{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9999934434890747, "class": 2, "threshold": 0.9999842643737793 } ], "prob": 0.99999344, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.99989665, "class": 0 }, { "m": "az/native", "prob": 0.99990284, "class": 0 }, { "m": "az/pe", "prob": 1.0, "class": 1 } ], "version": "v17.17", "threshold": 0.99998426, "analyzed_at": "2026-05-31T14:59:10Z" }, "path": "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14.exe", "raw": { "v": "5", "fs": [ { "f": "O(As₃)Md₃(Bi₄BkHe)", "x": 77, "ff": { "i": [ [ "kernel32", "GetModuleHandleA" ], [ "user32", "GetCursor" ], [ "advapi32", "RegOpenKeyExW" ], [ "shell32", "SHGetIconOverlayIndexA" ], [ "comctl32", "ImageList_SetBkColor" ], [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 715807.0, "icon_count": 2.0, "has_overlay": 1.0, "overlay_end": 653744.0, "has_manifest": 1.0, "overlay_size": 254548.0, "checksum_valid": 1.0, "overlay_offset": 399196.0, "resource_count": 6.0, "overlay_padding": 254715.0, "has_version_info": 1.0, "computed_checksum": 715807.0, "dos_stub_modified": 1.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "entry_in_writable_section": 1.0 }, "file": { "size": 653744.0, "entropy": 7.41, "size_bytes": 653744.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 8.0, "data_entropy": 3.85, "overlay_size": 254548.0, "string_count": 5942.0, "overlay_ratio": 0.39, "overlay_entropy": 8.0, "entropy_variance": 2.88, "avg_string_length": 4.89, "max_string_length": 487.0, "code_to_data_ratio": 1.0, "string_length_stddev": 6.74, "largest_section_ratio": 0.45, "sentence_string_count": 6.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 6.0 }, "sections": { "count": 4.0, "code_size": 105308.0, "entropy_max": 8.0, "entropy_mean": 6.02, "name_entropy": 3.15, "writable_count": 2.0, "executable_count": 2.0, "nonstandard_count": 1.0, "executable_writable_count": 1.0 }, "dependencies": { "count": 6.0 } }, "s": [ [ 504, "u8", ".shared" ], [ 584, "u8", ".rsrc" ], [ 623, "u8", "@.text" ], [ 1260, "u8", "kernel32.dll" ], [ 1280, "u8", "GetModuleHandleA" ], [ 1299, "u8", "user32.dll" ], [ 1317, "u8", "GetCursor" ], [ 1328, "u8", "advapi32.dll" ], [ 1348, "u8", "RegOpenKeyExW" ], [ 1363, "u8", "shell32.dll" ], [ 1381, "u8", "SHGetIconOverlayIndexA" ], [ 1406, "u8", "comctl32.dll" ], [ 1426, "u8", "ImageList_SetBkColor" ], [ 1449, "u8", "mscoree.dll" ], [ 2171, "u8", "M569" ], [ 2235, "u8", "M210" ], [ 3836, "u8", "679B" ], [ 7296, "u8", "pppYnmm" ], [ 7323, "u8", "t~~~Z}}}B|||.zzz" ], [ 17572, "u8", "fff1feeveee" ], [ 18180, "u8", "zzz~zzzezzzKzzz9yyy)xyy" ], [ 18732, "u8", "|||l{{{R{{{:yyy,yyy" ], [ 19287, "u8", "[{{{Ayyy-www!uuu" ], [ 20595, "u8", "7IHHm" ], [ 84563, "u8", "IHDR" ], [ 84589, "u8", "IDATx" ], [ 86286, "u8", "4ett" ], [ 86421, "u8", "1677" ], [ 86562, "u8", "j177" ], [ 86898, "u8", "Q677" ], [ 87012, "u8", "h0\u003c\u003c" ], [ 87303, "u8", "...255" ], [ 87351, "u8", "g.smq" ], [ 87383, "u8", "Ucbl" ], [ 87626, "u8", "P1VJ6" ], [ 88034, "u8", "v155" ], [ 89014, "u8", "o022" ], [ 89215, "u8", "CVjuu" ], [ 89740, "u8", "N379L" ], [ 89819, "u8", "h099" ], [ 90170, "u8", "6668y" ], [ 90202, "u8", "5333" ], [ 90227, "u8", "4EJYx" ], [ 90879, "u8", "3g8q" ], [ 91193, "u8", "177G" ], [ 91203, "u8", "eLLLp" ], [ 91749, "u8", "Lqfq" ], [ 91832, "u8", "S666" ], [ 92490, "u8", "h4h6" ], [ 92676, "u8", "krLfA" ], [ 92827, "u8", "144T" ], [ 92937, "u8", "Oeks" ], [ 93111, "u8", "vhEc" ], [ 94278, "u8", "YrmHs" ], [ 94522, "u8", "iEEqx" ], [ 95648, "u8", "go0nK" ], [ 96275, "u8", "TLRK" ], [ 97043, "u8", "incaLX" ], [ 97063, "u8", "9g1y" ], [ 98438, "u8", "5RIF" ], [ 98486, "u8", "SxA54" ], [ 99017, "u8", "492I" ], [ 100786, "u8", "I24Ckb" ], [ 100907, "u8", "BURA" ], [ 102078, "u8", "VOBO" ], [ 103153, "u8", "auNz" ], [ 104924, "u8", "YxBHw" ], [ 105901, "u8", "Unkt" ], [ 106609, "u8", "NYj; D" ], [ 107670, "u8", "Eeq90L" ], [ 107679, "u8", "J79D" ], [ 108992, "u8", "3::F" ], [ 109001, "u8", "222B" ], [ 110059, "u8", "LLN2\u003e\u003e" ], [ 