{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9991053938865662, "class": 1 } ], "prob": 0.9991054, "class": 1, "models": [ { "m": "az", "prob": 0.9978916, "class": 1 }, { "m": "az/native", "prob": 0.9991054, "class": 0 }, { "m": "az/pe", "prob": 0.99844295, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-02T22:25:09Z" }, "path": "22128", "raw": { "v": "4", "fs": [ { "f": "KO₄(As₅C₅Er₃I)H₂(DsU₂)Md₂(Bi₅He)", "x": 81, "id": 0, "is": [ "except_handler3", "controlfp", "set_app_type", "p__fmode", "p__commode", "adjust_fdiv", "setusermatherr", "initterm", "getmainargs", "acmdln", "exit", "cexit", "XcptFilter", "exit", "c_exit", "GetModuleHandleA", "MultiByteToWideChar", "SetErrorMode", "LoadLibraryW", "GetProcAddress", "GetCurrentThreadId", "FreeLibrary", "GetStartupInfoA", "GetStockObject", "SetTimer", "CloseWindowStation", "GetProcessWindowStation", "PostQuitMessage", "SetProcessWindowStation", "OpenInputDesktop", "OpenDesktopW", "DestroyWindow", "DefWindowProcW", "DispatchMessageW", "TranslateMessage", "GetMessageW", "UpdateWindow", "ShowWindow", "RegisterClassW", "CreateWindowExW", "OpenWindowStationW", "KillTimer", "MessageBoxW", "GetFocus", "LoadStringW", "SetThreadDesktop", "CloseDesktop", "GetThreadDesktop" ], "ms": { "binary": { "code_size": 32768.0, "file_size": 34304.0, "wx_sections": 1.0, "import_count": 48.0, "string_count": 97.0, "section_count": 4.0, "avg_complexity": 4.0, "function_count": 9.0, "import_density": 1.5, "max_complexity": 9.0, "string_density": 3.03, "overall_entropy": 7.61, "avg_basic_blocks": 7.67, "avg_section_size": 8320.0, "function_density": 0.28, "avg_function_size": 130.78, "avg_string_length": 13.16, "complexity_per_kb": 0.13, "max_string_length": 46.0, "wide_string_count": 27.0, "writable_sections": 3.0, "avg_string_entropy": 3.08, "code_section_ratio": 0.5, "code_to_data_ratio": 64.0, "data_to_file_ratio": 0.01, "rsrc_to_file_ratio": 0.85, "text_to_file_ratio": 0.1, "total_basic_blocks": 69.0, "executable_sections": 2.0, "section_name_entropy": 3.63, "string_length_stddev": 7.19, "largest_section_ratio": 0.85, "sentence_string_count": 5.0, "sentence_string_ratio": 0.05, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "has_malformed_structure": true, "normalized_import_count": 0.26, "normalized_section_count": 0.27, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 432, ".text" ], [ 512, ".rsrc" ], [ 552, "qhauqgb" ], [ 632, "msvcrt.dll" ], [ 643, "KERNEL32.dll" ], [ 656, "GDI32.dll" ], [ 666, "USER32.dll" ], [ 1276, "wide", "Winlogon" ], [ 1312, "wide", "XswchEndAll" ], [ 1336, "wide", "XswchSetSwitchConfig" ], [ 1380, "wide", "XswchTimerProc" ], [ 1412, "wide", "XswchPollSwitches" ], [ 1448, "wide", "XswchRegHelperWnd" ], [ 1484, "wide", "msswchx" ], [ 1500, "SWCH" ], [ 1524, "NB10" ], [ 1540, "msswchx.pdb" ], [ 1663, "139.117.8.133:86" ], [ 2258, "139.117.16.87:86" ], [ 2343, "86.104.16.17:13302" ], [ 2467, "bVSVVj\nj\nVVh" ], [ 2932, "XPVSS" ], [ 3462, "_c_exit" ], [ 3480, "_XcptFilter" ], [ 3494, "_cexit" ], [ 3504, "exit" ], [ 3512, "_acmdln" ], [ 3522, "__getmainargs" ], [ 3538, "_initterm" ], [ 3550, "__setusermatherr" ], [ 3570, "_adjust_fdiv" ], [ 3586, "__p__commode" ], [ 3602, "__p__fmode" ], [ 3616, "__set_app_type" ], [ 3646, "_controlfp" ], [ 3660, "_except_handler3" ], [ 3680, "FreeLibrary" ], [ 3694, "GetCurrentThreadId" ], [ 3716, "GetProcAddress" ], [ 3734, "LoadLibraryW" ], [ 3750, "SetErrorMode" ], [ 3766, "MultiByteToWideChar" ], [ 3788, "GetModuleHandleA" ], [ 3808, "GetStartupInfoA" ], [ 3840, "GetStockObject" ], [ 3868, "KillTimer" ], [ 3880, "MessageBoxW" ], [ 3894, "GetFocus" ], [ 3906, "LoadStringW" ], [ 3920, "SetThreadDesktop" ], [ 3940, "CloseDesktop" ], [ 3956, "GetThreadDesktop" ], [ 3976, "OpenDesktopW" ], [ 3992, "OpenInputDesktop" ], [ 4012, "SetProcessWindowStation" ], [ 4038, "OpenWindowStationW" ], [ 4060, "GetProcessWindowStation" ], [ 4086, "CloseWindowStation" ], [ 4108, "SetTimer" ], [ 4120, "PostQuitMessage" ], [ 4138, "DestroyWindow" ], [ 4154, "DefWindowProcW" ], [ 4172, "DispatchMessageW" ], [ 4192, "TranslateMessage" ], [ 4212, "GetMessageW" ], [ 4226, "UpdateWindow" ], [ 4242, "ShowWindow" ], [ 4256, "CreateWindowExW" ], [ 4274, "RegisterClassW" ], [ 4608, "wide", "msswch.dll" ], [ 5286, "wide", "VS_VERSION_INFO" ], [ 5378, "wide", "StringFileInfo" ], [ 5438, "wide", "CompanyName" ], [ 5464, "wide", "Microsoft Corporation" ], [ 5514, "wide", "FileDescription" ], [ 5570, "wide", "FileVersion" ], [ 5596, "wide", "5.1.2600.0 (xpclient.010817-1148)" ], [ 5670, "wide", "InternalName" ], [ 5718, "wide", "LegalCopyright" ], [ 5748, "wide", "© Microsoft Corporation. All rights reserved." ], [ 5846, "wide", "OriginalFilename" ], [ 5880, "wide", "msswch.exe" ], [ 5910, "wide", "ProductName" ], [ 5936, "wide", "Microsoft® Windows® Operating System" ], [ 6018, "wide", "ProductVersion" ], [ 6078, "wide", "VarFileInfo" ], [ 6110, "wide", "Translation" ], [ 6150, "wide", "This is not a user program" ], [ 6204, "wide", "Proc Not Found" ], [ 9097, "XW 5" ], [ 12154, "Z9AB" ], [ 12851, "Ucdv" ], [ 15433, "6PFI" ], [ 18872, "MPAR" ], [ 20656, "iwam" ], [ 31384, "-cBYgsd" ] ], "sz": 34304, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE header too corrupted to parse: Malformed entity: Resource directory offset (0x1400) out of bounds", "e": [ "Malformed entity: Resource directory offset (0x1400) out of bounds" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 9.