{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.0021164021, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T14:02:10Z" }, "path": "VirusShare_72d7ebfc243231422e43db96ad488219", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "94f330c788995d4d6d0ac4ec19ff6bf3", "pe.checksum": "0x00021a51", "pe.timestamp": 1482331922, "hash.authenti": "66102e313bbb0f6a219a8d620d7f646ea492ae35aa1bcff05a0cde80a229603f", "debug.pdb_path": "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\mfbt\\tests\\TestSaturate.pdb", "pe.codeview.age": 1, "hash.rich_header": "c2591e67dfa6126a005664b2dfd48b34bf384ddb21e1dbcfa9ff86f9cd4400da", "pe.codeview.guid": "47F00ED8-7F8D-4C61-A35B-8B1D760C5D62", "build.target_arch": "x86", "pe.linker_version": "14.0", "pe.rich_header.xor_key": "0xe742c5f1", "pe.debug_entries[0].size": 126, "pe.debug_entries[0].type": "codeview", "pe.debug_entries[1].size": 20, "pe.debug_entries[1].type": "vc_feature", "pe.debug_entries[2].size": 628, "pe.debug_entries[2].type": "pogo", "pe.data_directories[0].rva": 89984, "pe.data_directories[1].rva": 93668, "pe.data_directories[2].rva": 106496, "pe.data_directories[3].rva": 88496, "pe.data_directories[4].rva": 88584, "pe.data_directories[5].rva": 77824, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 3684, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 180, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 2912, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 84, "pe.data_directories[4].name": "load_config", "pe.data_directories[4].size": 64, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 376, "pe.debug_directory_types[0]": 2, "pe.debug_directory_types[1]": 12, "pe.debug_directory_types[2]": 13, "pe.debug_entries[0].timestamp": 1482331922, "pe.debug_entries[1].timestamp": 1482331922, "pe.debug_entries[2].timestamp": 1482331922, "pe.load_config.security_cookie": "0x415b90", "pe.rich_header_compids[0].count": 10, "pe.rich_header_compids[1].count": 10, "pe.rich_header_compids[2].count": 24, "pe.rich_header_compids[3].count": 13, "pe.rich_header_compids[4].count": 4, "pe.rich_header_compids[5].count": 3, "pe.rich_header_compids[6].count": 86, "pe.rich_header_compids[7].count": 5, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "binary.top_complex_unnamed[0].cc": 105, "binary.top_complex_unnamed[1].cc": 41, "binary.top_complex_unnamed[2].cc": 39, "binary.top_complex_unnamed[3].cc": 38, "binary.top_complex_unnamed[4].cc": 35, "binary.top_complex_unnamed[5].cc": 35, "binary.top_complex_unnamed[6].cc": 33, "binary.top_complex_unnamed[7].cc": 29, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 9664521, "pe.rich_header_compids[1].compid": 16997947, "pe.rich_header_compids[2].compid": 17129019, "pe.rich_header_compids[3].compid": 17063483, "pe.rich_header_compids[4].compid": 16866875, "pe.rich_header_compids[5].compid": 16866669, "pe.rich_header_compids[6].compid": 65536, "pe.rich_header_compids[7].compid": 17129109, "pe.rich_header_compids[8].compid": 16801429, "pe.rich_header_compids[9].compid": 16932501, "binary.top_complex_unnamed[0].bbs": 153, "binary.top_complex_unnamed[1].bbs": 77, "binary.top_complex_unnamed[2].bbs": 63, "binary.top_complex_unnamed[3].bbs": 43, "binary.top_complex_unnamed[4].bbs": 59, "binary.top_complex_unnamed[5].bbs": 56, "binary.top_complex_unnamed[6].bbs": 52, "binary.top_complex_unnamed[7].bbs": 43, "pe.rich_header_compids[6].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x40ce7a", "binary.top_complex_unnamed[0].size": 2288, "binary.top_complex_unnamed[1].addr": "0x4030a2", "binary.top_complex_unnamed[1].size": 1177, "binary.top_complex_unnamed[2].addr": "0x4081e4", "binary.top_complex_unnamed[2].size": 769, "binary.top_complex_unnamed[3].addr": "0x40c74c", "binary.top_complex_unnamed[3].size": 428, "binary.top_complex_unnamed[4].addr": "0x40455f", "binary.top_complex_unnamed[4].size": 819, "binary.top_complex_unnamed[5].addr": "0x407eff", "binary.top_complex_unnamed[5].size": 741, "binary.top_complex_unnamed[6].addr": "0x404ac1", "binary.top_complex_unnamed[6].size": 756, "binary.top_complex_unnamed[7].addr": "0x4075ee", "binary.top_complex_unnamed[7].size": 406, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".gfids", "pe.section_characteristics[4].