObj" ], [ 171456, "__vbaOnError" ], [ 176630, "_adj_fptan" ], [ 176744, "_adj_fprem1" ], [ 176772, "__vbaSetSystemError" ], [ 176930, "__vbaChkstk" ], [ 176962, "EVENT_SINK_AddRef" ], [ 177028, "DllFunctionCall" ], [ 177046, "_adj_fpatan" ], [ 177088, "EVENT_SINK_Release" ], [ 177124, "_CIsqrt" ], [ 177134, "EVENT_SINK_QueryInterface" ], [ 177162, "__vbaExceptHandler" ], [ 177184, "_adj_fprem" ], [ 177198, "_adj_fdivr_m64" ], [ 177216, "__vbaFPException" ], [ 177310, "__vbaErrorOverflow" ], [ 177430, "_adj_fdivr_m32" ], [ 177448, "_adj_fdiv_r" ], [ 177490, "_CIatan" ], [ 177516, "_allmul" ], [ 370261, "202.209.129.247:219" ], [ 370262, "209.129.247.212:56266" ], [ 477130, "wide", "VS_VERSION_INFO" ], [ 477222, "wide", "StringFileInfo" ], [ 477282, "wide", "CompanyName" ], [ 477308, "wide", "UEFI" ], [ 477326, "wide", "ProductName" ], [ 477352, "wide", "Kawaii-Unicorn" ], [ 477390, "wide", "FileVersion" ], [ 477416, "wide", "1.00" ], [ 477434, "wide", "ProductVersion" ], [ 477482, "wide", "InternalName" ], [ 477546, "wide", "OriginalFilename" ], [ 477580, "wide", "Kawaii-Unicorn.exe" ], [ 477626, "wide", "VarFileInfo" ], [ 477658, "wide", "Translation" ] ], "sz": 479761, "ts": [ { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 1.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "virussign.com_7dae0846d142496727dc8e5be666e830.vir" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.00" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.9950000047683716, "d": "UTF-16 cmd rename command", "e": [ "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00" ], "i": "well-known/malware/trojan/shellobject/hijack::rename-command-utf16", "l": 1 }, { "a": "T1071.001", "c": 0.8199999928474426, "d": "JFIF image response marker", "e": [ "image/jpeg" ], "i": "objectives/command-and-control/channel/http/stego::jfif-response-marker", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 0.00" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.63)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 8.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.9950000047683716, "d": "UTF-16 .die payload marker", "e": [ "2e 00 64 00 69 00 65 00" ], "i": "well-known/malware/trojan/shellobject/hijack::die-extension-utf16", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1027.009", "c": 0.9700000286102295, "d": "Embedded cmd rename command", "e": [ "cmd /c rename \"" ], "i": "objectives/command-and-control/dropper/binder::cmd-rename-command", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.func_count = 8.00" ], "i": "metadata/binary/metrics/structural::few-functions", "l": 3 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_func_size = 21629.38" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 294912.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 294912)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.87" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 12.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2 }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1612", "c": 0.8500000238418579, "d": "Large PE resource section", "e": [ ".rsrc (size: 294912)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-rsrc-section", "l": 1, "m": "B0023" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 225.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 294912.00" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-large-rsrc-section", "l": 1 }, { "c": 0.949999988079071, "d": "VB6 runtime binary file write", "e": [ "vbaPutOwner3" ], "i": "micro-behaviors/fs/file/write/direct::vb6-put-owner3", "l": 3 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.04" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.949999988079071, "d": "cmd interpreter marker encoded", "e": [ "cmd /c rename \"" ], "i": "metadata/lang/encoded/wide::shell-interpreter-cmd", "l": 1 }, { "a": "T1027.009", "c": 0.9800000190734863, "d": "Dropped .die extension marker", "e": [ ".die" ], "i": "objectives/command-and-control/dropper/binder::die-extension", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "d5974899-ca88-7f42-9516-8e7635808df3" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 479232.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 8.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.949999988079071, "d": "PE compile timestamp far in future", "e": [ "pe.timestamp = 1547904896.00" ], "i": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.9300000071525574, "d": "VB6 runtime file open helper", "e": [ "vbaFileOpen" ], "i": "micro-behaviors/fs/file/write/direct::vb6-file-open", "l": 2 }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1247533676,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.04" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1547904896.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "VB6 __vbaVarCat string concatenation", "e": [ "vbaVarCat" ], "i": "micro-behaviors/data/string/runtime::vb6-string-construction-cat", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 67.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 1547904896.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "c": 0.949999988079071, "d": "Multiple external IPv4 endpoints in PE resources", "e": [ "209.129.247.212:56266", "202.209.129.247:219" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-rsrc-pair", "l": 4 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "c": 0.8799999952316284, "d": "Large low-entropy PE resources", "e": [ ".rsrc (size: 294912, entropy: 2.46)" ], "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SetLayeredWindowAttributes" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 8.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "202.209.129.247:219", "209.129.247.212:56266" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 3 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027", "c": 0.7799999713897705, "d": ".NET XOR CA payload key", "e": [ "202" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-xor-ca-payload-key", "l": 1, "m": "C0025" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links MSVBVM60.DLL (CIcos, adj_fptan, vbaVarMove, vbaFreeVar, ORDINAL 588, ... +62 more)", "e": [ "MSVBVM60.DLL" ], "i": "metadata/dylib::msvbvm60/dll", "l": 2 }, { "c": 0.949999988079071, "d": "VB6 runtime opens and writes file", "e": [ "vbaPutOwner3", "vbaFileOpen" ], "i": "micro-behaviors/fs/file/write/direct::vb6-binary-file-write", "l": 3 }, { "c": 0.9950000047683716, "d": "Rename executable extension to .die", "e": [ "63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 72 00 65 00 6e 00 61 00 6d 00 65 00 20 00 22 00", "2e 00 64 00 69 00 65 00", ".die", ".exe", "cmd /c rename \"" ], "i": "well-known/malware/trojan/shellobject/hijack::rename-to-die", "l": 4 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "Disproportionately large icon resources (payload carrier)", "e": [ "pe.icon_count = 2.00", ".rsrc (size: 294912)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-icon-resource", "l": 4, "m": "B0023" } ], "sha": "2030a7870093e8d83e4094cd65135213c93e4572f7a4551242737ace83a0ad48", "path": "/data/samples/bad/harvest/virussign/virussign.com_7dae0846d142496727dc8e5be666e830.vir", "type": "pe" } ], "tv": "bef72" } }