{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998558759689331, "class": 2 } ], "prob": 0.9998559, "class": 2, "models": [ { "m": "az", "prob": 0.9992004, "class": 0 }, { "m": "az/native", "prob": 0.99953353, "class": 0 }, { "m": "az/pe", "prob": 0.9998559, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T09:20:01Z" }, "path": "63839", "raw": { "v": "4", "fs": [ { "f": "KO₇(As₁₃Dy₃Er₆Al₂C₅Co₂Xe)H₆(Cm₃Db₂F₂OsPo₄Cr)Md₃(Bi₄BkSi)", "k": { "pe.checksum": "0x0007e77f", "pe.timestamp": 1398420244, "hashes.imphash": "b3a82b150fcb07d7d977ec143261fb7e", "signing.issuer": "GlobalSign CodeSigning CA - G2", "signing.serial": "1121cbde0e20d87673ea3438eeeb8a63be19", "signing.catalog": "authenticode", "signing.subject": "Apps Installer SL", "build.target_arch": "x86", "pe.linker_version": "10.0", "signing.is_signed": true, "signing.not_after": 1422196683, "signing.not_before": 1390574283, "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_RCDATA", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.resource_types[4]": "RT_MANIFEST", "signing.signing_time": 1398519475, "signing.countersigner": "Symantec Time Stamping Services CA - G2", "pe.rich_header.xor_key": "0x4ef2ce84", "hashes.rich_header_hash": "78cbe8142e071727b61dc2d5b625c50bc9929901519619cd45476c6a2d6e2798", "signing.thumbprint_sha1": "2216bf1ee2d198f6d0c0236c71302c441ead78ee", "pe.version_info.company_name": "pinstaller", "pe.version_info.file_version": "3.1.10.30", "pe.version_info.internal_name": "psetup.exe", "pe.load_config.security_cookie": "0x424850", "pe.version_info.legal_copyright": "Copyright ©2014", "pe.version_info.product_version": "3.1.10", "binary.top_complex_unnamed[0].cc": 384, "binary.top_complex_unnamed[1].cc": 139, "binary.top_complex_unnamed[2].cc": 93, "binary.top_complex_unnamed[3].cc": 93, "binary.top_complex_unnamed[4].cc": 79, "binary.top_complex_unnamed[5].cc": 71, "binary.top_complex_unnamed[6].cc": 69, "binary.top_complex_unnamed[7].cc": 65, "pe.dll_characteristics.nx_compat": true, "pe.manifest.supported_os[0].guid": "{e2011457-1546-43c5-a5fe-008deee3d3f0}", "pe.manifest.supported_os[0].name": "vista", "pe.manifest.supported_os[1].guid": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.manifest.supported_os[1].name": "win7", "pe.manifest.supported_os[2].guid": "{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}", "pe.manifest.supported_os[2].name": "win8", "pe.manifest.supported_os[3].guid": "{1f676c76-80e1-4239-95bb-83d0f6d0da78}", "pe.manifest.supported_os[3].name": "win8.1", "pe.version_info.file_description": "pinstaller", "binary.top_complex_unnamed[0].bbs": 439, "binary.top_complex_unnamed[1].bbs": 226, "binary.top_complex_unnamed[2].bbs": 144, "binary.top_complex_unnamed[3].bbs": 144, "binary.top_complex_unnamed[4].bbs": 137, "binary.top_complex_unnamed[5].bbs": 130, "binary.top_complex_unnamed[6].bbs": 101, "binary.top_complex_unnamed[7].bbs": 99, "pe.version_info.original_filename": "pinstaller.exe", "binary.top_complex_unnamed[0].addr": "0x419184", "binary.top_complex_unnamed[0].size": 5330, "binary.top_complex_unnamed[1].addr": "0x413f59", "binary.top_complex_unnamed[1].size": 2978, "binary.top_complex_unnamed[2].addr": "0x41d0ec", "binary.top_complex_unnamed[2].size": 1845, "binary.top_complex_unnamed[3].addr": "0x41ba82", "binary.top_complex_unnamed[3].size": 1844, "binary.top_complex_unnamed[4].addr": "0x41af7a", "binary.top_complex_unnamed[4].size": 1463, "binary.top_complex_unnamed[5].addr": "0x40895e", "binary.top_complex_unnamed[5].size": 1836, "binary.top_complex_unnamed[6].addr": "0x408377", "binary.top_complex_unnamed[6].size": 1265, "binary.top_complex_unnamed[7].addr": "0x413415", "binary.top_complex_unnamed[7].size": 1789, "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 17, "pe.rich_header.entries[1].use_count": 54, "pe.rich_header.entries[2].use_count": 139, "pe.rich_header.entries[3].use_count": 15, "pe.rich_header.entries[4].use_count": 119, "pe.rich_header.entries[5].use_count": 6, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[0].product_id": 158, "pe.rich_header.entries[1].product_id": 171, "pe.rich_header.entries[2].product_id": 170, "pe.rich_header.entries[3].product_id": 147, "pe.rich_header.entries[4].product_id": 1, "pe.rich_header.entries[5].product_id": 175, "pe.rich_header.entries[6].product_id": 154, "pe.rich_header.entries[7].product_id": 157, "pe.manifest.requested_execution_level": "requireAdministrator", "pe.rich_header.entries[0].build_number": 30319, "pe.rich_header.entries[0].product_name": "Cvtres_VS2010", "pe.rich_header.entries[1].build_number": 30319, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 30319, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 30729, "pe.rich_header.entries[3].