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 10, "pe.rich_header.entries[1].use_count": 10, "pe.rich_header.entries[2].use_count": 24, "pe.rich_header.entries[3].use_count": 13, "pe.rich_header.entries[4].use_count": 4, "pe.rich_header.entries[5].use_count": 3, "pe.rich_header.entries[6].use_count": 86, "pe.rich_header.entries[7].use_count": 5, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 147, "pe.rich_header.entries[1].product_id": 259, "pe.rich_header.entries[2].product_id": 261, "pe.rich_header.entries[3].product_id": 260, "pe.rich_header.entries[4].product_id": 257, "pe.rich_header.entries[5].product_id": 257, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 261, "pe.rich_header.entries[8].product_id": 256, "pe.rich_header.entries[9].product_id": 258, "pe.rich_header.entries[0].build_number": 30729, "pe.rich_header.entries[0].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[1].build_number": 24123, "pe.rich_header.entries[1].product_name": "Cvtres_VS2013", "pe.rich_header.entries[2].build_number": 24123, "pe.rich_header.entries[2].product_name": "Cpp_VS2015", "pe.rich_header.entries[3].build_number": 24123, "pe.rich_header.entries[3].product_name": "C_VS2015", "pe.rich_header.entries[4].build_number": 24123, "pe.rich_header.entries[4].product_name": "Linker_VS2013", "pe.rich_header.entries[5].build_number": 23917, "pe.rich_header.entries[5].product_name": "Linker_VS2013", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 24213, "pe.rich_header.entries[7].product_name": "Cpp_VS2015", "pe.rich_header.entries[8].build_number": 24213, "pe.rich_header.entries[8].product_name": "Cpp_VS2013", "pe.rich_header.entries[9].build_number": 24213, "pe.rich_header.entries[9].product_name": "Linker_VS2013_LTCG", "pe.section_characteristics[0].raw_size": 71168, "pe.section_characteristics[1].raw_size": 19456, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[3].raw_size": 512, "pe.section_characteristics[4].raw_size": 3072, "pe.section_characteristics[0].virtual_size": 70968, "pe.section_characteristics[1].virtual_size": 19164, "pe.section_characteristics[2].virtual_size": 1116, "pe.section_characteristics[3].virtual_size": 84, "pe.section_characteristics[4].virtual_size": 2912, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 77824, "pe.section_characteristics[2].virtual_address": 98304, "pe.section_characteristics[3].virtual_address": 102400, "pe.section_characteristics[4].virtual_address": 106496, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 5, "id": 0, "is": [ "TerminateProcess", "GetCurrentProcess", "GetSystemInfo", "VirtualAlloc", "VirtualFree", "GetStartupInfoW", "IsDebuggerPresent", "InitializeSListHead", "GetSystemTimeAsFileTime", "GetCurrentThreadId", "GetCurrentProcessId", "QueryPerformanceCounter", "IsProcessorFeaturePresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetModuleHandleW", "?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z", "?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ", "?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ", "?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z", "?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z", "?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ", "?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ", "?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ", "?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z", "?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z", "?_BADOFF@std@@3_JB", "??_7ios_base@std@@6B@", "??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@", "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z", "??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ", "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z", "?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ", "??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ", "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ", "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z", "?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z", "?