{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.06094364449381828, "class": 0 } ], "prob": 0.060943644, "class": 0, "models": [ { "m": "az", "prob": 0.060943644, "class": 0 }, { "m": "az/native", "prob": 0.0, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-25T23:05:05Z" }, "path": "VirusShare_bb8f11088865a51cb82d9ad4bec9369d", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 4, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 200704.0, "entropy": 2.9, "size_bytes": 200704.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 231, "u8", "9Rich" ], [ 512, "u8", ".text" ], [ 591, "u8", "@.data" ], [ 672, "u8", ".rsrc" ], [ 711, "u8", "@.reloc" ], [ 3562, "u8", "5ntel" ], [ 3572, "u8", "5Genu" ], [ 4196, "u8", "RSDS" ], [ 4220, "unicode-escape", "F:\\Office\\Target†\\ship\\postc2r\\xone\\msosqm.pdb" ], [ 4272, "u8", "ne\\msosqm.pdb" ], [ 5248, "u8", ".rdata" ], [ 5264, "u8", ".rdata$sxdata" ], [ 5288, "u8", ".rdata$zzzdbg" ], [ 5492, "u8", ".data" ], [ 5508, "u8", ".bss" ], [ 5796, "u8", "KERNEL32.dll" ], [ 5812, "u8", "api-ms-win-crt-locale-l1-1-0.dll" ], [ 5848, "u8", "api-ms-win-crt-stdio-l1-1-0.dll" ], [ 5880, "u8", "api-ms-win-crt-math-l1-1-0.dll" ], [ 5912, "u8", "api-ms-win-crt-runtime-l1-1-0.dll" ], [ 5948, "u8", "api-ms-win-crt-heap-l1-1-0.dll" ], [ 5980, "base64", "T$T52\f\u0013^4" ], [ 6210, "u8", "_except_handler4_common" ], [ 6236, "u8", "memset" ], [ 6246, "u8", "__telemetry_main_return_trigger" ], [ 6280, "u8", "__telemetry_main_invoke_trigger" ], [ 6314, "u8", "_set_new_mode" ], [ 6330, "u8", "terminate" ], [ 6342, "u8", "_controlfp_s" ], [ 6358, "u8", "_register_onexit_function" ], [ 6386, "u8", "_initialize_onexit_table" ], [ 6414, "u8", "_cexit" ], [ 6424, "u8", "__p___argv" ], [ 6438, "u8", "__p___argc" ], [ 6452, "u8", "_c_exit" ], [ 6470, "u8", "exit" ], [ 6478, "u8", "_initterm_e" ], [ 6492, "u8", "_initterm" ], [ 6504, "u8", "_get_initial_narrow_environment" ], [ 6538, "u8", "_initialize_narrow_environment" ], [ 6572, "u8", "_configure_narrow_argv" ], [ 6598, "u8", "_crt_atexit" ], [ 6612, "u8", "_set_app_type" ], [ 6628, "u8", "_seh_filter_exe" ], [ 6646, "u8", "_register_thread_local_exe_atexit_callback" ], [ 6692, "u8", "__setusermatherr" ], [ 6712, "u8", "__p__commode" ], [ 6728, "u8", "_set_fmode" ], [ 6742, "u8", "_configthreadlocale" ], [ 6764, "u8", "GetProcessHeap" ], [ 6782, "u8", "HeapSetInformation" ], [ 6804, "u8", "GetCurrentProcessId" ], [ 6826, "u8", "GetCurrentThreadId" ], [ 6848, "u8", "GetSystemTimeAsFileTime" ], [ 6874, "u8", "GetTickCount" ], [ 6890, "u8", "VirtualProtect" ], [ 6908, "u8", "WerRegisterMemoryBlock" ], [ 6934, "u8", "GetModuleHandleW" ], [ 6954, "u8", "IsDebuggerPresent" ], [ 6974, "u8", "InitializeSListHead" ], [ 6996, "u8", "IsProcessorFeaturePresent" ], [ 7024, "u8", "TerminateProcess" ], [ 7044, "u8", "GetCurrentProcess" ], [ 7064, "u8", "SetUnhandledExceptionFilter" ], [ 7094, "u8", "UnhandledExceptionFilter" ], [ 7122, "u8", "QueryPerformanceCounter" ], [ 7860, "u8", "AppVIsvSubsystems32.dll" ], [ 53507, "u8", "IHDR" ], [ 53553, "u8", "IDATx" ], [ 55646, "u8", "IEND" ], [ 173494, "wide", "VS_VERSION_INFO" ], [ 173586, "wide", "StringFileInfo" ], [ 173646, "wide", "CompanyName" ], [ 173672, "wide", "Microsoft Corporation" ], [ 