{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9956173896789551, "class": 2 } ], "prob": 0.9956174, "class": 2, "models": [ { "m": "az", "prob": 0.98111963, "class": 0 }, { "m": "az/source", "prob": 0.9956174, "class": 2 }, { "m": "az/c", "prob": 0.9951656, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9958679, 0.99937946 ], "analyzed_at": "2026-05-05T12:21:37Z" }, "path": "hijak.c", "raw": { "v": "4", "fs": [ { "f": "O(As)H(Po₂)", "k": { "source.imports[0]": "CloseHandle", "source.imports[1]": "CreateToolhelp32Snapshot", "source.imports[2]": "GetLastError", "source.imports[3]": "GetThreadContext", "source.imports[4]": "OpenProcess", "source.imports[5]": "Process32First", "source.imports[6]": "Process32Next", "source.imports[7]": "ResumeThread", "source.imports[8]": "SetThreadContext", "source.imports[9]": "WaitForSingleObject", "source.strings[0]": "End sium", "source.strings[1]": "Error: %d ", "source.strings[2]": "Error: %d \\n", "source.strings[3]": "Failed to retrieve thread context ", "source.strings[4]": "Failed to retrieve thread context \\n", "source.strings[5]": "SetThreadContext Failed ", "source.strings[6]": "SetThreadContext Failed \\n", "source.strings[7]": "Thred resumed, waiting for shellcode ", "source.strings[8]": "Thred resumed, waiting for shellcode \\n", "source.strings[9]": "hijak.h", "source.has_imports": true, "source.imports[10]": "lstrlenW", "source.imports[11]": "printf", "source.imports[12]": "tolower", "source.imports[13]": "wcscmp", "source.strings[10]": "temp fun", "source.functions[0]": "GetProcess(LPWSTR processName, DWORD* pid, HANDLE* hProcess)", "source.functions[1]": "HijackThread(IN HANDLE hThread, IN PVOID pAddress)", "source.functions[2]": "temp(VOID)" }, "x": 38, "id": 0, "is": [ "CreateToolhelp32Snapshot", "Process32First", "printf", "GetLastError", "CloseHandle", "Process32Next", "lstrlenW", "tolower", "wcscmp", "OpenProcess", "printf", "GetLastError", "CloseHandle", "CloseHandle", "printf", "GetThreadContext", "printf", "SetThreadContext", "printf", "ResumeThread", "printf", "WaitForSingleObject", "printf", "CloseHandle" ], "ms": { "file": { "size": 1789.0 }, "text": { "tab_count": 115.0, "digit_ratio": 0.03, "space_count": 139.0, "total_lines": 72.0, "char_entropy": 5.54, "unique_chars": 78.0, "escape_density": 0.06, "import_density": 33.33, "string_density": 0.22, "avg_line_length": 23.85, "max_line_length": 81.0, "empty_line_ratio": 0.21, "last_line_length": 1.0, "most_common_char": "e", "whitespace_ratio": 0.18, "most_common_ratio": 0.06, "identifier_density": 1.26, "line_length_stddev": 21.89, "octal_escape_count": 1.0, "normalized_import_count": 2.83, "normalized_string_count": 1.89, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.35, "imports_to_functions_ratio": 8.0, "strings_to_functions_ratio": 5.33, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 7.13, "identifiers_to_functions_ratio": 14.67 }, "imports": { "total": 24.0, "unique_modules": 14.0, "third_party_count": 24.0, "third_party_ratio": 1.0 }, "strings": { "total": 16.0, "avg_length": 17.88, "max_length": 39.0, "avg_entropy": 3.22, "total_bytes": 286.0, "entropy_stddev": 0.54 }, "comments": { "chars": 24.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.01 }, "functions": { "total": 3.0, "length_stddev": 14.31, "avg_name_length": 40.0, "no_params_count": 3.0, "avg_length_lines": 22.0, "max_length_lines": 39.0, "min_length_lines": 4.0, "high_entropy_names": 2.0, "density_per_100_lines": 4.17, "code_in_functions_ratio": 0.92 }, "identifiers": { "total": 91.0, "avg_length": 11.43, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.89, "reuse_ratio": 0.48, "unique_count": 44.0, "length_stddev": 5.89, "has_digit_ratio": 0.14, "sequential_names": 1.0, "base64_like_names": 3.0, "single_char_count": 1.0, "single_char_ratio": 0.02, "high_entropy_count": 6.0, "high_entropy_ratio": 0.14, "all_lowercase_ratio": 0.16, "all_uppercase_ratio": 0.32, "numeric_suffix_count": 2.0 } }, "ss": [ [ 9, "hijak.h" ], [ 10, "hijak.h" ], [ 311, "Error: %d \\n" ], [ 312, "Error: %d " ], [ 1000, "Error: %d \\n" ], [ 1001, "Error: %d " ], [ 1170, "temp fun" ], [ 1171, "temp fun" ], [ 1415, "Failed to retrieve thread context \\n" ], [ 1416, "Failed to retrieve thread context " ], [ 1558, "SetThreadContext Failed \\n" ], [ 1559, "SetThreadContext Failed " ], [ 1640, "Thred resumed, waiting for shellcode \\n" ], [ 1641, "Thred resumed, waiting for shellcode " ], [ 1734, "End sium" ], [ 1735, "End sium" ] ], "sz": 1789, "ts": [ { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Get first process from snapshot", "e": [ "Process32First" ], "i": "micro-behaviors/process/enumerate/snapshot::process32-first-source", "l": 3 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process-source", "l": 2 }, { "a": "T1057", "c": 0.8500000238418579, "d": "CreateToolhelp32Snapshot API string", "e": [ "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot-string", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "PATH" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-13", "l": 1, "m": "B0032" }, { "a": "T1057", "c": 0.8999999761581421, "d": "Create process or module snapshot", "e": [ "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot-source", "l": 3, "m": "E1057" }, { "a": "T1057", "c": 0.8999999761581421, "d": "Enumerate next process in snapshot", "e": [ "Process32Next" ], "i": "micro-behaviors/process/enumerate/snapshot::process32-next-source", "l": 3 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1055.003", "c": 0.8999999761581421, "d": "Suspend remote thread execution", "e": [ "SuspendThread" ], "i": "micro-behaviors/process/info/thread::suspend-thread", "l": 4 }, { "a": "T1055.003", "c": 0.9200000166893005, "d": "Read thread execution context", "e": [ "GetThreadContext" ], "i": "micro-behaviors/process/info/thread::get-thread-context", "l": 3 }, { "a": "T1055.003", "c": 0.8999999761581421, "d": "Resume remote thread execution", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/info/thread::resume-thread", "l": 4 }, { "a": "T1055.003", "c": 0.9399999976158142, "d": "Modify thread execution context", "e": [ "SetThreadContext" ], "i": "micro-behaviors/process/info/thread::set-thread-context", "l": 3 }, { "a": "T1057", "c": 0.8999999761581421, "d": "Toolhelp process enumeration in source", "e": [ "Process32Next", "CreateToolhelp32Snapshot", "Process32First" ], "i": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration-source", "l": 3 } ], "sha": "239fcce9ff8e0b6cfb9466aea846735b6a25ff277d6a1a6e3c143744a65336fc", "path": "hijak.c", "type": "c" } ], "tv": "27ac5" } }