{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.008559201, "class": 0 }, { "m": "az/pe", "prob": 0.0028985508, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T17:02:33Z" }, "path": "329b6b6f13e52179944b2d0521751dec6aa67369ef1d2303936466a6cc6cdb01.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "b23510932b3d0f63aae2b8be70a1f033", "pe.checksum": "0x00105ec3", "pe.timestamp": 1746024254, "hash.authenti": "27efe57f7b6664e6cee995e5ca06a5ddfb210bc3551926204d9cd831dde108a1", "build.target_arch": "x86_64", "pe.linker_version": "14.0", "pe.resource_types[0]": "RT_VERSION", "pe.data_directories[0].rva": 273200, "pe.data_directories[1].rva": 1044480, "pe.data_directories[2].rva": 294912, "pe.data_directories[3].rva": 656384, "pe.data_directories[4].rva": 319488, "pe.data_directories[5].rva": 236688, "pe.data_directories[6].rva": 273888, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1008, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 6216, "pe.data_directories[3].name": "certificate", "pe.data_directories[3].size": 9768, "pe.data_directories[4].name": "base_relocation", "pe.data_directories[4].size": 1900, "pe.data_directories[5].name": "load_config", "pe.data_directories[5].size": 320, "pe.data_directories[6].name": "iat", "pe.data_directories[6].size": 648, "pe.version_info.company_name": "Microsoft Corporation", "pe.version_info.file_version": "10.0.19041.4355 (WinBuild.160101.0800)", "pe.version_info.product_name": "Microsoft® Windows® Operating System", "pe.load_config.cfg_check_func": "0x140042a60", "pe.version_info.internal_name": "mobsync.exe", "pe.load_config.security_cookie": "0x140045200", "pe.version_info.legal_copyright": "© Microsoft Corporation. All rights reserved.", "pe.version_info.product_version": "10.0.19041.4355", "pe.dll_characteristics.nx_compat": true, "pe.version_info.file_description": "Microsoft Sync Center", "pe.version_info.original_filename": "mobsync.exe", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".pdata", "pe.section_characteristics[4].name": ".gxfg", "pe.section_characteristics[5].name": ".retplne", "pe.section_characteristics[6].name": "_RDATA", "pe.section_characteristics[7].name": ".reloc", "pe.section_characteristics[8].name": ".jss", "pe.section_characteristics[9].name": ".jss", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[10].name": ".rsrc", "pe.dll_characteristics.high_entropy_va": true, "pe.section_characteristics[0].raw_size": 227328, "pe.section_characteristics[1].raw_size": 48640, "pe.section_characteristics[2].raw_size": 3584, "pe.section_characteristics[3].raw_size": 6656, "pe.section_characteristics[4].raw_size": 5120, "pe.section_characteristics[5].raw_size": 512, "pe.section_characteristics[6].raw_size": 512, "pe.section_characteristics[7].raw_size": 2048, "pe.section_characteristics[8].raw_size": 360448, "pe.section_characteristics[9].raw_size": 360448, "pe.section_characteristics[10].raw_size": 1024, "pe.section_characteristics[0].virtual_size": 227162, "pe.section_characteristics[1].virtual_size": 48236, "pe.section_characteristics[2].virtual_size": 10904, "pe.section_characteristics[3].virtual_size": 6216, "pe.section_characteristics[4].virtual_size": 5072, "pe.section_characteristics[5].virtual_size": 140, "pe.section_characteristics[6].virtual_size": 500, "pe.section_characteristics[7].virtual_size": 1900, "pe.section_characteristics[8].virtual_size": 360448, "pe.section_characteristics[9].virtual_size": 360448, "pe.section_characteristics[10].virtual_size": 1008, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 233472, "pe.section_characteristics[2].virtual_address": 282624, "pe.section_characteristics[3].virtual_address": 294912, "pe.section_characteristics[4].virtual_address": 303104, "pe.section_characteristics[5].virtual_address": 311296, "pe.section_characteristics[6].virtual_address": 