_Xout_of_range@std@@YAXPBD@Z", "?_Xbad_alloc@std@@YAXXZ", "?_Xlength_error@std@@YAXPBD@Z", "memset", "memmove", "except_handler4_common", "std_exception_copy", "std_type_info_destroy_list", "std_exception_destroy", "CxxThrowException", "memcpy", "p__commode", "stdio_common_vfprintf", "fflush", "acrt_iob_func", "set_fmode", "callnewh", "set_new_mode", "calloc", "free", "malloc", "cexit", "c_exit", "register_thread_local_exe_atexit_callback", "p___argv", "p___argc", "invalid_parameter_noinfo_noreturn", "seh_filter_dll", "initialize_onexit_table", "register_onexit_function", "execute_onexit_table", "crt_atexit", "crt_at_quick_exit", "controlfp_s", "terminate", "seh_filter_exe", "initialize_narrow_environment", "exit", "exit", "initterm_e", "initterm", "get_initial_narrow_environment", "configure_narrow_argv", "set_app_type", "except1", "dtest", "setusermatherr", "ceil", "configthreadlocale" ], "ms": { "pe": { "entry": 71737.0, "machine": 332.0, "checksum": 137809.0, "has_pogo": true, "pdb_path": "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\mfbt\\tests\\TestSaturate.pdb", "subsystem": 3.0, "timestamp": 1482331922.0, "image_base": 4194304.0, "codeview_age": 1.0, "has_checksum": true, "codeview_guid": "47F00ED8-7F8D-4C61-A35B-8B1D760C5D62", "entry_section": ".text", "size_of_image": 110592.0, "cfg_func_count": 256.0, "checksum_valid": true, "file_alignment": 512.0, "has_vc_feature": true, "characteristics": 290.0, "has_rich_header": true, "security_cookie": 4283280.0, "size_of_headers": 1024.0, "export_timestamp": 1482331922.0, "import_dll_count": 8.0, "se_handler_count": 4272504.0, "computed_checksum": 137809.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1482331922.0, "debug_timestamp_min": 1482331922.0, "dll_characteristics": 33088.0, "has_export_timestamp": true, "linker_major_version": 14.0, "debug_directory_types": [ 2.0, 12.0, 13.0 ], "has_resource_timestamp": false, "debug_directory_entries": 3.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 3.0 }, "file": { "size": 95744.0 }, "binary": { "code_size": 71168.0, "func_count": 426.0, "code_entropy": 6.58, "data_entropy": 3.81, "export_count": 64.0, "func_density": 6.13, "import_count": 86.0, "string_count": 344.0, "avg_func_size": 177.27, "section_count": 5.0, "avg_complexity": 5.85, "import_density": 1.24, "max_complexity": 105.0, "string_density": 4.95, "overall_entropy": 4.23, "avg_basic_blocks": 9.11, "avg_section_size": 18944.0, "dependency_count": 8.0, "entropy_variance": 2.6, "avg_string_length": 35.69, "complexity_per_kb": 0.08, "max_string_length": 117.0, "avg_string_entropy": 3.63, "code_to_data_ratio": 3.02, "data_to_file_ratio": 0.01, "text_to_file_ratio": 0.74, "total_basic_blocks": 3879.0, "func_analysis_depth": 2.0, "string_length_stddev": 29.32, "debug_reference_count": 3.0, "largest_section_ratio": 0.74, "sentence_string_count": 47.0, "sentence_string_ratio": 0.14, "writable_section_count": 1.0, "behavioral_import_ratio": 0.01, "executable_section_count": 1.0, "nonstandard_section_count": 1.0, "high_complexity_func_count": 1.0, "unnamed_complex_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 224, "Rich" ], [ 504, ".text" ], [ 583, "@.data" ], [ 624, ".gfids" ], [ 663, "@.reloc" ], [ 1203, "QQS2" ], [ 1437, "f90u" ], [ 2302, "f90t" ], [ 2373, "f98t" ], [ 3302, "QQSV3" ], [ 3404, "QQSV" ], [ 4634, "QVW3" ], [ 4656, "f98u" ], [ 5517, "QQVS2" ], [ 19973, "rYSVPRQ" ], [ 25906, "SVW3" ], [ 27054, "VQPW" ], [ 27077, "PWPW" ], [ 31259, "xxxxwwww" ], [ 32760, "QQSVW" ], [ 36232, "QSVW" ], [ 36960, "SVW9U" ], [ 37623, "XPWS" ], [ 38328, "ZRQP" ], [ 43239, "SVWP" ], [ 45252, "QSVW3" ], [ 53300, "SHPV" ], [ 71289, "5ntel" ], [ 72624, "Assertion failure: %s, at %s:%d" ], [ 72664, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/tests/TestSaturate.cpp" ], [ 72756, "++value == ++satValue (Test '++value == ++satValue' failed.)" ], [ 72820, "value++ == satValue++ (Test 'value++ == satValue++' failed.)" ], [ 72968, "--value == --satValue (Test '--value == --satValue' failed.)" ], [ 73032, "value-- == satValue-- (Test 'value-- == satValue--' failed.)" ], [ 73176, "--satValue == (std::numeric_limits\u003cT\u003e::max() - 1) (Test '--satValue == (std::numeric_limits\u003cT\u003e::max() - 1)' failed.)" ], [ 73296, "++satValue == (std::numeric_limits\u003cT\u003e::max()) (Test '++satValue == (std::numeric_limits\u003cT\u003e::max())' failed.)" ], [ 73408, "--satValue == (std::numeric_limits\u003cT\u003e::max() - 2) (Test '--satValue == (std::numeric_limits\u003cT\u003e::max() - 2)' failed.)" ], [ 73528, "++satValue == (std::numeric_limits\u003cT\u003e::min() + 1) (Test '++satValue == (std::numeric_limits\u003cT\u003e::min() + 1)' failed.)" ], [ 73648, "--satValue == (std::numeric_limits\u003cT\u003e::min()) (Test '--satValue == (std::numeric_limits\u003cT\u003e::min())' failed.)" ], [ 73760, "++satValue == (std::numeric_limits\u003cT\u003e::min() + 2) (Test '++satValue == (std::numeric_limits\u003cT\u003e::min() + 2)' failed.)" ], [ 73880, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/Compression.cpp" ], [ 73964, "inputSizeChecked.isValid()" ], [ 73992, "maxOutputSizeChecked.isValid()" ], [ 74024, "outputSizeChecked.isValid()" ], [ 74056, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/CheckedInt.h" ], [ 74168, "mIsValid (Invalid checked integer (division by zero or integer overflow))" ], [ 74248, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\decimal\\Decimal.h" ], [ 74336, "isFinite()" ], [ 74352, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\double-conversion\\utils.h" ], [ 74448, "!is_finalized() \u0026\u0026 position_ \u003c buffer_.length()" ], [ 74496, "strlen(buffer_.start()) == static_cast\u003csize_t\u003e(position_)" ], [ 74632, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/decimal/Decimal.cpp" ], [ 74720, "false (MOZ_ASSERT_UNREACHABLE: moz-decimal-utils.h)" ], [ 74772, "divisor" ], [ 74788, "n \u003c= Precision" ], [ 74804, "lhs.isFinite()" ], [ 74820, "rhs.isFinite()" ], [ 74836, "-Infinity" ], [ 74848, "Infinity" ], [ 74876, "bufLength \u003e 0" ], [ 74892, "0 \u003c= index \u0026\u0026 index \u003c length_" ], [ 74924, "len == 0 || (len \u003e 0 \u0026\u0026 data != 0)" ], [ 74960, "string too long" ], [ 74976, "invalid string position" ], [ 75000, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/Casting.h" ], [ 75152, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/FloatingPoint.h" ], [ 75264, "signbit == 0 || signbit == 1" ], [ 75296, "(significand \u0026 ~Traits::kSignificandBits) == 0" ], [ 75344, "significand \u0026 Traits::kSignificandBits" ], [ 75696, "Hit MOZ_CRASH(%s) at %s:%d" ], [ 75728, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/HashFunctions.h" ], [ 75856, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla\\utils.h" ], [ 75972, "!is_finalized() \u0026\u0026 position_ + n \u003c buffer_.length()" ], [ 76024, "static_cast\u003csize_t\u003e(n) \u003c= strlen(s)" ], [ 76064, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/double-conversion.h" ], [ 76184, "((flags \u0026 EMIT_TRAILING_DECIMAL_POINT) != 0) || !((flags \u0026 EMIT_TRAILING_ZERO_AFTER_POINT) != 0)" ], [ 76288, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/Poison.cpp" ], [ 76368, "no usable poison region identified" ], [ 76408, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/SHA1.cpp" ], [ 76492, "!mDone (SHA1Sum can only be used to compute a single hash.)" ], [ 76648, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\double-conversion\\bignum.h" ], [ 76744, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\double-conversion\\diy-fp.h" ], [ 76840, "e_ == other.e_" ], [ 76856, "f_ \u003e= other.f_" ], [ 76880, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\double-conversion\\ieee.h" ], [ 76972, "Sign() \u003e 0" ], [ 76984, "!IsSpecial()" ], [ 77000, "value() \u003e 0.0" ], [ 77016, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/bignum-dtoa.cc" ], [ 77116, "significand != 0" ], [ 77144, "!Double(v).IsSpecial()" ], [ 77260, "*decimal_point == -requested_digits" ], [ 77296, "estimated_power \u003e= 0" ], [ 77320, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/bignum.cc" ], [ 77444, "IsClamped()" ], [ 77456, "other.IsClamped()" ], [ 77476, "bigit_pos \u003e= 