{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 1.0, "class": 2 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:38:08Z" }, "path": "6573", "raw": { "v": "4", "fs": [ { "f": "O₂(CAs)H(Cm)Md₂(BiSi)", "k": { "hash.imp": "dd70e7d15b9356dabeb2a38b28041b9d", "pe.timestamp": 1189436270, "hash.authenti": "2c034dd5d01c85b3f39a82b73b8bedf97785ceadc34d1b6ec3487b27c574dee8", "hash.rich_header": "e51bbc6bda604cdb88eda52ba3f965556d3f1d522976fda041b95a9abbf52c82", "build.target_arch": "x86", "pe.linker_version": "8.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_MENU", "pe.resource_types[2]": "RT_DIALOG", "pe.resource_types[3]": "RT_STRING", "pe.resource_types[4]": "RT_GROUP_ICON", "pe.resource_types[5]": "RT_VERSION", "pe.resource_types[6]": "RT_MANIFEST", "pe.rich_header.xor_key": "0x43023da9", "pe.manifest.description": "AutoIt v3", "pe.data_directories[0].rva": 610744, "pe.data_directories[1].rva": 606208, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 784, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 4536, "pe.version_info.file_version": "File Folder", "pe.rich_header_compids[0].count": 2, "pe.rich_header_compids[1].count": 36, "pe.rich_header_compids[2].count": 9, "pe.rich_header_compids[3].count": 192, "pe.rich_header_compids[4].count": 53, "pe.rich_header_compids[5].count": 27, "pe.rich_header_compids[6].count": 470, "pe.rich_header_compids[7].count": 55, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "binary.top_complex_unnamed[0].cc": 2, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.rich_header_compids[0].compid": 8307863, "pe.rich_header_compids[1].compid": 8242727, "pe.rich_header_compids[2].compid": 6229955, "pe.rich_header_compids[3].compid": 7194151, "pe.rich_header_compids[4].compid": 7259687, "pe.rich_header_compids[5].compid": 6098883, "pe.rich_header_compids[6].compid": 65536, "pe.rich_header_compids[7].compid": 7521831, "pe.rich_header_compids[8].compid": 8177191, "pe.rich_header_compids[9].compid": 7915047, "pe.version_info.file_description": "File Folder", "binary.top_complex_unnamed[0].bbs": 4, "pe.rich_header_compids[6].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x45d057", "binary.top_complex_unnamed[0].size": 75, "pe.manifest.assembly_identity.name": "AutoIt3", "pe.manifest.assembly_identity.type": "win32", "pe.section_characteristics[0].name": "UPX0", "pe.section_characteristics[1].name": "UPX1", "pe.section_characteristics[2].name": ".rsrc", "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.rich_header.entries[0].use_count": 2, "pe.rich_header.entries[1].use_count": 36, "pe.rich_header.entries[2].use_count": 9, "pe.rich_header.entries[3].use_count": 192, "pe.rich_header.entries[4].use_count": 53, "pe.rich_header.entries[5].use_count": 27, "pe.rich_header.entries[6].use_count": 470, "pe.rich_header.entries[7].use_count": 55, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.manifest.dependencies[0].language": "*", "pe.rich_header.entries[0].product_id": 126, "pe.rich_header.entries[1].product_id": 125, "pe.rich_header.entries[2].product_id": 95, "pe.rich_header.entries[3].product_id": 109, "pe.rich_header.entries[4].product_id": 110, "pe.rich_header.entries[5].product_id": 93, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 114, "pe.rich_header.entries[8].product_id": 124, "pe.rich_header.entries[9].product_id": 120, "pe.manifest.assembly_identity.version": "3.0.0.0", "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[0].build_number": 