{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998842477798462, "class": 2 }, { "id": 1, "prob": 0.036662645637989044, "class": 0 }, { "id": 2, "prob": 0.060229819267988205, "class": 0 }, { "id": 3, "prob": 0.07448078691959381, "class": 0 }, { "id": 4, "prob": 0.08629532903432846, "class": 0 }, { "id": 5, "prob": 0.1553753912448883, "class": 0 }, { "id": 6, "prob": 0.050603002309799194, "class": 0 } ], "prob": 0.99988425, "class": 2, "models": [ { "m": "az", "prob": 0.9997372, "class": 2 }, { "m": "az/native", "prob": 0.99988425, "class": 2 }, { "m": "az/pe", "prob": 0.9993507, "class": 1 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T08:54:27Z" }, "path": "275445", "raw": { "v": "4", "fs": [ { "f": "K₂O₉(Al₆As₁₂C₄CoDy₂Er₅EuSXe)H₅(Cm₂Db₂F₂OsPo₄)Md₅(Bi₆Pa₂HeSi)", "k": { "pe.checksum": "0x00208183", "pe.has_pogo": true, "pe.timestamp": 1529664955, "hashes.imphash": "48fafbcc9fa53df7ce475bc894492f4d", "build.target_arch": "x86", "pe.linker_version": "14.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_MANIFEST", "pe.rich_header.xor_key": "0x19638ef4", "hashes.rich_header_hash": "cfc0ed9c795c01e543dca11560cc5329f527ae46fb522fef0d76ee429631adba", "pe.debug_entries[0].size": 692, "pe.debug_entries[0].type": "pogo", "pe.debug_directory_types[0]": 13, "pe.debug_entries[0].timestamp": 1529664955, "pe.load_config.security_cookie": "0x411a80", "binary.top_complex_unnamed[0].cc": 303, "binary.top_complex_unnamed[1].cc": 53, "binary.top_complex_unnamed[2].cc": 34, "binary.top_complex_unnamed[3].cc": 29, "binary.top_complex_unnamed[4].cc": 28, "binary.top_complex_unnamed[5].cc": 24, "binary.top_complex_unnamed[6].cc": 22, "binary.top_complex_unnamed[7].cc": 22, "pe.dll_characteristics.nx_compat": true, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "binary.top_complex_unnamed[0].bbs": 554, "binary.top_complex_unnamed[1].bbs": 100, "binary.top_complex_unnamed[2].bbs": 62, "binary.top_complex_unnamed[3].bbs": 53, "binary.top_complex_unnamed[4].bbs": 50, "binary.top_complex_unnamed[5].bbs": 42, "binary.top_complex_unnamed[6].bbs": 45, "binary.top_complex_unnamed[7].bbs": 40, "binary.top_complex_unnamed[0].addr": "0x40d17c", "binary.top_complex_unnamed[0].size": 3833, "binary.top_complex_unnamed[1].addr": "0x40722b", "binary.top_complex_unnamed[1].size": 768, "binary.top_complex_unnamed[2].addr": "0x407980", "binary.top_complex_unnamed[2].size": 914, "binary.top_complex_unnamed[3].addr": "0x40329b", "binary.top_complex_unnamed[3].size": 390, "binary.top_complex_unnamed[4].addr": "0x40a6ae", "binary.top_complex_unnamed[4].size": 493, "binary.top_complex_unnamed[5].addr": "0x407d6f", "binary.top_complex_unnamed[5].size": 530, "binary.top_complex_unnamed[6].addr": "0x409d93", "binary.top_complex_unnamed[6].size": 536, "binary.top_complex_unnamed[7].addr": "0x405709", "binary.top_complex_unnamed[7].size": 497, "pe.dll_characteristics.dynamic_base": true, "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.rich_header.entries[0].use_count": 9, "pe.rich_header.entries[1].use_count": 127, "pe.rich_header.entries[2].use_count": 18, "pe.rich_header.entries[3].use_count": 17, "pe.rich_header.entries[4].use_count": 29, "pe.rich_header.entries[5].use_count": 17, "pe.rich_header.entries[6].use_count": 9, "pe.rich_header.entries[7].use_count": 109, "pe.rich_header.entries[8].use_count": 3, "pe.rich_header.entries[9].use_count": 1, "pe.manifest.dependencies[0].language": "*", "pe.rich_header.entries[0].product_id": 259, "pe.rich_header.entries[10].use_count": 1, "pe.rich_header.entries[11].use_count": 1, "pe.rich_header.entries[1].product_id": 261, "pe.rich_header.entries[2].product_id": 260, "pe.rich_header.entries[3].product_id": 259, "pe.rich_header.entries[4].product_id": 261, "pe.rich_header.entries[5].product_id": 260, "pe.rich_header.entries[6].product_id": 257, "pe.rich_header.entries[7].product_id": 1, "pe.rich_header.entries[8].product_id": 265, "pe.rich_header.entries[9].product_id": 255, "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[10].product_id": 151, "pe.rich_header.entries[11].product_id": 258, "pe.rich_header.entries[0].build_number": 24610, "pe.rich_header.entries[0].product_name": "Cvtres_VS2013", "pe.rich_header.entries[1].build_number": 24610, "pe.rich_header.entries[1].product_name": "Cpp_VS2015", "pe.rich_header.entries[2].build_number": 24610, "pe.rich_header.entries[2].product_name": "C_VS2015", "pe.rich_header.entries[3].build_number": 24123, "pe.rich_header.entries[3].product_name": "Cvtres_VS2013", "pe.rich_header.entries[4].build_number": 24123, "pe.rich_header.entries[4].product_name": "Cpp_VS2015", "pe.rich_header.entries[5].build_number": 24123, "pe.rich_header.entries[5].product_name": "C_VS2015", "pe.rich_header.entries[6].build_number": 24610, "pe.rich_header.entries[6].product_name": "Linker_VS2013", "pe.rich_header.entries[7].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[8].build_number": 24210, "pe.rich_header.entries[8].product_name": "unknown", "pe.rich_header.entries[9].build_number": 24210, "pe.rich_header.entries[9].product_name": "C_VS2013", "pe.rich_header.entries[10].product_name": "unknown", "pe.rich_header.entries[11].build_number": 24210, "pe.rich_header.entries[11].product_name": "Linker_VS2013_LTCG", "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.manifest.dependencies[0].processor_architecture": "*" }, "x": 154, "id": 0, "is": [ "EnumResourceLanguagesW", "GetTimeZoneInformation", "GetUserDefaultLCID", "GetUserDefaultLocaleName", "GetVolumePathNameW", "EnumLanguageGroupLocalesW", "WriteConsoleW", "CreateFileW", "CloseHandle", "DecodePointer", "SetFilePointerEx", "EnumCalendarInfoW", "DosDateTimeToFileTime", "DnsHostnameToComputerNameW", "DisconnectNamedPipe", "DeleteVolumeMountPointW", "GetModuleHandleW", "GetConsoleMode", "GetConsoleCP", "FlushFileBuffers", "HeapReAlloc", "HeapSize", "GetProcessHeap", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "IsProcessorFeaturePresent", "QueryPerformanceCounter", "GetCurrentProcessId", "GetCurrentThreadId", "GetSystemTimeAsFileTime", "InitializeSListHead", "IsDebuggerPresent", "GetStartupInfoW", "RtlUnwind", "GetLastError", "SetLastError", "EnterCriticalSection", "LeaveCriticalSection", "DeleteCriticalSection", "InitializeCriticalSectionAndSpinCount", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "FreeLibrary", "GetProcAddress", "LoadLibraryExW", "GetStdHandle", "WriteFile", "GetModuleFileNameW", "MultiByteToWideChar", "WideCharToMultiByte", "ExitProcess", "GetModuleHandleExW", "GetACP", "HeapFree", "HeapAlloc", "FindClose", "FindFirstFileExW", "FindNextFileW", "IsValidCodePage", "GetOEMCP", "GetCPInfo", "GetCommandLineA", "GetCommandLineW", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "SetStdHandle", "GetFileType", "GetStringTypeW", "LCMapStringW", "RaiseException", "CalculatePopupWindowPosition", "GetWindowModuleFileNameW", "GetRegisteredRawInputDevices", "ActivateKeyboardLayout", "SetForegroundWindow", "CloseMetaFile", "CreateBrushIndirect", "SetDIBitsToDevice", "CreatePalette", "GetDeviceGammaRamp", "ColorCorrectPalette", "CoCreateInstance", "CoUninitialize", "CoTaskMemRealloc", "CoTaskMemAlloc", "CoInitialize", "CoTaskMemFree" ], "ms": { "pe": { "machine": 332.0, "checksum": 2130307.0, "has_pogo": true, "rsrc_size": 895488.0, "subsystem": 2.0, "timestamp": 1529664955.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 6.85, "entry_section": ".text", "size_of_image": 2113536.0, "timestamp_day": 22.0, "cfg_func_count": 256.0, "file_alignment": 512.0, "resource_count": 4.