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[4].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[5].build_number": 30319, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].build_number": 30319, "pe.rich_header.entries[6].product_name": "C_VS2010", "pe.rich_header.entries[7].build_number": 30319, "pe.rich_header.entries[7].product_name": "Linker_VS2010_LTCG", "pe.dll_characteristics.terminal_server_aware": true }, "x": 91, "id": 0, "is": [ "CreateDirectoryW", "WaitForSingleObject", "WriteFile", "SizeofResource", "CreateFileW", "GetTempPathW", "GetLastError", "LockResource", "CloseHandle", "FindFirstFileW", "GetCurrentProcess", "GetModuleHandleW", "OpenProcess", "GetVersionExW", "GetFileAttributesW", "GetModuleFileNameW", "LoadResource", "FindClose", "RemoveDirectoryW", "FindNextFileW", "DeleteFileW", "SetFilePointer", "SystemTimeToFileTime", "WideCharToMultiByte", "ReadFile", "MultiByteToWideChar", "GetCurrentDirectoryW", "LocalFileTimeToFileTime", "SetEndOfFile", "CreateFileA", "WriteConsoleW", "SetStdHandle", "FindResourceW", "GetProcAddress", "GetFileSize", "HeapReAlloc", "IsValidLocale", "EnumSystemLocalesA", "GetLocaleInfoA", "GetUserDefaultLCID", "GetCurrentProcessId", "GetTickCount", "QueryPerformanceCounter", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetModuleFileNameA", "LoadLibraryW", "GetLocaleInfoW", "HeapSize", "FlushFileBuffers", "InterlockedIncrement", "InterlockedDecrement", "InterlockedCompareExchange", "InterlockedExchange", "GetStringTypeW", "EncodePointer", "DecodePointer", "Sleep", "InitializeCriticalSection", "DeleteCriticalSection", "EnterCriticalSection", "LeaveCriticalSection", "HeapFree", "GetCPInfo", "ExitProcess", "GetSystemTimeAsFileTime", "HeapAlloc", "GetCommandLineA", "HeapSetInformation", "GetStartupInfoW", "RaiseException", "RtlUnwind", "LCMapStringW", "TerminateProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "IsProcessorFeaturePresent", "GetACP", "GetOEMCP", "IsValidCodePage", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "SetLastError", "GetCurrentThreadId", "SetHandleCount", "GetStdHandle", "InitializeCriticalSectionAndSpinCount", "GetFileType", "HeapCreate", "GetConsoleCP", "GetConsoleMode", "GetProcessHeap", "wsprintfW", "MessageBoxW", "RegOpenKeyExW", "RegQueryValueExW", "ShellExecuteExW", "GetModuleBaseNameW", "EnumProcesses", "EnumProcessModules", "GetFileVersionInfoW", "GetFileVersionInfoSizeW", "VerQueryValueW", "WinHttpConnect", "WinHttpOpenRequest", "WinHttpOpen", "WinHttpReceiveResponse", "WinHttpCloseHandle", "WinHttpSendRequest" ], "ms": { "pe": { "signer": "GlobalSign Root CA, GlobalSign CodeSigning CA - G2, Apps Installer SL, Symantec Time Stamping Services CA - G2, Symantec Time Stamping Services Signer - G4, TimeStamp-2048-2, Thawte Timestamping CA, TimeStamp-2048-1", "machine": 332.0, "checksum": 518015.0, "rsrc_size": 335360.0, "subsystem": 2.0, "timestamp": 1398420244.0, "icon_count": 2.0, "image_base": 4194304.0, "leaf_issuer": "GlobalSign CodeSigning CA - G2", "leaf_serial": "1121cbde0e20d87673ea3438eeeb8a63be19", "leaf_subject": "Apps Installer SL", "rsrc_entropy": 7.96, "signing_time": 1398519475.0, "entry_section": ".text", "has_signature": true, "size_of_image": 524288.0, "timestamp_day": 25.0, "checksum_valid": true, "file_alignment": 512.0, "leaf_not_after": 1422196683.0, "primary_signer": "Apps Installer SL", "resource_count": 5.0, "resource_types": [ "RT_ICON", "RT_RCDATA", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST" ], "signature_type": "developer", "timestamp_year": 2014.0, "characteristics": 258.0, "entry_point_rva": 61252.0, "leaf_not_before": 1390574283.0, "security_cookie": 4343888.0, "size_of_headers": 1024.0, "timestamp_month": 4.0, "cert_chain_depth": 5.