50327, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 50727, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 4035, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 50727, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 50727, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 4035, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 50727, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 50727, "pe.rich_header.entries[8].product_name": "unknown", "pe.rich_header.entries[9].build_number": 50727, "pe.rich_header.entries[9].product_name": "Cvtres_VS2008", "pe.section_characteristics[1].raw_size": 224256, "pe.section_characteristics[2].raw_size": 5632, "pe.section_characteristics[0].virtual_size": 376832, "pe.section_characteristics[1].virtual_size": 225280, "pe.section_characteristics[2].virtual_size": 8192, "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 380928, "pe.section_characteristics[2].virtual_address": 606208, "pe.section_characteristics[0].characteristics_hex": "e0000080", "pe.section_characteristics[1].characteristics_hex": "e0000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.manifest.dependencies[0].processor_architecture": "*", "pe.manifest.assembly_identity.processor_architecture": "*" }, "x": 46, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "RegCloseKey", "ImageList_Remove", "GetSaveFileNameW", "LineTo", "WNetUseConnectionW", "CoInitialize", "ORDINAL 35", "DragFinish", "GetDC", "VerQueryValueW", "timeGetTime", "ORDINAL 19" ], "ms": { "pe": { "entry": 604400.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 5632.0, "subsystem": 2.0, "timestamp": 1189436270.0, "icon_count": 2.0, "image_base": 4194304.0, "has_manifest": true, "rsrc_entropy": 4.18, "entry_section": "UPX1", "size_of_image": 614400.0, "file_alignment": 512.0, "resource_count": 7.0, "resource_types": [ "RT_ICON", "RT_MENU", "RT_DIALOG", "RT_STRING", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST" ], "characteristics": 291.0, "has_rich_header": true, "overlay_padding": 28160.0, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 13.0, "computed_checksum": 325546.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 32768.0, "has_export_timestamp": false, "linker_major_version": 8.0, "bss_like_section_count": 1.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "api_hashing_indicator_count": 1.0, "entry_in_nonstandard_section": true }, "file": { "size": 262144.0 }, "binary": { "code_size": 224256.0, "func_count": 2.0, "has_overlay": true, "code_entropy": 3.96, "func_density": 0.01, "import_count": 18.0, "overlay_size": 31232.0, "string_count": 239.0, "avg_func_size": 254.0, "overlay_ratio": 0.12, "section_count": 3.0, "avg_complexity": 16.0, "import_density": 0.08, "max_complexity": 30.0, "string_density": 1.09, "overall_entropy": 4.04, "overlay_entropy": 7.98, "avg_basic_blocks": 29.5, "avg_section_size": 76629.34, "dependency_count": 13.0, "entropy_variance": 3.24, "wx_section_count": 2.0, "avg_string_length": 8.68, "complexity_per_kb": 0.07, "max_string_length": 73.0, "wide_string_count": 8.0, "avg_string_entropy": 2.48, "code_to_data_ratio": 39.82, "rsrc_to_file_ratio": 0.02, "total_basic_blocks": 59.