{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.5419355, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T08:19:39Z" }, "path": "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(Bi₂Si)", "x": 6, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "checksum_valid": 0.0, "resource_count": 3.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 775493.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 764424.0, "entropy": 7.83, "size_bytes": 764424.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 7.83, "overlay_size": 13832.0, "string_count": 7725.0, "overlay_ratio": 0.02, "overlay_entropy": 7.52, "entropy_variance": 12.85, "avg_string_length": 5.4, "max_string_length": 145.0, "code_to_data_ratio": 1.0, "string_length_stddev": 4.65, "largest_section_ratio": 0.97, "sentence_string_count": 38.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 740864.0, "entropy_max": 7.83, "entropy_mean": 5.17, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 9448, "u8", "BSJB" ], [ 14660, "u8", "label1" ], [ 14667, "u8", "Form1" ], [ 14673, "u8", "errorProvider1" ], [ 14688, "u8", "groupBox1" ], [ 14698, "u8", "Trif32" ], [ 14705, "u8", "Int32" ], [ 14711, "u8", "label2" ], [ 14718, "u8", "label3" ], [ 14725, "u8", "label4" ], [ 14732, "u8", "label5" ], [ 14739, "u8", "label6" ], [ 14746, "u8", "\u003cModule\u003e" ], [ 14761, "u8", "SizeF" ], [ 14777, "u8", "btn_OK" ], [ 14784, "u8", "get_VP" ], [ 14791, "u8", "get_jfjP" ], [ 14806, "u8", "value__" ], [ 14814, "u8", "mscorlib" ], [ 14823, "u8", "System.Collections.Generic" ], [ 14850, "u8", "Microsoft.VisualBasic" ], [ 14872, "u8", "Thread" ], [ 14879, "u8", "Toad" ], [ 14888, "u8", "add_SelectedIndexChanged" ], [ 14913, "u8", "lb_Products_SelectedIndexChanged" ], [ 14946, "u8", "set_FormattingEnabled" ], [ 14968, "u8", "Synchronized" ], [ 14981, "u8", "Grid" ], [ 14991, "u8", "\u003cPrice\u003ek__BackingField" ], [ 15014, "u8", "\u003cName\u003ek__BackingField" ], [ 15036, "u8", "\u003cType\u003ek__BackingField" ], [ 15058, "u8", "\u003cShouldLive\u003ek__BackingField" ], [ 15086, "u8", "\u003cIsAlive\u003ek__BackingField" ], [ 15111, "u8", "\u003cCurrentGeneration\u003ek__BackingField" ], [ 15146, "u8", "\u003cCells\u003ek__BackingField" ], [ 15169, "u8", "\u003cColumns\u003ek__BackingField" ], [ 15194, "u8", "\u003cMaxGenerations\u003ek__BackingField" ], [ 15226, "u8", "\u003cproducts\u003ek__BackingField" ], [ 15252, "u8", "\u003cRows\u003ek__BackingField" ], [ 15274, "u8", "\u003cNewProduct\u003ek__BackingField" ], [ 15302, "u8", "\u003cAmount\u003ek__BackingField" ], [ 15326, "u8", "\u003ccart\u003ek__BackingField" ], [ 15348, "u8", "\u003clist\u003ek__BackingField" ], [ 15370, "u8", "\u003cdisplay\u003ek__BackingField" ], [ 15395, "u8", "\u003cCategory\u003ek__BackingField" ], [ 15421, "u8", "tb_Price" ], [ 15430, "u8", "get_Price" ], [ 15440, "u8", "set_Price" ], [ 15450, "u8", "totalPrice" ], [ 15461, "u8", "defaultInstance" ], [ 15477, "u8", "set_AutoScaleMode" ], [ 15495, "u8", "Lab2GameOfLife" ], [ 15510, "u8", "Image" ], [ 15516, "u8", "IDisposable" ], [ 15528, "u8", "Double" ], [ 15535, "u8", "RuntimeTypeHandle" ], [ 15553, "u8", "GetTypeFromHandle" ], [ 15571, "u8", "Console" ], [ 15579, "u8", "set_Title" ], [ 15589, "u8", "StillLifeGame" ], [ 15603, "u8", "OscilatorGame" ], [ 15617, "u8", "tb_Name" ], [ 15625, "u8", "get_Name" ], [ 15634, "u8", "set_Name" ], [ 15643, "u8", "CallByName" ], [ 15654, "u8", "WriteLine" ], [ 15664, "u8", "get_Type" ], [ 15673, "u8", "set_Type" ], [ 15682, "u8", "GameType" ], [ 15691, "u8", "gameType" ], [ 15700, "u8", "CallType" ], [ 15709, "u8", "get_Culture" ], [ 15721, "u8", "set_Culture" ], [ 15733, "u8", "resourceCulture" ], [ 15749, "u8", "ButtonBase" ], [ 15760, "u8", "UpDownBase" ], [ 15771, "u8", "ApplicationSettingsBase" ], [ 15795, "u8", "TextBoxBase" ], [ 15807, "u8", "Close" ], [ 15813, "u8", "Dispose" ], [ 15821, "u8", "TryParse" ], [ 15830, "u8", "EditorBrowsableState" ], [ 15851, "u8", "Write" ], [ 15857, "u8", "STAThreadAttribute" ], [ 15876, "u8", "CompilerGeneratedAttribute" ], [ 15903, "u8", "GuidAttribute" ], [ 