0" ], [ 77492, "LessEqual(other, *this)" ], [ 77548, "exponent \u003e= 0" ], [ 77564, "accumulator == 0" ], [ 77596, "power_exponent \u003e= 0" ], [ 77616, "other.used_digits_ \u003e 0" ], [ 77640, "other.bigits_[other.used_digits_ - 1] \u003e= ((1 \u003c\u003c kBigitSize) / 16)" ], [ 77708, "BigitLength() == other.BigitLength()" ], [ 77776, "a.IsClamped()" ], [ 77792, "b.IsClamped()" ], [ 77808, "c.IsClamped()" ], [ 77824, "used_digits_ \u003e= 0" ], [ 77844, "exponent_ \u003e= 0" ], [ 77860, "shift_amount \u003c kBigitSize" ], [ 77888, "shift_amount \u003e= 0" ], [ 77908, "exponent_ \u003c= other.exponent_" ], [ 79336, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/cached-powers.cc" ], [ 79440, "0 \u003c= index \u0026\u0026 index \u003c kCachedPowersLength" ], [ 79484, "min_exponent \u003c= cached_power.binary_exponent" ], [ 79532, "cached_power.binary_exponent \u003c= max_exponent" ], [ 79580, "kMinDecimalExponent \u003c= requested_exponent" ], [ 79624, "requested_exponent \u003c kMaxDecimalExponent + kDecimalExponentDistance" ], [ 79692, "*found_exponent \u003c= requested_exponent" ], [ 79736, "requested_exponent \u003c *found_exponent + kDecimalExponentDistance" ], [ 79800, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/double-conversion.cc" ], [ 79908, "length != 0" ], [ 79920, "exponent \u003c 1e4" ], [ 79936, "length \u003c= digits_after_point - (-decimal_point)" ], [ 79984, "digits_after_point \u003e 0" ], [ 80008, "length - decimal_point \u003c= digits_after_point" ], [ 80056, "mode == SHORTEST || mode == SHORTEST_SINGLE" ], [ 80100, "decimal_rep_length \u003c= requested_digits + 1" ], [ 80144, "decimal_rep_length \u003c= precision" ], [ 80176, "mode == SHORTEST || mode == SHORTEST_SINGLE || requested_digits \u003e= 0" ], [ 80248, "**current == *substring" ], [ 80272, "buffer_pos \u003c kBufferSize" ], [ 80300, "-max_exponent / 2 \u003c= exponent \u0026\u0026 exponent \u003c= max_exponent / 2" ], [ 80364, "tail_pointer != 0" ], [ 80384, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/fast-dtoa.cc" ], [ 80484, "rest \u003c= unsafe_interval" ], [ 80508, "rest \u003c ten_kappa" ], [ 80571, ";number \u003c (1u \u003c\u003c (number_bits + 1))" ], [ 80680, "kMinimalTargetExponent \u003c= w.e() \u0026\u0026 w.e() \u003c= kMaximalTargetExponent" ], [ 80764, "fractionals \u003c one.f()" ], [ 80792, "(((static_cast\u003cuint64_t\u003e(0xFFFFFFFF) \u003c\u003c 32) + 0xFFFFFFFFu)) / 10 \u003e= one.f()" ], [ 80868, "mode == FAST_DTOA_SHORTEST_SINGLE" ], [ 80904, "boundary_plus.e() == w.e()" ], [ 81088, "scaled_w.e() == boundary_plus.e() + ten_mk.e() + DiyFp::kSignificandSize" ], [ 81168, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/fixed-dtoa.cc" ], [ 81268, "(accumulator \u003e\u003e 32) == 0" ], [ 81296, "-64 \u003c= shift_amount \u0026\u0026 shift_amount \u003c= 64" ], [ 81340, "-128 \u003c= exponent \u0026\u0026 exponent \u003c= 0" ], [ 81376, "fractionals \u003e\u003e 56 == 0" ], [ 81400, "64 \u003c -exponent \u0026\u0026 -exponent \u003c= 128" ], [ 81436, "number \u003e 0" ], [ 81448, "current != end" ], [ 81464, "number \u003c ((int64_t)1 \u003c\u003c kSignificandSize)" ], [ 81508, "static_cast\u003cint64_t\u003e(static_cast\u003cdouble\u003e(number)) == number" ], [ 81568, "number != 0" ], [ 81863, "Dc:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/strtod.cc" ], [ 81960, "buffer[buffer.length() - 1] != '0'" ], [ 81996, "space_size \u003e= kMaxSignificantDecimalDigits" ], [ 82040, "read_digits == trimmed.length()" ], [ 82072, "0 \u003c exponent" ], [ 82088, "exponent \u003c PowersOfTenCache::kDecimalExponentDistance" ], [ 82144, "PowersOfTenCache::kDecimalExponentDistance == 8" ], [ 82192, "exponent \u003c= PowersOfTenCache::kMaxDecimalExponent" ], [ 82244, "precision_digits_count \u003c 64" ], [ 82272, "buffer.length() + exponent \u003c= kMaxDecimalPower + 1" ], [ 82324, "buffer.length() + exponent \u003e kMinDecimalPower" ], [ 82372, "buffer.length() \u003c= kMaxSignificantDecimalDigits" ], [ 82568, "to \u003c= length_" ], [ 82768, "Unknown exception" ], [ 82800, "bad allocation" ], [ 82828, "bad array new length" ], [ 