315392, "pe.section_characteristics[7].virtual_address": 319488, "pe.section_characteristics[8].virtual_address": 323584, "pe.section_characteristics[9].virtual_address": 684032, "pe.section_characteristics[10].virtual_address": 1044480, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "40000040", "pe.section_characteristics[5].characteristics_hex": "00000000", "pe.section_characteristics[6].characteristics_hex": "40000040", "pe.section_characteristics[7].characteristics_hex": "42000040", "pe.section_characteristics[8].characteristics_hex": "c0000040", "pe.section_characteristics[9].characteristics_hex": "c0000040", "pe.section_characteristics[10].characteristics_hex": "40000040" }, "x": 9, "id": 0, "is": [ "CloseHandle", "CreateFileA", "CreateFileW", "CreateThread", "DeleteCriticalSection", "EncodePointer", "EnterCriticalSection", "ExitProcess", "FindClose", "FindFirstFileExW", "FindNextFileW", "FlsAlloc", "FlsFree", "FlsGetValue", "FlsSetValue", "FlushFileBuffers", "FreeEnvironmentStringsW", "FreeLibrary", "GetACP", "GetCPInfo", "GetCommandLineA", "GetCommandLineW", "GetConsoleMode", "GetConsoleOutputCP", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThreadId", "GetEnvironmentStringsW", "GetFileSize", "GetFileSizeEx", "GetFileType", "GetLastError", "GetModuleFileNameW", "GetModuleHandleA", "GetModuleHandleExW", "GetModuleHandleW", "GetOEMCP", "GetProcAddress", "GetProcessHeap", "GetStartupInfoW", "GetStdHandle", "GetStringTypeW", "GetSystemTimeAsFileTime", "HeapAlloc", "HeapFree", "HeapReAlloc", "HeapSize", "InitializeCriticalSectionAndSpinCount", "InitializeSListHead", "IsDebuggerPresent", "IsProcessorFeaturePresent", "IsValidCodePage", "LCMapStringW", "LeaveCriticalSection", "LoadLibraryExW", "MultiByteToWideChar", "QueryPerformanceCounter", "QueryPerformanceFrequency", "RaiseException", "ReadFile", "RtlCaptureContext", "RtlLookupFunctionEntry", "RtlPcToFileHeader", "RtlUnwindEx", "RtlVirtualUnwind", "SetFilePointerEx", "SetLastError", "SetStdHandle", "SetUnhandledExceptionFilter", "Sleep", "TerminateProcess", "TlsAlloc", "TlsFree", "TlsGetValue", "TlsSetValue", "UnhandledExceptionFilter", "WaitForSingleObject", "WideCharToMultiByte", "WriteConsoleW", "WriteFile" ], "ms": { "pe": { "entry": 142312.0, "machine": 34404.0, "checksum": 1072835.0, "rsrc_size": 1024.0, "subsystem": 2.0, "timestamp": 1746024254.0, "image_base": 5368709120.0, "has_checksum": true, "rsrc_entropy": 3.38, "entry_section": ".text", "size_of_image": 1048576.0, "cfg_check_func": 5368982112.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 34.0, "security_cookie": 5368992256.0, "size_of_headers": 2048.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 1.0, "computed_checksum": 1072835.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 33120.0, "has_export_timestamp": false, "linker_major_version": 14.0, "certificate_table_size": 9768.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "api_hashing_indicator_count": 1.0 }, "file": { "size": 1028096.0 }, "binary": { "code_size": 227328.0, "has_overlay": true, "code_entropy": 6.89, "data_entropy": 4.28, "import_count": 80.0, "overlay_size": 9728.0, "string_count": 548.0, "overlay_ratio": 0.01, "section_count": 11.0, "import_density": 0.36, "string_density": 2.47, "overall_entropy": 4.99, "avg_section_size": 92392.73, "dependency_count": 1.0, "entropy_variance": 2.05, "avg_string_length": 13.02, "max_string_length": 94.0, "wide_string_count": 88.0, "avg_string_entropy": 2.81, "code_to_data_ratio": 0.29, "data_to_file_ratio": 0.0, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.22, "high_entropy_regions": 2.0, "string_length_stddev": 11.23, "largest_section_ratio": 0.35, "sentence_string_count": 88.0, "sentence_string_ratio": 0.16, "behavioral_import_ratio": 0.03, "high_entropy_string_count": 2.0, "nonstandard_section_count": 5.