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 1.0, "d": "String claiming to be Microsoft Corporation", "e": [ "Microsoft Corporation", "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/identity/vendor::microsoft-corporation-string", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 34304.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1140", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "© Microsoft Corporation. All rights reserved.", "Microsoft Corporation" ], "i": "objectives/command-and-control/dropper/staging::microsoft-company-string", "l": 1, "m": "B0023" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.08" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Attach thread to desktop", "e": [ "SetThreadDesktop" ], "i": "micro-behaviors/ui/window/station::set-thread-desktop-import", "l": 3 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 0.00" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "Microsoft Corporation", "© Microsoft Corporation. All rights reserved." ], "i": "objectives/evasion/masquerade/dll/task-scheduler::microsoft-company-string", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.949999988079071, "d": "Random low-entropy RWX cavity section", "e": [ ".rsrc (size: 29184, entropy: 0.00, perms: -rwx)" ], "i": "metadata/binary/section/metrics::random-rwx-cavity-section", "l": 4 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.85" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 7.61" ], "i": "objectives/command-and-control/dropper/staging::high-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "a": "T1620", "c": 0.8199999928474426, "d": "RegPhantom compact driver size", "e": [ "22128" ], "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size", "l": 1, "m": "B0032" }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "msswchx.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 0.8999999761581421, "d": "Open alternate desktop", "e": [ "OpenDesktopW" ], "i": "micro-behaviors/ui/window/station::open-desktop-import", "l": 3 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 48.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.function_count = 9.00" ], "i": "metadata/binary/metrics::few-functions", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 48.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 48.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 48.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load::load-library-w", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "MultiByteToWideChar", "SetProcessWindowStation", "GetProcessWindowStation" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Zero-entropy executable section (carved/packed PE)", "e": [ ".rsrc (size: 29184, entropy: 0.00, perms: -rwx)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::zero-entropy-executable-section", "l": 4, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.85" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 48.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1045", "c": 0.949999988079071, "d": "Very high entropy (strongly indicates", "e": [ "binary.overall_entropy = 7.61" ], "i": "objectives/anti-static/obfuscation/binary-metrics::very-high-entropy", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High overall file entropy (likely", "e": [ "binary.overall_entropy = 7.61" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-overall-entropy", "l": 3, "m": "B0032" }, { "a": "T1547.004", "c": 0.800000011920929, "d": "Winlogon key reference", "e": [ "Winlogon" ], "i": "objectives/persistence/login/winlogon/userinit::winlogon-short", "l": 2, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 3 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".rsrc (size: 29184, perms: -rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 34304 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "binary.has_malformed_structure = 1.00" ], "i": "metadata/binary/metrics::malformed-pe-structure", "l": 3 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::wx-sections", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links USER32.dll (SetTimer, CloseWindowStation, GetProcessWindowStation, PostQuitMessage, SetProcessWindowStation, ... +19 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (except_handler3, controlfp, set_app_type, p__fmode, p__commode, ... +10 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetModuleHandleA, MultiByteToWideChar, SetErrorMode, LoadLibraryW, GetProcAddress, ... +3 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetStockObject)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "CreateWindowExW", "PostQuitMessage", "DefWindowProcW", "RegisterClassW", "DispatchMessageW", "GetMessageW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "ProductVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 } ], "sha": "2b4e196c792f1e8c1ee6f358e8b4bfab67a3e76523f2ef862c0a459a07557e07", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/22128", "type": "pe" } ], "tv": "b2c18" } }