173722, "wide", "FileDescription" ], [ 173756, "wide", "Microsoft Office component" ], [ 173818, "wide", "FileVersion" ], [ 173882, "wide", "InternalName" ], [ 173908, "wide", "MsoSqm" ], [ 173930, "wide", "LegalTrademarks1" ], [ 173964, "wide", "Microsoft® is a registered trademark of Microsoft Corporation." ], [ 174098, "wide", "LegalTrademarks2" ], [ 174132, "wide", "Windows® is a registered trademark of Microsoft Corporation." ], [ 174262, "wide", "OriginalFilename" ], [ 174296, "wide", "MsoSqm.exe" ], [ 174326, "wide", "ProductName" ], [ 174352, "wide", "Microsoft Office 2016" ], [ 174402, "wide", "ProductVersion" ], [ 174470, "wide", "MOSEVersion" ], [ 174496, "wide", "BETA" ], [ 174514, "wide", "VarFileInfo" ], [ 174546, "wide", "Translation" ], [ 174576, "u8", "FE2X" ], [ 175668, "u8", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ], [ 176844, "u8", "Washington1" ], [ 176865, "u8", "Redmond1" ], [ 176883, "u8", "Microsoft Corporation1!0" ], [ 176915, "u8", "Microsoft Time-Stamp PCA0" ], [ 176943, "u8", "160330192129Z" ], [ 176958, "u8", "170630192129Z0" ], [ 177037, "u8", "Microsoft Corporation1" ], [ 177084, "u8", "nCipher DSE ESN:B1B7-F67F-FEC21%0#" ], [ 177125, "u8", "Microsoft Time-Stamp Service0" ], [ 177527, "u8", "M0K0I" ], [ 177537, "u8", "Chttp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" ], [ 177618, "u8", "L0J0H" ], [ 177634, "u8", "\u003chttp://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" ], [ 177875, "u8", "/iqS" ], [ 178106, "u8", "Microsoft Corporation1#0!" ], [ 178138, "u8", "Microsoft Code Signing PCA0" ], [ 178168, "u8", "150604174245Z" ], [ 178183, "u8", "160904174245Z0" ], [ 178294, "u8", "MOPR1" ], [ 178309, "u8", "Microsoft Corporation0" ], [ 178681, "u8", "a740Q" ], [ 178696, "u8", "F0D1" ], [ 178710, "u8", "MOPR1301" ], [ 178808, "u8", "O0M0K" ], [ 178818, "u8", "Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" ], [ 178901, "u8", "N0L0J" ], [ 178917, "u8", "\u003ehttp://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" ], [ 179336, "u8", "microsoft1-0+" ], [ 179356, "u8", "$Microsoft Root Certificate Authority0" ], [ 179397, "u8", "100831221932Z" ], [ 179412, "u8", "200831222932Z0y1" ], [ 180036, "u8", "I0G0E" ], [ 180046, "u8", "?http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" ], [ 180123, "u8", "H0F0D" ], [ 180139, "u8", "8http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" ], [ 180869, "u8", "070403125309Z" ], [ 180884, "u8", "210403130309Z0w1" ], [ 181499, "u8", "$Microsoft Root Certificate Authority" ], [ 182386, "u8", "Microsoft Code Signing PCA" ], [ 182562, "wide", "Microsoft Offic" ], [ 182599, "u8", "http://office.microsoft.com 0" ], [ 183032, "u8", "Microsoft Time-Stamp PCA" ], [ 183536, "u8", "N0L0" ], [ 183733, "u8", "Microsoft Corporation1(0\u0026" ], [ 183765, "u8", "Microsoft Code Signing PCA 20110" ], [ 183800, "u8", "151028203146Z" ], [ 183815, "u8", "170128203146Z0" ], [ 184462, "u8", "Chttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" ], [ 184543, "u8", "U0S0Q" ], [ 184559, "u8", "Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" ], [ 185281, "u8", "Microsoft Corporation1200" ], [ 185312, "u8", ")Microsoft Root Certificate Authority 20110" ], [ 185358, "u8", "110708205909Z" ], [ 186219, "u8", "S0Q0O" ], [ 