{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.5925531983375549, "class": 0 } ], "prob": 0.5925532, "class": 0, "models": [ { "m": "az", "prob": 0.5925532, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-10T23:42:16Z" }, "path": "190655", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₄Si)", "k": { "pe.checksum": "0x0000efc3", "pe.timestamp": 1446173016, "hash.authenti": "d166bad1d44f4fc266d59c3136460cd7a021912afb25b0e67ba3e0e4771785f3", "debug.pdb_path": "wmi.pdb", "pe.codeview.age": 1, "hash.rich_header": "6b7550cd526ffcecf8a0f093845c50c2c014321141b09f952fb6dc7d21e90943", "pe.codeview.guid": "7EC1DA01-A31B-4760-B669-5D8972993448", "build.target_arch": "x86_64", "pe.linker_version": "12.10", "pe.resource_types[0]": "RT_VERSION", "pe.rich_header.xor_key": "0x8de8e059", "pe.debug_entries[0].size": 32, "pe.debug_entries[0].type": "codeview", "pe.debug_entries[1].size": 100, "pe.debug_entries[1].type": "pogo", "pe.data_directories[0].rva": 4192, "pe.data_directories[1].rva": 8192, "pe.data_directories[2].rva": 4096, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 3135, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1016, "pe.data_directories[2].name": "debug", "pe.data_directories[2].size": 56, "pe.debug_directory_types[0]": 2, "pe.debug_directory_types[1]": 13, "pe.version_info.company_name": "Microsoft Corporation", "pe.version_info.file_version": "10.0.10586.0 (th2_release.151029-1700)", "pe.version_info.product_name": "Microsoft® Windows® Operating System", "pe.debug_entries[0].timestamp": 1446173016, "pe.debug_entries[1].timestamp": 1446173016, "pe.version_info.internal_name": "wmi", "pe.dll_characteristics.guard_cf": true, "pe.rich_header_compids[0].count": 1, "pe.rich_header_compids[1].count": 1, "pe.rich_header_compids[2].count": 1, "pe.version_info.legal_copyright": "© Microsoft Corporation. All rights reserved.", "pe.version_info.product_version": "10.0.10586.0", "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 15637684, "pe.rich_header_compids[1].compid": 15572148, "pe.rich_header_compids[2].compid": 15768756, "pe.version_info.file_description": "WMI DC and DP functionality", "pe.version_info.original_filename": "wmi.DLL", "pe.section_characteristics[0].name": ".rdata", "pe.section_characteristics[1].name": ".rsrc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 1, "pe.rich_header.entries[2].use_count": 1, "pe.rich_header.entries[0].product_id": 238, "pe.rich_header.entries[1].product_id": 237, "pe.rich_header.entries[2].product_id": 240, "pe.dll_characteristics.high_entropy_va": true, "pe.rich_header.entries[0].build_number": 40116, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 40116, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 40116, "pe.rich_header.entries[2].product_name": "unknown", "pe.section_characteristics[0].raw_size": 3584, "pe.section_characteristics[1].raw_size": 1024, "pe.section_characteristics[0].virtual_size": 3384, "pe.section_characteristics[1].virtual_size": 1016, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 8192, "pe.section_characteristics[0].characteristics_hex": "40000040", "pe.section_characteristics[1].characteristics_hex": "40000040" }, "x": 6, "id": 0, "ms": { "pe": { "machine": 34404.0, "checksum": 61379.0, "has_pogo": true, "pdb_path": "wmi.pdb", "rsrc_size": 1024.0, "subsystem": 2.0, "timestamp": 1446173016.0, "image_base": 6442450944.0, "codeview_age": 1.0, "has_checksum": true, "rsrc_entropy": 3.3, "codeview_guid": "7EC1DA01-A31B-4760-B669-5D8972993448", "forward_ratio": 1.0, "size_of_image": 12288.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 8226.0, "entry_in_header": true, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 1446170181.0, "has_version_info": true, "computed_checksum": 61379.