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 9.24, "largest_section_ratio": 0.86, "sentence_string_count": 6.0, "sentence_string_ratio": 0.03, "writable_section_count": 3.0, "behavioral_import_ratio": 0.22, "entry_in_writable_region": true, "executable_section_count": 2.0, "nonstandard_section_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, "UPX0" ], [ 536, "UPX1" ], [ 576, ".rsrc" ], [ 987, "3.00" ], [ 1837, "/ECP" ], [ 1897, "8LYN" ], [ 2253, "UN4WPD" ], [ 2642, "HWWS" ], [ 2672, "GTJ9" ], [ 3359, "AX9E" ], [ 4691, "6F4V" ], [ 8399, "CSWG" ], [ 9509, "Gisc" ], [ 9565, "PK7H" ], [ 13369, "YHIOU" ], [ 13542, "UPIPO" ], [ 14515, "CI42" ], [ 17263, "RAPXO" ], [ 17387, "97to" ], [ 19637, "SXA0" ], [ 20731, "SSQW" ], [ 27407, "hF@GG.r" ], [ 29419, "EYS_" ], [ 34273, "/Qmj" ], [ 35046, "PO3F" ], [ 35170, "aiqye" ], [ 35418, "i5u6" ], [ 38096, "V5AC" ], [ 38550, "FP_P" ], [ 40649, "63CZA" ], [ 42482, "DDT9X" ], [ 42610, "PDHLT" ], [ 43852, "riPDHLTx" ], [ 44468, "QDYA" ], [ 45465, "sipDLXT" ], [ 55405, "tm81" ], [ 56763, "OO1S" ], [ 59557, "FF1R" ], [ 59979, "XKMW2" ], [ 60572, "P9AT" ], [ 64174, "X_8R0" ], [ 67338, "LYEM" ], [ 70281, "Shdh" ], [ 72169, "YSGE" ], [ 75289, "Zd y" ], [ 75547, "z8 9" ], [ 79111, "JPXQ" ], [ 85075, "O ck" ], [ 85141, "Zacq" ], [ 93406, "a8g06" ], [ 93737, "B96X" ], [ 93927, "7V9I" ], [ 95676, "PEBX" ], [ 95937, "H4KW" ], [ 98423, "Q0H_" ], [ 101462, "a87z" ], [ 102175, "ZWPF" ], [ 105127, "SNRA" ], [ 114784, "/MR2" ], [ 115446, "Nzfh" ], [ 115756, "jqlKpVi" ], [ 116385, "CCXN" ], [ 118624, "YP2U" ], [ 119139, "2\u003e=R" ], [ 121848, "QQQQZ" ], [ 122975, "e9jx0" ], [ 130605, "p2et" ], [ 130658, "263u" ], [ 132393, "QN6Z" ], [ 133474, "T4PL" ], [ 135009, "DED8M" ], [ 136461, "euanj" ], [ 138543, "2OJTO" ], [ 141008, "3F5M" ], [ 141787, "ERCP" ], [ 142016, "2RTR" ], [ 142646, "6ILWD" ], [ 145008, "PX8C" ], [ 156172, "\u003c\u003cDW" ], [ 156468, "t.pf" ], [ 156811, "O wn" ], [ 158862, "t6mu" ], [ 161955, "/Ot0" ], [ 165713, "OWH5" ], [ 169151, "WR06YH" ], [ 170596, "4MYW" ], [ 171579, "S2Q7" ], [ 175842, "f9.6" ], [ 177788, "/qtP" ], [ 178861, "6q0u" ], [ 181824, "XYYM" ], [ 185123, "26ys" ], [ 188642, "et_FZ" ], [ 189034, "QSWJ" ], [ 189493, "HLPTrrr" ], [ 189503, "\\`drrrrhlptP" ], [ 194049, "kh90" ], [ 194723, "4y\u003c\u003c" ], [ 200720, "pnbWSmFV" ], [ 201470, "IsDebuggerPresentn" ], [ 201496, "is too big" ], [ 201521, "t Pcognized/with an" ], [ 201549, "zWsupportT" ], [ 201584, "followb" ], [ 201653, "toNEWLI" ], [ 201865, "m 10" ], [ 202033, "sMTPGBurx" ], [ 202342, "YXRW" ], [ 202688, "THEN" ], [ 202701, "PRUN" ], [ 202722, "ACCEP" ], [ 203265, "Zosh" ], [ 203324, "Gurmuk" ], [ 203356, "eorg" ], [ 204112, "qrstuvwxyz[\\" ], [ 204289, "GHIJKLMNO" ], [ 204647, ".mixc" ], [ 204766, "SING" ], [ 204785, "6034" ], [ 204996, "/clr" ], [ 206830, "wo_OG" ], [ 206879, "AcJPopup" ], [ 207059, "Type" ], [ 207237, "RTTI" ], [ 207312, "/efa" ], [ 207982, "33pk" ], [ 208433, "tomo" ], [ 208707, "zkWsjr_e" ], [ 208880, "evS.WINU0" ], [ 208895, "OWN7'LSHIFT" ], [ 208922, "CTRL" ], [ 208936, "_XBUTTON2" ], [ 208962, "NCH_APP2" ], [ 208975, "AMEDI" ], [ 209005, "PREVM" ], [ 209051, "FAJRTIES'" ], [ 209089, "BACK_" ], [ 209168, "7654" ], [ 209235, "34GHTGG2" ], [ 209274, "8765" ], [ 209282, "432W" ], [ 209320, "M040" ], [ 209377, "Input" ], [ 209791, "Toolhelp" ], [ 210044, "LNDW" ], [ 210155, "EA0602X" ], [ 211229, "7S2Z" ], [ 212339, "/cDj" ], [ 212710, "MSHE" ], [ 212719, "Recyc" ], [ 213347, "Icmp" ], [ 213511, "OKN_" ], [ 216244, "HG2M" ], [ 217555, "HMXB" ], [ 218551, "h.h,v 1.1 2004" ], [ 