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 7.0, "manifest_present": true, "signing_time_day": 26.0, "certificate_count": 1.0, "computed_checksum": 518015.0, "section_alignment": 4096.0, "signing_time_year": 2014.0, "cert_validity_days": 366.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "signing_time_month": 4.0, "dll_characteristics": 33088.0, "rich_header_present": true, "leaf_thumbprint_sha1": "2216bf1ee2d198f6d0c0236c71302c441ead78ee", "linker_major_version": 10.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 6616.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 512728.0 }, "binary": { "code_size": 119808.0, "func_count": 499.0, "entry_point": 61252.0, "has_overlay": true, "code_entropy": 6.6, "data_entropy": 4.47, "func_density": 4.26, "import_count": 112.0, "overlay_size": 256.0, "string_count": 664.0, "avg_func_size": 315.64, "has_signature": true, "overlay_ratio": 0.0, "section_count": 5.0, "avg_complexity": 9.23, "import_density": 0.96, "max_complexity": 384.0, "string_density": 5.68, "overall_entropy": 5.66, "overlay_entropy": 1.92, "avg_basic_blocks": 14.66, "avg_section_size": 100966.4, "dependency_count": 7.0, "entropy_variance": 1.41, "avg_string_length": 17.03, "complexity_per_kb": 0.08, "max_string_length": 364.0, "wide_string_count": 73.0, "writable_sections": 1.0, "avg_string_entropy": 3.0, "code_to_data_ratio": 0.31, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.65, "text_to_file_ratio": 0.23, "total_basic_blocks": 7315.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 23.19, "high_complexity_funcs": 9.0, "largest_section_ratio": 0.65, "sentence_string_count": 101.0, "sentence_string_ratio": 0.15, "behavioral_import_ratio": 0.08, "unnamed_complex_func_count": 8.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 472, ".text" ], [ 551, "@.data" ], [ 592, ".rsrc" ], [ 631, "@.reloc" ], [ 1304, "j2h8" ], [ 2209, "QSVW" ], [ 2285, "6PSQ" ], [ 5115, "VW8E" ], [ 7633, "SSSSP" ], [ 7769, "SSSSSSV" ], [ 8495, "YVPS" ], [ 15235, "SVW3" ], [ 17064, "QQVW" ], [ 18123, "QQSV" ], [ 22374, "QSW3" ], [ 32105, "K4VW" ], [ 40195, "F49E" ], [ 61233, ".t|PVj@" ], [ 80924, "RPSW" ], [ 82962, "UVWS" ], [ 83668, "QSVP" ], [ 88984, "f90u" ], [ 90781, "YYPV" ], [ 113481, "UQPXY]Y[" ], [ 118031, "SW9E" ], [ 121500, "generic" ], [ 121548, "iostream" ], [ 121588, "system" ], [ 121624, "iostream stream error" ], [ 121896, "Unknown exception" ], [ 121936, "bad allocation" ], [ 121952, "CorExitProcess" ], [ 121968, "wide", "mscoree.dll" ], [ 122024, "Visual C++ CRT: Not enough memory to complete call to strerror." ], [ 122088, "LC_TIME" ], [ 122096, "LC_NUMERIC" ], [ 122108, "LC_MONETARY" ], [ 122120, "LC_CTYPE" ], [ 122132, "LC_COLLATE" ], [ 122144, "LC_ALL" ], [ 122255, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 123146, "wide", "h(((( H" ], [ 123824, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 124208, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 124460, "wide", "dddd, MMMM dd, yyyy" ], [ 124500, "wide", "MM/dd/yy" ], [ 124536, "wide", "December" ], [ 124556, "wide", "November" ], [ 124576, "wide", "October" ], [ 124592, "wide", "September" ], [ 124612, "wide", "August" ], [ 124628, "wide", "July" ], [ 124640, "wide", "June" ], [ 124652, "wide", "April" ], [ 124664, "wide", "March" ], [ 124676, "wide", "February" ], [ 124696, "wide", "January" ], [ 124808, "wide", "Saturday" ], [ 124828, "wide", "Friday" ], [ 124844, "wide", "Thursday" ], [ 124864, "wide", "Wednesday" ], [ 124884, "wide", "Tuesday" ], [ 124900, "wide", "Monday" ], [ 124916, "wide", "Sunday" ], [ 125000, "dddd, MMMM dd, yyyy" ], [ 125020, "MM/dd/yy" ], [ 125040, "December" ], [ 125052, "November" ], [ 125064, "October" ], [ 125072, "September" ], [ 125084, "August" ], [ 125092, "July" ], [ 125100, "June" ], [ 125108, "April" ], [ 125116, "March" ], [ 125124, "February" ], [ 125136, "January" ], [ 125192, "Saturday" ], [ 125204, "Friday" ], [ 125212, "Thursday" ], [ 125224, "Wednesday" ], [ 125236, "Tuesday" ], [ 125244, "Monday" ], [ 