{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.946899950504303 } ], "prob": 0.94689995, "models": [ { "m": "az", "raw": 0.72674364, "prob": 0.94689995, "class": 0 }, { "m": "az/native", "raw": 0.537495, "prob": 0.169279, "class": 0 }, { "m": "az/pe", "raw": 0.7451247, "prob": 0.9567308, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-07T12:41:21Z" }, "path": "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd.dll", "raw": { "v": "6", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorDllMain" ] ], "m": { "pe": { "checksum": 204125.0, "checksum_valid": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "computed_checksum": 204125.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 167200.0, "entropy": 5.49, "size_bytes": 167200.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.57, "overlay_size": 11552.0, "string_count": 1365.0, "overlay_ratio": 0.07, "overall_entropy": 5.49, "overlay_entropy": 7.36, "entropy_variance": 5.93, "avg_string_length": 19.46, "max_string_length": 165.0, "code_to_data_ratio": 1.0, "string_length_stddev": 12.31, "largest_section_ratio": 0.86, "sentence_string_count": 19.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 143360.0, "entropy_max": 5.57, "entropy_mean": 2.16, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 37036, "u8", "BSJB" ], [ 98568, "wide", "PÒRĈWľXĿfŀgŁhŋ" ], [ 115485, "u8", "\u003cModule\u003e" ], [ 115494, "u8", "IWebBrowser" ], [ 115506, "u8", "SHDocVw" ], [ 115514, "u8", "DWebBrowserEvents" ], [ 115532, "u8", "CommandStateChangeConstants" ], [ 115560, "u8", "IWebBrowserApp" ], [ 115575, "u8", "IWebBrowser2" ], [ 115588, "u8", "OLECMDID" ], [ 115597, "u8", "OLECMDF" ], [ 115605, "u8", "OLECMDEXECOPT" ], [ 115619, "u8", "tagREADYSTATE" ], [ 115633, "u8", "SecureLockIconConstants" ], [ 115657, "u8", "NewProcessCauseConstants" ], [ 115682, "u8", "DWebBrowserEvents2" ], [ 115701, "u8", "WebBrowser_V1Class" ], [ 115720, "u8", "DWebBrowserEvents2_Event" ], [ 115745, "u8", "DWebBrowserEvents2_StatusTextChangeEventHandler" ], [ 115793, "u8", "DWebBrowserEvents2_ProgressChangeEventHandler" ], [ 115839, "u8", "DWebBrowserEvents2_CommandStateChangeEventHandler" ], [ 115889, "u8", "DWebBrowserEvents2_DownloadBeginEventHandler" ], [ 115934, "u8", "DWebBrowserEvents2_DownloadCompleteEventHandler" ], [ 115982, "u8", "DWebBrowserEvents2_TitleChangeEventHandler" ], [ 116025, "u8", "DWebBrowserEvents2_PropertyChangeEventHandler" ], [ 116071, "u8", "DWebBrowserEvents2_BeforeNavigate2EventHandler" ], [ 116118, "u8", "DWebBrowserEvents2_NewWindow2EventHandler" ], [ 116160, "u8", "DWebBrowserEvents2_NavigateComplete2EventHandler" ], [ 116209, "u8", "DWebBrowserEvents2_DocumentCompleteEventHandler" ], [ 116257, "u8", "DWebBrowserEvents2_OnQuitEventHandler" ], [ 116295, "u8", "DWebBrowserEvents2_OnVisibleEventHandler" ], [ 116336, "u8", "DWebBrowserEvents2_OnToolBarEventHandler" ], [ 116377, "u8", "DWebBrowserEvents2_OnMenuBarEventHandler" ], [ 116418, "u8", "DWebBrowserEvents2_OnStatusBarEventHandler" ], [ 116461, "u8", "DWebBrowserEvents2_OnFullScreenEventHandler" ], [ 116505, "u8", "DWebBrowserEvents2_OnTheaterModeEventHandler" ], [ 116550, "u8", "DWebBrowserEvents2_WindowSetResizableEventHandler" ], [ 116600, "u8", "DWebBrowserEvents2_WindowSetLeftEventHandler" ], [ 116645, "u8", "DWebBrowserEvents2_WindowSetTopEventHandler" ], [ 116689, "u8", "DWebBrowserEvents2_WindowSetWidthEventHandler" ], [ 116735, "u8", "DWebBrowserEvents2_WindowSetHeightEventHandler" ], [ 