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1446173016.0, "debug_timestamp_min": 1446173016.0, "dll_characteristics": 16736.0, "has_export_timestamp": true, "linker_major_version": 12.0, "linker_minor_version": 10.0, "debug_directory_types": [ 2.0, 13.0 ], "export_forwarder_count": 45.0, "has_resource_timestamp": false, "debug_directory_entries": 2.0, "number_of_rva_and_sizes": 16.0, "system_dll_forward_count": 3.0, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 2.0 }, "file": { "size": 5632.0 }, "binary": { "data_entropy": 5.04, "export_count": 45.0, "string_count": 117.0, "section_count": 2.0, "overall_entropy": 4.17, "avg_section_size": 2304.0, "entropy_variance": 0.87, "avg_string_length": 25.4, "max_string_length": 63.0, "wide_string_count": 18.0, "avg_string_entropy": 3.63, "rsrc_to_file_ratio": 0.18, "string_length_stddev": 14.79, "debug_reference_count": 2.0, "largest_section_ratio": 0.64, "sentence_string_count": 4.0, "sentence_string_ratio": 0.03 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 464, ".rdata" ], [ 503, "@.rsrc" ], [ 1610, "WMI.dll" ], [ 1618, "CloseTrace" ], [ 1629, "api-ms-win-eventing-consumer-l1-1-0.CloseTrace" ], [ 1676, "ControlTraceA" ], [ 1690, "api-ms-win-eventing-legacy-l1-1-0.ControlTraceA" ], [ 1738, "ControlTraceW" ], [ 1752, "api-ms-win-eventing-controller-l1-1-0.ControlTraceW" ], [ 1804, "CreateTraceInstanceId" ], [ 1826, "ntdll.EtwCreateTraceInstanceId" ], [ 1857, "EnableTrace" ], [ 1869, "api-ms-win-eventing-legacy-l1-1-0.EnableTrace" ], [ 1915, "GetTraceEnableFlags" ], [ 1935, "api-ms-win-eventing-classicprovider-l1-1-0.GetTraceEnableFlags" ], [ 1998, "GetTraceEnableLevel" ], [ 2018, "api-ms-win-eventing-classicprovider-l1-1-0.GetTraceEnableLevel" ], [ 2081, "GetTraceLoggerHandle" ], [ 2102, "api-ms-win-eventing-classicprovider-l1-1-0.GetTraceLoggerHandle" ], [ 2166, "OpenTraceA" ], [ 2177, "api-ms-win-eventing-legacy-l1-1-0.OpenTraceA" ], [ 2222, "OpenTraceW" ], [ 2233, "api-ms-win-eventing-consumer-l1-1-0.OpenTraceW" ], [ 2280, "ProcessTrace" ], [ 2293, "api-ms-win-eventing-consumer-l1-1-0.ProcessTrace" ], [ 2342, "QueryAllTracesA" ], [ 2358, "api-ms-win-eventing-legacy-l1-1-0.QueryAllTracesA" ], [ 2408, "QueryAllTracesW" ], [ 2424, "api-ms-win-eventing-controller-l1-1-0.QueryAllTracesW" ], [ 2478, "RegisterTraceGuidsA" ], [ 2498, "api-ms-win-eventing-obsolete-l1-1-0.RegisterTraceGuidsA" ], [ 2554, "RegisterTraceGuidsW" ], [ 2574, "api-ms-win-eventing-classicprovider-l1-1-0.RegisterTraceGuidsW" ], [ 2637, "RemoveTraceCallback" ], [ 2657, "api-ms-win-eventing-obsolete-l1-1-0.RemoveTraceCallback" ], [ 2713, "SetTraceCallback" ], [ 2730, "api-ms-win-eventing-obsolete-l1-1-0.SetTraceCallback" ], [ 2783, "StartTraceA" ], [ 2795, "api-ms-win-eventing-legacy-l1-1-0.StartTraceA" ], [ 2841, "StartTraceW" ], [ 2853, "api-ms-win-eventing-controller-l1-1-0.StartTraceW" ], [ 2903, "TraceEvent" ], [ 2914, "ntdll.EtwLogTraceEvent" ], [ 2937, "TraceEventInstance" ], [ 2956, "ntdll.EtwTraceEventInstance" ], [ 2984, "UnregisterTraceGuids" ], [ 3005, "api-ms-win-eventing-classicprovider-l1-1-0.UnregisterTraceGuids" ], [ 3069, "WmiCloseBlock" ], [ 3083, "wmiclnt.WmiCloseBlock" ], [ 3105, "WmiDevInstToInstanceNameA" ], [ 3131, "wmiclnt.WmiDevInstToInstanceNameA" ], [ 3165, "WmiDevInstToInstanceNameW" ], [ 3191, "wmiclnt.WmiDevInstToInstanceNameW" ], [ 3225, "WmiEnumerateGuids" ], [ 3243, "wmiclnt.WmiEnumerateGuids" ], [ 3269, "WmiExecuteMethodA" ], [ 3287, "wmiclnt.WmiExecuteMethodA" ], [ 3313, "WmiExecuteMethodW" ], [ 3331, "wmiclnt.WmiExecuteMethodW" ], [ 3357, "WmiFileHandleToInstanceNameA" ], [ 3386, "wmiclnt.WmiFileHandleToInstanceNameA" ], [ 3423, "WmiFileHandleToInstanceNameW" ], [ 3452, "wmiclnt.WmiFileHandleToInstanceNameW" ], [ 3489, "WmiFreeBuffer" ], [ 3503, "wmiclnt.WmiFreeBuffer" ], [ 3525, "WmiMofEnumerateResourcesA" ], [ 3551, "wmiclnt.WmiMofEnumerateResourcesA" ], [ 3585, "WmiMofEnumerateResourcesW" ], [ 3611, "wmiclnt.WmiMofEnumerateResourcesW" ], [ 