{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.33333334, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T20:22:43Z" }, "path": "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb.exe", "raw": { "v": "5", "fs": [ { "f": "O(As)H(Cm)Md", "x": 40, "ff": { "i": [ [ "msvcrt", "memset" ], [ "msvcrt", "printf" ], [ "msvcrt", "memcpy" ], [ "msvcrt", "memmove" ], [ "msvcrt", "rand" ], [ "msvcrt", "wcslen" ], [ "msvcrt", "strcmp" ], [ "msvcrt", "srand" ], [ "msvcrt", "strtol" ], [ "msvcrt", "wsystem" ], [ "msvcrt", "vsnprintf" ], [ "msvcrt", "vsnwprintf" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "controlfp" ], [ "msvcrt", "argc" ], [ "msvcrt", "argv" ], [ "msvcrt", "environ" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "exit" ], [ "kernel32", "FileTimeToSystemTime" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapSize" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "GetLastError" ], [ "kernel32", "Sleep" ], [ "kernel32", "WriteFile" ], [ "kernel32", "HeapFree" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "SleepEx" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "ExpandEnvironmentStringsW" ], [ "ntdll", "NtQuerySystemInformation" ], [ "ntdll", "RtlGetNtVersionNumbers" ], [ "winhttp", "WinHttpOpen" ], [ "winhttp", "WinHttpConnect" ], [ "winhttp", "WinHttpOpenRequest" ], [ "winhttp", "WinHttpSendRequest" ], [ "winhttp", "WinHttpReceiveResponse" ], [ "winhttp", "WinHttpQueryDataAvailable" ], [ "winhttp", "WinHttpReadData" ], [ "winhttp", "WinHttpCloseHandle" ], [ "bcrypt", "BCryptEnumRegisteredProviders" ], [ "bcrypt", "BCryptRegisterConfigChangeNotify" ] ], "m": { "pe": { "checksum": 65962.0, "checksum_valid": 1.0, "computed_checksum": 65962.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 12288.0, "entropy": 4.94, "size_bytes": 12288.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.03, "data_entropy": 3.79, "string_count": 96.0, "entropy_variance": 2.06, "avg_string_length": 12.57, "max_string_length": 77.0, "code_to_data_ratio": 0.73, "string_length_stddev": 10.81, "largest_section_ratio": 0.67, "sentence_string_count": 4.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 45.0 }, "sections": { "count": 3.0, "code_size": 8192.0, "entropy_max": 5.03, "entropy_mean": 3.46, "name_entropy": 2.58, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 5.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 392, "u8", ".text" ], [ 472, "u8", ".pdata" ], [ 6972, "u8", "M H9" ], [ 8770, "url", "\u0002i\u0002i\u0002i\u0002i\u0002i\u0002i\u0003i" ], [ 8808, "wide", "%c%c%c%c" ], [ 8850, "u8", "v5.mrmpzjjhn3sgtq5w.pro" ], [ 8902, "url", "t/v5/%hs/%hs/%hs/\u0006llx\u0006llx/\u0006x/%ls.bin" ], [ 8988, "u8", "ERROR %lu in #%i" ], [ 9034, "u8", "/~isapi/isapiv5.dll/v5/ucph/yzxt/240602043700469/000c07001063/000001/xdrb.bin" ], [ 9184, "u8", "TrollAV/5.0" ], [ 9394, "u8", "Retrying %ls" ], [ 9410, "wide", "%%tmp%%\\%hs.exe" ], [ 9442, "u8", "http://%ls%ls --\u003e %ls" ], [ 9464, "wide", "%s %06x" ], [ 9497, "u8", "Grupa Sendbajt, User Id: %s" ], [ 9527, "u8", "1533105200" ], [ 9538, "u8", "d2=%s, executing..." ], [ 9569, "u8", "dd=%s, executing..." ], [ 10520, "u8", "msvcrt.dll" ], [ 10533, "u8", "memset" ], [ 10542, "u8", "printf" ], [ 10551, "u8", "memcpy" ], [ 10560, "u8", "memmove" ], [ 10577, "u8", "wcslen" ], [ 10603, "u8", "strtol" ], [ 10612, "u8", "_wsystem" ], [ 10623, "u8", "_vsnprintf" ], [ 10636, "u8", "_vsnwprintf" ], [ 10650, "u8", "__set_app_type" ], [ 10667, "u8", "_controlfp" ], [ 10680, "u8", "__argc" ], [ 10689, "u8", "__argv" ], [ 10698, "u8", "_environ" ], [ 10709, "u8", "__getmainargs" ], [ 10725, "u8", "exit" ], [ 10730, "u8", "kernel32.dll" ], [ 10745, "u8", "FileTimeToSystemTime" ], [ 10768, "u8", "GetProcessHeap" ], [ 10785, "u8", "HeapAlloc" ], [ 10797, "u8", "HeapSize" ], [ 10808, "u8", "HeapReAlloc" ], [ 10822, "u8", "CreateFileW" ], [ 10836, "u8", "GetLastError" ], [ 10851, "u8", "Sleep" ], [ 10859, "u8", "WriteFile" ], [ 10871, "u8", "HeapFree" ], [ 10882, "u8", "CloseHandle" ], [ 10896, "u8", "SleepEx" ], [ 10906, "u8", "GetCommandLineW" ], [ 