125252, "Sunday" ], [ 125286, "wide", "nKERNEL32.DLL" ], [ 125316, "FlsFree" ], [ 125324, "FlsSetValue" ], [ 125336, "FlsGetValue" ], [ 125348, "FlsAlloc" ], [ 125372, "UTF-16LE" ], [ 125384, "UNICODE" ], [ 125390, "wide", "Eruntime error" ], [ 125432, "wide", "TLOSS error" ], [ 125460, "wide", "SING error" ], [ 125488, "wide", "DOMAIN error" ], [ 125520, "wide", "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 126016, "wide", "R6032\r\n- not enough space for locale information" ], [ 126120, "wide", "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 126320, "wide", "R6030\r\n- CRT not initialized" ], [ 126384, "wide", "R6028\r\n- unable to initialize heap" ], [ 126464, "wide", "R6027\r\n- not enough space for lowio initialization" ], [ 126576, "wide", "R6026\r\n- not enough space for stdio initialization" ], [ 126688, "wide", "R6025\r\n- pure virtual function call" ], [ 126768, "wide", "R6024\r\n- not enough space for _onexit/atexit table" ], [ 126880, "wide", "R6019\r\n- unable to open console device" ], [ 126968, "wide", "R6018\r\n- unexpected heap error" ], [ 127040, "wide", "R6017\r\n- unexpected multithread lock error" ], [ 127136, "wide", "R6016\r\n- not enough space for thread data" ], [ 127224, "wide", "R6010\r\n- abort() has been called" ], [ 127296, "wide", "R6009\r\n- not enough space for environment" ], [ 127384, "wide", "R6008\r\n- not enough space for arguments" ], [ 127472, "wide", "R6002\r\n- floating point support not loaded" ], [ 127742, "wide", "BMicrosoft Visual C++ Runtime Library" ], [ 127836, "wide", "\u003cprogram name unknown\u003e" ], [ 127884, "wide", "Runtime Error!\n\nProgram:" ], [ 128112, "bad exception" ], [ 128128, "Illegal byte sequence" ], [ 128152, "Directory not empty" ], [ 128172, "Function not implemented" ], [ 128200, "No locks available" ], [ 128220, "Filename too long" ], [ 128240, "Resource deadlock avoided" ], [ 128268, "Result too large" ], [ 128288, "Domain error" ], [ 128304, "Broken pipe" ], [ 128316, "Too many links" ], [ 128332, "Read-only file system" ], [ 128356, "Invalid seek" ], [ 128372, "No space left on device" ], [ 128396, "File too large" ], [ 128412, "Inappropriate I/O control operation" ], [ 128448, "Too many open files" ], [ 128468, "Too many open files in system" ], [ 128500, "Invalid argument" ], [ 128520, "Is a directory" ], [ 128536, "Not a directory" ], [ 128552, "No such device" ], [ 128568, "Improper link" ], [ 128584, "File exists" ], [ 128596, "Resource device" ], [ 128612, "Unknown error" ], [ 128628, "Bad address" ], [ 128640, "Permission denied" ], [ 128660, "Not enough space" ], [ 128680, "Resource temporarily unavailable" ], [ 128716, "No child processes" ], [ 128736, "Bad file descriptor" ], [ 128756, "Exec format error" ], [ 128776, "Arg list too long" ], [ 128796, "No such device or address" ], [ 128824, "Input/output error" ], [ 128844, "Interrupted function call" ], [ 128872, "No such process" ], [ 128888, "No such file or directory" ], [ 128916, "Operation not permitted" ], [ 128952, "united-states" ], [ 128968, "united-kingdom" ], [ 128984, "trinidad \u0026 tobago" ], [ 129004, "south-korea" ], [ 129016, "south-africa" ], [ 129032, "south korea" ], [ 129044, "south africa" ], [ 129060, "slovak" ], [ 129068, "puerto-rico" ], [ 129080, "pr-china" ], [ 129092, "pr china" ], [ 129108, "new-zealand" ], [ 129120, "hong-kong" ], [ 129132, "holland" ], [ 129140, "great britain" ], [ 129156, "england" ], [ 129172, "china" ], [ 129180, "britain" ], [ 129188, "america" ], [ 129216, "swedish-finland" ], [ 129232, "spanish-venezuela" ], [ 129252, "spanish-uruguay" ], [ 129268, "spanish-puerto rico" ], [ 129288, "spanish-peru" ], [ 129304, "spanish-paraguay" ], [ 129324, "spanish-panama" ], [ 129340, "spanish-nicaragua" ], [ 129360, "spanish-modern" ], [ 129376, "spanish-mexican" ], [ 129392, "spanish-honduras" ], [ 129412, "spanish-guatemala" ], [ 129432, "spanish-el salvador" ], [ 129452, "spanish-ecuador" ], [ 129468, "spanish-dominican republic" ], [ 129496, "spanish-costa rica" ], [ 129516, "spanish-colombia" ], [ 129536, "spanish-chile" ], [ 129552, "spanish-bolivia" ], [ 129568, "spanish-argentina" ], [ 