15917, "u8", "GeneratedCodeAttribute" ], [ 15940, "u8", "DebuggerNonUserCodeAttribute" ], [ 15969, "u8", "DebuggableAttribute" ], [ 15989, "u8", "EditorBrowsableAttribute" ], [ 16014, "u8", "ComVisibleAttribute" ], [ 16034, "u8", "AssemblyTitleAttribute" ], [ 16057, "u8", "AssemblyTrademarkAttribute" ], [ 16084, "u8", "TargetFrameworkAttribute" ], [ 16109, "u8", "AssemblyFileVersionAttribute" ], [ 16138, "u8", "AssemblyConfigurationAttribute" ], [ 16169, "u8", "AssemblyDescriptionAttribute" ], [ 16198, "u8", "CompilationRelaxationsAttribute" ], [ 16230, "u8", "AssemblyProductAttribute" ], [ 16255, "u8", "AssemblyCopyrightAttribute" ], [ 16282, "u8", "AssemblyCompanyAttribute" ], [ 16307, "u8", "RuntimeCompatibilityAttribute" ], [ 16337, "u8", "get_Value" ], [ 16347, "u8", "set_Value" ], [ 16357, "u8", "value" ], [ 16363, "u8", "get_ShouldLive" ], [ 16378, "u8", "set_ShouldLive" ], [ 16393, "u8", "Beehive" ], [ 16401, "u8", "get_IsAlive" ], [ 16413, "u8", "set_IsAlive" ], [ 16425, "u8", "isAlive" ], [ 16433, "u8", "Evolve" ], [ 16440, "u8", "Remove" ], [ 16447, "u8", "EdQt.exe" ], [ 16456, "u8", "set_Size" ], [ 16465, "u8", "set_AutoSize" ], [ 16478, "u8", "set_ClientSize" ], [ 16493, "u8", "ISupportInitialize" ], [ 16512, "u8", "Loaf" ], [ 16517, "u8", "System.Threading" ], [ 16534, "u8", "set_Padding" ], [ 16546, "u8", "System.Runtime.Versioning" ], [ 16572, "u8", "ToString" ], [ 16581, "u8", "disposing" ], [ 16591, "u8", "add_Validating" ], [ 16606, "u8", "tb_Name_Validating" ], [ 16625, "u8", "System.Drawing" ], [ 16640, "u8", "ShowDialog" ], [ 16651, "u8", "get_Width" ], [ 16661, "u8", "get_Length" ], [ 16672, "u8", "label6_Click" ], [ 16685, "u8", "btn_OK_Click" ], [ 16698, "u8", "add_Click" ], [ 16708, "u8", "btn_Cancel_Click" ], [ 16725, "u8", "btn_ClearProducts_Click" ], [ 16749, "u8", "btn_AddProduct_Click" ], [ 16770, "u8", "btn_DeleteProduct_Click" ], [ 16794, "u8", "btn_DeleteFromCart_Click" ], [ 16819, "u8", "btn_AddtoCart_Click" ], [ 16839, "u8", "btn_ClearCart_Click" ], [ 16859, "u8", "Block" ], [ 16865, "u8", "Decimal" ], [ 16873, "u8", "VP_Lab2_final" ], [ 16887, "u8", "tb_Total" ], [ 16896, "u8", "refreshTotal" ], [ 16909, "u8", "Label" ], [ 16915, "u8", "btn_Cancel" ], [ 16926, "u8", "set_Cancel" ], [ 16937, "u8", "System.ComponentModel" ], [ 16959, "u8", "GetPixel" ], [ 16968, "u8", "ToggleCell" ], [ 16979, "u8", "set_ContainerControl" ], [ 17000, "u8", "ListControl" ], [ 17012, "u8", "Program" ], [ 17020, "u8", "get_Item" ], [ 17029, "u8", "get_SelectedItem" ], [ 17046, "u8", "System" ], [ 17053, "u8", "Trim" ], [ 17058, "u8", "Form" ], [ 17063, "u8", "Enum" ], [ 17068, "u8", "resourceMan" ], [ 17080, "u8", "set_UpDownAlign" ], [ 17096, "u8", "set_TextAlign" ], [ 17110, "u8", "Main" ], [ 17115, "u8", "AppDomain" ], [ 17125, "u8", "GetDomain" ], [ 17135, "u8", "set_Margin" ], [ 17146, "u8", "set_Icon" ], [ 17155, "u8", "MessageBoxIcon" ], [ 17170, "u8", "Beacon" ], [ 17177, "u8", "Application" ], [ 17189, "u8", "set_Location" ], [ 17202, "u8", "set_CausesValidation" ], [ 17223, "u8", "get_CurrentGeneration" ], [ 17245, "u8", "set_CurrentGeneration" ], [ 17267, "u8", "System.Configuration" ], [ 17288, "u8", "System.Globalization" ], [ 17309, "u8", "Interaction" ], [ 17321, "u8", "System.Reflection" ], [ 17339, "u8", "ControlCollection" ], [ 17357, "u8", "ObjectCollection" ], [ 17374, "u8", "Button" ], [ 17385, "u8", "NumericUpDown" ], [ 17399, "u8", "CultureInfo" ], [ 17411, "u8", "Bitmap" ], [ 17418, "u8", "SpaceShip" ], [ 17428, "u8", "set_TabStop" ], [ 17440, "u8", "Clear" ], [ 17446, "u8", "Char" ], [ 17451, "u8", "Pulsar" ], [ 17458, "u8", "InvokeMember" ], [ 17471, "u8", "set_DisplayMember" ], [ 17489, "u8", "ErrorProvider" ], [ 17503, "u8", "sender" ], [ 17510, "u8", "Binder" ], [ 17517, "u8", "get_ResourceManager" ], [ 17537, "u8", "ComponentResourceManager" ], [ 17562, "u8", "Blinker" ], [ 17570, "u8", "CancelEventHandler" ], [ 17589, "u8", "System.CodeDom.Compiler" ], [ 17613, "u8", "IContainer" ], [ 17624, "u8", "Whister" ], [ 17632, "u8", "set_UseVisualStyleBackColor" ], [ 17660, "u8", "SetError" ], [ 17669, "u8", "GetEnumerator" ], [ 