116782, "u8", "DWebBrowserEvents2_WindowClosingEventHandler" ], [ 116827, "u8", "DWebBrowserEvents2_ClientToHostWindowEventHandler" ], [ 116877, "u8", "DWebBrowserEvents2_SetSecureLockIconEventHandler" ], [ 116926, "u8", "DWebBrowserEvents2_FileDownloadEventHandler" ], [ 116970, "u8", "DWebBrowserEvents2_NavigateErrorEventHandler" ], [ 117015, "u8", "DWebBrowserEvents2_PrintTemplateInstantiationEventHandler" ], [ 117073, "u8", "DWebBrowserEvents2_PrintTemplateTeardownEventHandler" ], [ 117126, "u8", "DWebBrowserEvents2_UpdatePageStatusEventHandler" ], [ 117174, "u8", "DWebBrowserEvents2_PrivacyImpactedStateChangeEventHandler" ], [ 117232, "u8", "DWebBrowserEvents2_NewWindow3EventHandler" ], [ 117274, "u8", "DWebBrowserEvents2_SetPhishingFilterStatusEventHandler" ], [ 117329, "u8", "DWebBrowserEvents2_WindowStateChangedEventHandler" ], [ 117379, "u8", "DWebBrowserEvents2_NewProcessEventHandler" ], [ 117421, "u8", "DWebBrowserEvents2_ThirdPartyUrlBlockedEventHandler" ], [ 117473, "u8", "DWebBrowserEvents2_RedirectXDomainBlockedEventHandler" ], [ 117527, "u8", "DWebBrowserEvents2_BeforeScriptExecuteEventHandler" ], [ 117578, "u8", "DWebBrowserEvents2_WebWorkerStartedEventHandler" ], [ 117626, "u8", "DWebBrowserEvents2_WebWorkerFinsihedEventHandler" ], [ 117675, "u8", "DWebBrowserEvents_Event" ], [ 117699, "u8", "DWebBrowserEvents_BeforeNavigateEventHandler" ], [ 117744, "u8", "DWebBrowserEvents_NavigateCompleteEventHandler" ], [ 117791, "u8", "DWebBrowserEvents_StatusTextChangeEventHandler" ], [ 117838, "u8", "DWebBrowserEvents_ProgressChangeEventHandler" ], [ 117883, "u8", "DWebBrowserEvents_DownloadCompleteEventHandler" ], [ 117930, "u8", "DWebBrowserEvents_CommandStateChangeEventHandler" ], [ 117979, "u8", "DWebBrowserEvents_DownloadBeginEventHandler" ], [ 118023, "u8", "DWebBrowserEvents_NewWindowEventHandler" ], [ 118063, "u8", "DWebBrowserEvents_TitleChangeEventHandler" ], [ 118105, "u8", "DWebBrowserEvents_FrameBeforeNavigateEventHandler" ], [ 118155, "u8", "DWebBrowserEvents_FrameNavigateCompleteEventHandler" ], [ 118207, "u8", "DWebBrowserEvents_FrameNewWindowEventHandler" ], [ 118252, "u8", "DWebBrowserEvents_QuitEventHandler" ], [ 118287, "u8", "DWebBrowserEvents_WindowMoveEventHandler" ], [ 118328, "u8", "DWebBrowserEvents_WindowResizeEventHandler" ], [ 118371, "u8", "DWebBrowserEvents_WindowActivateEventHandler" ], [ 118416, "u8", "DWebBrowserEvents_PropertyChangeEventHandler" ], [ 118461, "u8", "WebBrowser_V1" ], [ 118475, "u8", "WebBrowserClass" ], [ 118491, "u8", "WebBrowser" ], [ 118502, "u8", "InternetExplorerClass" ], [ 118524, "u8", "InternetExplorer" ], [ 118541, "u8", "InternetExplorerMediumClass" ], [ 118569, "u8", "InternetExplorerMedium" ], [ 118592, "u8", "ShellBrowserWindowClass" ], [ 118616, "u8", "ShellBrowserWindow" ], [ 118635, "u8", "ShellWindowTypeConstants" ], [ 118660, "u8", "ShellWindowFindWindowOptions" ], [ 118689, "u8", "DShellWindowsEvents" ], [ 118709, "u8", "IShellWindows" ], [ 118723, "u8", "ShellWindowsClass" ], [ 118741, "u8", "DShellWindowsEvents_Event" ], [ 118767, "u8", "DShellWindowsEvents_WindowRegisteredEventHandler" ], [ 118816, "u8", "DShellWindowsEvents_WindowRevokedEventHandler" ], [ 118862, "u8", "ShellWindows" ], [ 118875, "u8", "IShellUIHelper" ], [ 118890, "u8", "IShellUIHelper2" ], [ 118906, "u8", "IShellUIHelper3" ], [ 118922, "u8", "IShellUIHelper4" ], [ 118938, "u8", "IShellUIHelper5" ], [ 118954, "u8", "IShellUIHelper6" ], [ 118970, "u8", "ShellUIHelperClass" ], [ 