186229, "u8", "Ihttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" ], [ 186316, "u8", "R0P0N" ], [ 186332, "u8", "Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" ], [ 186443, "u8", "3http://www.microsoft.com/pkiops/docs/primarycps.htm0@" ], [ 186514, "wide", "Legal_policy_statement‮" ], [ 187061, "u8", "WqVNHE" ], [ 187204, "u8", "Microsoft Code Signing PCA 2011" ], [ 188079, "u8", "nCipher DSE ESN:728D-C45F-F9EB1%0#" ], [ 188120, "u8", "Microsoft Time-Stamp Service" ], [ 188289, "u8", ")Microsoft Root Certificate Authority 20100" ], [ 188335, "u8", "100701213655Z" ], [ 188428, "u8", "Microsoft Corporation1\u00260$" ], [ 188460, "u8", "Microsoft Time-Stamp PCA 20100" ], [ 188948, "u8", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" ], [ 189047, "u8", "\u003ehttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" ], [ 189157, "u8", "1http://www.microsoft.com/PKI/docs/CPS/default.htm0@" ], [ 189226, "wide", "Legal_Policy_Statement‮" ], [ 189984, "u8", "160330192425Z" ], [ 189999, "u8", "170630192425Z0" ], [ 190578, "u8", "Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" ], [ 190677, "u8", "\u003ehttp://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" ], [ 191414, "u8", "nCipher NTS ESN:4DE9-0C5E-3E091+0)" ], [ 191454, "u8", "\"Microsoft Time Source Master Clock0" ], [ 191515, "u8", "20160613165654Z" ], [ 191532, "u8", "20160614165654Z0w0=" ], [ 192055, "u8", "Microsoft Time-Stamp PCA 2010" ], [ 192496, "u8", "Odjf" ] ], "v": { "pe.machine": "i386", "pe.subsystem": "windows_cui", "pe.timestamp": 1465044327, "pe.image_base": 4194304, "pe.image_size": 192512, "pe.machine_id": 332, "pe.os_version": "6.1", "pe.entry_point": 4858, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 3, "pe.file_alignment": 512, "pe.cert_table_size": 16072, "pe.section_alignment": 4096, "pe.subsystem_version": "6.1", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.linker_major_version": 14, "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].serial": "330000010a2c79aed7797ba6ac00010000010a", "pe.signatures[0].subject": "CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2016-09-04T17:42:45Z", "pe.signatures[0].not_before": "2015-06-04T17:42:45Z", "pe.coff.dos_header_pe_pointer": 264, "pe.signatures[0].nested.issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].nested.serial": "330000006447849486db411938000000000064", "pe.signatures[0].nested.subject": "CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].nested.verified": true, "pe.signatures[0].thumbprint_sha1": "3bda323e552db1fde5f4fbee75d6d5b2b187eedc", "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].nested.not_after": "2017-01-28T20:31:46Z", "pe.signatures[0].signature_digest": "5f4458a1e717cad3d0bf470541f3247686c7b5f5", "pe.signatures[0].nested.not_before": "2015-10-28T20:31:46Z", "pe.signatures[0].thumbprint_sha256": "67c529ad57b2aedd4d248993324270c7064d4f6bdaaf70044d772d05c56001a4", "pe.signatures[0].signature_algorithm": "sha1WithRSAEncryption", "pe.signatures[0].nested.thumbprint_sha1": "54da79490495aa6d7898b183d86ea600e3fc5ebf", "pe.signatures[0].nested.cert_chain_depth": 