{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9333333373069763, "class": 0 } ], "prob": 0.93333334, "class": 0, "models": [ { "m": "az", "prob": 0.9017224, "class": 0 }, { "m": "az/native", "prob": 0.8567708, "class": 0 }, { "m": "az/pe", "prob": 0.93333334, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-15T21:50:41Z" }, "path": "VirusShare_1bdaf5295a9d8826d7c4b2a8a391b600", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₄Si)", "k": { "hash.imp": "94e2b0572ac9e87d08b3c525a2cff4f7", "pe.checksum": "0x0018493b", "pe.timestamp": 1635505702, "hash.rich_header": "908db1848d4901278d495f9618cfeb39b6c7cce8351be7f63ed7006e52e82acc", "build.target_arch": "x86", "pe.linker_version": "14.29", "pe.resource_types[0]": "RT_VERSION", "pe.resource_types[1]": "RT_MANIFEST", "pe.rich_header.xor_key": "0x77e2496e", "pe.inflated_sections[0]": " ", "pe.inflated_sections[1]": ".idata", "pe.debug_entries[0].size": 856, "pe.debug_entries[0].type": "pogo", "pe.data_directories[0].rva": 356408, "pe.data_directories[1].rva": 360448, "pe.data_directories[2].rva": 1526272, "pe.data_directories[3].rva": 335872, "pe.overflowing_sections[0]": ".boot", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1465, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 6512, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.debug_directory_types[0]": 13, "pe.version_info.company_name": "NVIDIA Corporation", "pe.version_info.file_version": "1.0.0.1", "pe.version_info.product_name": "NVIDIA GeForce Experience", "pe.debug_entries[0].timestamp": 1635505702, "pe.version_info.internal_name": "GeForce Experience Permission.exe", "pe.rich_header_compids[0].count": 13, "pe.rich_header_compids[1].count": 166, "pe.rich_header_compids[2].count": 22, "pe.rich_header_compids[3].count": 17, "pe.rich_header_compids[4].count": 20, "pe.rich_header_compids[5].count": 74, "pe.rich_header_compids[6].count": 5, "pe.rich_header_compids[7].count": 92, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "pe.version_info.legal_copyright": "(C) 2020-2021 NVIDIA Corporation. All rights reserved.", "pe.version_info.product_version": "1.0.0.1", "pe.rich_header_compids[0].compid": 17001236, "pe.rich_header_compids[10].count": 1, "pe.rich_header_compids[1].compid": 17132308, "pe.rich_header_compids[2].compid": 17066772, "pe.rich_header_compids[3].compid": 17069394, "pe.rich_header_compids[4].compid": 17003858, "pe.rich_header_compids[5].compid": 17134930, "pe.rich_header_compids[6].compid": 16870164, "pe.rich_header_compids[7].compid": 65536, "pe.rich_header_compids[8].compid": 17135032, "pe.rich_header_compids[9].compid": 16741816, "pe.version_info.file_description": "GeForce Experience Permission", "pe.rich_header_compids[10].compid": 16938424, "pe.rich_header_compids[7].product": "Unknown", "pe.version_info.original_filename": "GeForce Experience Permission", "pe.section_characteristics[0].name": " ", "pe.section_characteristics[1].name": " ", "pe.section_characteristics[2].name": " ", "pe.section_characteristics[3].name": " ", "pe.section_characteristics[4].name": " ", "pe.section_characteristics[5].name": " ", "pe.section_characteristics[6].name": ".debug", "pe.section_characteristics[7].name": ".128xeq2", "pe.section_characteristics[8].name": ".idata", "pe.section_characteristics[9].name": ".rsrc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 13, "pe.rich_header.entries[1].use_count": 166, "pe.rich_header.entries[2].use_count": 22, "pe.rich_header.entries[3].use_count": 17, "pe.rich_header.entries[4].use_count": 20, "pe.rich_header.entries[5].use_count": 74, "pe.rich_header.entries[6].use_count": 5, "pe.rich_header.entries[7].use_count": 92, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.section_characteristics[10].name": ".128xeq2", "pe.section_characteristics[11].name": ".boot", "pe.rich_header.entries[0].product_id": 259, "pe.rich_header.entries[10].use_count": 1, "pe.rich_header.entries[1].product_id": 261, "pe.rich_header.entries[2].product_id": 260, "pe.rich_header.entries[3].product_id": 260, "pe.rich_header.entries[4].product_id": 