129588, "portuguese-brazilian" ], [ 129612, "norwegian-nynorsk" ], [ 129632, "norwegian-bokmal" ], [ 129652, "norwegian" ], [ 129664, "italian-swiss" ], [ 129680, "irish-english" ], [ 129696, "german-swiss" ], [ 129712, "german-luxembourg" ], [ 129732, "german-lichtenstein" ], [ 129752, "german-austrian" ], [ 129768, "french-swiss" ], [ 129784, "french-luxembourg" ], [ 129804, "french-canadian" ], [ 129820, "french-belgian" ], [ 129836, "english-usa" ], [ 129848, "english-us" ], [ 129860, "english-uk" ], [ 129872, "english-trinidad y tobago" ], [ 129900, "english-south africa" ], [ 129924, "english-nz" ], [ 129936, "english-jamaica" ], [ 129952, "english-ire" ], [ 129964, "english-caribbean" ], [ 129984, "english-can" ], [ 129996, "english-belize" ], [ 130012, "english-aus" ], [ 130024, "english-american" ], [ 130044, "dutch-belgian" ], [ 130060, "chinese-traditional" ], [ 130080, "chinese-singapore" ], [ 130100, "chinese-simplified" ], [ 130120, "chinese-hongkong" ], [ 130140, "chinese" ], [ 130156, "canadian" ], [ 130168, "belgian" ], [ 130176, "australian" ], [ 130188, "american-english" ], [ 130208, "american english" ], [ 130228, "american" ], [ 130972, "Norwegian-Nynorsk" ], [ 131012, "wide", "UTF-16LE" ], [ 131032, "wide", "UNICODE" ], [ 131048, "Complete Object Locator'" ], [ 131076, "Class Hierarchy Descriptor'" ], [ 131108, "Base Class Array'" ], [ 131128, "Base Class Descriptor at (" ], [ 131156, "Type Descriptor'" ], [ 131176, "`local static thread guard'" ], [ 131204, "`managed vector copy constructor iterator'" ], [ 131248, "`vector vbase copy constructor iterator'" ], [ 131292, "`vector copy constructor iterator'" ], [ 131328, "`dynamic atexit destructor for '" ], [ 131364, "`dynamic initializer for '" ], [ 131392, "`eh vector vbase copy constructor iterator'" ], [ 131436, "`eh vector copy constructor iterator'" ], [ 131476, "`managed vector destructor iterator'" ], [ 131516, "`managed vector constructor iterator'" ], [ 131556, "`placement delete[] closure'" ], [ 131588, "`placement delete closure'" ], [ 131616, "`omni callsig'" ], [ 131632, "delete[]" ] ], "sz": 512728, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: GlobalSign Root CA", "e": [ "GlobalSign Root CA" ], "i": "metadata/signed/developer::globalsign-root-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: GlobalSign CodeSigning CA - G2", "e": [ "GlobalSign CodeSigning CA - G2" ], "i": "metadata/signed/developer::globalsign-codesigning-ca---g2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Apps Installer SL", "e": [ "Apps Installer SL" ], "i": "metadata/signed/developer::apps-installer-sl", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Symantec Time Stamping Services CA - G2", "e": [ "Symantec Time Stamping Services CA - G2" ], "i": "metadata/signed/developer::symantec-time-stamping-services-ca---g2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Symantec Time Stamping Services Signer - G4", "e": [ "Symantec Time Stamping Services Signer - G4" ], "i": "metadata/signed/developer::symantec-time-stamping-services-signer---g4", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: TimeStamp-2048-2", "e": [ "TimeStamp-2048-2" ], "i": "metadata/signed/developer::timestamp-2048-2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Thawte Timestamping CA", "e": [ "Thawte Timestamping CA" ], "i": "metadata/signed/developer::thawte-timestamping-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: TimeStamp-2048-1", "e": [ "TimeStamp-2048-1" ], "i": "metadata/signed/developer::timestamp-2048-1", "l": 2 }, { "c": 1.0, "d": "Signed by Apps Installer SL", "e": [ "Apps Installer SL" ], "i": "metadata/signed/leaf::apps-installer-sl", "l": 3 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Create WinHTTP HTTP request handle", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request", "l": 3, "m": "C0002" }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP send request text reference", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request-text", "l": 1, "m": "C0002" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1398420244.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 335360)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 335360.