110110, "u8", "7XZZ" ], [ 112084, "u8", "Xgme" ], [ 112981, "u8", "N_CN" ], [ 113037, "u8", "9VWW" ], [ 113102, "u8", "94YIT" ], [ 113512, "u8", "JMMXr" ], [ 113558, "u8", "LbfwM" ], [ 114713, "u8", "t.ko" ], [ 116080, "u8", "EHjR2" ], [ 116113, "u8", "MkHcw" ], [ 116634, "u8", "RWJE" ], [ 116964, "u8", "J0QR" ], [ 117369, "u8", "IDAT" ], [ 118375, "u8", "P2T9" ], [ 118510, "u8", "Tgln" ], [ 118796, "u8", "VtQE72" ], [ 118845, "u8", "dLUjz" ], [ 119400, "u8", "f8a4" ], [ 119775, "u8", "uecBy" ], [ 119948, "u8", "h1hWB" ], [ 120026, "u8", "OY05" ], [ 121377, "u8", "YM9V" ], [ 122565, "u8", "biPa" ], [ 123026, "u8", "8POED" ], [ 125836, "u8", "B8NJ" ], [ 127688, "u8", "QLRX" ], [ 127948, "u8", "YOKH" ], [ 129605, "u8", "M\u00262\u003e" ], [ 130708, "u8", "DG82" ], [ 135138, "u8", "vJJ2z" ], [ 135926, "u8", "5RAV" ], [ 138862, "u8", "P537" ], [ 142032, "u8", "c872" ], [ 142080, "u8", "219.132.252.107:59615" ], [ 142100, "u8", "04ki" ], [ 144638, "u8", "Rlnn" ], [ 145792, "u8", "%vwvY__GHI" ], [ 145815, "u8", "X__gii" ], [ 146148, "u8", "1TuMUV" ], [ 146848, "u8", "TUM9" ], [ 147784, "u8", "A077" ], [ 149582, "u8", "Kkmd" ], [ 149589, "u8", "weUq" ], [ 150494, "u8", "Z4VGh" ], [ 151227, "u8", "55jn" ], [ 152597, "u8", "YCGM_7" ], [ 152619, "u8", "Clon" ], [ 154007, "u8", "IPS2D" ], [ 154217, "u8", "dggWg" ], [ 154302, "u8", "PQ_A" ], [ 155656, "u8", "uHrDP" ], [ 155719, "u8", "5ADQ" ], [ 155850, "u8", "4dBXKy" ], [ 156311, "u8", "3776" ], [ 156569, "u8", "thvcq_" ], [ 158969, "u8", "Yh6XZZ" ], [ 159111, "u8", "Cvvv" ], [ 160614, "u8", "IEND" ], [ 243516, "u8", "aIDATx" ], [ 243946, "u8", "TDTUU" ], [ 246647, "u8", "tq[)" ], [ 246776, "u8", "129.144.43.32:28696" ], [ 248343, "u8", "gyb.n" ], [ 249835, "u8", "CYK7" ], [ 249886, "u8", "36 Z" ], [ 250668, "wide", "CHARTABLE" ], [ 250734, "wide", "DVCLAL" ], [ 250806, "wide", "HELPER_EXE_AMD64" ], [ 250882, "wide", "PACKAGEINFO" ], [ 250950, "wide", "SHFOLDERDLL" ], [ 251016, "wide", "TMAINFORM" ], [ 251082, "wide", "TNEWDISKFORM" ], [ 251150, "wide", "TSELECTFOLDERFORM" ], [ 251230, "wide", "TSELECTLANGUAGEFORM" ], [ 251314, "wide", "TUNINSTALLPROGRESSFORM" ], [ 251402, "wide", "TUNINSTSHAREDFILEFORM" ], [ 251490, "wide", "TWIZARDFORM" ], [ 251922, "wide", "IMG_MERIT2-07[1]" ], [ 252074, "wide", "PHOTO_2022-02-05_08-13-13" ], [ 252314, "wide", "VS_VERSION_INFO" ], [ 252406, "wide", "StringFileInfo" ], [ 252442, "wide", "040904b0" ], [ 252466, "wide", "FileDescription" ], [ 252500, "wide", "Export Plugin for Notepad++, a free (GNU) source code editor" ], [ 252630, "wide", "FileVersion" ], [ 252656, "wide", "0.3.0 Unicode" ], [ 252690, "wide", "InternalName" ], [ 252716, "wide", "Exporter" ], [ 252742, "wide", "LegalCopyright" ], [ 252772, "wide", "Copyright (C) 2019" ], [ 252818, "wide", "OriginalFilename" ], [ 252852, "wide", "NppExport.dll" ], [ 252886, "wide", "ProductName" ], [ 252912, "wide", "NppExport" ], [ 252938, "wide", "ProductVersion" ], [ 252986, "wide", "VarFileInfo" ], [ 253018, "wide", "Translation" ], [ 253115, "u8", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e" ], [ 253174, "u8", "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 253249, "u8", "\u003cassemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/\u003e" ], [ 253315, "u8", "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\"\u003e" ], [ 253371, "u8", "\u003csecurity\u003e" ], [ 253387, "u8", "\u003crequestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 253457, "u8", "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], [ 253528, "u8", "\u003c/requestedPrivileges\u003e" ], [ 253558, "u8", "\u003c/security\u003e" ], [ 253575, "u8", "\u003c/trustInfo\u003e" ], [ 253591, "u8", "\u003c/assembly\u003e" ], [ 253628, "wide", "SYSTEMDATA" ], [ 254429, "u8", "SCWK" ], [ 256239, "u8", "poZp" ], [ 257534, "u8", "nNHwR" ], [ 258684, "u8", "sgIf" ], [ 260908, "u8", "K4ivNS" ], [ 262623, "u8", "F3hua" ], [ 263624, "u8", "GEBL" ], [ 265487, "u8", "bzSn" ], [ 270022, "u8", "J0ETOa" ], [ 270112, "u8", "q.Ey" ], [ 270872, "u8", "4 