259, "pe.rich_header.entries[5].product_id": 261, "pe.rich_header.entries[6].product_id": 257, "pe.rich_header.entries[7].product_id": 1, "pe.rich_header.entries[8].product_id": 261, "pe.rich_header.entries[9].product_id": 255, "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[10].product_id": 258, "pe.rich_header.entries[0].build_number": 27412, "pe.rich_header.entries[0].product_name": "Cvtres_VS2013", "pe.rich_header.entries[1].build_number": 27412, "pe.rich_header.entries[1].product_name": "Cpp_VS2015", "pe.rich_header.entries[2].build_number": 27412, "pe.rich_header.entries[2].product_name": "C_VS2015", "pe.rich_header.entries[3].build_number": 30034, "pe.rich_header.entries[3].product_name": "C_VS2015", "pe.rich_header.entries[4].build_number": 30034, "pe.rich_header.entries[4].product_name": "Cvtres_VS2013", "pe.rich_header.entries[5].build_number": 30034, "pe.rich_header.entries[5].product_name": "Cpp_VS2015", "pe.rich_header.entries[6].build_number": 27412, "pe.rich_header.entries[6].product_name": "Linker_VS2013", "pe.rich_header.entries[7].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[8].build_number": 30136, "pe.rich_header.entries[8].product_name": "Cpp_VS2015", "pe.rich_header.entries[9].build_number": 30136, "pe.rich_header.entries[9].product_name": "C_VS2013", "pe.section_characteristics[0].raw_size": 71680, "pe.section_characteristics[1].raw_size": 2048, "pe.section_characteristics[2].raw_size": 24576, "pe.section_characteristics[3].raw_size": 1024, "pe.section_characteristics[4].raw_size": 75264, "pe.section_characteristics[5].raw_size": 5632, "pe.section_characteristics[6].raw_size": 1024, "pe.section_characteristics[7].raw_size": 16384, "pe.section_characteristics[8].raw_size": 512, "pe.section_characteristics[9].raw_size": 1536, "pe.rich_header.entries[10].build_number": 30136, "pe.rich_header.entries[10].product_name": "Linker_VS2013_LTCG", "pe.section_characteristics[11].raw_size": 1325568, "pe.section_characteristics[0].virtual_size": 139090, "pe.section_characteristics[1].virtual_size": 3126, "pe.section_characteristics[2].virtual_size": 59942, "pe.section_characteristics[3].virtual_size": 7416, "pe.section_characteristics[4].virtual_size": 107277, "pe.section_characteristics[5].virtual_size": 7256, "pe.section_characteristics[6].virtual_size": 4096, "pe.section_characteristics[7].virtual_size": 16384, "pe.section_characteristics[8].virtual_size": 4096, "pe.section_characteristics[9].virtual_size": 1465, "pe.section_characteristics[10].virtual_size": 3072000, "pe.section_characteristics[11].virtual_size": 1325568, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 143360, "pe.section_characteristics[2].virtual_address": 147456, "pe.section_characteristics[3].virtual_address": 208896, "pe.section_characteristics[4].virtual_address": 217088, "pe.section_characteristics[5].virtual_address": 327680, "pe.section_characteristics[6].virtual_address": 335872, "pe.section_characteristics[7].virtual_address": 339968, "pe.section_characteristics[8].virtual_address": 356352, "pe.section_characteristics[9].virtual_address": 360448, "pe.section_characteristics[10].virtual_address": 364544, "pe.section_characteristics[11].virtual_address": 3436544, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "60000020", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "c0000040", "pe.section_characteristics[4].characteristics_hex": "40000040", "pe.section_characteristics[5].characteristics_hex": "42000040", "pe.section_characteristics[6].characteristics_hex": "40000040", "pe.section_characteristics[7].characteristics_hex": "c0000040", "pe.section_characteristics[8].characteristics_hex": "c0000040", "pe.section_characteristics[9].characteristics_hex": "40000040", "pe.section_characteristics[10].characteristics_hex": "e0000060", "pe.section_characteristics[11].characteristics_hex": "60000060" }, "x": 42, "id": 0, "is": [ "GetModuleHandleA", "ShowWindow" ], "ms": { "pe": { "entry": 3436632.0, "machine": 332.0, "checksum": 1591611.0, "has_pogo": true, "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1635505702.0, "image_base": 4194304.0, "has_checksum": true, "has_manifest": true, "rsrc_entropy": 3.98, "entry_section": ".boot", "size_of_image": 4763648.0, "file_alignment": 512.0, "resource_count": 2.0, "resource_types": [ "RT_VERSION", "RT_MANIFEST" ], "characteristics": 258.0, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 2.0, "computed_checksum": 504872.