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 1.0, "d": "GetTempPathW import", "e": [ "GetTempPathW" ], "i": "objectives/command-and-control/dropper/staging/resource::get-temp-path-w-import", "l": 1 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 1.0, "d": "Issued by GlobalSign Code Signing CA", "e": [ "GlobalSign CodeSigning CA - G2" ], "i": "metadata/signed/certificate::pe-cert-issuer-globalsign", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "IWR" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "63839" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Initialize WinHTTP session", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open", "l": 3, "m": "C0002" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 1.0, "d": "PE overlay is exactly 256 bytes", "e": [ "binary.overlay_size = 256.00" ], "i": "metadata/binary/layout::overlay-size-256", "l": 3 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 524288.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.00" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload/archive::zip-magic", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::lock-resource", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 112.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-w", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 499.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "41", "46", "4e", "48", "4b" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…ssembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD", "…ompatibility\u003e\u003c/assembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Connect WinHTTP to remote host", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-connect", "l": 3, "m": "C0002" }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.65" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": "MSVC C++ runtime strerror diagnostic string", "e": [ "Visual C++ CRT: Not enough memory to complete call to strerror." ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-strerror-string", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 112.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime", "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.23" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 11264)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 7315.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "Close WinHTTP handle object", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle", "l": 3, "m": "C0002" }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 335360.00" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-large-rsrc-section", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 112.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "a": "T1057", "c": 0.8500000238418579, "d": "Get process module name (PSAPI)", "e": [ "GetModuleBaseNameW" ], "i": "micro-behaviors/process/enumerate/psapi::get-module-basename-w", "l": 3 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Receive WinHTTP server response", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response", "l": 3, "m": "C0002" }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.66" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 335360, entropy: 7.96)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 499.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.60)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 664.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 3 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 112.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP receive response text reference", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response-text", "l": 1, "m": "C0002" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Input/output error" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 112.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 112.