118989, "u8", "ShellUIHelper" ], [ 119003, "u8", "DShellNameSpaceEvents" ], [ 119025, "u8", "IShellFavoritesNameSpace" ], [ 119050, "u8", "IShellNameSpace" ], [ 119066, "u8", "ShellNameSpaceClass" ], [ 119086, "u8", "DShellNameSpaceEvents_Event" ], [ 119114, "u8", "DShellNameSpaceEvents_FavoritesSelectionChangeEventHandler" ], [ 119173, "u8", "DShellNameSpaceEvents_SelectionChangeEventHandler" ], [ 119223, "u8", "DShellNameSpaceEvents_DoubleClickEventHandler" ], [ 119269, "u8", "DShellNameSpaceEvents_InitializedEventHandler" ], [ 119315, "u8", "ShellNameSpace" ], [ 119330, "u8", "IScriptErrorList" ], [ 119347, "u8", "CScriptErrorListClass" ], [ 119369, "u8", "CScriptErrorList" ], [ 119386, "u8", "DShellNameSpaceEvents_SinkHelper" ], [ 119419, "u8", "DShellNameSpaceEvents_EventProvider" ], [ 119455, "u8", "DShellWindowsEvents_SinkHelper" ], [ 119486, "u8", "DShellWindowsEvents_EventProvider" ], [ 119520, "u8", "DWebBrowserEvents_SinkHelper" ], [ 119549, "u8", "DWebBrowserEvents_EventProvider" ], [ 119581, "u8", "DWebBrowserEvents2_SinkHelper" ], [ 119611, "u8", "DWebBrowserEvents2_EventProvider" ], [ 119644, "u8", "mscorlib" ], [ 119653, "u8", "Object" ], [ 119660, "u8", "System" ], [ 119667, "u8", "GuidAttribute" ], [ 119681, "u8", "System.Runtime.InteropServices" ], [ 119712, "u8", "TypeLibTypeAttribute" ], [ 119733, "u8", "DispIdAttribute" ], [ 119749, "u8", "InterfaceTypeAttribute" ], [ 119772, "u8", "Enum" ], [ 119777, "u8", "DefaultMemberAttribute" ], [ 119800, "u8", "System.Reflection" ], [ 119818, "u8", "TypeLibFuncAttribute" ], [ 119839, "u8", "ComVisibleAttribute" ], [ 119859, "u8", "Type" ], [ 119864, "u8", "ComEventInterfaceAttribute" ], [ 119891, "u8", "MulticastDelegate" ], [ 119909, "u8", "CoClassAttribute" ], [ 119926, "u8", "ClassInterfaceAttribute" ], [ 119950, "u8", "ComSourceInterfacesAttribute" ], [ 119979, "u8", "IEnumerable" ], [ 119991, "u8", "System.Collections" ], [ 120010, "u8", "IEnumerator" ], [ 120022, "u8", "TypeLibTypeFlags" ], [ 120039, "u8", "ClassInterfaceType" ], [ 120058, "u8", "IDisposable" ], [ 120070, "u8", "IConnectionPointContainer" ], [ 120096, "u8", "System.Runtime.InteropServices.ComTypes" ], [ 120136, "u8", "ArrayList" ], [ 120146, "u8", "IConnectionPoint" ], [ 120163, "u8", "Guid" ], [ 120168, "u8", "Byte" ], [ 120173, "u8", "Monitor" ], [ 120181, "u8", "System.Threading" ], [ 120198, "u8", "Delegate" ], [ 120207, "u8", "Marshal" ], [ 120218, "u8", "Exception" ], [ 120228, "u8", "ImportedFromTypeLibAttribute" ], [ 120257, "u8", "TypeLibVersionAttribute" ], [ 120281, "u8", "GoBack" ], [ 120288, "u8", "GoForward" ], [ 120298, "u8", "GoHome" ], [ 120305, "u8", "GoSearch" ], [ 120314, "u8", "Navigate" ], [ 120327, "u8", "Flags" ], [ 120333, "u8", "TargetFrameName" ], [ 120349, "u8", "PostData" ], [ 120358, "u8", "Headers" ], [ 120366, "u8", "Refresh" ], [ 120374, "u8", "Refresh2" ], [ 120383, "u8", "Level" ], [ 120389, "u8", "Stop" ], [ 120394, "u8", "get_Application" ], [ 120410, "u8", "get_Parent" ], [ 120421, "u8", "get_Container" ], [ 120435, "u8", "get_Document" ], [ 120448, "u8", "get_TopLevelContainer" ], [ 120470, "u8", "get_Type" ], [ 120479, "u8", "get_Left" ], [ 120488, "u8", "set_Left" ], [ 120500, "u8", "get_Top" ], [ 120508, "u8", "set_Top" ], [ 120516, "u8", "get_Width" ], [ 120526, "u8", "set_Width" ], [ 120536, "u8", "get_Height" ], [ 120547, "u8", "set_Height" ], [ 120558, "u8", "get_LocationName" ], [ 120575, "u8", "get_LocationURL" ], [ 