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1635505702.0, "debug_timestamp_min": 1635505702.0, "dll_characteristics": 32832.0, "has_export_timestamp": false, "linker_major_version": 14.0, "linker_minor_version": 29.0, "debug_directory_types": [ 13.0 ], "entry_in_last_section": true, "bss_like_section_count": 1.0, "certificate_table_size": 6512.0, "has_resource_timestamp": false, "debug_directory_entries": 1.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "section_raw_overflow_count": 1.0, "max_section_inflation_ratio": 8.0, "debug_timestamp_unique_count": 1.0, "entry_in_nonstandard_section": true, "debug_timestamp_nonzero_count": 1.0, "security_directory_out_of_bounds": true }, "file": { "size": 501760.0 }, "binary": { "code_size": 1399296.0, "func_count": 2.0, "code_entropy": 5.79, "data_entropy": 1.13, "func_density": 0.0, "import_count": 2.0, "string_count": 226.0, "avg_func_size": 210.5, "section_count": 12.0, "avg_complexity": 13.5, "import_density": 0.0, "max_complexity": 26.0, "string_density": 0.17, "overall_entropy": 5.32, "avg_basic_blocks": 26.5, "avg_section_size": 127104.0, "dependency_count": 2.0, "entropy_variance": 2.97, "wx_section_count": 1.0, "avg_string_length": 7.44, "complexity_per_kb": 0.04, "max_string_length": 73.0, "wide_string_count": 18.0, "avg_string_entropy": 2.31, "code_to_data_ratio": 11.11, "rsrc_to_file_ratio": 0.0, "total_basic_blocks": 53.0, "func_analysis_depth": 2.0, "high_entropy_regions": 5.0, "string_length_stddev": 9.35, "debug_reference_count": 1.0, "largest_section_ratio": 2.64, "sentence_string_count": 8.0, "sentence_string_ratio": 0.04, "writable_section_count": 4.0, "executable_section_count": 4.0, "nonstandard_section_count": 10.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 231, "wRichnI" ], [ 751, "B.debug" ], [ 791, "@.128xeq2" ], [ 832, ".idata" ], [ 872, ".rsrc" ], [ 952, ".boot" ], [ 1239, "41IR7M" ], [ 2815, "Rwrs" ], [ 3029, "XaFZFkw" ], [ 5662, "x0aj" ], [ 7658, "2RRV" ], [ 11671, "/KRo" ], [ 14653, "OUAM" ], [ 16189, "auh7x" ], [ 18293, "pe2j" ], [ 19657, "`2\u003ec~_`" ], [ 21964, "X3OP" ], [ 22533, "61SI" ], [ 24173, "f9x3" ], [ 25423, ".oen" ], [ 25658, "ibhx9" ], [ 27464, "Qslu" ], [ 29648, "JCVB" ], [ 30257, "RZJH" ], [ 34122, "`P_`" ], [ 39296, "UP6N" ], [ 41554, "367v" ], [ 49315, "Ygmz" ], [ 51979, "U_3Z" ], [ 53690, "P17P" ], [ 57914, "Amic" ], [ 61083, "/hEW" ], [ 61650, "85JH" ], [ 63097, "Txud" ], [ 66418, "/WQ2" ], [ 72937, "FDW_" ], [ 74870, "p643o" ], [ 83271, "KF9S" ], [ 83972, "01 y" ], [ 88005, "Vrove" ], [ 89561, ".v+SQ@" ], [ 90972, "M6JCW" ], [ 96827, "68.97.128.212:17770" ], [ 96860, "PI63" ], [ 97270, "/GJzQ3" ], [ 99040, "2KV5H" ], [ 100926, "/iGVD" ], [ 101697, "seodd" ], [ 101716, "3ftu" ], [ 102309, "JNMV" ], [ 102926, "t5s4" ], [ 103351, "3d42r" ], [ 104035, "f1k5" ], [ 104221, "M_9Z" ], [ 105674, "P9Z0" ], [ 106563, "/dwO6l" ], [ 108422, "KWZ2" ], [ 110960, "2\u003eE?" ], [ 111088, "XYLP" ], [ 112500, ".477" ], [ 114237, "pi.z" ], [ 117705, "Flaq" ], [ 118695, "EMGV" ], [ 121451, "4NTG" ], [ 125779, "OZ8C" ], [ 128253, "uuhXASr" ], [ 130618, "S6GP" ], [ 134504, "J784P" ], [ 135345, "7wma" ], [ 136929, "/4CUT" ], [ 138171, "Fumi" ], [ 139424, "316l" ], [ 141211, "Yygv" ], [ 141664, "/2Zat" ], [ 142422, "f3 k" ], [ 146734, "F1DO" ], [ 147848, "9l0u" ], [ 147984, "e1hm" ], [ 156454, "Jzbx" ], [ 156619, "ZBS8" ], [ 158960, "a]2\u003e" ], [ 159278, "DY4F" ], [ 159689, "YJA3IM" ], [ 164450, "Wdpd" ], [ 167410, "i93d" ], [ 167495, "zx3i" ], [ 167517, "Hcdq" ], [ 169297, "/mDNs2" ], [ 170700, "DN24" ], [ 174199, "GEuzZVZ" ], [ 176677, "Taur" ], [ 177301, "LXSM" ], [ 181364, ".r1b23iqwxie" ], [ 181744, ".rdata" ], [ 181780, ".rdata$sxdata" ], [ 181804, ".rdata$voltmd" ], [ 