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON", "RT_MANIFEST" ], "timestamp_year": 2018.0, "characteristics": 258.0, "entry_point_rva": 7368.0, "security_cookie": 4266624.0, "size_of_headers": 1024.0, "timestamp_month": 6.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 4.0, "manifest_present": true, "se_handler_count": 4247932.0, "checksum_mismatch": true, "computed_checksum": 2124765.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1529664955.0, "debug_timestamp_min": 1529664955.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 14.0, "debug_directory_types": [ 13.0 ], "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 2092032.0 }, "binary": { "code_size": 1188864.0, "func_count": 265.0, "entry_point": 7368.0, "wx_sections": 1.0, "code_entropy": 7.14, "data_entropy": 1.99, "func_density": 0.23, "import_count": 91.0, "string_count": 5624.0, "avg_func_size": 137.67, "section_count": 6.0, "avg_complexity": 6.48, "import_density": 0.08, "max_complexity": 303.0, "string_density": 4.84, "overall_entropy": 5.03, "avg_basic_blocks": 10.76, "avg_section_size": 348501.34, "dependency_count": 4.0, "entropy_variance": 2.59, "avg_string_length": 82.29, "complexity_per_kb": 0.01, "max_string_length": 1132.0, "wide_string_count": 65.0, "writable_sections": 2.0, "avg_string_entropy": 3.76, "code_to_data_ratio": 1.32, "data_to_file_ratio": 0.0, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.43, "text_to_file_ratio": 0.02, "total_basic_blocks": 2852.0, "executable_sections": 2.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "high_entropy_strings": 70.0, "string_length_stddev": 170.9, "debug_reference_count": 1.0, "high_complexity_funcs": 2.0, "largest_section_ratio": 0.55, "sentence_string_count": 307.0, "sentence_string_ratio": 0.05, "behavioral_import_ratio": 0.02, "unnamed_complex_func_count": 2.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "xor", "'Rnou\u0026vtiatgk\u0026eghhir\u0026dc\u0026tsh\u0026oh\u0026BIU\u0026kibc(" ], [ 99, "xor", "x=ohs=ts=YRN=pryx3" ], [ 103, "xor", "d*cd*NEY*geno$" ], [ 240, "Rich" ], [ 520, ".text" ], [ 600, ".data" ], [ 640, ".gfids" ], [ 679, "@.rsrc" ], [ 719, "@.reloc" ], [ 6270, "5ntel" ], [ 6699, "xor", "/yZtm9;i9:" ], [ 7710, "UVWS" ], [ 9033, "UQPXY]Y[" ], [ 9673, "f98u" ], [ 9696, "QWWP" ], [ 10110, "xor", "y1Mu*\"yOMf+" ], [ 14995, "5DPR" ], [ 17389, "WWWPWS" ], [ 17957, "8PPR" ], [ 21034, "SVW3" ], [ 22203, "9E WW" ], [ 23437, "QSVW" ], [ 29274, "PPPPPWS" ], [ 29332, "QQQP" ], [ 29487, "xor", "GG.R7b-GGA@G" ], [ 37808, "QQSV" ], [ 38579, "5PWR" ], [ 42336, "WVU3" ], [ 46661, "xor", "7ew1MewYMewgMew" ], [ 46697, "xor", "7ew+7ew'7ewI7ew" ], [ 46729, "xor", "XvdhYvdBYvdXYvd6Yvd" ], [ 46777, "xor", "JewsIewkIew3Iew'Iew)Iew" ], [ 46833, "xor", "YugaXugsXugMXugSXug'Xug+Xug?Xug" ], [ 46897, "xor", "Zwek%wey%weK%we" ], [ 47100, "wide", "api-ms-win-core-fibers-l1-1-1" ], [ 47160, "wide", "api-ms-win-core-synch-l1-2-0" ], [ 47220, "wide", "kernel32" ], [ 47248, "FlsAlloc" ], [ 47268, "FlsFree" ], [ 47276, "xor", "BhwCapRehqa" ], [ 47296, "xor", "BhwWapRehqa" ], [ 47316, "InitializeCriticalSectionEx" ], [ 47323, "xor", "zivPazgzpr" ], [ 47756, "__cdecl" ], [ 47764, "__pascal" ], [ 47776, "__stdcall" ], [ 47788, "__thiscall" ], [ 47800, "__fastcall" ], [ 47812, "xor", "YYpceritegjj" ], [ 47828, "__clrcall" ], [ 47840, "__eabi" ], [ 47856, "__restrict" ], [ 47868, "xor", "RRxcladjchi" ], [ 47880, "restrict(" ], [ 47900, "delete" ], [ 47936, "operator" ], [ 48116, "xor", "fjiegj\u0026urgroe\u0026asgtb!" ], [ 48152, "xor", "fpdguc\u0026bcurtserit!" ], [ 48172, "xor", "fpcerit\u0026bcjcroha\u0026bcurtserit!" ], [ 48186, "xor", "xq6rsebdcubyd1" ], [ 48204, "xor", "gcbafrks'dhitsurdshu'dkhtrub " ], [ 48236, "xor", "fuegjgt\u0026bcjcroha\u0026bcurtserit!" ], [ 48250, "xor", "xq6rsebdcubyd1" ], [ 48268, "xor", "gqbdshu'dhitsurdshu'nsbufshu " ], [ 48300, "xor", "fpcerit\u0026bcurtserit\u0026orctgrit!" ], [ 48306, "xor", "b0tucdbesd" ], [ 48332, "xor", "fpcerit\u0026pdguc\u0026eihurtserit\u0026orctgrit!" ], [ 48368, "xor", "fpotrsgj\u0026bouvjgeckchr\u0026kgv!" ], [ 48396, "xor", "fcn\u0026pcerit\u0026eihurtserit\u0026orctgrit!" ], [ 48432, "xor", "fcn\u0026pcerit\u0026bcurtserit\u0026orctgrit!" ], [ 48441, "xor", "b0tucdbesd" ], [ 48464, "xor", "fcn\u0026pcerit\u0026pdguc\u0026eihurtserit\u0026orctgrit!" ], [ 48504, "xor", "vuyfo6uyxebdcubyd6uzyecds1" ], [ 48509, "xor", "\u0026eihurtserit\u0026ejiustc!" ], [ 48532, "xor", "fsbr\u0026tcrsthoha!" ], [ 48560, "xor", "dhkgeh$rbpefha#" ], [ 48576, "`local vftable constructor closure'" ], [ 48620, "delete[]" ], [ 48632, "xor", "dkijm$gehhwmc#" ], [ 48648, "xor", "fvjgeckchr\u0026bcjcrc\u0026ejiustc!" ], [ 48676, "`placement delete[] closure'" ], [ 48708, "xor", "fkghgacb\u0026pcerit\u0026eihurtserit\u0026orctgrit!" ], [ 48748, "xor", "fkghgacb\u0026pcerit\u0026bcurtserit\u0026orctgrit!" ], [ 48762, "xor", "b0tucdbesd" ], [ 48788, "xor", "fcn\u0026pcerit\u0026eiv" ], [ 48803, "xor", "\u0026eihurtserit\u0026orctgrit!" ], [ 48828, "xor", "fcn\u0026pcerit\u0026pdguc\u0026eiv" ], [ 48849, "xor", "\u0026eihurtserit\u0026orctgrit!" ], [ 48872, "xor", "korejfbh+beb" ], [ 48900, "xor", "korejfbh+j" ], [ 48913, "xor", "ns'cbtsurdshu'ahu' " ], [ 48914, "xor", "b6rsebdcubyd6pyd61" ], [ 48936, "xor", "fpcerit\u0026eiv" ], [ 48948, "xor", "\u0026eihurtserit\u0026orctgrit!" ], [ 48972, "xor", "fpcerit\u0026pdguc\u0026eiv" ], [ 48990, "xor", "\u0026eihurtserit\u0026orctgrit!" ], [ 49016, "xor", "fkghgacb\u0026pcerit\u0026eiv" ], [ 49036, "xor", "\u0026eihurtserit\u0026orctgrit!" ], [ 49060, "xor", "fjiegj\u0026urgroe\u0026rntcgb\u0026asgtb!" ], [ 49076, "xor", "ervs7pbves0" ], [ 49088, "xor", "ivctgrit\u0026$$\u0026" ], [ 49104, "Type Descriptor'" ], [ 49107, "xor", "vc\u0026Bcuetovrit!" ], [ 49124, "xor", "'Eftb'Dkftt'Cbtdunwshu'fs'/" ], [ 49152, "xor", "4Vugq4Wxugg4Uffum3" ], [ 49172, "xor", "\u0026Ejguu\u0026Noctgten" ], [ 49188, "xor", "\u0026Bcuetovrit!" ], [ 49204, "xor", "$Gkithapa$Kfnagp$Hkgepkv#" ], [ 49388, "wide", "mscoree.dll" ], [ 49412, "CorExitProcess" ], [ 50896, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 51280, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 51532, "Sunday" ], [ 51540, "Monday" ], [ 51548, "Tuesday" ], [ 51556, "Wednesday" ], [ 51568, "Thursday" ], [ 51580, "Friday" ], [ 51588, "Saturday" ], [ 51648, "January" ], [ 51656, "February" ], [ 51668, "March" ], [ 51676, "April" ], [ 51684, "June" ], [ 51692, "July" ], [ 51700, "August" ], [ 51708, "September" ], [ 51720, "October" ], [ 51728, "November" ], [ 51740, "December" ], [ 51760, "MM/dd/yy" ], [ 51772, "dddd, MMMM dd, yyyy" ], [ 51860, "wide", "Sunday" ], [ 51876, "wide", "Monday" ], [ 51892, "wide", "Tuesday" ], [ 51908, "wide", "Wednesday" ], [ 51928, "wide", "Thursday" ], [ 51948, "wide", "Friday" ], [ 51964, "wide", "Saturday" ], [ 52080, "wide", "January" ], [ 52096, "wide", "February" ], [ 52116, "wide", "March" ], [ 52128, "wide", "April" ], [ 52140, "wide", "June" ], [ 52152, "wide", "July" ], [ 52164, "wide", "August" ], [ 52180, "wide", "September" ], [ 52200, "wide", "October" ], [ 52216, "wide", "November" ], [ 52236, "wide", "December" ], [ 52272, "wide", "MM/dd/yy" ], [ 52292, "wide", "dddd, MMMM dd, yyyy" ], [ 52880, "wide", "api-ms-win-core-file-l1-2-2" ], [ 52936, "wide", "api-ms-win-core-localization-l1-2-1" ], [ 