17683, "u8", "Activator" ], [ 17693, "u8", ".ctor" ], [ 17699, "u8", ".cctor" ], [ 17706, "u8", "System.Diagnostics" ], [ 17725, "u8", "System.Runtime.InteropServices" ], [ 17756, "u8", "System.Runtime.CompilerServices" ], [ 17788, "u8", "System.Resources" ], [ 17805, "u8", "VP_Lab2_final.Form1.resources" ], [ 17835, "u8", "VP_Lab2_final.Properties.Resources.resources" ], [ 17880, "u8", "VP_Lab2_final.FromProduct.resources" ], [ 17916, "u8", "DebuggingModes" ], [ 17931, "u8", "VP_Lab2_final.Properties" ], [ 17956, "u8", "EnableVisualStyles" ], [ 17975, "u8", "GetExportedTypes" ], [ 17992, "u8", "refreshTextBoxes" ], [ 18009, "u8", "BindingFlags" ], [ 18022, "u8", "Settings" ], [ 18031, "u8", "CancelEventArgs" ], [ 18047, "u8", "get_Cells" ], [ 18057, "u8", "set_Cells" ], [ 18067, "u8", "get_Controls" ], [ 18080, "u8", "get_Items" ], [ 18090, "u8", "System.Windows.Forms" ], [ 18111, "u8", "get_Columns" ], [ 18123, "u8", "set_Columns" ], [ 18135, "u8", "columns" ], [ 18143, "u8", "set_AutoScaleDimensions" ], [ 18167, "u8", "get_MaxGenerations" ], [ 18186, "u8", "set_MaxGenerations" ], [ 18205, "u8", "maxGenerations" ], [ 18220, "u8", "MessageBoxButtons" ], [ 18238, "u8", "lb_Products" ], [ 18250, "u8", "btn_ClearProducts" ], [ 18268, "u8", "get_products" ], [ 18281, "u8", "set_products" ], [ 18294, "u8", "components" ], [ 18305, "u8", "get_Rows" ], [ 18314, "u8", "set_Rows" ], [ 18333, "u8", "Concat" ], [ 18340, "u8", "Format" ], [ 18347, "u8", "Boat" ], [ 18352, "u8", "GetObject" ], [ 18362, "u8", "btn_AddProduct" ], [ 18377, "u8", "btn_DeleteProduct" ], [ 18395, "u8", "FromProduct" ], [ 18407, "u8", "get_NewProduct" ], [ 18422, "u8", "set_NewProduct" ], [ 18437, "u8", "get_Height" ] ], "v": { "file.stem": "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1724637151, "file.basename": "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155.exe", "pe.image_base": 4194304, "pe.image_size": 778240, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 748590, "pe.headers_size": 512, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 13832, "pe.image_hash.sha1": "481441915e8e4a6b206742861a463a7665bf1306", "pe.version.company": "767556767", "pe.version.comments": "jhgffsd", "pe.image_hash.sha256": "7511fb4e4ca61e5e5143d8f1254bd4746cb41c1130349e504c83bbfe9c33ca53", "pe.image_hash.sha384": "99a7226c96ef2536b0e312f442b265da3d271705f1a8843e409e213c8bc67e6ad4dd20a994b27c62c31d987d6279f046", "pe.image_hash.sha512": "440ad58ec4fbcdcb4704d9c6f2d2af268f3e87748475c41c0f0ac66e5233ae0049b7cec9d425f0bdd125ee8103b46be311b212a6fb7b079dd352dc050a616fb8", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "tytytty", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.version.trademarks": "oiyu5767878", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.version.description": "778yugh", "pe.linker_major_version": 48, "pe.signatures[0].issuer": "CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "pe.signatures[0].serial": "7c1118cbbadc95da3752c46e47a27438", "pe.version.file_version": "11.11.11.11", "pe.version.product_name": "uiyutt", "pe.signatures[0].subject": "CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB", "pe.version.internal_name": "EdQt.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 748508, "pe.data_directories[1].rva": 753664, "pe.data_directories[2].rva": 750592, "pe.data_directories[3].rva": 770048, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-11-08T23:59:59Z", "pe.version.product_version": "11.11.11.11", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 79, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 8660, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 13832, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.signatures[0].not_before": "2018-11-13T00:00:00Z", "pe.version.original_filename": "EdQt.