181828, ".rdata$zzzdbg" ], [ 182032, ".data" ], [ 182084, ".bss" ], [ 198656, "kernel32.dll" ], [ 198671, "GetModuleHandleA" ], [ 198688, "USER32.dll" ], [ 198701, "ShowWindow" ], [ 199334, "wide", "VS_VERSION_INFO" ], [ 199426, "wide", "StringFileInfo" ], [ 199486, "wide", "CompanyName" ], [ 199512, "wide", "NVIDIA Corporation" ], [ 199558, "wide", "FileDescription" ], [ 199592, "wide", "GeForce Experience Permission" ], [ 199658, "wide", "FileVersion" ], [ 199684, "wide", "1.0.0.1" ], [ 199706, "wide", "InternalName" ], [ 199732, "wide", "GeForce Experience Permission.exe" ], [ 199806, "wide", "LegalCopyright" ], [ 199836, "wide", "(C) 2020-2021 NVIDIA Corporation. All rights reserved." ], [ 199954, "wide", "OriginalFilename" ], [ 200054, "wide", "ProductName" ], [ 200080, "wide", "NVIDIA GeForce Experience" ], [ 200138, "wide", "ProductVersion" ], [ 200190, "wide", "VarFileInfo" ], [ 200222, "wide", "Translation" ], [ 200252, "\u003c?xml version='1.0' encoding='UTF-8' standalone='yes'?\u003e" ], [ 200309, "\u003cassembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'\u003e" ], [ 200384, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 200440, "\u003csecurity\u003e" ], [ 200456, "\u003crequestedPrivileges\u003e" ], [ 200485, "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], [ 200557, "\u003c/requestedPrivileges\u003e" ], [ 200587, "\u003c/security\u003e" ], [ 200604, "\u003c/trustInfo\u003e" ], [ 200620, "\u003c/assembly\u003e" ], [ 201128, "XSQRVWU" ], [ 201733, "RN04" ], [ 205430, "p72r" ], [ 208312, "151.145.80.241:11635" ], [ 209516, "30.83.79.188:40042" ], [ 213108, "F1CJ" ], [ 213331, "2XQT" ], [ 218803, "J Z1" ], [ 220477, "PY306" ], [ 221914, "XI_9" ], [ 222316, "EQ4I" ], [ 222854, "ZX2B" ], [ 224489, "/rGl" ], [ 225427, "xi25" ], [ 234375, "2r1vim" ], [ 235345, "b/r/3uo" ], [ 244559, "/Z T" ], [ 244747, "XQG1" ], [ 246697, "ZHXA" ], [ 247872, "Hlsr" ], [ 248964, "irun" ], [ 252377, "DQI5" ], [ 253370, "9uxp" ], [ 255627, "Uvji" ], [ 258726, "WT_R" ], [ 261249, "LB0K" ], [ 267641, "BS 3" ], [ 268931, "WHVHK" ], [ 271931, "Oeodk" ], [ 272219, "UTOY" ], [ 273126, "/MqK" ], [ 274354, "NQ31" ], [ 283350, "I2Q5" ], [ 284043, "2eut" ], [ 291573, "HI1J" ], [ 291837, "uy \u003c\u003c" ], [ 302444, "Uuul" ], [ 307878, "Ykiu" ], [ 309081, "XV8Q" ], [ 318093, "/sma" ], [ 319002, "FR43" ], [ 320871, "NVQR" ], [ 321367, "30IWZ" ], [ 328155, "WT_U" ], [ 329861, "QBD1" ], [ 333266, "ZBJV" ], [ 335459, "dl12" ], [ 335620, "QQIWY" ], [ 336370, "V68M" ], [ 345311, "WYZB" ], [ 346756, "U2B0" ], [ 350547, "Iyoi" ], [ 352862, "VSQZ" ], [ 353691, "Kbqw" ], [ 357866, "WNBO" ], [ 358719, "ZN2X" ], [ 363531, "XMYW" ], [ 366453, "OK4C" ], [ 373095, "g3f1" ], [ 386114, "7G2J" ], [ 388778, "/ZyP" ], [ 397087, "9H0J" ], [ 399840, "o-ooc1" ], [ 408996, "VSRW" ], [ 409334, "U_QX" ], [ 410520, "ITO5" ], [ 410531, "Ji__ea" ], [ 411447, "18NU" ], [ 412820, "RT94V" ], [ 413473, "/39F" ], [ 413509, "XS2N" ], [ 413669, "uep5" ], [ 420021, "UYMD" ], [ 421446, "v.ll" ], [ 431468, "do2g" ], [ 437868, "OBPZ" ], [ 438808, "DEB5L" ], [ 448665, "RMSO" ], [ 451798, "z3a1" ], [ 453030, "XL8V" ], [ 454044, "N4RJ" ], [ 456797, "EN P5" ], [ 457920, "Ufzo" ], [ 461227, "TFOM" ], [ 467253, "TERF" ], [ 469149, "fi96" ], [ 469904, "164.191.198.81:47269" ], [ 482323, "Zaen" ], [ 484357, "Z5 B" ], [ 485650, "T6B5" ], [ 486309, "DI_1" ], [ 490413, "DYJV" ], [ 497097, "..hl" ], [ 501186, "NLHO" ] ], "sz": 501760, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "NVIDIA GeForce Experience" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 2.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8399999737739563, "d": "PE has many sections", "e": [ "binary.section_count = 12.00" ], "i": "metadata/binary/section/metrics::many-sections-pe", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1635505702.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "PE certificate table entry populated", "e": [ "pe.certificate_table_size = 6512.00" ], "i": "metadata/binary/layout::cert-table-present", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1635505702.