{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.0032894737, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T09:12:04Z" }, "path": "agent.exe", "raw": { "v": "5", "fs": [ { "f": "O(Er)H(Po)", "x": 4, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 24088.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 6144.0, "entropy": 4.13, "size_bytes": 6144.0 }, "binary": { "is_pie": 1.0, "code_entropy": 4.95, "string_count": 155.0, "entropy_variance": 3.96, "avg_string_length": 12.32, "max_string_length": 54.0, "code_to_data_ratio": 1.0, "string_length_stddev": 9.81, "largest_section_ratio": 0.67, "sentence_string_count": 9.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 4096.0, "entropy_max": 4.95, "entropy_mean": 2.45, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 1856, "u8", "BSJB" ], [ 2557, "u8", "\u003cModule\u003e" ], [ 2566, "u8", "QNXAgent" ], [ 2575, "u8", "Program" ], [ 2583, "u8", "C2Host" ], [ 2590, "u8", "SafetyFile" ], [ 2606, "u8", "File" ], [ 2611, "u8", "System.IO" ], [ 2621, "u8", "Exists" ], [ 2628, "u8", "Int64" ], [ 2634, "u8", "System" ], [ 2641, "u8", "Stopwatch" ], [ 2651, "u8", "System.Diagnostics" ], [ 2670, "u8", "StartNew" ], [ 2679, "u8", "Math" ], [ 2684, "u8", "Sqrt" ], [ 2693, "u8", "Console" ], [ 2701, "u8", "get_Error" ], [ 2711, "u8", "TextWriter" ], [ 2722, "u8", "Write" ], [ 2728, "u8", "Stop" ], [ 2733, "u8", "get_ElapsedTicks" ], [ 2750, "u8", "Thread" ], [ 2757, "u8", "System.Threading" ], [ 2774, "u8", "Sleep" ], [ 2780, "u8", "DateTime" ], [ 2800, "u8", "op_Subtraction" ], [ 2815, "u8", "TimeSpan" ], [ 2824, "u8", "get_TotalMilliseconds" ], [ 2846, "u8", "GetTimestamp" ], [ 2859, "u8", "Frequency" ], [ 2869, "u8", "String" ], [ 2876, "u8", "Concat" ], [ 2883, "u8", "Format" ], [ 2890, "u8", "binary" ], [ 2897, "u8", "arguments" ], [ 2907, "u8", "ProcessStartInfo" ], [ 2924, "u8", ".ctor" ], [ 2930, "u8", "set_FileName" ], [ 2943, "u8", "set_Arguments" ], [ 2957, "u8", "set_UseShellExecute" ], [ 2977, "u8", "set_RedirectStandardOutput" ], [ 3004, "u8", "set_RedirectStandardError" ], [ 3030, "u8", "set_CreateNoWindow" ], [ 3049, "u8", "Process" ], [ 3057, "u8", "Start" ], [ 3063, "u8", "WaitForExit" ], [ 3075, "u8", "get_HasExited" ], [ 3089, "u8", "Kill" ], [ 3094, "u8", "IDisposable" ], [ 3106, "u8", "Dispose" ], [ 3114, "u8", "Object" ], [ 3121, "u8", "Environment" ], [ 3133, "u8", "GetEnvironmentVariable" ], [ 3156, "u8", "Path" ], [ 3161, "u8", "Combine" ], [ 3169, "u8", "Main" ], [ 3174, "u8", "AntiAnalysisTiming" ], [ 3193, "u8", "LolbinExecution" ], [ 3209, "u8", "RunLolbin" ], [ 3219, "u8", ".cctor" ], [ 3226, "u8", "agent" ], [ 3232, "u8", "RuntimeCompatibilityAttribute" ], [ 3262, "u8", "System.Runtime.CompilerServices" ], [ 3294, "u8", "mscorlib" ], [ 3303, "u8", "agent.exe" ], [ 3318, "u8", "/bin/sh" ], [ 3334, "u8", "/usr/bin/sh" ], [ 3358, "u8", "/bin/curl" ], [ 3378, "u8", "/usr/bin/curl" ], [ 3406, "u8", "http://" ], [ 3422, "u8", "/beacon" ], [ 3438, "u8", "-c \"exec {0} -s -m 10 -o /dev/null {1}\"" ], [ 3518, "u8", "/bin/wget" ], [ 3538, "u8", "/usr/bin/wget" ], [ 3566, "u8", "/config" ], [ 3582, "u8", "-c \"exec {0} -q -O /dev/null {1}\"" ], [ 3650, "u8", "-c \"exec uname -a\"" ], [ 3688, "u8", "-c \"exec {0} -s -m 10 -o /dev/null http://{1}/env\"" ], [ 3790, "u8", "qnx-csharp-timing-lolbin-b90ba.benchmark.atomdrift.org" ], [ 3900, "u8", "HOME" ], [ 3910, "u8", ".dbbkgy" ], [ 4163, "u8", "WrapNonExceptionThrows" ], [ 4270, "u8", "mscoree.dll" ], [ 4702, "wide", "VS_VERSION_INFO" ], [ 4794, "wide", "VarFileInfo" ], [ 4826, "wide", "Translation" ], [ 4862, "wide", "StringFileInfo" ], [ 4898, "wide", "007f04b0" ], [ 4922, "wide", "Comments" ], [ 4950, "wide", "CompanyName" ], [ 4986, "wide", "FileDescription" ], [ 