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].signing_time": "2019-03-16T12:31:52Z", "pe.signatures[0].nested.issuer": "CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "pe.signatures[0].nested.serial": "7c1118cbbadc95da3752c46e47a27438", "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].nested.subject": "CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB", "pe.signatures[0].nested.verified": true, "pe.signatures[0].thumbprint_sha1": "5b9e273cf11941fd8c6be3f038c4797bbe884268", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].nested.not_after": "2021-11-08T23:59:59Z", "pe.signatures[0].signature_digest": "404fe2b553c439b94b03a2a1b265ab000f12cf23", "pe.signatures[0].nested.not_before": "2018-11-13T00:00:00Z", "pe.signatures[0].signing_time_unix": 1552739512, "pe.signatures[0].thumbprint_sha256": "4cd3325617ebb63319ba6e8f2a74b0b8cca58920b48d8026ebca2c756630d570", "pe.signatures[0].nested.signing_time": "2019-03-16T12:31:55Z", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].nested.thumbprint_sha1": "5b9e273cf11941fd8c6be3f038c4797bbe884268", "pe.signatures[0].nested.cert_chain_depth": 4, "pe.signatures[0].nested.digest_algorithm": "sha256", "pe.signatures[0].nested.eku_code_signing": true, "pe.signatures[0].nested.signature_digest": "ba765aedeaf1e389b4e9a0f861d2821e53674e2faf61e7bc93fcdd23c9b8bd6d", "pe.signatures[0].nested.signing_time_unix": 1552739515, "pe.signatures[0].nested.thumbprint_sha256": "4cd3325617ebb63319ba6e8f2a74b0b8cca58920b48d8026ebca2c756630d570", "pe.signatures[0].nested.signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1", "pe.signatures[0].nested.signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 740864, 7.83, "r-x" ], [ ".rsrc", 741376, 8704, 7.58, "r--" ], [ ".reloc", 750080, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 764424, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x24e8" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x24e8" ] }, { "c": 1.0, "d": "Authenticode chain CN: Simon Tatham", "e": [ "Simon Tatham" ], "i": "metadata/signed/unknown::simon-tatham", "l": 2 }, { "c": 1.0, "d": "Signed by Simon Tatham", "e": [ "Simon Tatham" ], "i": "metadata/signed/leaf::simon-tatham", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "tytytty" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x453d" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x43a9" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "778yugh" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "0x3d1b" ] }, { "c": 1.0, "d": "Modification of HTTP context items", "e": [ "set_ItemHeight" ], "i": "micro-behaviors/communications/http/server/managed::http-item-setter", "l": 1, "el": [ "0x4810" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "11.11.11.11" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xb4e1e" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1, "el": [ "0x42db" ] }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "get_ResourceManager", "ComponentResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x446d", "0x4481" ] }, { "c": 0.800000011920929, "d": "Dynamic object instantiation via Activator", "e": [ "Activator" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::activator", "l": 1, "el": [ "0x4513" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "uiyutt" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.83)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 7725.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R", "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x56e4", "0x39de" ] }, { "a": "T1140", "c": 0.8399999737739563, "d": "CreateInstance activation token", "e": [ "CreateInstance" ], "i": "objectives/command-and-control/dropper/staging/embedded::createinstance-token", "l": 1, "m": "B0030", "el": [ "0x4cc2" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0xb6e9e" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "c5", "c6" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014", "el": [ "0x9ecde", "0x8f5e2" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 7725.