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"requireAdministrator\",\"ui_access\":false,\"supported_os\":[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "a": "T1057", "c": 0.8500000238418579, "d": "Enumerate modules in process (PSAPI)", "e": [ "EnumProcessModules" ], "i": "micro-behaviors/process/enumerate/psapi::enum-process-modules", "l": 3 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesA" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetEnvironmentStringsW", "StringFileInfo", ".?AV?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@", "LCMapStringW", "FreeEnvironmentStringsW", "string too long", "GetStringTypeW", "invalid string position", ".?AV?$basic_stringbuf@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "PE has an Authenticode signature", "e": [ "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-is-authenticode-signed", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1055.002", "c": 0.8500000238418579, "d": "OpenProcess API name in strings", "e": [ "OpenProcess" ], "i": "objectives/evasion/process/injection/dll::open-process-text", "l": 3 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Send WinHTTP request to server", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request", "l": 3, "m": "C0002" }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "63839" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Enumerate all running processes (PSAPI)", "e": [ "EnumProcesses" ], "i": "micro-behaviors/process/enumerate/psapi::enum-processes", "l": 3, "m": "E1057" }, { "c": 0.8799999952316284, "d": "High entropy resource section (encrypted payload)", "e": [ "pe.rsrc_entropy = 7.96" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-high-rsrc-entropy", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 499.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 112.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 3 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 112.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "spanish-dominican republic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 1.92" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle", "FindClose", "WinHttpCloseHandle" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "1f676c76-80e1-4239-95bb-83d0f6d0da78", "52fe2c91-49dc-40b7-b209-1f140a000013", "35138b9a-5d96-4fbd-8e2d-a2440225f93a", "e2011457-1546-43c5-a5fe-008deee3d3f0", "4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38" ], "i": "objectives/command-and-control/channel/http::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount", "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "a": "T1620", "c": 0.8500000238418579, "d": "mscoree.dll text reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-dll-text-ref", "l": 3, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is requireAdministrator", "e": [ "requireAdministrator" ], "i": "metadata/build/manifest::pe-requires-admin", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.65" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "LocalFileTimeToFileTime", "InitializeCriticalSection", "InterlockedIncrement", "InterlockedCompareExchange", "GetSystemTimeAsFileTime", "SystemTimeToFileTime", "InterlockedDecrement", "GetModuleFileNameW", "GetUserObjectInformationW", "GetProcessWindowStation", "GetCurrentDirectoryW", "UnhandledExceptionFilter", "GetModuleBaseNameW", "MultiByteToWideChar", "GetFileVersionInfoSizeW", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.800000011920929, "d": "Data before JAR/ZIP header", "e": [ "50 4B 03 04" ], "i": "objectives/anti-static/polyglot/format::jar-polyglot-prefix", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::module-stomping-target", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 499.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Manifest declares only Vista support", "e": [ "[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\",\"name\":\"vista\"}, {\"guid\":\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\",\"name\":\"win7" ], "i": "metadata/build/manifest::pe-vista-only-manifest", "l": 3 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "41.140.213.211:25553" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 3 }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.96)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 3, "m": "C0027" }, { "a": "T1027.002", "c": 0.8500000238418579, "d": "High entropy PE resource