53008, "wide", "api-ms-win-core-localization-obsolete-l1-2-0" ], [ 53104, "wide", "api-ms-win-core-processthreads-l1-1-2" ], [ 53180, "wide", "api-ms-win-core-string-l1-1-0" ], [ 53240, "wide", "api-ms-win-core-sysinfo-l1-2-1" ], [ 53304, "wide", "api-ms-win-core-winrt-l1-1-0" ], [ 53364, "wide", "api-ms-win-core-xstate-l2-1-0" ], [ 53424, "wide", "api-ms-win-rtcore-ntuser-window-l1-1-0" ], [ 53504, "wide", "api-ms-win-security-systemfunctions-l1-1-0" ], [ 53592, "wide", "ext-ms-win-ntuser-dialogbox-l1-1-0" ], [ 53664, "wide", "ext-ms-win-ntuser-windowstation-l1-1-0" ], [ 53760, "wide", "api-ms-win-appmodel-runtime-l1-1-2" ], [ 53832, "wide", "user32" ], [ 53848, "wide", "api-ms-" ], [ 53864, "wide", "ext-ms-" ], [ 53928, "LCMapStringEx" ], [ 53952, "xor", "DgkidmFiem\\gDKAL" ], [ 53976, "AppPolicyGetProcessTerminationMethod" ], [ 53985, "xor", "AcrVtiecuuRctkohgroihKcrnib" ], [ 60428, "wide", "az-az-cyrl" ], [ 60452, "wide", "az-az-latn" ], [ 60512, "wide", "bs-ba-latn" ], [ 60644, "wide", "div-mv" ], [ 61380, "wide", "kok-in" ], [ 61648, "wide", "quz-bo" ], [ 61664, "wide", "quz-ec" ], [ 61680, "wide", "quz-pe" ], [ 61792, "wide", "sma-no" ], [ 61808, "wide", "sma-se" ], [ 61824, "wide", "smj-no" ], [ 61840, "wide", "smj-se" ], [ 61856, "wide", "smn-fi" ], [ 61872, "wide", "sms-fi" ], [ 61900, "wide", "sr-ba-cyrl" ], [ 61924, "wide", "sr-ba-latn" ], [ 61948, "wide", "sr-sp-cyrl" ], [ 61972, "wide", "sr-sp-latn" ], [ 62032, "wide", "syr-sy" ], [ 62144, "wide", "uz-uz-cyrl" ], [ 62168, "wide", "uz-uz-latn" ], [ 62216, "wide", "zh-chs" ], [ 62232, "wide", "zh-cht" ], [ 62352, "log10" ], [ 62952, "asin" ], [ 62960, "acos" ], [ 63945, "xor", "kiFK=BXe-'*kC" ], [ 65352, "atan" ], [ 65360, "atan2" ], [ 65380, "ceil" ], [ 65388, "floor" ], [ 65428, "_hypot" ], [ 65472, "xor", "Hyrocvqcre" ], [ 65676, "GCTL" ], [ 66024, ".rdata" ], [ 66040, "xor", "9esvcv3dosvcv" ], [ 66064, "xor", "=awrgr7iiiwqt" ], [ 66066, "xor", "ilyl)wwwioj" ], [ 66188, ".zxc" ], [ 66300, ".bss" ], [ 69039, "sh |" ], [ 69216, "/JJj" ], [ 71555, "LVM8NQO" ], [ 71575, "V7WZX/Y" ], [ 72095, "xor", "RES_T@UnV:WSh" ], [ 72529, "xor", "DsCtBnAW@$O" ], [ 73619, "TWU8V" ], [ 74057, "/h0F1" ], [ 74569, "xor", "HrWmVCUiTZSrR" ], [ 74627, "xor", "QOP%S.R_M.L OpNXIMHJK" ], [ 75141, "MYNZO" ], [ 75187, "xor", "t)uOvpw9xyy" ], [ 75217, "sbtbuzv" ], [ 75563, "xor", "MlL7O=NKI\"H:KyJ" ], [ 75565, "xor", "1J2@364_5G6" ], [ 75655, "NIO_P" ], [ 76581, "xor", "z)y;x=GAFGEnD" ], [ 76613, "xor", "IOJFKZTQUmVMW" ], [ 76741, "m7nyo" ], [ 76753, "s1ttu" ], [ 77177, "xor", "@TOxNaMpLrK" ], [ 77671, "xor", "I(HP7u6f534" ], [ 78643, "xor", ":L;38E9x6a7L4A5" ], [ 78709, "EnFyGGH" ], [ 79245, "QhR/SYT" ], [ 79279, "bRcwdOe" ], [ 79751, "xor", "IKHgWoViU%T" ], [ 81225, "/R0X1" ], [ 82297, "xor", "J#EeDmGkF7Au@" ], [ 82321, "SETBU" ], [ 82329, "WAXCY" ], [ 82803, "DLEUF" ], [ 83255, "xor", "CYB8MnLqOpNVI" ], [ 83417, "wuxpysz" ], [ 83809, "xor", "L+KYJpI9HY7" ], [ 84297, "xor", "KlTcU+V\\W8PrQaR" ], [ 84299, "xor", "GpF8EOD+CaBrA" ], [ 84403, "xor", "tWuiv1wZxay" ], [ 84441, "wBxyy.z" ], [ 84797, "xor", "437F6z1_0i3" ], [ 84867, "LnMRNAO" ], [ 84875, "PHQWR" ], [ 84885, "U6VLW" ], [ 85397, "UQVFW" ] ], "sz": 2092032, "ts": [ { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x95763" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code IN token", "e": [ "=IN?", ":IN;", "^IN_", "{IN{", "|IN|", "~IN~", "!IN#", "\u0026IN ", "!IN " ], "i": "objectives/anti-analysis/geofencing/region::country-code-in", "l": 1, "m": "B0007.003" }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "275445" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-windowstation-l1-1-0", "ext-ms-win-ntuser-dialogbox-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2 }, { "c": 0.8199999928474426, "d": "rdata over 2.5 times text size", "e": [ ".rdata = 2509.0% of .text (1143296 / 45568 bytes)", ".rdata" ], "i": "metadata/binary/section/metrics::rdata-ratio-over-2pt5x", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 5624.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1529664955.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 895488)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code RU token", "e": [ "^RU\\", ":RU;", "\u0026RU\u0026", "'RU!", "\"RU ", "^RU_", "$RU$", "?RU=", "]RU^", "$RU'", "+RU+", "%RU'", "]RU_", "\u0026RU'" ], "i": "objectives/anti-analysis/geofencing/region/country-code-c::country-code-ru", "l": 1, "m": "B0007.003" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 895488.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code UZ token", "e": [ " UZ%", "]UZ\\", "~UZ", "[UZ[", "]UZ]", "/UZ!", "\u0026UZ\u0026", "@UZ@", "%UZ%" ], "i": "objectives/anti-analysis/geofencing/region/country-code-d::country-code-uz", "l": 1, "m": "B0007.003" }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.14" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ZA token", "e": [ "^ZA]", ",ZA.", "@ZA_", "@ZA#", "_ZA]", "^ZA^", "\\ZA]", "]ZA[", "=ZA;" ], "i": "objectives/anti-analysis/geofencing/region::country-code-za", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "IwR" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code UA token", "e": [ "}UA{", "UA@", "]UA\\", "+UA)", "+UA%", ")UA,", "\\UA\\", "@UA@", "_UA^", "+UA*", ":UA\u003c", " UA'", "=UA\u003c", "^UA^", "@UA" ], "i": "objectives/anti-analysis/geofencing/region/country-code-d::country-code-ua", "l": 1, "m": "B0007.003" }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "275445" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage/control::set-foreground-window", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AM token", "e": [ "-AM-", ")AM)", "#AM!", "$AM%", "_AM_", "\"AM\u003c", "^AM_", "AM@", "?AM=", "\u003cAM=" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-am", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "d": "OpenGL graphics reference cluster B", "e": [ "GlXF", "GLXM", "GLxE" ], "i": "micro-behaviors/dylib/library/abi-graphics::opengl-ref-b", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.76" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code TJ token", "e": [ "^TJ_", "]TJ]", "_TJ^", "\"TJ!", "\\TJ[", " TJ ", "#TJ#", "_TJ`", "]TJ\\", "?TJ=", "[TJ\\", "\u0026TJ%", "\\TJ\\", "^TJ\\", "_TJ\\", "-TJ," ], "i": "objectives/anti-analysis/geofencing/region/country-code-c::country-code-tj", "l": 1, "m": "B0007.003" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KG token", "e": [ "|KG{", "?KG?", "@KG?", "{KG{", "\u003cKG;", "\u003eKG@", ",KG.", "}KG}", ";KG\u003c", ";KG:", "\u003eKG?", "=KG;", "\u003cKG\u003e" ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-kg", "l": 1, "m": "B0007.003" }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.800000011920929, "d": "rdata over five times text size", "e": [ ".rdata", ".rdata = 2509.0% of .text (1143296 / 45568 bytes)" ], "i": "metadata/binary/section/metrics::rdata-ratio-over-5x", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 265.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 1.0, "d": "PGO-trained release build (POGO)", "e": [ "true" ], "i": "metadata/build/reproducible::pe-pgo-trained", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "DosDateTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 4.