218574, "9:50:3" ], [ 218810, "yrstuv" ], [ 218866, "defghiy" ], [ 218875, "yjkmno" ], [ 219010, "aAeEiIoOuUyYnN" ], [ 220044, "x\u003c\u003cW3W" ], [ 220326, "r.la" ], [ 221622, "ideCLToM" ], [ 221797, "/Wu1" ], [ 222376, "Fjsh" ], [ 222381, "Buff" ], [ 223474, "4boa" ], [ 223797, "E9BK" ], [ 224075, "ZPMW" ], [ 224901, "XPTPSW" ], [ 228486, "wide", "VS_VERSION_INFO" ], [ 228578, "wide", "StringFileInfo" ], [ 228638, "wide", "FileDescription" ], [ 228672, "wide", "File Folder" ], [ 228702, "wide", "FileVersion" ], [ 228758, "wide", "CompiledScript" ], [ 228818, "wide", "VarFileInfo" ], [ 228850, "wide", "Translation" ], [ 228884, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e" ], [ 228941, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 229016, "\u003cassemblyIdentity" ], [ 229036, "type=\"win32\"" ], [ 229055, "processorArchitecture=\"*\"" ], [ 229087, "version=\"3.0.0.0\"" ], [ 229137, "\u003cdescription\u003eAutoIt v3\u003c/description\u003e" ], [ 229178, "\u003c!-- Identify the application security requirements. --\u003e" ], [ 229237, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\"\u003e" ], [ 229292, "\u003csecurity\u003e" ], [ 229306, "\u003crequestedPrivileges\u003e" ], [ 229332, "\u003crequestedExecutionLevel" ], [ 229362, "level=\"asInvoker\"" ], [ 229386, "uiAccess=\"false\"/\u003e" ], [ 229411, "\u003c/requestedPrivileges\u003e" ], [ 229438, "\u003c/security\u003e" ], [ 229453, "\u003c/trustInfo\u003e" ], [ 229470, "\u003c!-- Identify the application dependencies. --\u003e" ], [ 229520, "\u003cdependency\u003e" ], [ 229535, "\u003cdependentAssembly\u003e" ], [ 229598, "name=\"Microsoft.Windows.Common-Controls\"" ], [ 229644, "version=\"6.0.0.0\"" ], [ 229667, "language=\"*\"" ], [ 229716, "publicKeyToken=\"6595b64144ccf1df\"" ], [ 229762, "\u003c/dependentAssembly\u003e" ], [ 229786, "\u003c/dependency\u003e" ], [ 229802, "\u003c/assembly\u003e" ], [ 230220, "KERNEL32.DLL" ], [ 230233, "ADVAPI32.dll" ], [ 230246, "COMCTL32.dll" ], [ 230259, "comdlg32.dll" ], [ 230272, "GDI32.dll" ], [ 230282, "MPR.dll" ], [ 230290, "ole32.dll" ], [ 230300, "OLEAUT32.dll" ], [ 230313, "SHELL32.dll" ], [ 230325, "USER32.dll" ], [ 230336, "VERSION.dll" ], [ 230348, "WINMM.dll" ], [ 230358, "WSOCK32.dll" ], [ 230372, "LoadLibraryA" ], [ 230386, "GetProcAddress" ], [ 230402, "VirtualProtect" ], [ 230418, "VirtualAlloc" ], [ 230432, "VirtualFree" ], [ 230446, "ExitProcess" ], [ 230460, "RegCloseKey" ], [ 230474, "ImageList_Remove" ], [ 230492, "GetSaveFileNameW" ], [ 230518, "WNetUseConnectionW" ], [ 230538, "CoInitialize" ], [ 230552, "DragFinish" ], [ 230572, "VerQueryValueW" ], [ 230588, "timeGetTime" ], [ 233681, "VW1L" ], [ 234268, "Zjez" ], [ 238463, "z8j6" ], [ 239888, "Pdqv" ], [ 247028, "Vjsm" ], [ 248348, "/uq8" ] ], "sz": 262144, "ts": [ { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"assembly_identity\":{\"type\":\"win32\",\"processor_architecture\":\"*\",\"version\":\"3.0.0.0\",\"name\":\"AutoIt3\"},\"description\":\"AutoIt v3" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "GHIJKLMNO" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "timeGetTime multimedia timing", "e": [ "timeGetTime" ], "i": "micro-behaviors/time/timing/check::timegettime", "l": 2, "m": "B0003.003" }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage/control::get-dc", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "publicKeyToken=\"6595b64144ccf1df\"" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "File Folder" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 614400.