section", "e": [ ".rsrc (size: 335360, entropy: 7.96)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-rsrc", "l": 4 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "24 f0 41 00", "44 f0 41 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.65" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateDirectoryW, WaitForSingleObject, WriteFile, SizeofResource, CreateFileW, ... +90 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (wsprintfW, MessageBoxW)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteExW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegOpenKeyExW, RegQueryValueExW)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINHTTP.dll (WinHttpConnect, WinHttpOpenRequest, WinHttpOpen, WinHttpReceiveResponse, WinHttpCloseHandle, ... +1 more)", "e": [ "WINHTTP.dll" ], "i": "metadata/dylib::winhttp/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links PSAPI.DLL (GetModuleBaseNameW, EnumProcesses, EnumProcessModules)", "e": [ "PSAPI.DLL" ], "i": "metadata/dylib::psapi/dll", "l": 2 }, { "a": "T1057", "c": 0.8999999761581421, "d": "PSAPI process enumeration chain", "e": [ "EnumProcesses", "GetModuleBaseNameW", "EnumProcessModules" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-process-scan", "l": 3 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "24 f0 41 00", "GetTickCount", "44 f0 41 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetUserDefaultLCID", "GetLocaleInfoW", "GetLocaleInfoA", "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2 }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetProcessWindowStation", "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 112.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindFirstFileW", "FindNextFileW", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileA", "CreateFileW", "GetModuleFileNameA", "GetFileSize", "ReadFile" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "GetModuleFileNameW", "DeleteFileW" ], "i": "objectives/evasion/self-delete/file/script::module-path-delete", "l": 2, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "SizeofResource", "LoadResource", "FindResourceW", "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-full-extraction", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceW", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-load-lock-chain", "l": 2 }, { "c": 0.8500000238418579, "d": "Resource extraction to temp directory", "e": [ "SizeofResource", "GetTempPathW", "LockResource", "FindResourceW", "LoadResource" ], "i": "objectives/command-and-control/dropper/staging/embedded::pe-resource-temp-stager-persistence-chain", "l": 1 }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting::file-enumeration-targeting", "l": 1, "m": "C0000" }, { "a": "T1057", "c": 0.8799999952316284, "d": "Process enumeration combined with process access", "e": [ "OpenProcess", "EnumProcesses" ], "i": "objectives/discovery/process/targeting::process-enumeration-with-access", "l": 3, "m": "E1057" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetLocaleInfoA", "GetLocaleInfoW", "GetUserDefaultLCID", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "EnumSystemLocalesA" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1620", "c": 0.9300000071525574, "d": "Native PE loads .NET payload via CLR", "e": [ "mscoree.dll", "CorExitProcess", "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/loader::native-pe-loads-dotnet-payload", "l": 4, "m": "B0032" }, { "a": "T1057", "c": 0.9200000166893005, "d": "Process reconnaissance for targeting", "e": [ "EnumProcessModules", "GetModuleBaseNameW", "EnumProcesses", "OpenProcess" ], "i": "objectives/discovery/process/targeting::process-reconnaissance-pattern", "l": 3, "m": "E1057" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetCommandLineA", "GetLocaleInfoW", "GetLocaleInfoA", "FreeEnvironmentStringsW", "GetUserDefaultLCID", "GetEnvironmentStringsW", "EnumSystemLocalesA", "GetSystemTimeAsFileTime" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" } ], "sha": "2313b21f941c99dc9d2e516c83ae0e16bdbe021553d95c87dff59440763765f1", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/63839", "type": "pe" } ], "tv": "84923" } }