10924, "u8", "ExpandEnvironmentStringsW" ], [ 10950, "u8", "ntdll.dll" ], [ 10962, "u8", "NtQuerySystemInformation" ], [ 10989, "u8", "RtlGetNtVersionNumbers" ], [ 11012, "u8", "winhttp.dll" ], [ 11026, "u8", "WinHttpOpen" ], [ 11040, "u8", "WinHttpConnect" ], [ 11057, "u8", "WinHttpOpenRequest" ], [ 11078, "u8", "WinHttpSendRequest" ], [ 11099, "u8", "WinHttpReceiveResponse" ], [ 11124, "u8", "WinHttpQueryDataAvailable" ], [ 11152, "u8", "WinHttpReadData" ], [ 11170, "u8", "WinHttpCloseHandle" ], [ 11189, "u8", "bcrypt.dll" ], [ 11202, "u8", "BCryptEnumRegisteredProviders" ], [ 11234, "u8", "BCryptRegisterConfigChangeNotify" ] ], "v": { "file.stem": "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb", "pe.imphash": "37ec4d5e131f267a8ecadb03682a70b8", "pe.machine": "x86_64", "pe.subsystem": "windows_cui", "file.basename": "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb.exe", "pe.image_base": 4194304, "pe.image_size": 20480, "pe.machine_id": 34404, "pe.os_version": "4.0", "pe.entry_point": 11248, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.file_alignment": 512, "pe.image_hash.sha1": "114748bb2b2b2f564253f890b0b52a068ea89263", "pe.image_hash.sha256": "134223bfebced025295c007b98037f273d55480806159ccdd5f28d1884526b79", "pe.image_hash.sha384": "c08c04240511f03405bfa76d4daa49d379db56b80e3a3a6b6fbb42af86acf6a3df94c367f41313f8b388cd4ee8cc082b", "pe.image_hash.sha512": "b6e94cafd41528efa66cb7fc8b8e0c6025c42d76cdde1374ad1f8ed6c70fc3a59f72222a96e34c7c2b6861e2dea64c482f931731c067263d17377cd25dee65d5", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "large_address_aware", "pe.characteristics_raw": 559, "pe.linker_major_version": 6, "pe.data_directories[0].rva": 13184, "pe.data_directories[1].rva": 16384, "pe.data_directories[2].rva": 13304, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "exception", "pe.data_directories[1].size": 192, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 400, "pe.coff.dos_header_pe_pointer": 128 }, "id": "pe", "sc": [ [ ".text", 512, 8192, 5.03, "r-x" ], [ ".data", 8704, 3072, 3.79, "rw-" ], [ ".pdata", 11776, 512, 1.56, "r--" ] ] }, "id": 0, "sz": 12288, "ts": [ { "c": 0.8999999761581421, "d": "Wide string length", "e": [ "wcslen" ], "i": "micro-behaviors/data/string/library::wcslen", "l": 2, "el": [ "0x3420" ] }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Query WinHTTP buffered response bytes", "e": [ "WinHttpQueryDataAvailable" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-data-available", "l": 3, "m": "C0002", "el": [ "0x3550" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 45.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP connect API string reference", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-connect-text", "l": 1, "m": "C0002", "el": [ "0x2b20" ] }, { "c": 0.8999999761581421, "d": "Windows BCrypt DLL name", "e": [ "bcrypt.dll" ], "i": "micro-behaviors/crypto/symmetric/aes/cng::bcrypt-dll-name", "l": 1, "m": "C0021", "el": [ "0x2bb5" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8799999952316284, "d": "Small string table footprint", "e": [ "binary.string_count = 96.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table", "l": 1 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP receive response text reference", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response-text", "l": 1, "m": "C0002", "el": [ "0x2b5b" ] }, { "c": 0.8999999761581421, "d": "Formatted console output", "e": [ "printf" ], "i": "micro-behaviors/os/stdio::printf", "l": 2, "el": [ "0x3400" ] }, { "c": 0.8999999761581421, "d": "String comparison", "e": [ "strcmp" ], "i": "micro-behaviors/data/string/library::strcmp", "l": 2, "el": [ "0x3428" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP read API string reference", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data-text", "l": 1, "m": "C0002", "el": [ "0x2b90" ] }, { "a": "T1071.001", "c": 0.8799999952316284, "d": "WinHTTP DLL name string reference", "e": [ "winhttp.dll" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-dll-name-text", "l": 1, "m": "C0002", "el": [ "0x2b04" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP send request text reference", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request-text", "l": 1, "m": "C0002", "el": [ "0x2b46" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Connect WinHTTP to remote host", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-connect", "l": 3, "m": "C0002", "el": [ "0x3530" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x34e0" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Send WinHTTP request to server", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request", "l": 3, "m": "C0002", "el": [ "0x3540" ] }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1, "el": [ "0x34c0" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP query-data API string reference", "e": [ "WinHttpQueryDataAvailable" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-data-available-text", "l": 1, "m": "C0002", "el": [ "0x2b74" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x34d8" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP request API string reference", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request-text", "l": 1, "m": "C0002", "el": [ "0x2b31" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Create WinHTTP HTTP request handle", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request", "l": 3, "m": "C0002", "el": [ "0x3538" ] }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Read WinHTTP response body", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data", "l": 3, "m": "C0002", "el": [ "0x3558" ] }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query system information", "e": [ "NtQuerySystemInformation" ], "i": "micro-behaviors/os/exception/handler::query-system-information", "l": 2, "m": "C0046", "el": [ "0x3510" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 45.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1620", "c": 0.8199999928474426, "d": "RegPhantom compact driver size", "e": [ "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb.exe" ], "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Initialize WinHTTP session", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open", "l": 3, "m": "C0002", "el": [ "0x3528" ] }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2, "el": [ "0x3410" ] }, { "c": 0.20000000298023224, "d": "tmp keyword", "e": [ "tmp" ], "i": "micro-behaviors/data/text/keywords/lexicon::tmp", "l": 1, "el": [ "0x24c2" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x34a0" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x234a" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ExpandEnvironmentStringsW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x2aac" ] }, { "a": "T1071.001", "c": 0.800000011920929, "d": "Close WinHTTP handle object", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle", "l": 3, "m": "C0002", "el": [ "0x3560" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x34f8" ] }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2, "el": [ "0x2ac6" ] }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x3408" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0xe3e" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Windows %TEMP% or %TMP% environment reference", "e": [ "%tmp%" ], "i": "micro-behaviors/fs/path/temp::win-temp-env", "l": 2, "el": [ "0x24c2" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 45.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1071.001", "c": 0.8199999928474426, "d": "WinHTTP close-handle API string", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle-text", "l": 1, "m": "C0002", "el": [ "0x2ba2" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 45.