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0xb6fa2" ] }, { "c": 0.8199999928474426, "d": "AppDomain GetDomain token", "e": [ "GetDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-getdomain-token", "l": 1, "el": [ "0x42e5" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.83" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027.009", "c": 0.7200000286102295, "d": ".NET resource GetObject token", "e": [ "GetObject" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getobject-token", "l": 1, "el": [ "0x47b0" ] }, { "c": 0.8999999761581421, "d": "PNG image magic in text section", "e": [ "89 50 4E 47 0D 0A 1A 0A" ], "i": "metadata/binary/resource::png-magic-in-text", "l": 1, "el": [ "0x5923" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1041", "c": 0.8600000143051147, "d": "Notification config wording", "e": [ "sender" ], "i": "objectives/exfiltration/messaging/webhook::notification-config-word", "l": 1, "m": "B0030", "el": [ "0x445f" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0x55f4" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "11.11.11.11" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1!0" ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "0xb85cd" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0xb7046" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "11.11.11.11" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1027.003", "c": 0.8199999928474426, "d": ".NET Bitmap type reference", "e": [ "System.Drawing.Bitmap" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-bitmap-type-token", "l": 1, "m": "F0001.006", "el": [ "0x7931" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0xb4e1e" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0xb70ee" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x46aa" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "ca", "cd", "c0", "c4" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0xa5894", "0xaae94", "0x96bdb", "0x38b80" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x46aa" ] }, { "a": "T1036.001", "c": 0.8799999952316284, "d": "UTN USERFirst Object string in overlay", "e": [ "UTN-USERFirst-Object", "UTN-USERFirst-Object0", "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05" ], "i": "objectives/evasion/masquerade/binary::overlay-utn-object-string", "l": 1, "el": [ "0xb8d47", "0xb8610", "0xb887f" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x403f" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.83" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 0.8199999928474426, "d": "Reflection exported types token", "e": [ "GetExportedTypes" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-exported-types-token", "l": 1, "el": [ "0x4637" ] }, { "a": "T1113", "c": 0.699999988079071, "d": "System.Drawing.Bitmap class reference", "e": [ "Bitmap" ], "i": "micro-behaviors/hardware/display/screen::bitmap-fromscratch-str", "l": 1, "m": "C0014", "el": [ "0x4403" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "0x452a" ] }, { "c": 0.7799999713897705, "d": "Assembly accessor token (get_Assembly)", "e": [ "get_Assembly" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token", "l": 1, "el": [ "0x4a31" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 7725.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "a": "T1113", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "get_display", "set_display" ], "i": "objectives/collection/monitor/capture::remote-desktop-control-fragments--rx-4", "l": 1, "el": [ "0x4a11", "0x4a1d" ] }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x5a8cb" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xd4e" ] }, { "c": 1.0, "d": "Issued by Comodo Code Signing CA", "e": [ "CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB" ], "i": "metadata/signed/certificate::pe-cert-issuer-comodo", "l": 2, "el": [ "value:pe.signatures[0].issuer" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 7725.