3645, "WmiNotificationRegistrationA" ], [ 3674, "wmiclnt.WmiNotificationRegistrationA" ], [ 3711, "WmiNotificationRegistrationW" ], [ 3740, "wmiclnt.WmiNotificationRegistrationW" ], [ 3777, "WmiOpenBlock" ], [ 3790, "wmiclnt.WmiOpenBlock" ], [ 3811, "WmiQueryAllDataA" ], [ 3828, "wmiclnt.WmiQueryAllDataA" ], [ 3853, "WmiQueryAllDataW" ], [ 3870, "wmiclnt.WmiQueryAllDataW" ], [ 3895, "WmiQueryGuidInformation" ], [ 3919, "wmiclnt.WmiQueryGuidInformation" ], [ 3951, "WmiQuerySingleInstanceA" ], [ 3975, "wmiclnt.WmiQuerySingleInstanceA" ], [ 4007, "WmiQuerySingleInstanceW" ], [ 4031, "wmiclnt.WmiQuerySingleInstanceW" ], [ 4063, "WmiSetSingleInstanceA" ], [ 4085, "wmiclnt.WmiSetSingleInstanceA" ], [ 4115, "WmiSetSingleInstanceW" ], [ 4137, "wmiclnt.WmiSetSingleInstanceW" ], [ 4167, "WmiSetSingleItemA" ], [ 4185, "wmiclnt.WmiSetSingleItemA" ], [ 4211, "WmiSetSingleItemW" ], [ 4229, "wmiclnt.WmiSetSingleItemW" ], [ 4256, "RSDS" ], [ 4280, "wmi.pdb" ], [ 4308, "GCTL" ], [ 4336, ".edata" ], [ 4352, ".rdata$zzzdbg" ], [ 4710, "wide", "VS_VERSION_INFO" ], [ 4802, "wide", "StringFileInfo" ], [ 4862, "wide", "CompanyName" ], [ 4888, "wide", "Microsoft Corporation" ], [ 4938, "wide", "FileDescription" ], [ 4972, "wide", "WMI DC and DP functionality" ], [ 5034, "wide", "FileVersion" ], [ 5060, "wide", "10.0.10586.0 (th2_release.151029-1700)" ], [ 5146, "wide", "InternalName" ], [ 5186, "wide", "LegalCopyright" ], [ 5216, "wide", "© Microsoft Corporation. All rights reserved." ], [ 5314, "wide", "OriginalFilename" ], [ 5348, "wide", "wmi.DLL" ], [ 5370, "wide", "ProductName" ], [ 5396, "wide", "Microsoft® Windows® Operating System" ], [ 5478, "wide", "ProductVersion" ], [ 5542, "wide", "VarFileInfo" ], [ 5574, "wide", "Translation" ] ], "sz": 5632, "ts": [ { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 45.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny PE single-function stub", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/layout::tiny-single-function-pe", "l": 3 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 0.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "190655" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 1.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-eventing-classicprovider-l1-1-0.GetTraceLoggerHandle", "api-ms-win-eventing-consumer-l1-1-0.ProcessTrace", "api-ms-win-eventing-classicprovider-l1-1-0.GetTraceEnableFlags", "api-ms-win-eventing-obsolete-l1-1-0.SetTraceCallback", "api-ms-win-eventing-obsolete-l1-1-0.RemoveTraceCallback", "api-ms-win-eventing-consumer-l1-1-0.CloseTrace", "api-ms-win-eventing-controller-l1-1-0.QueryAllTracesW", "api-ms-win-eventing-legacy-l1-1-0.EnableTrace", "api-ms-win-eventing-controller-l1-1-0.ControlTraceW", "api-ms-win-eventing-consumer-l1-1-0.OpenTraceW", "api-ms-win-eventing-legacy-l1-1-0.ControlTraceA", "api-ms-win-eventing-legacy-l1-1-0.OpenTraceA", "api-ms-win-eventing-obsolete-l1-1-0.RegisterTraceGuidsA", "api-ms-win-eventing-classicprovider-l1-1-0.RegisterTraceGuidsW", "api-ms-win-eventing-legacy-l1-1-0.QueryAllTracesA", "api-ms-win-eventing-classicprovider-l1-1-0.GetTraceEnableLevel" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 0.00" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "High ratio of forwarded exports (\u003e80%)", "e": [ "pe.forward_ratio = 1.00" ], "i": "metadata/binary/symbols/exports::high-forwarder-ratio", "l": 3 }, { "c": 1.0, "d": "Tiny PE by file size", "e": [ "pe.machine = 34404.00" ], "i": "metadata/binary/metrics/size::tiny-pe", "l": 3 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny PE stub footprint", "e": [ "190655" ], "i": "well-known/malware/trojan/shellobject/revengerat::tiny-pe-footprint", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Control Flow Guard enabled", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-cfg", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 45.