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code MD token", "e": [ "]MD\\", "\u003cMD?", "\\MD]", ":MD;", "\u003cMD\u003e", "=MD\u003c", "\u003cMD=", "?MD=", "\u003eMD\u003c", "@MD@", "_MD_", "\u003eMD;", "^MD]", "{MD{", "\u003eMD=", "\u003cMD:" ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-md", "l": 1, "m": "B0007.003" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "!\"(#$*%\u0026,'8-9;/;=\"\u003e0$02\u002634855:66;77\u003cH7\u003cH7=H6\u003c75\u003c64;52;3091\u003e8?\u003c'=:%\u003c8$:'#9\u0026#8%\"'#!'#!\u0026\" '\" '\" '! 8! 8...", "2 1 1!!0!\"0\"#0#$0#$1$%1%%1%\u00262\u0026'2''3((4))5*)6+)7,*8-*8-*9.*9/+:0+:1,;2,;3-\u003c5.\u003c6/\u003c70=81=:2\u003e;3?=5@\u003e6@...", "Qw|KtrNjp@ov;mu\u003eck1bj5`i*gh/fh-eo,eo#eo,eo,eo-eh/eh(eo*eo4eo6eo0en2en\u003cem\u003eem8el:dcDdcGdbA[aC[`MZgOZfI...", "==-\u003c=,?\u003c/\u003e?.\u003e?)9?)8\u003e(8\u003e(8\u003e+;\u003e+;\u003e+;\u003e+;\u003e+:?+:?+:?+:?+:?+:?+:?+:\u003e+:\u003e+:\u003e+59+59(59(59)59.59.:\u003e/:\u003e/:\u003e,;?,;...", ",, --!--!.-\"..#..#/.$/.$//%0/%0/\u002610\u002610\u002620'20'20'20\u002620\u002620\u00262/\u00261/\u00261.%0.%/-$/-$/,$/-%/-%0.\u00261/'21)42*64+7...", "=\"-\u003c=,\u003c\u003c/?\u003c.\u003e?.\u003e?)9?)8?(8\u003e+8\u003e+;?+;?+;?+;?+;?+;?+;?+;?+;?+;?+:?+:\u003e+:\u003e+:9+59+59(59(59):\u003e.:\u003e/:\u003e/;?/;?,8...", " !-# -\"#,=#,=#/\u003c#/\u003c#/\u003c#.\u003c#.\u003c /= /=!/\"\u0026,#', '- '-!'-!'- \u0026, !,#!/\"#/=\".\u003c\".?\u003c)\u003e?(9\u003e(99+89+;9+;9+8\u003e(8?(9...", ",, .-!/-!/.\"0.\"0.#0.#0.#0.#0.#0-#/,#/+\".+\"-*!,)!+)!+*!,+\",+\"-,#..$//$00\u0011\u002622'33'45(66)76)76)75(64(64'...", "7('7(\u002667%57%56$46#46#35\"35\"25!26!25!25!25!15 16 16 15 15 15 15 14 04 03 03 04!04\"04#14#15$15$25$26%3...", "!\"(#$*%\u0026,'8-9;/;=\"\u003e0$02\u002634855:66;77\u003cH7\u003cH7=H6\u003c75\u003c64;52;3091\u003e8?\u003c'=:%\u003c8$:'#9\u0026#8%\"'#!'#!\u0026\" '\" '\" '! 8! 8...", "z(#q5*t\u003e5k;\u003cnDGbAAYJH]WRQS\\R_YVZeHYaJdlLbjOchO`vNawNnwNntNntNntNnwNnwNnwOavNavNavNavNnvNnwNnwNotOouO...", "1 1! 0!!0\"\"0##0#$0$%0%%1%\u00261\u0026'2''2((3))5**6+*7,*8-*8.+9.+:/+:0,;1,\u003c2-\u003c3-\u003c4.=5.=6/=70=81\u003e:2\u003e;3?=5@\u003e6@...", "58-58-58,5;.5;)45+74%66\u002600 23\"MM\u003cOO\u003eII8HH;JK:EJ:DE:GE;GJ8DK\u003eEH\u003cJI\"HO IM\u0026O3$M0%36+17(65)4:)5:.:;.;;.;...", "g}+gz-dx/by!cg#`e%ab'n`9ln;ml=kj\u003chh\u003eVV1TT0UR2SP5P^4^\\7_ZI]XHZFKXDMYBLFCOGAADN@ELCBMECJD@KFAIYAIXN6ZO...", "\u003c=-\u003c\u003c,?\u003c/\u003e?.9?)9\u003e)8\u003e(8\u003e(;\u003e+;\u003e+:\u003e+:\u003e+:\u003e+:\u003e+:?+:?+:?+:?+:?(:?(:\u003e(:\u003e(5\u003e(59(59(49)49)59.59/59/5\u003e,:\u003e,:?,;...", "4+u?3j9\u003coDEeONYJH]URQQ]U^YH[eJYbLgoMenMdmMclLclLclKclJcmIdmHdnHdnWeoWeoWe`Ve`Ve`VeoUeoUdnUdmUclTbkTa..." ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code JP token", "e": [ "^JP_", "\\JP[", "\"JP#", "_JP^", ".JP.", "\\JP\\", "^JP^", "'JP%" ], "i": "objectives/anti-analysis/geofencing/region::country-code-jp", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "Short -h help flag", "e": [ "-hU" ], "i": "metadata/package/help::usage-help", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.48" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-synch-l1-2-0" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 2048)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 2852.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 895488.00" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-large-rsrc-section", "l": 1 }, { "c": 0.699999988079071, "d": "Create brush object", "e": [ "CreateBrushIndirect" ], "i": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.75, "d": "High entropy encrypted data", "e": [ ".rdata (entropy: 7.60)" ], "i": "micro-behaviors/data/encode/payload::payload-blob-metrics", "l": 3 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "275445" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz" ], "i": "micro-behaviors/dylib/library/family::xz-ref", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.03" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 895488, entropy: 6.85)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "+)rPPu]^IZEMGCACHENuZJqXt|^w" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 265.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.68)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 5624.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "Enumerate language group locales (callback trigger)", "e": [ "EnumLanguageGroupLocalesW" ], "i": "micro-behaviors/os/callback/enum::enum-language-group-locales", "l": 3 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 3 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8600000143051147, "d": "High entropy rdata section", "e": [ ".rdata (entropy: 7.60)" ], "i": "metadata/binary/section/metrics::high-entropy-rdata-section", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KZ token", "e": [ "_KZ]", "*KZ(", ".KZ.", ".KZ/", "\\KZ\\", "[KZ[", "\\KZ_", "+KZ,", "}KZ}", "]KZ^" ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-kz", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false,\"dependencies\":[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Cont" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.05" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 1.0, "d": "Malware infrastructure naming suffix", "e": [ "d0_c2", "D2-C2", "0-C2" ], "i": "micro-behaviors/data/text/malware/terms::malware-infrastructure-suffix", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LCMapStringEx", "api-ms-win-core-string-l1-1-0" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 1.0, "d": "Uses named pipe IPC APIs", "e": [ "DisconnectNamedPipe" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage", "l": 3 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1567", "c": 1.0, "d": "Regex component marker", "e": [ "N-\tN*6N*7A+4A(2A)0NW?NT:OR9MP'J^\"H\\!IZ,wY+tF)uDWrEUsERsERrDUtFTvXVHZ)M_+OQ-@R/ET.GV Y(#[+%Z*$Z*$Z*$[+$X($F)$G)$EV%CW%@T%AT%OU%LR", "\\Y~\\F~\\Fq\\Fq\\Fq\\Fq\\Fp\\Fp\\Fp]Fp]Fp]Fp]Yp]Yp]Yp]YpZYpZYsZYsZYs[Yr[Xr[Xu[Xu[Xt[XtZXwZ[wZ[v][v][I][I\\ZH\\ZK_ZJ_]M_]L^]O^]N^]A^]@^]C^]", "VC~T@~U@qRApSAsPArPArQAuQAtQ@tQCwPCwPBwSBwSEtSEtSEuSErSErSBpPC~QA|^Oz_My]KGZIBXW@YUO\u0026PJ$^H%\\W\"ZU#[S#[P#[P\"ZP%]S$_R\u0026QUXSWZUI\\VK^H", "Cs~BuqEupEtpEtsEtsBtsBtrBtrBtrBtrBurBurEusErsErsErsDrsDrsGssGssGssGppDppDqpE~qE~qB" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "275445" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "PIQNRFSUT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Remove a volume mount point", "e": [ "DeleteVolumeMountPointW" ], "i": "micro-behaviors/fs/volume::delete-volume-mount-point-w", "l": 3 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1036.005", "c": 0.8799999952316284, "d": "Two dotted-quad version strings", "e": [ "39.38.28.2", "29.29.29.18", "73.63.63.63", "99.89.89.89", "69.58.58.58", "36.35.35.24", "77.44.44.47", "86.97.97.97", "65.54.45.46", "37.37.48.49", "36.36.29.58", "66.96.96.97", "22.22.22.21", "34.34.34.24", "32.12.63.40", "96.97.97.97" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1 }, { "c": 0.8799999952316284, "d": "High entropy resource section (encrypted payload)", "e": [ "pe.rsrc_entropy = 6.85" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-high-rsrc-entropy", "l": 1 }, { "a": "T1567.002", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "api-ms-win-core-synch-l1-2-0" ], "i": "well-known/tool/dual-use/megacmd::megacmd-binary-name--rx-5", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 265.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 5624.