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.79" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 2.64" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "Entry point in non-standard section", "e": [ " (size: 2048, entropy: 7.25, perms: r-x)" ], "i": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section", "l": 1, "m": "F0001" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 13.50" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 8.00" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "c": 1.0, "d": "PE second resource is RT_MANIFEST", "e": [ "RT_MANIFEST" ], "i": "metadata/binary/resource::pe-resource-manifest-second", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.0.1" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 1.0, "d": "PGO-trained release build (POGO)", "e": [ "pe.has_pogo = 1.00" ], "i": "metadata/build/reproducible::pe-pgo-trained", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 5.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 2.64" ], "i": "metadata/binary/metrics/structural::section-exceeds-file-size", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 226.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.31" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "GeForce Experience Permission" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8399999737739563, "d": "asInvoker execution manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.31" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.949999988079071, "d": "PE security directory RVA out of bounds", "e": [ "pe.security_directory_out_of_bounds = 1.00" ], "i": "metadata/binary/layout::security-dir-out-of-bounds", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 2.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "(C) 2020-2021 NVIDIA Corporation. All rights reserved." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "VirusShare_1bdaf5295a9d8826d7c4b2a8a391b600" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.9399999976158142, "d": "High-entropy .boot packer section", "e": [ ".boot (size: 1325568, entropy: 7.92, perms: r-x)" ], "i": "objectives/anti-static/pack/detect::boot-packed-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.32" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_1bdaf5295a9d8826d7c4b2a8a391b600" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 2.64" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "30.83.79.188:40042", "164.191.198.81:47269", "68.97.128.212:17770", "151.145.80.241:11635" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 2.64" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE entry point in last section", "e": [ "pe.entry_in_last_section = 1.00" ], "i": "metadata/binary/anomaly/format::pe-entry-in-last-section", "l": 3 }, { "c": 0.9200000166893005, "d": "Large high-entropy random executable section", "e": [ ".boot (size: 1325568, entropy: 7.92, perms: r-x)" ], "i": "metadata/binary/section/metrics::random-exec-payload-section", "l": 4 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 2.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "binary.import_count = 2.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 2.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 12.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8999999761581421, "d": "Many nonstandard PE section names", "e": [ "binary.nonstandard_section_count = 10.00" ], "i": "metadata/binary/section/metrics::many-nonstandard-section-names", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 2.64" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links kernel32.dll (GetModuleHandleA)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (ShowWindow)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "PE ships only RT_VERSION + RT_MANIFEST resources", "e": [ "RT_MANIFEST", "pe.resource_count = 2.00", "RT_VERSION" ], "i": "metadata/binary/resource::pe-version-and-manifest-only", "l": 3 } ], "sha": "29fb77e3c1022d37e4c0ca51c04c172eaebd4866d851432922dae803f8f40a84", "path": "VirusShare_1bdaf5295a9d8826d7c4b2a8a391b600", "type": "pe" } ], "tv": "08128" } }