83348, "RSDS" ], [ 83372, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\mfbt\\tests\\TestSaturate.pdb" ], [ 83784, ".rdata" ], [ 83820, ".rdata$sxdata" ], [ 83844, ".rdata$zzzdbg" ], [ 83968, ".edata" ], [ 84064, ".data" ], [ 84096, ".bss" ], [ 85032, "TestSaturate.exe" ], [ 85049, "??0Decimal@blink@@QAE@ABV01@@Z" ], [ 85080, "??0Decimal@blink@@QAE@ABVEncodedData@01@@Z" ], [ 85123, "??0Decimal@blink@@QAE@H@Z" ], [ 85187, "??0SHA1Sum@mozilla@@QAE@XZ" ], [ 85214, "??4Decimal@blink@@QAEAAV01@ABV01@@Z" ], [ 85250, "??8Decimal@blink@@QBE_NABV01@@Z" ], [ 85282, "??9Decimal@blink@@QBE_NABV01@@Z" ], [ 85314, "??DDecimal@blink@@QBE?AV01@ABV01@@Z" ], [ 85350, "??GDecimal@blink@@QBE?AV01@ABV01@@Z" ], [ 85386, "??GDecimal@blink@@QBE?AV01@XZ" ], [ 85416, "??HDecimal@blink@@QBE?AV01@ABV01@@Z" ], [ 85452, "??KDecimal@blink@@QBE?AV01@ABV01@@Z" ], [ 85488, "??MDecimal@blink@@QBE_NABV01@@Z" ], [ 85520, "??NDecimal@blink@@QBE_NABV01@@Z" ], [ 85552, "??ODecimal@blink@@QBE_NABV01@@Z" ], [ 85584, "??PDecimal@blink@@QBE_NABV01@@Z" ], [ 85616, "??XDecimal@blink@@QAEAAV01@ABV01@@Z" ], [ 85652, "??YDecimal@blink@@QAEAAV01@ABV01@@Z" ], [ 85688, "??ZDecimal@blink@@QAEAAV01@ABV01@@Z" ], [ 85724, "??_0Decimal@blink@@QAEAAV01@ABV01@@Z" ], [ 85761, "??_FDecimal@blink@@QAEXXZ" ], [ 85787, "?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z" ], [ 85891, "?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z" ], [ 85998, "?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z" ], [ 86090, "?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ" ], [ 86165, "?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z" ], [ 86257, "?HashBytes@mozilla@@YAIPBXI@Z" ], [ 86287, "?IsFloat32Representable@mozilla@@YA_NN@Z" ], [ 86328, "?ToExponential@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z" ], [ 86415, "?ToFixed@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z" ], [ 86496, "?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPA_NPAVStringBuilder@2@@Z" ], [ 86585, "?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z" ], [ 86692, "?Unused@mozilla@@3Uunused_t@1@B" ], [ 86724, "?abs@Decimal@blink@@QBE?AV12@XZ" ], [ 86756, "?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z" ], [ 86820, "?ceil@Decimal@blink@@QBE?AV12@XZ" ], [ 86853, "?compareTo@Decimal@blink@@ABE?AV12@ABV12@@Z" ], [ 86897, "?compress@LZ4@Compression@mozilla@@SAIPBDIPAD@Z" ], [ 86945, "?compressLimitedOutput@LZ4@Compression@mozilla@@SAIPBDIPADI@Z" ], [ 87007, "?decompress@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z" ], [ 87062, "?decompress@LZ4@Compression@mozilla@@SA_NPBDPADI@Z" ], [ 87113, "?finish@SHA1Sum@mozilla@@QAEXAAY0BE@E@Z" ], [ 87153, "?floor@Decimal@blink@@QBE?AV12@XZ" ], [ 87187, "?fromDouble@Decimal@blink@@SA?AV12@N@Z" ], [ 87226, "?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z" ], [ 87328, "?gChaosFeatures@detail@mozilla@@3W4ChaosFeature@2@A" ], [ 87380, "?gChaosModeCounter@detail@mozilla@@3V?$Atomic@I$01X@2@A" ], [ 87436, "?gTwoCharEscapes@detail@mozilla@@3QBDB" ], [ 87475, "?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z" ], [ 87521, "?kBase10MaximalLength@DoubleToStringConverter@double_conversion@@2HB" ], [ 87590, "?nan@Decimal@blink@@SA?AV12@XZ" ], [ 87621, "?remainder@Decimal@blink@@QBE?AV12@ABV12@@Z" ], [ 87665, "?round@Decimal@blink@@QBE?AV12@XZ" ], [ 87699, "?toDouble@Decimal@blink@@QBENXZ" ], [ 87731, "?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ" ], [ 87826, "?toString@Decimal@blink@@QBE_NPADI@Z" ], [ 87863, "?update@SHA1Sum@mozilla@@QAEXPBXI@Z" ], [ 87941, "gMozCrashReason" ], [ 87957, "gMozillaPoisonBase" ], [ 87976, "gMozillaPoisonSize" ], [ 87995, "gMozillaPoisonValue" ], [ 88015, "mozPoisonValueInit" ], [ 88594, "TerminateProcess" ], [ 88614, "GetCurrentProcess" ], [ 88634, "GetSystemInfo" ], [ 88650, "VirtualAlloc" ], [ 88666, "VirtualFree" ], [ 88678, "KERNEL32.dll" ], [ 88694, "?_Xbad_alloc@std@@YAXXZ" ], [ 88720, "?_Xlength_error@std@@YAXPBD@Z" ], [ 88752, "?_Xout_of_range@std@@YAXPBD@Z" ], [ 88784, "?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z" ], [ 88828, "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ" ], [ 88888, "??