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code BY token", "e": [ "^BY_", "+BY/", "/BY.", "/BY-" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-by", "l": 1, "m": "B0007.003" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 91.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KH token", "e": [ "\u003cKH=", "\u003eKH\u003c", "=KH=", "?KH@", "\"KH\u003c", ":KH;", "@KH@", "_KH^", "=KH\u003c", "?KH=" ], "i": "objectives/anti-analysis/geofencing/region::country-code-kh", "l": 1, "m": "B0007.003" }, { "d": "OpenGL graphics reference cluster A", "e": [ "GlX", "GLx", "GLX" ], "i": "micro-behaviors/dylib/library/abi-graphics::opengl-ref-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "d": "COMPUTERNAME environment variable", "e": [ "DnsHostnameToComputerNameW" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AZ token", "e": [ "}AZ}", "{AZ{", ")AZ+", "+AZ,", "^AZ_", ")AZ(", ",AZ-", "*AZ+", "'AZ$", "\\AZ]", "[AZ[", "^AZ^", "]AZ]" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-az", "l": 1, "m": "B0007.003" }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "nupmwtiiktjapog|c\\xgU" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-6", "l": 1, "m": "F0004" }, { "a": "T1027.010", "d": "Custom base64 decode lookup table", "e": [ "$DK+DK+DK+KK+KK+KK+KK+KK+KK$" ], "i": "micro-behaviors/data/encode/base64::decode-table", "l": 2, "m": "B0032.001" }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "FindClose" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"processor_architecture\":\"*\",\"public_key_token\":" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "a": "T1046", "c": 0.6000000238418579, "d": "Kerberos port 88", "e": [ "88" ], "i": "objectives/discovery/network/scan/internal-port::kerberos-port", "l": 1, "m": "E1046" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token", "e": [ "^ID_", "ID~", "=ID?", "/ID-", ";ID=", "/ID/", "#ID!", "@ID?", "\u003cID\u003e", "\u003eID@", "\u003eID?", ":ID\u003c", ";ID\u003c", "\u003eID=", "-ID," ], "i": "objectives/anti-analysis/geofencing/region::country-code-id", "l": 1, "m": "B0007.003" }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1620", "c": 0.8500000238418579, "d": "mscoree.dll text reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-dll-text-ref", "l": 3, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "c": 0.7200000286102295, "d": "Writable .rdata section permissions", "e": [ ".rdata (perms: rwx)" ], "i": "metadata/binary/section/names::writable-rdata", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".rdata", ".rdata+.data = 2513.5% of text (1145344 / 45568 bytes)", ".data" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "275445" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AppPolicyGetProcessTerminationMethod", "InitializeCriticalSectionAndSpinCount", "InitializeCriticalSectionEx", "AjqiVawkqvgaHejcqecawS", "CapRkhqiaTeplJeiaS", "ChskJghasgacAtisvJiegjcuQ", "DeleteVolumeMountPointW", "DnsHostnameToComputerNameW", "AcrTcaourctcbTgqOhvsrBcpoecu", "DisconnectNamedPipe", "AcrVtiecuuRctkohgroihKcrnib", "GetSystemTimeAsFileTime", "GetTimeZoneInformation", "EgjesjgrcVivsvQohbiqViuoroih", "GetWindowModuleFileNameW", "InitializeSListHead" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8500000238418579, "d": ".rdata significantly larger than .text", "e": [ ".rdata", ".rdata = 2509.0% of .text (1143296 / 45568 bytes)" ], "i": "metadata/binary/section/metrics::oversized-rdata-ratio", "l": 4 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::module-stomping-target", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted data section (very high)", "e": [ ".rdata (entropy: 7.60)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-data-section", "l": 4, "m": "B0032" }, { "c": 0.6000000238418579, "d": "High entropy in data section", "e": [ ".rdata (entropy: 7.60)" ], "i": "metadata/binary/metrics/structural::high-entropy-data", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 265.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted rdata section (PE crypter)", "e": [ ".rdata (entropy: 7.60)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-rdata-section", "l": 4, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "Opaque token in version resource", "e": [ "3AB5CD6EF6GG6HH6IH5IH4IG2HF1GE/FD", "3rz3px3ow3mv2lu2kt2jt1it1it0it0ju/jv", "4AA3AA3BB2CC2DD2DE1EE0FE0FF/FF", "6ry7px7nw7mu6kt6jt6is5is5is4it3it1iu0ju/jv", "2AB3CD4EF4FG4HG4HG3HG2GF0GE/FD", "5AB7CC8EE8FF8GF8HF7GE5FD3EB1DA/B", "1J31I31I21H20H10O17O17O17O27O27O27O27N16N16M15L15L05C04C0+C7+B7", "5AA5BB4BC4CD4DD3EE3FF2GG2GG0GG/GG", "5rz5px5nw5mu4lt4jt4js4is3it2it1iu0ju/jv", "4AC5DE6FF7GH7IH6IH5IG4IF2HE1GD/EC", "1BB3DD5FF6HH8JI8KJ9LJ8LJ7LI6KH4JG1IE/GC", "83/93Q93R94T94U94V94V93W73V62U51T30S2", "4I35H35O24N24M25M25L25L25L14L14L14L14M25M25N36N36O36O36O36O25O14N14N1+N0+M0", "2t+1t+1tT0tT7tT6tU5KU5KU4KU4JV4JV5JW5KW6KP7KP1KQ3tS=", "1AB3CD4EF6GH7II8JJ8KJ8KJ8KI7JH6IG4HF3GD1EB/C", "0AA2CC4EE5GF7IH7JI8KI7KI6KH5JG3IF1HD/FC" ], "i": "metadata/package/versioning::pe-version-resource-opaque-token", "l": 4 }, { "c": 0.8399999737739563, "d": "Resource-heavy PE with large .rsrc", "e": [ ".rsrc (size: 895488)" ], "i": "metadata/binary/resource::resource-heavy-rsrc", "l": 3 }, { "c": 0.8500000238418579, "d": "Multiple opaque tokens in version resource", "e": [ "2t+1t+1tT0tT7tT6tU5KU5KU4KU4JV4JV5JW5KW6KP7KP1KQ3tS=", "1AB3CD4EF6GH7II8JJ8KJ8KJ8KI7JH6IG4HF3GD1EB/C", "4AA3AA3BB2CC2DD2DE1EE0FE0FF/FF", "6ry7px7nw7mu6kt6jt6is5is5is4it3it1iu0ju/jv", "3AB5CD6EF6GG6HH6IH5IH4IG2HF1GE/FD", "1BB3DD5FF6HH8JI8KJ9LJ8LJ7LI6KH4JG1IE/GC", "0AA2CC4EE5GF7IH7JI8KI7KI6KH5JG3IF1HD/FC", "4AC5DE6FF7GH7IH6IH5IG4IF2HE1GD/EC", "5AB7CC8EE8FF8GF8HF7GE5FD3EB1DA/B", "1J31I31I21H20H10O17O17O17O27O27O27O27N16N16M15L15L05C04C0+C7+B7", "83/93Q93R94T94U94V94V93W73V62U51T30S2", "5rz5px5nw5mu4lt4jt4js4is3it2it1iu0ju/jv", "3rz3px3ow3mv2lu2kt2jt1it1it0it0ju/jv", "5AA5BB4BC4CD4DD3EE3FF2GG2GG0GG/GG", "4I35H35O24N24M25M25L25L25L14L14L14L14M25M25N36N36O36O36O36O25O14N14N1+N0+M0", "2AB3CD4EF4FG4HG4HG3HG2GF0GE/FD" ], "i": "metadata/package/versioning::pe-version-resource-multi-opaque-tokens", "l": 4 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 5624.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".rdata (entropy: 7.60, perms: rwx)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".rdata (size: 1143296, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.8199999928474426, "d": "Oversized PE resource section", "e": [ ".rsrc (size: 895488)" ], "i": "metadata/binary/resource::oversized-rsrc", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Oversized rdata section vs code", "e": [ ".rdata = 2509.0% of .text (1143296 / 45568 bytes)", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-rdata-section", "l": 4, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 91.