120591, "u8", "get_Busy" ], [ 120600, "u8", "Application" ], [ 120612, "u8", "Parent" ], [ 120619, "u8", "Container" ], [ 120629, "u8", "Document" ], [ 120638, "u8", "TopLevelContainer" ], [ 120656, "u8", "Left" ], [ 120665, "u8", "Width" ], [ 120671, "u8", "Height" ], [ 120678, "u8", "LocationName" ], [ 120691, "u8", "LocationURL" ], [ 120703, "u8", "Busy" ], [ 120708, "u8", "BeforeNavigate" ], [ 120723, "u8", "Cancel" ], [ 120730, "u8", "NavigateComplete" ], [ 120747, "u8", "StatusTextChange" ], [ 120764, "u8", "Text" ], [ 120769, "u8", "ProgressChange" ], [ 120784, "u8", "Progress" ], [ 120793, "u8", "ProgressMax" ], [ 120805, "u8", "DownloadComplete" ], [ 120822, "u8", "CommandStateChange" ], [ 120841, "u8", "Command" ], [ 120849, "u8", "Enable" ], [ 120856, "u8", "DownloadBegin" ], [ 120870, "u8", "NewWindow" ], [ 120880, "u8", "Processed" ], [ 120890, "u8", "TitleChange" ], [ 120902, "u8", "FrameBeforeNavigate" ], [ 120922, "u8", "FrameNavigateComplete" ], [ 120944, "u8", "FrameNewWindow" ], [ 120959, "u8", "Quit" ], [ 120964, "u8", "WindowMove" ], [ 120975, "u8", "WindowResize" ], [ 120988, "u8", "WindowActivate" ], [ 121003, "u8", "PropertyChange" ], [ 121018, "u8", "Property" ], [ 121027, "u8", "value__" ], [ 121035, "u8", "CSC_UPDATECOMMANDS" ], [ 121054, "u8", "CSC_NAVIGATEFORWARD" ], [ 121074, "u8", "CSC_NAVIGATEBACK" ], [ 121091, "u8", "ClientToWindow" ], [ 121114, "u8", "PutProperty" ], [ 121126, "u8", "vtValue" ], [ 121134, "u8", "GetProperty" ], [ 121146, "u8", "get_Name" ], [ 121155, "u8", "get_HWND" ], [ 121164, "u8", "get_FullName" ], [ 121177, "u8", "get_Path" ], [ 121186, "u8", "get_Visible" ], [ 121198, "u8", "set_Visible" ], [ 121210, "u8", "pBool" ], [ 121216, "u8", "get_StatusBar" ], [ 121230, "u8", "set_StatusBar" ], [ 121244, "u8", "get_StatusText" ], [ 121259, "u8", "set_StatusText" ], [ 121274, "u8", "StatusText" ], [ 121285, "u8", "get_ToolBar" ], [ 121297, "u8", "set_ToolBar" ], [ 121309, "u8", "Value" ], [ 121315, "u8", "get_MenuBar" ], [ 121327, "u8", "set_MenuBar" ] ], "v": { "file.stem": "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd", "pe.imphash": "dae02f32a21e03ce65412f6e56942daa", "pe.machine": "i386", "pe.subsystem": "windows_cui", "pe.timestamp": 1552799408, "file.basename": "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd.dll", "pe.image_base": 4194304, "pe.image_size": 172032, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 148414, "pe.headers_size": 4096, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.clr.is_il_only": 1, "pe.file_alignment": 4096, "pe.cert_table_size": 11552, "pe.image_hash.sha1": "d28af3d8de0e5216e23e7e25eb7916c1420287df", "pe.version.company": " ", "pe.version.comments": " ", "pe.image_hash.sha256": "ae21103e200d57acf8e4d419741c8adcfb88927b756b3d777ec7cfef2cfec9a4", "pe.image_hash.sha384": "8e13bd92734f8071bb14a6b161a5b1654f91e53a719e6e2fb3d98b0dfa277a016578a270581ea8f943e2040eddbf67ef", "pe.image_hash.sha512": "9e38f1e4a92557571f402e148daaa2652a15d0376bbf92839bda20ac46919f4a2ef216897d87593bb7a2a5d52dc409297b0905968b368e815e4959f8a9ad1540", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": " ", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.version.trademarks": " ", "pe.characteristics_raw": 8450, "pe.clr.runtime_version": "2.5", "pe.version.description": " ", "pe.linker_major_version": 8, "pe.signatures[0].issuer": "CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US", "pe.signatures[0].serial": "76ee7ef043821e76143e9510553389e1", "pe.version.file_version": "1.1.0.0", "pe.version.product_name": "Assembly