5030, "wide", "FileVersion" ], [ 5078, "wide", "InternalName" ], [ 5104, "wide", "agent" ], [ 5122, "wide", "LegalCopyright" ], [ 5162, "wide", "LegalTrademarks" ], [ 5206, "wide", "OriginalFilename" ], [ 5240, "wide", "agent.exe" ], [ 5266, "wide", "ProductName" ], [ 5302, "wide", "ProductVersion" ] ], "v": { "file.stem": "agent", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_cui", "file.basename": "agent.exe", "pe.image_base": 4194304, "pe.image_size": 32768, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 11966, "pe.headers_size": 512, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "01b1136e8990c0f97f19b9e2a76d5934f0a11431", "pe.version.company": " ", "pe.version.comments": " ", "pe.image_hash.sha256": "07669551e1cf6564d6721d66651d68d73cbf882fcb023b16d3e4b065cbadcbf0", "pe.image_hash.sha384": "7c39fdc8fd919f488232f66c1578fbb904d550b1394f0ba371ed0bcb53f8f2b97ac3a2741520ac461dab408426cd61a6", "pe.image_hash.sha512": "c78657ab4d864c0844b63dc495cd389f4820620c0d7b73fdfb61dd3608851075782b33391380be8388d94185e89a5061523ef09ea18dc29577e395dc0f253867", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": " ", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.version.trademarks": " ", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.version.description": " ", "pe.linker_major_version": 8, "pe.version.file_version": "0.0.0.0", "pe.version.product_name": " ", "pe.version.internal_name": "agent", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 11888, "pe.data_directories[1].rva": 16384, "pe.data_directories[2].rva": 24576, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": " ", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 728, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.version.original_filename": "agent.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1 }, "id": "pe", "sc": [ [ ".text", 512, 4096, 4.95, "r-x" ], [ ".rsrc", 4608, 1024, 2.32, "r--" ], [ ".reloc", 5632, 512, 0.08, "r--" ] ] }, "id": 0, "sz": 6144, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x740" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x740" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "c": 0.6000000238418579, "d": ".NET Process class token", "e": [ "Process" ], "i": "micro-behaviors/process/create/spawn::process-class-token-dotnet", "l": 1, "el": [ "0xbe9" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x1492" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "0.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x10ae" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x10ae" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0xa33" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.550000011920929, "d": ".NET Start method token", "e": [ "Start" ], "i": "micro-behaviors/process/create/spawn::start-method-token-dotnet", "l": 1, "el": [ "0xbf1" ] }, { "c": 0.7799999713897705, "d": "Process shell execute configuration", "e": [ "set_UseShellExecute" ], "i": "objectives/evasion/process/hidden/execution::use-shell-execute", "l": 1, "el": [ "0xb8d" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x137a" ] }, { "c": 0.8199999928474426, "d": ".NET child stdout redirection", "e": [ "set_RedirectStandardOutput" ], "i": "micro-behaviors/process/create/spawn::redirect-standard-output-dotnet", "l": 3, "el": [ "0xba1" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 155.