8X" ], [ 271087, "u8", "Zksy" ], [ 272455, "u8", "VCJye" ], [ 273607, "u8", "VVFH" ], [ 276335, "u8", "poTm" ], [ 280158, "u8", "ygOu" ], [ 280188, "u8", "bFBmt" ], [ 280892, "u8", "03DP" ], [ 281214, "u8", "VW1O1" ], [ 283150, "u8", "IT9B" ], [ 283720, "u8", "LdMFq" ], [ 288576, "u8", "UVlaV" ], [ 289589, "u8", "bdGo" ], [ 290453, "u8", "NH8H" ], [ 291245, "u8", ".kfa" ], [ 293058, "u8", "G2be9" ], [ 295466, "u8", "ccVqDU" ], [ 296285, "u8", "Diclz" ], [ 300168, "u8", "8Ycj8" ], [ 302920, "u8", "Xurd" ], [ 303147, "u8", "MxarA" ], [ 303763, "u8", "Ff4jv" ], [ 304256, "u8", "GPQO" ], [ 305808, "u8", "p GXj" ], [ 305909, "u8", ")(24" ], [ 306474, "u8", "HQRY7" ], [ 306866, "u8", "tyJe" ], [ 308675, "u8", "f64v" ], [ 309347, "u8", "aSmwy" ], [ 310455, "u8", "EpduZ" ], [ 310641, "u8", "AkbJS" ], [ 315089, "u8", "Y84Q" ], [ 316506, "u8", "01OR" ], [ 317414, "u8", "\u003c\u003c2J" ], [ 317837, "u8", "RWVMQ" ], [ 318035, "u8", "QTHW" ], [ 321132, "u8", "WGeAY" ], [ 321669, "u8", "BBm8Y" ], [ 321913, "u8", "/\tTW" ], [ 322883, "u8", "DQBzw" ], [ 323503, "u8", "Y1ZM" ], [ 326329, "u8", "BeuTaL" ], [ 326979, "u8", "SSiET" ], [ 331364, "u8", "7vxO8" ], [ 331880, "u8", "JsZUd" ], [ 332202, "u8", "JSRE" ], [ 332212, "u8", "f 14d" ], [ 332349, "u8", "xxEF48" ], [ 332390, "u8", "KnGkn" ], [ 332496, "u8", "Dzwd" ], [ 332713, "u8", "R4_7" ], [ 335251, "u8", "7UEO" ], [ 336678, "u8", "7DAGN" ], [ 338221, "u8", "/jb3" ], [ 338285, "u8", "YKTCj" ], [ 339812, "u8", "v8Sos" ], [ 342635, "u8", "GYJ92" ], [ 343390, "u8", "z7LII" ], [ 344786, "u8", "9ajq" ], [ 346513, "u8", "YxQuy" ], [ 348027, "u8", "Tlii" ], [ 348154, "u8", "u2\u003et" ], [ 348373, "u8", "TVS9" ] ], "v": { "file.stem": "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14", "pe.imphash": "eac773fa60e36d5c5c3998e78642c7e0", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 3189256799, "file.basename": "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14.exe", "pe.image_base": 4194304, "pe.image_size": 995328, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 888832, "pe.headers_size": 1024, "pe.version.type": "unknown", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "ff49f5b6136903882224eabc0cdbcf6e35db7fcb", "pe.image_hash.sha256": "6eaae9d735df59530fa01279ef850a9e9861b2722d54fdca48c4be8de144ad99", "pe.image_hash.sha384": "76a9974f717ffa0331a11885707db59ab756c082d9a61ec76773857d60efea090c64bda800ba282b23b62a810f0bdeee", "pe.image_hash.sha512": "21e054b096b6885b099fb1a50db8d673ceed8e583d4146547f6c1f03ae50732a9b22f3bfb26818aa47878f8f8ed7db1113fc9f944062177e04acd7e922f61393", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_RCDATA", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.resource_types[4]": "RT_MANIFEST", "pe.resource_types[5]": "RT_UNKNOWN", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright (C) 2019", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 258, "pe.version.description": "Export Plugin for Notepad++, a free (GNU) source code editor", "pe.inflated_sections[0]": ".rdata", "pe.linker_major_version": 48, "pe.version.file_version": "0.3.0 Unicode", "pe.version.product_name": "NppExport", "pe.version.internal_name": "Exporter", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.data_directories[0].rva": 237568, "pe.data_directories[1].rva": 241664, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "0.3.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 484, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 643532, "pe.version.original_filename": "NppExport.dll", "pe.coff.dos_header_pe_pointer": 256, "pe.manifest.assembly_identity.name": "MyApplication.app", "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "asInvoker" }, "id": "pe", "sc": [ [ ".shared", 1024, 0, 0.0, "r-x" ], [ ".rdata", 1024, 512, 3.85, "rw-" ], [ ".rsrc", 1536, 292185, 6.21, "r--" ], [ ".text", 293888, 105308, 8.0, "rwx" ] ] }, "id": 0, "sz": 653744, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright (C) 2019" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Export