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ ".rdata (entropy: 7.60)" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-2--inline-29203", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".rdata (entropy: 7.60)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-payload-section-cond-0--inline-29177", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".rdata (entropy: 7.60, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data", ".rdata", ".rdata+.data = 2513.5% of text (1145344 / 45568 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".rdata+.data = 2513.5% of text (1145344 / 45568 bytes)", ".data", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, CoUninitialize, CoTaskMemRealloc, CoTaskMemAlloc, CoInitialize, ... +1 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (EnumResourceLanguagesW, GetTimeZoneInformation, GetUserDefaultLCID, GetUserDefaultLocaleName, GetVolumePathNameW, ... +69 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CalculatePopupWindowPosition, GetWindowModuleFileNameW, GetRegisteredRawInputDevices, ActivateKeyboardLayout, SetForegroundWindow)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (CloseMetaFile, CreateBrushIndirect, SetDIBitsToDevice, CreatePalette, GetDeviceGammaRamp, ... +1 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Large encoded configuration data section", "e": [ ".rdata (entropy: 7.60, perms: rwx)", ".rdata", ".data", ".rdata+.data = 2513.5% of text (1145344 / 45568 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section", "l": 4, "m": "B0032" }, { "a": "T1614", "c": 0.7799999713897705, "d": "Asia Africa country code cluster", "e": [ "^IN_" ], "i": "objectives/anti-analysis/geofencing/region::asia-africa-country-code-cluster", "l": 4, "m": "B0007.003" }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 91.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleExW", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "High entropy strings known false positive profile", "e": [ "GlXF", "GLx", "GLxE", "GLX", "GlX", "binary.import_count = 91.00", "GLXM" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-high-entropy-strings-known-fp", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection/toolkit::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "DD~DD~DD~ED~ED~ED~ED~ED~ED~ED~ED~DD}DD}D \u003cxor\u003e", "\\u~]tq]wp]vs]vs]Ir\\Hu\\Ht_Kt^KwQKwPKwSKwR \u003cxor\u003e", "UM~VM~VM}VL|VL{UL{UKzUKzUKyTJyTJyTJySIxS \u003cxor\u003e", "{]~z]}y]|w\\{v\\zu\\zt\\ys\\ys\\xr\\xq[wqZwqYwp \u003cxor\u003e", "yy|yF|yG}yD{yEyyBGy@ByOAyMMxHHxWTxRP{Q\\{ \u003cxor\u003e", "f-xfSxgPxgVxg[xgYx`_x`]xa\\xbCycBz}B{~Bty \u003cxor\u003e", "3\u002612\u002605\u002637\u002626\u002659\u002659\u002648'48'49$59$59$56%27 \u003cxor\u003e", "s?0O!4K#7G%:C'=@) ]+#[-\u0026ZP*XS.XVQXYUX\\YY \u003cxor\u003e", "][%_f Za#ec.`n)ch4nj7it2kv=uw?wp:pqDqqFr \u003cxor\u003e", "W\u0026~V)~Y+A[-A]/@\\.C_0C^3C!2C#5B\"7B%6E%9D$ \u003cxor\u003e", "BGxC@xL@xMAxNAyNAyOAyH@xH@xHGxHF \u003cxor\u003e", "s^~r]}q]sp\\rv\\puSwtSukRtiQkiPjhPjoPjoWjo \u003cxor\u003e", "xl{~`xse}pYqu]vjRkoVhlKmaHbfMgdCeZA[XGY^ \u003cxor\u003e", "QA@PA@PBAOCBODCODDPEEPFFPGGQHHQIHRJITKJU \u003cxor\u003e", "x\\~x^y{Yyz[yzUxzTxzTxzWyzWyzWyzTyzTyzTyz \u003cxor\u003e", "u0=u18v,;v.6v(1w+-w\u0026*w\"\u0026v^\\uYY{UWyQL~MJC \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor → base64", "e": [ "\u003cbinary data\u003e \u003cxor+base64\u003e" ], "i": "metadata/encoded-payload/xor-base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "3 2 2!!2!\"1\"#1\"#1#$1#$1#$1$$2%%2\u0026%3'\u00264 \u003curl\u003e", ",, ,, -,!--!--\".-#.-#.-#..$/.$/.%0.%0/%0 \u003curl\u003e", ")(!++#--\u0026/0(23*45,78.990;;1\u003c;1\u003c;1\u003c:1;90: \u003curl\u003e", "20 21!31\"31#42$42$42R\u002652'52(52)52)52*52* \u003curl\u003e", "\u0026\u0026 ((!**#,-\u0026./(12*35,57.8909:1;;2\u003c;2\u003c;2; \u003curl\u003e", ",, ,, --!--!--\"..#..#..$/.$/.%//%0/%0/\u00261 \u003curl\u003e", "0 0 0! 0\"!0\"!1#!1$!1%\"1%\"1\u0026\"1'#1($1*$1 \u003curl\u003e", "2 2 !1!\"1\"\"1\"#1#$1#$1$$1$%2%%2%\u00263\u0026\u00263('4 \u003curl\u003e", ",, ,, ,,!-,!--\"--#.-#.-#.-$.-$/.$/.%/.%0 \u003curl\u003e", "/. 0.!0/!1/\"1/#20$20$3000\u002630\u002640'41'41(41 \u003curl\u003e", ",, .-!/-!/.\"0.\"0.#0.#0.#0.#0.#0-#/,#/+\". \u003curl\u003e", "1 1! 0!!0\"\"0##0#$0$%0%%1%\u00261\u0026'2''2((3))5 \u003curl\u003e", "31 53\"86$:9'=\u003c)?\u003e+B@-DB.FD0GD0GD0GD0GC0F \u003curl\u003e", "0! 0\" 0\" 0#!0$!0$!0%!0\u0026\"0'#0)$1*%1+\u00262-'2 \u003curl\u003e", "++ ,,!.-!/.\"/.\"0/#0/#1/$1/$1/$0.$0.$0-$/ \u003curl\u003e", "6' 8(!9*\":,$\u003c.%=0'\u003e2)?4*?6,@7-@7-?7.\u003e7.= \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\"#Q !^..Q/.Q/.P" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 649.00", "text.max_line_length = 910.00", "text.max_line_length = 903.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 200.00", "text.import_density = 700.00", "text.import_density = 300.00", "text.import_density = 500.00", "text.import_density = 100.00" ], "i": "metadata/binary/metrics/text-density::shell-high-import-density", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very long shell lines", "e": [ "text.max_line_length = 649.00", "text.max_line_length = 910.00", "text.max_line_length = 903.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "l": 3, "m": "B0032" }, { "c": 1.0, "d": "Code recovered from xor-encoded layer", "e": [ "Decoded layer at offset 0x1ef147", "Decoded layer at offset 0x130ade", "Decoded layer at offset 0x1b1aa0", "Decoded layer at offset 0x159202", "Decoded layer at offset 0x158a62", "Decoded layer at offset 0x1b29dd" ], "i": "metadata/lang/encoded/xor", "l": 2 }, { "c": 1.0, "d": "Regex component marker", "e": [ "O1=N0;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Mixed encoding indicators", "e": [ "I7\u003cJH\u003cKH=KI=LI=LI=LH=LH=L7\u003cK6", "77\u003cHH\u003cHH=H7=H7=75\u003c64\u003c52" ], "i": "objectives/anti-static/obfuscation/multi-layer::mixed-encoding-indicators", "l": 3 } ], "sha": "2f0c3ec12278a82524e61586c19e6134e1cccc910e0a6267d4533e533a9c388e", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/275445", "type": "pe" }, { "f": "O₂(AsS)Md(Pa)", "k": { "source.imports[0]": "'S$%P\"#Q !^..Q/.Q/.P/!R. T!#W %I#$H%'J$YM", "source.imports[1]": "HK]IH\\II_IH^HKPKJRJMTMLWLOIONHNAJN@MNCMO@JL@KKNIWOTSJP\\H\\YVY\"T\",R/7P)1^3", "source.imports[2]": "Jy", "source.imports[3]": "My", "source.imports[4]": "^N_QA^PAPSASRNSRORRORUOUTOUTLTTLTTLTTMUTMUUJRRKRRKSSHPPIQPV^QW\\^W]_T[", "source.strings[0]": "S$%P\"#Q !^..Q/.Q/.P/!R. T!#W %I#$H%", "source.strings[1]": "^W#PV#SH UJ WM IO KA JC LB OE#OD#OD#OD#LD#LE#ME#MB#JB#KC H@ H@!H@!H@!JC MB#OE", "source.has_imports": true }, "x": 2, "dp": 1, "id": 1, "is": [ "Jy", "Jy", "My", "My", "'S$%P\"#Q !^..Q/.Q/.P/!R. T!#W %I#$H%'J$YM", "^N_QA^PAPSASRNSRORRORUOUTOUTLTTLTTLTTMUTMUUJRRKRRKSSHPPIQPV^QW\\^W]_T[", "HK]IH\\II_IH^HKPKJRJMTMLWLOIONHNAJN@MNCMO@JL@KKNIWOTSJP\\H\\YVY\"T\",R/7P)1^3" ], "ms": { "file": { "size": 649.0 }, "text": { "digit_ratio": 0.01, "space_count": 13.0, "total_lines": 1.0, "char_entropy": 5.19, "unique_chars": 55.0, "escape_density": 0.46, "import_density": 700.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 6.0, "avg_line_length": 649.0, "max_line_length": 649.0, "last_line_length": 649.0, "long_token_count": 3.0, "most_common_char": "V", "whitespace_ratio": 0.02, "most_common_ratio": 0.05, "unicode_escape_count": 3.0, "normalized_import_count": 7.0, "normalized_string_count": 6.0, "max_inline_whitespace_run": 1.0 }, "encoded": { "shell": { "xor_count": 1.0, "total_count": 1.0 }, "xor_count": 1.0, "total_count": 1.0 }, "imports": { "total": 7.0, "unique_modules": 5.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "strings": { "total": 6.0, "avg_length": 32.17, "max_length": 77.0, "avg_entropy": 2.17, "total_bytes": 193.0, "entropy_stddev": 1.86 }, "comments": {}, "functions": {}, "identifiers": {} }, "ss": [ [ 328, "S$%P\"#Q !^..Q/.Q/.P/!R. T!