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x34c0" ] }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2, "el": [ "0x3498" ] }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "0x33f8" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "0x34b8" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x2a82" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 3072)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x34a8" ] }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1, "el": [ "0x3438" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x34c8" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Receive WinHTTP server response", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response", "l": 3, "m": "C0002", "el": [ "0x3548" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x24c2" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.9900000095367432, "d": "WINHTTP.dll string", "e": [ "WINHTTP.dll" ], "i": "objectives/command-and-control/dropper/elex-loader::winhttp-dll-string", "l": 1, "el": [ "0x2b04" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0x34d0" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP open API string reference", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-text", "l": 1, "m": "C0002", "el": [ "0x2b12" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014", "el": [ "0x2ac6" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 45.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 45.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x2a46" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 45.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x2094" ] }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 12288 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "WinHttpQueryDataAvailable", "FileTimeToSystemTime" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x2b74", "0x29f9" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x29ea" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x24c2" ] }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform/defender::ntdll-dll-str", "l": 1, "el": [ "0x2ac6" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links ntdll (NtQuerySystemInformation, RtlGetNtVersionNumbers)", "e": [ "ntdll" ], "i": "metadata/dylib::ntdll", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcrt (memset, printf, memcpy, memmove, rand, ... +14 more)", "e": [ "msvcrt" ], "i": "metadata/dylib::msvcrt", "l": 2, "el": [ "19 symbols" ] }, { "c": 0.949999988079071, "d": "links bcrypt (BCryptEnumRegisteredProviders, BCryptRegisterConfigChangeNotify)", "e": [ "bcrypt" ], "i": "metadata/dylib::bcrypt", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (FileTimeToSystemTime, GetProcessHeap, HeapAlloc, HeapSize, HeapReAlloc, ... +9 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "14 symbols" ] }, { "c": 0.949999988079071, "d": "links winhttp (WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, WinHttpSendRequest, WinHttpReceiveResponse, ... +3 more)", "e": [ "winhttp" ], "i": "metadata/dylib::winhttp", "l": 2, "el": [ "8 symbols" ] }, { "a": "T1071.001", "c": 0.9300000071525574, "d": "Dynamically resolved WinHTTP downloader flow", "e": [ "WinHttpConnect", "WinHttpOpenRequest", "WinHttpSendRequest", "WinHttpCloseHandle", "winhttp.dll", "WinHttpOpen", "WinHttpQueryDataAvailable", "WinHttpReceiveResponse", "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-downloader-flow-text", "l": 3, "m": "C0002", "el": [ "0x2b20", "0x2b31", "0x2b46", "0x2ba2", "0x2b04", "0x2b12", "0x2b74", "0x2b5b", "0x2b90" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "WinHTTP request response data flow", "e": [ "WinHttpReadData", "WinHttpOpenRequest", "WinHttpReceiveResponse", "WinHttpQueryDataAvailable", "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-request-flow", "l": 3, "m": "C0002", "el": [ "0x3558", "0x3538", "0x3548", "0x3550", "0x3540" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "Runtime API string decryption (DLL names without loader imports)", "e": [ "kernel32.dll", "ntdll.dll", "imports.count = 45.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::runtime-api-decryption", "l": 4, "m": "B0032.014", "el": [ "0x29ea", "0x2ac6", "" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "\u003cbinary data\u003e \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:8902" ] } ], "sha": "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb", "path": "2c39852ab10d9a965516581777bdb4198f888ead5dc51d1ec9d2f07c6c772fcb.exe", "type": "pe" } ], "tv": "176d6" } }