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode.$" ], [ 384, ".text" ], [ 463, "@.data" ], [ 504, ".pdata" ], [ 543, "@.gxfg" ], [ 583, "@.retplne" ], [ 663, "@.reloc" ], [ 703, "B.jss" ], [ 744, ".jss" ], [ 784, ".rsrc" ], [ 2048, "AWAVAUATVWUSH" ], [ 19535, "s.xu" ], [ 68080, "AVVWUSH" ], [ 69520, "UAWAVAUATVWSH" ], [ 75200, "AVVWSH" ], [ 76048, "VWSH" ], [ 88032, "VWUSH" ], [ 88576, "UVWSH" ], [ 103264, "UVPH" ], [ 141866, "UWAVH" ], [ 141927, "Genu" ], [ 147802, "N0E3" ], [ 152989, "x UAVAWH" ], [ 163991, "UVWATAUAVAWH" ], [ 164787, "IH9B" ], [ 165295, "SVWATAUAVAWH" ], [ 165828, "@SVWATAUAVAWH" ], [ 168000, "t$ WATAUAVAWH" ], [ 171744, "@USVWATAUAVAWH" ], [ 173618, "E E3" ], [ 180335, "l$ VWATAVAWH" ], [ 187741, "{ AUAVAWH" ], [ 188477, "x ATAVAWH" ], [ 189576, "gfffffffH" ], [ 192752, "@UATAUAVAWH" ], [ 201585, "vyfffff" ], [ 201616, "ob0f" ], [ 206202, "VWAV" ], [ 208572, "@USVWATAVAWH" ], [ 221276, "@SUVWATAVAWH" ], [ 223163, "USVWAVH" ], [ 227473, "vKfffff" ], [ 238368, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 238752, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 249409, "TUUUU" ], [ 256700, "Unknown exception" ], [ 256718, "bad array new length" ], [ 256739, "string too long" ], [ 256758, "17:44:13" ], [ 256768, "wide", "KERNEL32.DLL" ], [ 256808, "July" ], [ 256816, "Sunday" ], [ 256824, "Monday" ], [ 256832, "Friday" ], [ 256860, "August" ], [ 256912, "April" ], [ 256924, "__eabi" ], [ 256932, "March" ], [ 256952, "June" ], [ 257124, "log10" ], [ 257172, "(null)" ], [ 257720, "dddd, MMMM dd, yyyy" ], [ 257744, "MM/dd/yy" ], [ 257760, "directory not empty" ], [ 257784, "text file busy" ], [ 257800, "device or resource busy" ], [ 257824, "no such file or directory" ], [ 257856, "not a directory" ], [ 257872, "is a directory" ], [ 257888, "not enough memory" ], [ 257912, "February" ], [ 257928, "January" ], [ 257936, "Thursday" ], [ 257952, "Tuesday" ], [ 257960, "Wednesday" ], [ 257976, "Saturday" ], [ 257992, "InitializeCriticalSectionEx" ], [ 258024, "LCMapStringEx" ], [ 258040, "stream timeout" ], [ 258056, "timed out" ], [ 258072, "invalid argument" ], [ 258096, "operator co_await" ], [ 258120, "connection reset" ], [ 258144, "network reset" ], [ 258160, "not a socket" ], [ 258176, "__restrict" ], [ 258192, "file exists" ], [ 258208, "connection already in progress" ], [ 258240, "operation in progress" ], [ 258264, "no such device or address" ], [ 258296, "bad address" ], [ 258312, "no such process" ], [ 258328, "no child process" ], [ 258352, "CorExitProcess" ], [ 258368, "success" ], [ 258392, "too many symbolic link levels" ], [ 258424, "too many links" ], [ 258440, "no stream resources" ], [ 258464, "resource deadlock would occur" ], [ 258496, "bad file descriptor" ], [ 258520, "operator" ], [ 258536, "executable format error" ], [ 258560, "io error" ], [ 258576, "protocol error" ], [ 258592, "October" ], [ 258600, "November" ], [ 258616, "September" ], [ 258632, "December" ], [ 258648, "network down" ], [ 258664, "no protocol option" ], [ 258688, "bad exception" ], [ 258704, "inappropriate io control operation" ], [ 258744, "bad allocation" ], [ 258760, "argument out of domain" ], [ 258784, "resource unavailable try again" ], [ 258816, "too many files open" ], [ 258840, "too many files open in system" ], [ 258872, "read only file system" ], [ 258896, "not a stream" ], [ 258912, "__fastcall" ], [ 258928, "__thiscall" ], [ 258944, "__vectorcall" ], [ 258960, "__clrcall" ], [ 258976, "__stdcall" ], [ 258992, "bad function call" ], [ 259016, "__cdecl" ], [ 259024, "__pascal" ], [ 259040, "no link" ], [ 259048, "cross device link" ], [ 259072, "invalid seek" ], [ 259088, "operation would block" ], [ 259112, "argument list too long" ], [ 259136, "filename too long" ], [ 259160, "message size" ], [ 259176, "FlsSetValue" ], [ 