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "COMODO certificate string in overlay", "e": [ "COMODO CA Limited1#0!", "COMODO CA Limited1*0(", "COMODO CA Limited1+0)" ], "i": "objectives/evasion/masquerade/binary::overlay-comodo-string", "l": 1, "el": [ "0xb7b98", "0xb868e", "0xb7515" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8199999928474426, "d": "Type.InvokeMember reflection token", "e": [ "InvokeMember" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token", "l": 1, "el": [ "0x4432" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "get_Value", "set_Value", "value", "value__" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x3fd1", "0x3fdb", "0x3fe5", "0x39d6" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x56e4" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0xb712a" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ToString", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x40bc", "0xb6f3e" ] }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "0x4cb8" ] }, { "c": 0.800000011920929, "d": "CancelEventArgs usage", "e": [ "CancelEventArgs" ], "i": "objectives/impact/ui/manipulation::cancel-event-args", "l": 1, "el": [ "0x466f" ] }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x3a02" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8999999761581421, "d": "WCF generated code attribute", "e": [ "GeneratedCodeAttribute" ], "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute", "l": 1, "el": [ "0x3e2d" ] }, { "c": 0.800000011920929, "d": "CodeDom compiler access", "e": [ "System.CodeDom.Compiler" ], "i": "metadata/lang/compiler/managed::codedom-compiler", "l": 2, "el": [ "0x44b5" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x56e4" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0xb6fd6" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image/pixel::pixel-access-getpixel", "l": 2, "el": [ "0x423f" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 7725.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003c\u003c\u003cObsolete\u003e\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1, "el": [ "0xb8f54" ] }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.9200000166893005, "d": "Large high-entropy random executable section", "e": [ ".text (size: 740864, entropy: 7.83, perms: r-x)" ], "i": "metadata/binary/section/metrics::random-exec-payload-section", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.6000000238418579, "d": "Beacon keyword (neutral context)", "e": [ "Beacon" ], "i": "micro-behaviors/data/text/keywords/c2::beacon", "l": 1, "el": [ "0x4312" ] }, { "c": 0.7200000286102295, "d": "WinForms Button control token", "e": [ "Button" ], "i": "micro-behaviors/ui/controls/widget::winforms-button", "l": 1, "el": [ "0x43de" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 740864, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.7200000286102295, "d": "WinForms Label control token", "e": [ "Label" ], "i": "micro-behaviors/ui/controls/widget::winforms-label", "l": 1, "el": [ "0x420d" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x403f" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "CompilationRelaxationsAttribute", "TargetFrameworkAttribute", "AssemblyTrademarkAttribute", "DebuggerNonUserCodeAttribute", "AssemblyFileVersionAttribute", "ComVisibleAttribute", "CompilerGeneratedAttribute", "DebuggableAttribute", "AssemblyProductAttribute", "GeneratedCodeAttribute", "AssemblyDescriptionAttribute", "ApplicationSettingsBase", "AssemblyTitleAttribute", "AssemblyConfigurationAttribute", "AssemblyCopyrightAttribute", "EditorBrowsableAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x3f46", "0x3ed4", "0x3eb9", "0x3e44", "0x3eed", "0x3e8e", "0x3e04", "0x3e61", "0x3f66", "0x3e2d", "0x3f29", "0x3d9b", "0x3ea2", "0x3f0a", "0x3f7f", "0x3e75" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "11.11.11.11" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.002", "c": 0.8500000238418579, "d": ".NET assembly with single import (packed)", "e": [ "imports.count = 1.00", "BSJB", "binary.code_entropy = 7.83" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-single-import", "l": 1 }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "11.11.11.11" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.002", "c": 0.8999999761581421, "d": ".NET assembly with bootstrap-only imports", "e": [ "binary.code_entropy = 7.83", "imports.count = 1.00", "BSJB" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-bootstrap-imports", "l": 1 }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155", "path": "2d2d4b2d72c47e85af4708ddf86ef35409db8212658b518d7d538fe22bec4155.exe", "type": "pe" } ], "tv": "52045" } }