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0xcde" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "a": "T1036", "c": 0.949999988079071, "d": "PE FileDescription is single-character placeholder", "e": [ " " ], "i": "objectives/evasion/masquerade/identity/fabricated::pe-file-description-single-char", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.7200000286102295, "d": "Path combination helper token", "e": [ "Combine" ], "i": "micro-behaviors/fs/temp/directory::path-combine-token", "l": 1, "el": [ "0xc59" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1105", "c": 0.75, "d": ".NET environment variable token", "e": [ "GetEnvironmentVariable" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::dotnet-getenvironmentvariable-token", "l": 1, "el": [ "0xc3d" ] }, { "a": "T1036", "c": 0.949999988079071, "d": "PE CompanyName is single-character placeholder", "e": [ " " ], "i": "objectives/evasion/masquerade/identity/fabricated::pe-company-name-single-char", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": ".NET child stderr redirection", "e": [ "set_RedirectStandardError" ], "i": "micro-behaviors/process/create/spawn::redirect-standard-error-dotnet", "l": 3, "el": [ "0xbbc" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x13d6" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x1456" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x125e" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "String" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x12fe", "0xb35" ] }, { "a": "T1105", "c": 0.8999999761581421, "d": "ProcessStartInfo execution token", "e": [ "ProcessStartInfo" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::processstartinfo-exec-token", "l": 1, "el": [ "0xb5b" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0xce7" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": ".NET Process type token", "e": [ "ProcessStartInfo" ], "i": "micro-behaviors/process/create/spawn::process-token-dotnet", "l": 1, "el": [ "0xb5b" ] }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "agent.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "agent.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x1356" ] }, { "c": 0.8999999761581421, "d": "Tiny PE stub footprint", "e": [ "agent.exe" ], "i": "well-known/malware/trojan/shellobject/revengerat::tiny-pe-footprint", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "0xa5b" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "RuntimeCompatibilityAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xca0" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "agent.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0xce7" ] }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 6144 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1564.003", "c": 0.8600000143051147, "d": ".NET process window suppression", "e": [ "set_CreateNoWindow" ], "i": "micro-behaviors/process/create/hidden::dotnet-create-no-window", "l": 2, "el": [ "0xbd6" ] }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariable" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001", "el": [ "0xc3d" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.6000000238418579, "d": "Beacon keyword (neutral context)", "e": [ "beacon" ], "i": "micro-behaviors/data/text/keywords/c2::beacon", "l": 1, "el": [ "0xd5e" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.8799999952316284, "d": ".NET child process stdio redirection", "e": [ "set_RedirectStandardError", "set_RedirectStandardOutput", "ProcessStartInfo" ], "i": "micro-behaviors/process/create/spawn::dotnet-redirected-stdio", "l": 3, "el": [ "0xbbc", "0xba1", "0xb5b" ] }, { "c": 0.9200000166893005, "d": ".NET hidden process launch setup", "e": [ "set_CreateNoWindow", "set_UseShellExecute", "ProcessStartInfo" ], "i": "objectives/evasion/process/hidden/execution::dotnet-hidden-process-launch", "l": 3, "el": [ "0xbd6", "0xb8d", "0xb5b" ] } ], "sha": "24a71452e1a9dd4597d8ec6c861a6d5fc7efc29f8a896baa98db5a830efe65bd", "path": "/data/samples/bad/synthetic/crucible/qnx-csharp-timing-lolbin-b90ba/agent.exe", "type": "pe" } ], "tv": "52045" } }