259192, "FlsGetValue" ], [ 259208, "delete" ], [ 259216, "address in use" ], [ 259232, "wrong protocol type" ], [ 259256, "broken pipe" ], [ 259272, "GetSystemTimePreciseAsFileTime" ], [ 259304, "state not recoverable" ], [ 259328, "address not available" ], [ 259352, "no lock available" ], [ 259376, "no message available" ], [ 259400, "host unreachable" ], [ 259424, "network unreachable" ], [ 259448, "value too large" ], [ 259464, "file too large" ], [ 259480, "result out of range" ], [ 259504, "no message" ], [ 259520, "bad message" ], [ 259536, "FlsFree" ], [ 259544, "illegal byte sequence" ], [ 259568, "no space on device" ], [ 259592, "no such device" ], [ 259608, "no buffer space" ], [ 259624, "AppPolicyGetProcessTerminationMethod" ], [ 259664, "identifier removed" ], [ 259688, "operation not permitted" ], [ 259712, "address family not supported" ], [ 259744, "function not supported" ], [ 259768, "operation not supported" ], [ 259792, "protocol not supported" ], [ 259816, "not supported" ], [ 259832, "connection aborted" ], [ 259856, "interrupted" ], [ 259872, "already connected" ], [ 259896, "not connected" ], [ 259912, "connection refused" ], [ 259936, "destination address required" ], [ 259968, "__unaligned" ], [ 259984, "operation canceled" ], [ 260008, "permission denied" ], [ 260032, "owner dead" ], [ 260048, "FlsAlloc" ], [ 260064, "delete[]" ], [ 260080, "GetTempPath2W" ], [ 260096, "LocaleNameToLCID" ], [ 260120, "operator\u003c=\u003e" ], [ 260144, "__swift_3" ], [ 260160, "__swift_2" ], [ 260176, "__swift_1" ], [ 260192, "nan(snan)" ], [ 260208, "nan(ind)" ], [ 260224, "NAN(SNAN)" ], [ 260240, "NAN(IND)" ], [ 260256, "restrict(" ], [ 260288, "Base Class Descriptor at (" ], [ 260320, "Base Class Array'" ], [ 260344, "Class Hierarchy Descriptor'" ], [ 260376, "Type Descriptor'" ], [ 260400, "`vector deleting destructor'" ], [ 260432, "`scalar deleting destructor'" ], [ 260464, "`vbase destructor'" ], [ 260488, "`vector copy constructor iterator'" ], [ 260528, "`eh vector copy constructor iterator'" ], [ 260568, "`managed vector copy constructor iterator'" ], [ 260616, "`vector vbase copy constructor iterator'" ], [ 260664, "`eh vector vbase copy constructor iterator'" ], [ 260712, "`vector constructor iterator'" ], [ 260744, "`eh vector constructor iterator'" ], [ 260784, "`managed vector constructor iterator'" ], [ 260824, "`vector vbase constructor iterator'" ], [ 260864, "`eh vector vbase constructor iterator'" ], [ 260904, "`vector destructor iterator'" ], [ 260936, "`eh vector destructor iterator'" ], [ 260968, "`managed vector destructor iterator'" ], [ 261008, "Complete Object Locator'" ], [ 261040, "`virtual displacement map'" ], [ 261096, "`udt returning'" ], [ 261112, "`omni callsig'" ], [ 261144, "`copy constructor closure'" ], [ 261176, "`default constructor closure'" ], [ 261208, "`local vftable constructor closure'" ], [ 261248, "`placement delete closure'" ], [ 261280, "`placement delete[] closure'" ], [ 261328, "`local vftable'" ], [ 261360, "`anonymous namespace'" ], [ 261384, "`local static thread guard'" ], [ 261416, "`local static guard'" ], [ 261440, "`dynamic atexit destructor for '" ], [ 261480, "`dynamic initializer for '" ], [ 261624, "wide", "dddd, MMMM dd, yyyy" ], [ 261664, "wide", "MM/dd/yy" ], [ 261704, "wide", "syr-sy" ], [ 261736, "wide", "February" ], [ 261760, "wide", "January" ], [ 261808, "wide", "July" ], [ 261856, "wide", "Thursday" ], [ 261880, "wide", "Tuesday" ], [ 261896, "wide", "Wednesday" ], [ 261920, "wide", "Saturday" ], [ 261944, "wide", "Sunday" ], [ 261960, "wide", "Monday" ], [ 261976, "wide", "Friday" ], [ 262088, "wide", "div-mv" ], [ 262248, "wide", "August" ], [ 262328, "wide", "zh-cht" ], [ 262448, "wide", "zh-chs" ], [ 262656, "wide", "October" ], [ 262672, "wide", "November" ], [ 262696, "wide", "September" ], [ 