#W %I#$H%" ], [ 459, "^W#PV#SH UJ WM IO KA JC LB OE#OD#OD#OD#LD#LE#ME#MB#JB#KC H@ H@!H@!H@!JC MB#OE" ], [ 460, "^W#PV#SH UJ WM IO KA JC LB OE#OD#OD#OD#LD#LE#ME#MB#JB#KC H@ H@!H@!H@!JC MB#OE" ], [ 549, "AE" ], [ 634, "T" ], [ 635, "T" ] ], "sz": 649, "ts": [ { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.8399999737739563, "d": "Hidden directory literal", "e": [ "\"#Q !^..Q/.Q/.P" ], "i": "objectives/supply-chain/install-hook/module-backdoor::hidden-dir-literal", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 649.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 700.00" ], "i": "metadata/binary/metrics/text-density::shell-high-import-density", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very long shell lines", "e": [ "text.max_line_length = 649.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "l": 3, "m": "B0032" }, { "c": 1.0, "d": "Code recovered from xor-encoded layer", "e": [ "Decoded layer at offset 0x130ade" ], "i": "metadata/lang/encoded/xor", "l": 2 } ], "sha": "2d6cf1d35e358caff95604610418294fa5d8c289ce0f34d16491d524ed346888", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/275445##xor@1247966", "type": "shell" }, { "f": "O(As₂)H(Po)Md(Pa)", "k": { "source.imports[0]": "\" \u003c# =\"/", "source.imports[1]": "\"#)$%+\u0026',8:.:\u003c!=?#01\u002623845966;77\u003cHH\u003cHH=H7=H7=75\u003c64\u003c52;3091\u003e8?\u003c\u0026=:%\u003c8$;'#:%#9$\"8#!8#!8\" 8\"", "source.imports[2]": "\"2\u0026\"1'#18$18%19%1:\u00262:'2", "source.strings[0]": "#)$%+\u0026',8:.:\u003c!=?#01\u002623845966;77\u003cHH\u003cHH=H7=H7=75\u003c64\u003c52;3091\u003e8?\u003c\u0026=:%\u003c8$;'#:%#9$", "source.strings[1]": "#18$18%19%1:\u00262:", "source.strings[2]": "%+\u0026',8:.:\u003c!=?#01\u002623845966;77\u003cHH\u003cHH=H7=H7=75\u003c64\u003c52;3091\u003e8?\u003c\u0026=:%\u003c8", "source.strings[3]": ";'#:%#9", "source.has_imports": true }, "x": 2, "dp": 1, "id": 2, "is": [ "\"#)$%+\u0026',8:.:\u003c!=?#01\u002623845966;77\u003cHH\u003cHH=H7=H7=75\u003c64\u003c52;3091\u003e8?\u003c\u0026=:%\u003c8$;'#:%#9$\"8#!8#!8\" 8\"", "\" \u003c# =\"/", "\"2\u0026\"1'#18$18%19%1:\u00262:'2" ], "ms": { "file": { "size": 903.0 }, "text": { "digit_ratio": 0.54, "space_count": 21.0, "total_lines": 1.0, "char_entropy": 5.64, "unique_chars": 73.0, "import_density": 300.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 22.0, "avg_line_length": 903.0, "max_line_length": 903.0, "last_line_length": 903.0, "long_token_count": 3.0, "most_common_char": "8", "whitespace_ratio": 0.02, "most_common_ratio": 0.04, "normalized_import_count": 3.0, "normalized_string_count": 22.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 1.0 }, "encoded": { "shell": { "xor_count": 1.0, "total_count": 1.0 }, "xor_count": 1.0, "total_count": 1.0 }, "imports": { "total": 3.0, "unique_modules": 3.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "strings": { "total": 22.0, "avg_length": 9.27, "max_length": 76.0, "path_count": 2.0, "avg_entropy": 1.56, "total_bytes": 204.0, "entropy_stddev": 1.07 }, "comments": { "chars": 820.0, "lines": 1.0, "total": 1.0, "high_entropy_comments": 1.0 }, "functions": {}, "identifiers": {} }, "ss": [ [ 3, "#)$%+\u0026',8:.:\u003c!=?#01\u002623845966;77\u003cHH\u003cHH=H7=H7=75\u003c64\u003c52;3091\u003e8?\u003c\u0026=:%\u003c8$;'#:%#9$" ], [ 4, "#)" ], [ 7, "%+\u0026',8:.:\u003c!=?#01\u002623845966;77\u003cHH\u003cHH=H7=H7=75\u003c64\u003c52;3091\u003e8?\u003c\u0026=:%\u003c8" ], [ 72, ";'#:%#9" ], [ 88, " 8" ], [ 89, " 8" ], [ 94, " 9" ], [ 95, " 9" ], [ 100, " :" ], [ 101, " :" ], [ 106, " \u003c# =" ], [ 107, " \u003c# =" ], [ 115, "/\u003e" ], [ 116, "/\u003e" ], [ 121, ".?" ], [ 122, ".?" ], [ 202, ".6" ], [ 203, ".6" ], [ 227, "2\u0026" ], [ 228, "2\u0026" ], [ 232, "#18$18%19%1:\u00262:" ], [ 296, "2\u003e" ] ], "sz": 903, "ts": [ { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 1.0, "d": "Regex component marker", "e": [ "O1=N0;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 903.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Mixed encoding indicators", "e": [ "77\u003cHH\u003cHH=H7=H7=75\u003c64\u003c52" ], "i": "objectives/anti-static/obfuscation/multi-layer::mixed-encoding-indicators", "l": 3 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 300.00" ], "i": "metadata/binary/metrics/text-density::shell-high-import-density", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very long shell lines", "e": [ "text.max_line_length = 903.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "l": 3, "m": "B0032" }, { "c": 1.0, "d": "Code recovered from xor-encoded layer", "e": [ "Decoded layer at offset 0x158a62" ], "i": "metadata/lang/encoded/xor", "l": 2 } ], "sha": "6108df4248c3340a3c52a9f03187e636a49fa5c9de8bb326764b92978d1ba5c0", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/275445##xor@1411682", "type": "shell" }, { "f": "O(As₃)Md(Pa)", "k": { "source.imports[0]": "\"(#$*%\u0026,'8-9;/;=\"", "source.imports[1]": "34855:66", "source.imports[2]": "52", "source.strings[0]": "!\"(#$*%\u0026,'8-9;/;=\"\u003e0$02\u002634855:66;77\u003cH7\u003cH7=H6\u003c75\u003c64;52;3091\u003e8?\u003c'=:%\u003c8$:'#9\u0026#8%\"'#!'#!\u0026\" '\" '\" '! 8! 8\" 9\" :\" ;\" \u003c\"/=\".=\".\u003e\".\u003e!-?!-?!,?!,0!+0 +0 *0/*0/*0/*0/*0/*1/*1/+2/+2/+3/+3/+4/,5/,6 ,6 -7!-7!-H!.H\".7\".7#/7#/6#/6$ 5% 5%!4\u0026!4\u0026\"3'\"3'#38$28)\u00262:\u00263:'3;83\u003c93\u003c93=93=:4=:4\u003e:3\u003e:3\u003e:3\u003e:3\u003e93\u003e93?93?93\u003e83\u003e'2\u003e'2\u003e\u00262\u003e\u00261=%1=$0=$?\u003c#?\u003c\"\u003e;!=; =:/\u003c:/\u003c;/\u003c;/=;/=\u003c == \u003e\u003e!??\"10#213\u002654866:H7;I7\u003cJH\u003cKH=KI=LI=LI=LH=LH=L7\u003cK6;K5:J48H38H2'72'61'61'51'52'528638749H5:I6;J7\u003cKH=LH\u003eNI\u003eNI\u003eOI\u003e@I=@H\u003c@7;A6:A58A4'A3%@2$A1#@?!@\u003e @=/@=/@\u003c.@\u003c.O;.O\u003c.N\u003c/N= N\u003e!M?\"M0#L1$L2%K3\u0026K4'K58K69K69K6:J69J69J69I59H58H4874873863862862'52'51'51\u002640\u002640%4?$4?$4\u003e#4=\"3\u003c!3; 3:/29.28-1'-1\u0026,1%,0%,0$,0$,?#-?$.?%/0\u0026!1'\"28$4:\u00265;'7=9H\u003e;J0\u003cK1=M2\u003eN3?O3\u003eO2\u003eO1\u003cO?;N\u003e:M\u003c9L;'K9\u0026J8\u0026I'%H'%H\u0026%7\u0026%6'h\u00266987\u003c:H\u003e\u003cJ0\u003eK30M62OH4@K6BMHDOJEAKGCMXDNYENYDMYDMXCLGCLFBKEAKEAJDAJCAJCAKCBKCCLDDMEEOFG@XXAYZBZ[C[\\C[\\C[\\C[[BZY@YXOGFMEDLDCJBBJABJABJBDLCFNEXAX[D[_G_S[Sh_WmSlcVaxif|kzpk}sjpuhqwUr", "source.strings[1]": "%\u0026,'8-9;/;=", "source.strings[2]": "(#$*%\u0026,'8-9;/;=", "source.strings[3]": "=:%\u003c8$:", "source.has_imports": true }, "x": 2, "dp": 1, "id": 3, "is": [ "\"(#$*%\u0026,'8-9;/;=\"", "\"(#$*%\u0026,'8-9;/;=\"", "34855:66", "34855:66", "52" ], "ms": { "file": { "size": 910.0 }, "text": { "digit_ratio": 0.53, "space_count": 21.0, "total_lines": 1.0, "char_entropy": 5.67, "unique_chars": 76.0, "import_density": 500.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 4.0, "avg_line_length": 910.0, "max_line_length": 910.0, "last_line_length": 910.0, "long_token_count": 3.0, "most_common_char": "3", "whitespace_ratio": 0.02, "most_common_ratio": 0.04, "normalized_import_count": 5.0, "normalized_string_count": 4.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 1.0 }, "encoded": { "shell": { "xor_count": 1.0, "total_count": 1.0 }, "xor_count": 1.0, "total_count": 1.0 }, "imports": { "total": 5.0, "unique_modules": 3.0, "wildcard_imports": 2.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "strings": { "total": 4.0, "avg_length": 8.75, "max_length": 15.0, "avg_entropy": 2.64, "total_bytes": 35.0, "entropy_stddev": 1.05 }, "comments": { "chars": 838.0, "lines": 1.0, "total": 1.0, "high_entropy_comments": 1.0 }, "functions": {}, "identifiers": {} }, "ss": [ [ 1, "(#$*%\u0026,'8-9;/;=" ], [ 2, "(#" ], [ 6, "%\u0026,'8-9;/;=" ], [ 62, "=:%\u003c8$:" ], [ 0, "url", "!