2, "pe.signatures[0].nested.digest_algorithm": "sha256", "pe.signatures[0].nested.eku_code_signing": true, "pe.signatures[0].nested.signature_digest": "267a7b8049308944ca607424bc1e13c7905b9072d16dc61d713133164d3473e1", "pe.signatures[0].nested.thumbprint_sha256": "984b16c29a722998185c5603201c8f3e8c7f221cd9869f5d809ecb86f06ee283", "pe.signatures[0].nested.signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1", "pe.signatures[0].nested.signature_digest_algorithm": "sha256" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 200704, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/unknown::microsoft-corporation", "l": 2 }, { "c": 1.0, "d": "Signed by Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/leaf::microsoft-corporation", "l": 3 }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "c": 0.949999988079071, "d": "Microsoft code-signing certificate chain", "e": [ "Microsoft Code Signing PCA 2011" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "l": 2 }, { "c": 0.9700000286102295, "d": "Office AppV sideload DLL reference", "e": [ "AppVIsvSubsystems32.dll" ], "i": "objectives/command-and-control/dropper/sideload::office-appv-sideload-dll-ref", "l": 1 }, { "a": "T1036", "c": 0.8999999761581421, "d": "Dense Microsoft certificate text", "e": [ "Microsoft® is a registered trademark of Microsoft Corporation.", "Microsoft Corporation1200", "Microsoft Corporation1", "Microsoft Corporation", "Microsoft Corporation1!0", "Windows® is a registered trademark of Microsoft Corporation.", "Microsoft Corporation1(0\u0026", "Microsoft Corporation0", "Microsoft Corporation1\u00260$", "Microsoft Corporation1#0!" ], "i": "objectives/evasion/masquerade/binary::dense-microsoft-cert-text", "l": 1, "m": "OB0006" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "msosqm.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.949999988079071, "d": "Microsoft timestamp certificate chain", "e": [ "Microsoft Time-Stamp Service", "Microsoft Time-Stamp PCA 2010" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_bb8f11088865a51cb82d9ad4bec9369d" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2 }, { "c": 1.0, "d": "Issued by a Microsoft Code Signing PCA", "e": [ "CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US" ], "i": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.9900000095367432, "d": "Office postc2r build-pipeline PDB path", "e": [ "F:\\Office\\Target†\\ship\\postc2r\\xone\\msosqm.pdb" ], "i": "objectives/command-and-control/dropper/sideload::office-postc2r-pdb-path", "l": 1 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "MicrosoftTimeStampPCA", "SetUnhandledExceptionFilter", "WerRegisterMemoryBlock", "GetSystemTimeAsFileTime", "InitializeSListHead", "UnhandledExceptionFilter", "GetCurrentProcessId" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 200704 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 1.0, "d": "Microsoft certificate chain markers", "e": [ "Microsoft Corporation", "Microsoft Time-Stamp PCA 2010", "Microsoft Code Signing PCA 2011", "Microsoft Time-Stamp Service" ], "i": "metadata/signed/platform::microsoft-certificate-chain", "l": 1 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "\u003cbinary data\u003e \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 } ], "sha": "269d435052126d52b770bb4154e8379e0dd9c1b9ba06a7b946074f7c05931f94", "path": "VirusShare_bb8f11088865a51cb82d9ad4bec9369d", "type": "pe" } ], "tv": "7924e" } }