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ" ], [ 88948, "?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ" ] ], "sz": 95744, "ts": [ { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 3879.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "41", "48", "40" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 426.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 64.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "High export count metric", "e": [ "binary.export_count = 64.00" ], "i": "metadata/binary/metrics/anomaly::high-export-count-marker", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "TestSaturate.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 1.0, "d": "PGO-trained release build (POGO)", "e": [ "pe.has_pogo = 1.00" ], "i": "metadata/build/reproducible::pe-pgo-trained", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.23" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.58)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.23" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "outputSizeChecked.isValid()" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 344.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 64.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 0.8999999761581421, "d": "Allocate zeroed memory", "e": [ "calloc" ], "i": "micro-behaviors/mem/c-runtime/functions::calloc", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "d": "overflow keyword", "e": [ "mIsValid (Invalid checked integer (division by zero or integer overflow))" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "a": "T1016", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.export_count = 64.00" ], "i": "micro-behaviors/os/network/interface::host-network-fingerprint-surface-cond-0--inline-3605", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_72d7ebfc243231422e43db96ad488219" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z", "?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z", "**current == *substring", "?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPA_NPAVStringBuilder@2@@Z", "?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z", "?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ", "?kBase10MaximalLength@DoubleToStringConverter@double_conversion@@2HB", "invalid string position", "?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ", "?ToExponential@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z", "?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z", "string too long", "?toString@Decimal@blink@@QBE_NPADI@Z", "?ToFixed@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z", "?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z", "?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1620", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.export_count = 64.00" ], "i": "objectives/command-and-control/backdoor/loader/native-reflect::runtime-loader-with-encoded-data-cond-4--inline-14359", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.85" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.63" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 426.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 110592.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0xFFFFFFFF" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 426.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025" }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.58" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1482331922.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "High export count metric", "e": [ "binary.export_count = 64.00" ], "i": "micro-behaviors/communications/socket/route::high-export-count", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 86.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "--satValue == (std::numeric_limits\u003cT\u003e::max() - 1) (Test '--satValue == (std::numeric_limits\u003cT\u003e::max() - 1)' failed.)", "++satValue == (std::numeric_limits\u003cT\u003e::max()) (Test '++satValue == (std::numeric_limits\u003cT\u003e::max())' failed.)", "--satValue == (std::numeric_limits\u003cT\u003e::max() - 2) (Test '--satValue == (std::numeric_limits\u003cT\u003e::max() - 2)' failed.)", "--satValue == (std::numeric_limits\u003cT\u003e::min()) (Test '--satValue == (std::numeric_limits\u003cT\u003e::min())' failed.)", "++satValue == (std::numeric_limits\u003cT\u003e::min() + 2) (Test '++satValue == (std::numeric_limits\u003cT\u003e::min() + 2)' failed.)", "value() \u003e 0.0", "mozPoisonValueInit", "?