262720, "wide", "December" ], [ 262872, "wide", "smj-no" ], [ 262920, "wide", "sma-no" ], [ 263016, "wide", "quz-bo" ], [ 263080, "wide", "uz-uz-latn" ], [ 263104, "wide", "az-az-latn" ], [ 263128, "wide", "sr-sp-latn" ], [ 263152, "wide", "bs-ba-latn" ], [ 263176, "wide", "sr-ba-latn" ], [ 263440, "wide", "kok-in" ], [ 263648, "wide", "uz-uz-cyrl" ], [ 263672, "wide", "az-az-cyrl" ], [ 263696, "wide", "sr-sp-cyrl" ] ], "sz": 1028096, "ts": [ { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "10.0.19041.4355 (WinBuild.160101.0800)" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.9200000166893005, "d": "Large binary with few functions", "e": [ "binary.func_count = 0.00" ], "i": "metadata/package/metrics::recovered-function-count-under-10", "l": 2 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-file-l1-2-2", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-file-l1-2-4" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2 }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-file-l1-2-4", "api-ms-win-core-sysinfo-l1-2-1" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "329b6b6f13e52179944b2d0521751dec6aa67369ef1d2303936466a6cc6cdb01.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 80.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 80.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 0.00" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 3584)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 548.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "© Microsoft Corporation. All rights reserved." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.89" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.99" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 2.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8600000143051147, "d": "Uppercase _RDATA companion section", "e": [ "_RDATA" ], "i": "metadata/binary/section/metrics::uppercase-rdata-section", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "329b6b6f13e52179944b2d0521751dec6aa67369ef1d2303936466a6cc6cdb01.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Minimal resource section footprint", "e": [ ".rsrc (size: 1024)" ], "i": "well-known/malware/virus/virlock::tiny-rsrc-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "329b6b6f13e52179944b2d0521751dec6aa67369ef1d2303936466a6cc6cdb01.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 80.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE certificate table entry populated", "e": [ "pe.certificate_table_size = 9768.00" ], "i": "metadata/binary/layout::cert-table-present", "l": 1 }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Windows operating system product string", "e": [ "Microsoft® Windows® Operating System" ], "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string", "l": 1 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Microsoft Sync Center" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.800000011920929, "d": "In-code MZ/PE compare immediate", "e": [ "MZf9\bu/HcH\u003cH\u0003ȁ9PE" ], "i": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 80.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.99" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "51", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 80.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 80.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.81" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "329b6b6f13e52179944b2d0521751dec6aa67369ef1d2303936466a6cc6cdb01.