imported from type library 'SHDocVw'.", "pe.signatures[0].subject": "CN=Lavasoft Limited,O=Lavasoft Limited,L=Sliema,ST=Sliema,C=MT", "pe.version.internal_name": "Interop.SHDocVw", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 148324, "pe.data_directories[1].rva": 155648, "pe.data_directories[2].rva": 155648, "pe.data_directories[3].rva": 163840, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2019-03-29T23:59:59Z", "pe.version.product_version": "1.1.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 872, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 11552, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.signatures[0].not_before": "2017-03-13T00:00:00Z", "pe.version.original_filename": "Interop.SHDocVw.dll", "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].nested.issuer": "CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US", "pe.signatures[0].nested.serial": "76ee7ef043821e76143e9510553389e1", "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].nested.subject": "CN=Lavasoft Limited,O=Lavasoft Limited,L=Sliema,ST=Sliema,C=MT", "pe.signatures[0].nested.verified": true, "pe.signatures[0].thumbprint_sha1": "b99c6f735653238eb611e1dab57eeb588d0fc8d4", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].nested.not_after": "2019-03-29T23:59:59Z", "pe.signatures[0].signature_digest": "d28af3d8de0e5216e23e7e25eb7916c1420287df", "pe.signatures[0].nested.not_before": "2017-03-13T00:00:00Z", "pe.signatures[0].thumbprint_sha256": "da69984bbcd8b1874771dad74ea324069e82f7e7825d4eaa6716365bba957550", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].nested.thumbprint_sha1": "b99c6f735653238eb611e1dab57eeb588d0fc8d4", "pe.signatures[0].nested.cert_chain_depth": 2, "pe.signatures[0].nested.digest_algorithm": "sha256", "pe.signatures[0].nested.eku_code_signing": true, "pe.signatures[0].nested.signature_digest": "ae21103e200d57acf8e4d419741c8adcfb88927b756b3d777ec7cfef2cfec9a4", "pe.signatures[0].nested.thumbprint_sha256": "da69984bbcd8b1874771dad74ea324069e82f7e7825d4eaa6716365bba957550", "pe.signatures[0].nested.signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1", "pe.signatures[0].nested.signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 4096, 143360, 5.57, "r-x" ], [ ".rsrc", 147456, 4096, 0.9, "r--" ], [ ".reloc", 151552, 4096, 0.02, "r--" ] ] }, "id": 0, "sz": 167200, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Lavasoft Limited", "e": [ "Lavasoft Limited" ], "i": "metadata/signed/unknown::lavasoft-limited", "l": 2 }, { "c": 1.0, "d": "Signed by Lavasoft Limited", "e": [ "Lavasoft Limited" ], "i": "metadata/signed/leaf::lavasoft-limited", "l": 3 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.1.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "21c06" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Headers" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1, "el": [ "1d626" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Assembly imported from type library 'SHDocVw'." ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "116c" ] }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.1.