\"(#$*%\u0026,'8-9;/;=\"\u003e0$02\u002634855:66;77\u003cH7\u003cH7=H6\u003c75\u003c64;52;3091\u003e8?\u003c'=:%\u003c8$:'#9\u0026#8%\"'#!'#!\u0026\" '\" '\" '! 8! 8\" 9\" :\" ;\" \u003c\"/=\".=\".\u003e\".\u003e!-?!" ] ], "sz": 910, "ts": [ { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "!\"(#$*%\u0026,'8-9;/;=\"\u003e0$02\u002634855:66;77\u003cH7\u003cH7=H6\u003c75\u003c64;52;3091\u003e8?\u003c'=:%\u003c8$:'#9\u0026#8%\"'#!'#!\u0026\" '\" '\" '! 8! 8..." ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 910.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Mixed encoding indicators", "e": [ "I7\u003cJH\u003cKH=KI=LI=LI=LH=LH=L7\u003cK6" ], "i": "objectives/anti-static/obfuscation/multi-layer::mixed-encoding-indicators", "l": 3 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 500.00" ], "i": "metadata/binary/metrics/text-density::shell-high-import-density", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very long shell lines", "e": [ "text.max_line_length = 910.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-long-lines", "l": 3, "m": "B0032" }, { "c": 1.0, "d": "Code recovered from xor-encoded layer", "e": [ "Decoded layer at offset 0x159202" ], "i": "metadata/lang/encoded/xor", "l": 2 } ], "sha": "227060e3e7ca27cd1ff9993a47d9c3190763ceca576fab25c79828aa9e59e278", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/275445##xor@1413634", "type": "shell" }, { "f": "Md(Pa)", "k": { "source.imports[0]": "'P\u003e\u0026O=$N\u003c#N;#M:\"M8!M7 M6_L5^L3]K1\\K0[K/ZK-ZK,ZK+YK*XJ)WJ'VI", "source.imports[1]": "VJ$UJ#UJ\"TI!SH RH QG_PG_OF_NE_MD_LB_K@ J", "source.strings[0]": "P\u003e\u0026O=$N\u003c#N;#M:\"M8!M7 M6_L5^L3]K1\\K0[K/ZK-ZK,ZK+YK*XJ)WJ", "source.strings[1]": "TI!SH RH QG_PG_OF_NE_MD_LB_K@ J", "source.has_imports": true }, "x": 1, "dp": 1, "id": 4, "is": [ "'P\u003e\u0026O=$N\u003c#N;#M:\"M8!M7 M6_L5^L3]K1\\K0[K/ZK-ZK,ZK+YK*XJ)WJ'VI", "VJ$UJ#UJ\"TI!SH RH QG_PG_OF_NE_MD_LB_K@ J" ], "ms": { "file": { "size": 109.0 }, "text": { "digit_ratio": 0.11, "space_count": 4.0, "total_lines": 1.0, "char_entropy": 5.43, "unique_chars": 56.0, "import_density": 200.0, "string_density": 3.0, "avg_line_length": 109.0, "max_line_length": 109.0, "last_line_length": 109.0, "most_common_char": "K", "whitespace_ratio": 0.04, "most_common_ratio": 0.07, "normalized_import_count": 2.0, "normalized_string_count": 3.0, "max_inline_whitespace_run": 1.0 }, "encoded": { "shell": { "xor_count": 1.0, "total_count": 1.0 }, "xor_count": 1.0, "total_count": 1.0 }, "imports": { "total": 2.0, "unique_modules": 2.0, "wildcard_imports": 1.0, "third_party_count": 2.0, "third_party_ratio": 1.0 }, "strings": { "total": 3.0, "avg_length": 39.0, "max_length": 55.0, "avg_entropy": 4.46, "total_bytes": 117.0, "entropy_stddev": 0.41, "high_entropy_count": 1.0 }, "comments": { "chars": 34.0, "lines": 1.0, "total": 1.0 }, "functions": {}, "identifiers": {} }, "ss": [ [ 0, "P\u003e\u0026O=$N\u003c#N;#M:\"M8!M7 M6_L5^L3]K1\\K0[K/ZK-ZK,ZK+YK*XJ)WJ" ], [ 77, "TI!SH RH QG_PG_OF_NE_MD_LB_K@ J" ], [ 78, "TI!SH RH QG_PG_OF_NE_MD_LB_K@ J" ] ], "sz": 109, "ts": [ { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 200.00" ], "i": "metadata/binary/metrics/text-density::shell-high-import-density", "l": 2 }, { "c": 1.0, "d": "Code recovered from xor-encoded layer", "e": [ "Decoded layer at offset 0x1b1aa0" ], "i": "metadata/lang/encoded/xor", "l": 2 } ], "sha": "6c28ff9e9a914eeb2b8dee41e75567cf77102b358abcae2587941e68cc7ecdbe", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/275445##xor@1776288", "type": "shell" }, { "f": "Md(Pa)", "k": { "source.imports[0]": ",V:#U9!T?", "source.imports[1]": ".P", "source.imports[2]": "Nz", "source.imports[3]": "VM$UL[TC$KB$JA$IG$HE%O{", "source.strings[0]": "K\u003c\u0026K3%J2$J0ZI7YI5XH4XH+_H*_I)^I(^I.]H-\\H,\\O#SO\"SH!SH!SH!SH RH", "source.has_imports": true }, "x": 1, "dp": 1, "id": 5, "is": [ ".P", ".P", ",V:#U9!T?", ",V:#U9!T?", "VM$UL[TC$KB$JA$IG$HE%O{", "Nz", "Nz" ], "ms": { "file": { "size": 121.0 }, "text": { "digit_ratio": 0.1, "space_count": 3.0, "total_lines": 1.0, "char_entropy": 5.51, "unique_chars": 60.0, "import_density": 700.0, "string_density": 1.0, "avg_line_length": 121.0, "max_line_length": 121.0, "last_line_length": 121.0, "most_common_char": "H", "whitespace_ratio": 0.02, "most_common_ratio": 0.09, "normalized_import_count": 7.0, "normalized_string_count": 1.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 1.0 }, "encoded": { "shell": { "xor_count": 1.0, "total_count": 1.0 }, "xor_count": 1.0, "total_count": 1.0 }, "imports": { "total": 7.0, "relative_ratio": 0.29, "unique_modules": 4.0, "relative_imports": 2.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "strings": { "total": 1.0, "avg_length": 61.0, "max_length": 61.0, "avg_entropy": 4.7, "total_bytes": 61.0 }, "comments": { "chars": 114.0, "lines": 1.0, "total": 1.0, "high_entropy_comments": 1.0 }, "functions": {}, "identifiers": {} }, "ss": [ [ 18, "K\u003c\u0026K3%J2$J0ZI7YI5XH4XH+_H*_I)^I(^I.]H-\\H,\\O#SO\"SH!SH!SH!SH RH" ] ], "sz": 121, "ts": [ { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 700.00" ], "i": "metadata/binary/metrics/text-density::shell-high-import-density", "l": 2 }, { "c": 1.0, "d": "Code recovered from xor-encoded layer", "e": [ "Decoded layer at offset 0x1b29dd" ], "i": "metadata/lang/encoded/xor", "l": 2 } ], "sha": "c0ec16c14ddb5adec5a533e176d5b3fa7a0ff39173ec4575887c272e6f39b73d", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/275445##xor@1780189", "type": "shell" }, { "f": "Md(Pa)", "k": { "source.imports[0]": "S8", "source.strings[0]": "U;XU=YU\u003eZU0[T1[T2[S3[R4\\R5]R7^R(_S)_S*PS*PS+QS+QS+RT,RT,RT,RT,RT,QT,QT,QT,QT,QT-QU-RU.RV.RV/RW/SW/SH SI SI/SI.SJ-SJ,RJ*QJ(PJ5_J3^I1\\I\u003e[H\u003cYW9", "source.has_imports": true }, "x": 1, "dp": 1, "id": 6, "is": [ "S8" ], "ms": { "file": { "size": 149.0 }, "text": { "digit_ratio": 0.13, "space_count": 2.0, "total_lines": 1.0, "char_entropy": 4.9, "unique_chars": 45.0, "import_density": 100.0, "string_density": 1.0, "avg_line_length": 149.0, "max_line_length": 149.0, "last_line_length": 149.0, "long_token_count": 1.0, "most_common_char": "S", "whitespace_ratio": 0.01, "most_common_ratio": 0.1, "normalized_import_count": 1.0, "normalized_string_count": 1.0, "max_inline_whitespace_run": 1.0 }, "encoded": { "shell": { "xor_count": 1.0, "total_count": 1.0 }, "xor_count": 1.0, "total_count": 1.0 }, "imports": { "total": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 1.0, "avg_length": 140.0, "max_length": 140.0, "avg_entropy": 4.78, "total_bytes": 140.0 }, "comments": {}, "functions": {}, "identifiers": {} }, "ss": [ [ 6, "U;XU=YU\u003eZU0[T1[T2[S3[R4\\R5]R7^R(_S)_S*PS*PS+QS+QS+RT,RT,RT,RT,RT,QT,QT,QT,QT,QT-QU-RU.RV.RV/RW/SW/SH SI SI/SI.SJ-SJ,RJ*QJ(PJ5_J3" ] ], "sz": 149, "ts": [ { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 100.00" ], "i": "metadata/binary/metrics/text-density::shell-high-import-density", "l": 2 }, { "c": 1.0, "d": "Code recovered from xor-encoded layer", "e": [ "Decoded layer at offset 0x1ef147" ], "i": "metadata/lang/encoded/xor", "l": 2 } ], "sha": "401606c0110d846f2b5b985f0c0c0d35d9427f7c4b126583208da3c1a8f72bd9", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/275445##xor@2027847", "type": "shell" } ], "tv": "84923" } }