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 0.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.8799999952316284, "d": "Sparse function count stub", "e": [ "binary.func_count = 0.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::sparse-function-stub", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.export_count = 45.00" ], "i": "objectives/command-and-control/backdoor/loader/native-reflect::runtime-loader-with-encoded-data-cond-4--inline-14359", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.17" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1446173016.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.EtwLogTraceEvent", "ntdll.EtwTraceEventInstance", "ntdll.EtwCreateTraceInstanceId" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "wmi.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 45.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_valid = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Windows operating system product string", "e": [ "Microsoft® Windows® Operating System" ], "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 12288.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Import count is exactly zero", "e": [ "binary.import_count = 0.00" ], "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count", "l": 2 }, { "c": 1.0, "d": "PGO-trained release build (POGO)", "e": [ "pe.has_pogo = 1.00" ], "i": "metadata/build/reproducible::pe-pgo-trained", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.63" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8799999952316284, "d": "Small string table footprint", "e": [ "binary.string_count = 117.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.17" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.8199999928474426, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "10.0.10586.0 (th2_release.151029-1700)" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 117.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 1446170181.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation", "Microsoft Corporation." ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1 }, { "c": 0.9900000095367432, "d": "Pure proxy DLL (100% forwarded exports)", "e": [ "pe.forward_ratio = 1.00" ], "i": "metadata/binary/symbols/exports::pure-proxy-dll", "l": 2 }, { "c": 0.699999988079071, "d": "No imported symbols", "e": [ "binary.import_density = 0.00" ], "i": "metadata/binary/metrics/structural::no-imports", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 0.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 2.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.export_count = 45.00" ], "i": "objectives/anti-static/obfuscation/payload/section::versioned-export-heavy-library-cond-1--inline-29160", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 1.0, "d": "Modern PE hardening (ASLR + DEP + CFG)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-modern-hardening", "l": 2 }, { "c": 0.8600000143051147, "d": "Low-code PE with no imports", "e": [ "binary.code_entropy = 0.00", "binary.import_density = 0.00" ], "i": "metadata/binary/resource::low-code-no-import-resource-stub", "l": 1 }, { "a": "T1497.003", "c": 0.7799999713897705, "d": "Microsoft export-heavy waitable timer context", "e": [ "Microsoft Corporation", "binary.export_count = 45.00" ], "i": "objectives/anti-analysis/timing/evasion::waitable-timer-export-heavy-microsoft", "l": 1, "m": "B0003.003" }, { "c": 0.8999999761581421, "d": "PE file consisting primarily of resources (e.g., .mui, UI localization)", "e": [ "binary.code_entropy = 0.00", "binary.func_count = 0.00", "binary.import_density = 0.00" ], "i": "metadata/binary/resource::resource-only-dll", "l": 2 } ], "sha": "237ef5ffc12100365442d06e61cfa8855a7a23e71546c2365688af0b900b058b", "path": "/data/samples/good/datasets/pe-machine-learning-dataset/190655", "type": "pe" } ], "tv": "6f60c" } }