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Random lowercase PE section name", "e": [ ".retplne (size: 512)" ], "i": "metadata/binary/section/metrics::random-lowercase-section-name", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.81" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "FreeEnvironmentStringsW", "LCMapStringW", "GetStringTypeW", "string too long", "api-ms-win-core-string-l1-1-0", "LCMapStringEx", "GetEnvironmentStringsW", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004" }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Microsoft® Windows® Operating System" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "FlsGetValue", "TlsGetValue", "TlsSetValue", "value too large", "FlsSetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".pdata", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 80.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "QueryPerformanceFrequency timing", "e": [ "QueryPerformanceFrequency" ], "i": "micro-behaviors/time/timing/check::query-performance-frequency", "l": 2, "m": "B0003.003" }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.89)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1070", "c": 0.6000000238418579, "d": "Vectorized zero-fill blocks (xorps + movups stores)", "e": [ "0F 57 C0 0F 11" ], "i": "objectives/evasion/indicator-removal/cleanup::vectorized-zero-density", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1746024254.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 80.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "GetTempPath2W name staged for runtime resolution", "e": [ "GetTempPath2W" ], "i": "micro-behaviors/os/api-resolution/manual::gettemppath2w-staged", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation", "Microsoft Corporation." ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 11.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.03" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 80.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 80.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "00 41 39 2d 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Very few recovered functions in large PE", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::recovered-function-count-under-10", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "67 20 01 00", "14 3d 01 00", "e4 72 01 00", "09 c4 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "binary.dependency_count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemTimePreciseAsFileTime", "InitializeSListHead", "UnhandledExceptionFilter", "InitializeCriticalSectionAndSpinCount", "SetUnhandledExceptionFilter", "GetSystemTimeAsFileTime", "WideCharToMultiByte", "RtlLookupFunctionEntry", "GetCurrentProcessId", "GetModuleHandleExW", "AppPolicyGetProcessTerminationMethod", "MultiByteToWideChar", "GetModuleFileNameW", "QueryPerformanceFrequency", "InitializeCriticalSectionEx" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "329b6b6f13e52179944b2d0521751dec6aa67369ef1d2303936466a6cc6cdb01.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CloseHandle, CreateFileA, CreateFileW, CreateThread, DeleteCriticalSection, ... +75 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA", "GetModuleHandleExW", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "Benign unsigned Microsoft binary with many imports", "e": [ "binary.import_count = 80.00", "Microsoft Corporation", "Microsoft Corporation." ], "i": "objectives/anti-static/obfuscation/imports::benign-unsigned-microsoft-import-heavy-context", "l": 1, "m": "B0032.014" }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsAlloc", "FlsSetValue", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 1.0, "d": "Benign unsigned Microsoft binary with many imports", "e": [ "binary.import_count = 80.00", "Microsoft Corporation", "Microsoft Corporation." ], "i": "metadata/binary/vendor::benign-unsigned-microsoft-import-heavy-context", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "329b6b6f13e52179944b2d0521751dec6aa67369ef1d2303936466a6cc6cdb01", "path": "329b6b6f13e52179944b2d0521751dec6aa67369ef1d2303936466a6cc6cdb01.exe", "type": "pe" } ], "tv": "85efb" } }