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"language\":\"*\",\"processor_architecture\":\"*\",\"pub" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 19 (send)", "e": [ "ORDINAL 19" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-19", "l": 1 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 7.98" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "ProductName claims \"File Folder\"", "e": [ "File Folder" ], "i": "objectives/evasion/masquerade/version-resource/folder-icon::file-folder-product-name", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.02" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.04" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.48" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 239.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.04" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.48" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "6573" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1189436270.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 5632.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "File Folder" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 0.9599999785423279, "d": "Compact RWX UPX1 payload section", "e": [ "UPX1 (size: 224256, entropy: 7.93, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::compact-rwx-upx1", "l": 4 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 18.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.7200000286102295, "d": "WSOCK32 Winsock DLL import", "e": [ "WSOCK32.dll" ], "i": "micro-behaviors/communications/socket/init::wsock32-dll-marker", "l": 3 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 18.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 32768.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 224256, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links WINMM.dll (timeGetTime)", "e": [ "WINMM.dll" ], "i": "metadata/dylib::winmm/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (LineTo)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (ImageList_Remove)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WSOCK32.dll (ORDINAL 19)", "e": [ "WSOCK32.dll" ], "i": "metadata/dylib::wsock32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comdlg32.dll (GetSaveFileNameW)", "e": [ "comdlg32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 35)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetDC)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (DragFinish)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MPR.dll (WNetUseConnectionW)", "e": [ "MPR.dll" ], "i": "metadata/dylib::mpr/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "well-known/malware/trojan/shellobject/strings::misleading-upx-sections", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027.002", "c": 0.949999988079071, "d": "UPX dynamic loader stub", "e": [ "UPX0", "pe.entry_in_nonstandard_section = 1.00", "binary.func_count = 2.00", "VirtualFree", "VirtualProtect", "VirtualAlloc", "UPX1", "GetProcAddress" ], "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub", "l": 3, "m": "F0001" }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 2, "m": "B0032" } ], "sha": "28e2d97684a388abcab9d24dc989ada666efc9b85aa41eea553e2e106972ae02", "path": "6573", "type": "pe" } ], "tv": "46790" } }