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z", "++value == ++satValue (Test '++value == ++satValue' failed.)", "value-- == satValue-- (Test 'value-- == satValue--' failed.)", "++satValue == (std::numeric_limits\u003cT\u003e::min() + 1) (Test '++satValue == (std::numeric_limits\u003cT\u003e::min() + 1)' failed.)", "--value == --satValue (Test '--value == --satValue' failed.)", "gMozillaPoisonValue", "value++ == satValue++ (Test 'value++ == satValue++' failed.)" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\mfbt\\tests\\TestSaturate.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 64.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.export_count = 64.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-10--inline-29172", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 426.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "PowersOfTenCache::kDecimalExponentDistance == 8", "exponent \u003c= PowersOfTenCache::kMaxDecimalExponent", "min_exponent \u003c= cached_power.binary_exponent", "0 \u003c= index \u0026\u0026 index \u003c kCachedPowersLength", "exponent \u003c PowersOfTenCache::kDecimalExponentDistance", "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/cached-powers.cc", "cached_power.binary_exponent \u003c= max_exponent" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.export_count = 64.00" ], "i": "objectives/anti-static/obfuscation/payload/section::versioned-export-heavy-library-cond-1--inline-29160", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeSListHead", "CreateDecimalRepresentation", "DoubleToStringConverter", "EcmaScriptConverter", "CreateExponentialRepresentation", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcessId", "GetSystemTimeAsFileTime" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 1482331922.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (TerminateProcess, GetCurrentProcess, GetSystemInfo, VirtualAlloc, VirtualFree, ... +11 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-heap-l1-1-0.dll (callnewh, set_new_mode, calloc, free, malloc)", "e": [ "api-ms-win-crt-heap-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-heap-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-stdio-l1-1-0.dll (p__commode, stdio_common_vfprintf, fflush, acrt_iob_func, set_fmode)", "e": [ "api-ms-win-crt-stdio-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-stdio-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-math-l1-1-0.dll (except1, dtest, setusermatherr, ceil)", "e": [ "api-ms-win-crt-math-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-math-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-locale-l1-1-0.dll (configthreadlocale)", "e": [ "api-ms-win-crt-locale-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-locale-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VCRUNTIME140.dll (memset, memmove, except_handler4_common, std_exception_copy, std_type_info_destroy_list, ... +3 more)", "e": [ "VCRUNTIME140.dll" ], "i": "metadata/dylib::vcruntime140/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-runtime-l1-1-0.dll (cexit, c_exit, register_thread_local_exe_atexit_callback, p___argv, p___argc, ... +18 more)", "e": [ "api-ms-win-crt-runtime-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-runtime-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCP140.dll (?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z, ... +19 more)", "e": [ "MSVCP140.dll" ], "i": "metadata/dylib::msvcp140/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 86.00", "pe.has_rich_header = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 1 } ], "sha": "2e7b937c187bc8790432cd64c1ccde6fbe41f24da12afcc324697d7b44df3097", "path": "VirusShare_72d7ebfc243231422e43db96ad488219", "type": "pe" } ], "tv": "529a0" } }