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1036", "c": 0.949999988079071, "d": "PE FileDescription is single-character placeholder", "e": [ " " ], "i": "objectives/evasion/masquerade/identity/fabricated::pe-file-description-single-char", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.4000000059604645, "d": "cmd/command/result vocabulary word", "e": [ "Command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "l": 1, "el": [ "1d809" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1!0" ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "28675" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.49" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".reloc (size: 4096, entropy: 0.02, perms: r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2, "el": [ "2433a" ] }, { "c": 1.0, "d": "DLL filename extension present", "e": [ "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd.dll" ], "i": "metadata/file/extension::dll-basename", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "2417a" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "COMODO certificate string in overlay", "e": [ "COMODO CA Limited1,0*" ], "i": "objectives/evasion/masquerade/binary::overlay-comodo-string", "l": 1, "el": [ "285c3" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "2426a" ] }, { "c": 1.0, "d": "Derived string condition", "e": [ "DefaultSearchProvider" ], "i": "objectives/discovery/host/browser::inline__search-engine-id__any_3", "l": 1, "el": [ "209ee" ] }, { "a": "T1036.001", "c": 0.8399999737739563, "d": "Symantec timestamp string in overlay", "e": [ "+Symantec Time Stamping Services Signer - G40" ], "i": "objectives/evasion/masquerade/binary::overlay-symantec-string", "l": 1, "el": [ "26559" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "24156" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "1ac41" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.1.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2, "el": [ "241a6" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "Download", "DOWNLOAD" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105", "el": [ "1c4b1", "1de42" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "240fe" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=2.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "22349" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices", "System.Runtime.InteropServices.CustomMarshalers.EnumeratorToEnumVariantMarshaler, CustomMarshalers, Version=2.0.0.0, Culture=neu", "System.Runtime.InteropServices.ComTypes" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "1d381", "22349", "1d520" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 1.0, "d": "Windows DLL extension", "e": [ "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd.dll" ], "i": "metadata/file/extension::dll", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "value__", "vtValue", "Value" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "1d8c3", "1d926", "1d9dd" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1365.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1036", "c": 0.949999988079071, "d": "PE CompanyName is single-character placeholder", "e": [ " " ], "i": "objectives/evasion/masquerade/identity/fabricated::pe-company-name-single-char", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "233ae" ] }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2, "el": [ "2405e" ] }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1, "el": [ "1f850" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "241d6" ] }, { "c": 0.949999988079071, "d": "Filename ends with .dll", "e": [ "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd.dll" ], "i": "metadata/package/files::dll-extension-basename", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "IConnectionPointContainer", "msDiagnoseConnectionUILess", "m_ConnectionPoint", "DiagnoseConnection", "m_ConnectionPointContainer", "FindConnectionPoint", "IConnectionPoint" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012", "el": [ "1d506", "20e33", "21623", "20998", "215f4", "21b88", "1d552" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "1d35c" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.57" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "242ba" ] }, { "a": "T1036.001", "c": 0.8799999952316284, "d": "UTN USERFirst Object string in overlay", "e": [ "UTN-USERFirst-Object0", "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05", "UTN-USERFirst-Object" ], "i": "objectives/evasion/masquerade/binary::overlay-utn-object-string", "l": 1, "el": [ "286b8", "28929", "28b38" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "1d3f8" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "2405e" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1365.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "DWebBrowserEvents2_Event_add_DownloadBegin", "add_DownloadComplete", "remove_DownloadComplete", "OLECMDID_STOPDOWNLOAD", "DWebBrowserEvents2_FileDownloadEventHandler", "FileDownload", "DWebBrowserEvents_DownloadCompleteEventHandler", "DownloadBegin", "DWebBrowserEvents_DownloadBeginEventHandler", "add_DownloadBegin", "DWebBrowserEvents2_DownloadCompleteEventHandler", "DownloadComplete", "DWebBrowserEvents2_DownloadBeginEventHandler", "OLECMDID_DONTDOWNLOADCSS", "remove_DownloadBegin", "OLECMDID_SETDOWNLOADSTATE" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1, "el": [ "1eed3", "1ebaf", "1ebc4", "1de5c", "1c8be", "1e6af", "1cc7b", "1d818", "1ccdb", "1ec0d", "1c4de", "1d7e5", "1c4b1", "1dfc3", "1ec1f", "1de42" ] }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "0002DF01-0000-0000-C000-000000000046", "0002DF05-0000-0000-C000-000000000046" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030", "el": [ "22a82", "225cb" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1365.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InternetExplorerMediumClass", "ShellNameSpaceClass", "InterfaceTypeAttribute", "TypeLibFuncAttribute", "DefaultMemberAttribute", "ComSourceInterfacesAttribute", "NewProcessCauseConstants", "ShellWindowTypeConstants", "SecureLockIconConstants", "ComEventInterfaceAttribute", "ShellBrowserWindowClass", "CommandStateChangeConstants", "ShellWindowFindWindowOptions", "ComVisibleAttribute", "TypeLibTypeAttribute", "ClassInterfaceAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "1cf0d", "1d11a", "1d3c5", "1d40a", "1d3e1", "1d48e", "1c3c9", "1cf6b", "1c3b1", "1d438", "1cf40", "1c34c", "1cf84", "1d41f", "1d3a0", "1d476" ] }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1, "el": [ "2405e" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "get_Path", "IWebBrowserApp_get_Path", "IWebBrowserApp_Path", "bstrFullPath", "strImpExpPath", "Path" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012", "el": [ "1d959", "2025d", "2053d", "21208", "20875", "1da39" ] }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.1.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.1.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2, "el": [ "2433a", "2405e", "241a6" ] } ], "sha": "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd", "path": "2cb8da2f65212fdbfe5085d84f4689494d40ed58c77150fb8dfd0a5d92616dbd.dll", "type": "pe" } ], "tv": "318d5" } }