Plugin for Notepad++, a free (GNU) source code editor" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 8.00, perms: rwx)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 0.8600000143051147, "d": "PE has medium sized overlay", "e": [ "binary.overlay_size = 254548.00" ], "i": "metadata/binary/section/metrics::medium-overlay-pe", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x3db64" ] }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032", "el": [ "0x3a0ac" ] }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 292185, entropy: 6.21)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1, "el": [ "0x530" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x4ec" ] }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0x14a53" ] }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "0x3de11" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "NppExport" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 8.00)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 5942.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST, RT_UNKNOWN]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x3d99a" ] }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 5942.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "Delphi VCL TUninstallProgressForm decoy class", "e": [ "TUNINSTALLPROGRESSFORM" ], "i": "well-known/malware/trojan/elex/worm::elex-vcl-tuninstall-decoy", "l": 1, "el": [ "0x3d5b2" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2, "el": [ "value:pe.manifest.requested_execution_level" ] }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"MyApplication.app\",\"version\":\"1.0.0.0\"" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "Large PE resource section", "e": [ ".rsrc (size: 292185)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-rsrc-section", "l": 1, "m": "B0023" }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2, "el": [ "0x3a0ac" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x3db12" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "0.3.0 Unicode" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x5a9" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x3db92" ] }, { "c": 1.0, "d": "Delphi VCL TWizardForm decoy class", "e": [ "TWIZARDFORM" ], "i": "well-known/malware/trojan/elex/worm::elex-vcl-twizardform-decoy", "l": 1, "el": [ "0x3d662" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 8.00" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 5942.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.85)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 5942.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "Delphi VCL TUninstSharedFileForm decoy class", "e": [ "TUNINSTSHAREDFILEFORM" ], "i": "well-known/malware/trojan/elex/worm::elex-vcl-tuninstshared-decoy", "l": 1, "el": [ "0x3d60a" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8999999761581421, "d": "Tool identity claims Notepad++", "e": [ "Notepad++" ], "i": "metadata/package/tooling::tool-identity-notepadplusplus", "l": 1, "el": [ "0x3da54" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST, RT_UNKNOWN]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x3a08c" ] }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x3dbd6" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2, "el": [ "0x5a9" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x3d9f6" ] }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 292185)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 254548.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 3 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 6.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.39" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 3 }, { "c": 0.8999999761581421, "d": "Manifest is MyApplication template name", "e": [ "MyApplication.app" ], "i": "metadata/build/manifest::pe-manifest-myapplication-template", "l": 3, "el": [ "value:pe.manifest.assembly_identity.name" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x3da32" ] }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "sections.executable_writable_count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 5942.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 254548.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "Binary has 25 or fewer imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-25-imports", "l": 3 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 8.00" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary imports fewer than 40 functions", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::import-count-under-40", "l": 1 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 6.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.7200000286102295, "d": "Writable .rdata section permissions", "e": [ ".rdata (perms: rw-)" ], "i": "metadata/binary/section/names::writable-rdata", "l": 3 }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 8.00, perms: rwx)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 105308, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x4ec" ] }, { "c": 0.699999988079071, "d": "Binary has 50 or fewer imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-50-imports", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 6.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.699999988079071, "d": "Binary has 30 or fewer imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-30-imports", "l": 3 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "129.144.43.32:28696", "219.132.252.107:59615" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1, "el": [ "0x3c3f8", "0x22b00" ] }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.89" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".text (size: 105308, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 6.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1, "el": [ "0x5a9" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.39" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 254548.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Writable .text section (custom packer indicator)", "e": [ ".text (size: 105308, entropy: 8.00, perms: rwx)" ], "i": "metadata/binary/section/metrics::writable-text-section", "l": 4 }, { "c": 0.949999988079071, "d": "links shell32 (SHGetIconOverlayIndexA)", "e": [ "shell32" ], "i": "metadata/dylib::shell32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (GetModuleHandleA)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links comctl32 (ImageList_SetBkColor)", "e": [ "comctl32" ], "i": "metadata/dylib::comctl32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links advapi32 (RegOpenKeyExW)", "e": [ "advapi32" ], "i": "metadata/dylib::advapi32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (GetCursor)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.8600000143051147, "d": "PNG and manifest in resources", "e": [ "IHDR", "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::png-and-manifest-rsrc", "l": 2, "el": [ "0x14a53", "0x3de11" ] }, { "a": "T1612", "c": 0.8500000238418579, "d": "Disproportionately large icon resources (payload carrier)", "e": [ "[RT_ICON, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST, RT_UNKNOWN]", ".rsrc (size: 292185)", "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-icon-resource", "l": 3, "m": "B0023", "el": [ "value:pe.resource_types", "", "" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 6.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Large high-entropy overlay", "e": [ "binary.overlay_entropy = 8.00", "binary.overlay_size = 254548.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Binary with encrypted overlay payload", "e": [ "binary.overlay_entropy = 8.00", "binary.has_overlay = 1.00", "binary.overlay_size = 254548.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::binary-encrypted-overlay", "l": 4, "m": "B0032" } ], "sha": "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14", "path": "28b37d67a0ba8991fbae8ea2048f44ee06d8c3df823750e585ca0322df10ef14.exe", "type": "pe" } ], "tv": "52045" } }