{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.00023250407, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-18T06:24:56Z" }, "path": "VirusShare_419f5d358cea22a18e7ea3f465658eae", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "0fbf32532db2d14e7ac3ea5fae7eb05b", "pe.checksum": "0x0003e200", "pe.timestamp": 1441136226, "hash.authenti": "9828c81d0ba3e4ac3958e1c2fa26f15026809091349505318fc61ee3e1b6699e", "build.target_arch": "x86", "pe.linker_version": "11.0", "pe.resource_types[0]": "RT_VERSION", "pe.data_directories[0].rva": 213000, "pe.data_directories[1].rva": 209900, "pe.data_directories[2].rva": 221184, "pe.data_directories[3].rva": 229376, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 79, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 688, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 16, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.version_info.file_version": "0.0.0.0", "pe.dll_characteristics.no_seh": true, "pe.version_info.internal_name": "rtc_retsnk.dll", "pe.version_info.legal_copyright": " ", "pe.version_info.product_version": "0.0.0.0", "pe.dll_characteristics.nx_compat": true, "pe.version_info.file_description": " ", "pe.version_info.original_filename": "rtc_retsnk.dll", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".sdata", "pe.section_characteristics[2].name": ".rsrc", "pe.section_characteristics[3].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[0].raw_size": 202240, "pe.section_characteristics[1].raw_size": 512, "pe.section_characteristics[2].raw_size": 1024, "pe.section_characteristics[3].raw_size": 512, "pe.section_characteristics[0].virtual_size": 201796, "pe.section_characteristics[1].virtual_size": 112, "pe.section_characteristics[2].virtual_size": 688, "pe.section_characteristics[3].virtual_size": 16, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 8192, "pe.section_characteristics[1].virtual_address": 212992, "pe.section_characteristics[2].virtual_address": 221184, "pe.section_characteristics[3].virtual_address": 229376, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "42000040" }, "x": 4, "id": 0, "is": [ "CorDllMain" ], "ms": { "pe": { "entry": 209982.0, "machine": 332.0, "checksum": 254464.0, "is_dotnet": true, "rsrc_size": 1024.0, "subsystem": 3.0, "timestamp": 1441136226.0, "image_base": 268435456.0, "mixed_mode": true, "clr_version": "2.5", "has_checksum": true, "rsrc_entropy": 2.2, "entry_section": ".text", "size_of_image": 237568.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 8450.0, "size_of_headers": 1024.0, "export_timestamp": 1441136226.0, "has_version_info": true, "import_dll_count": 1.0, "computed_checksum": 254464.0, "section_alignment": 8192.0, "resource_timestamp": 0.0, "dll_characteristics": 34112.0, "has_export_timestamp": true, "linker_major_version": 11.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 205312.0 }, "binary": { "code_size": 202240.0, "code_entropy": 5.31, "data_entropy": 1.34, "export_count": 2.0, "import_count": 1.0, "string_count": 340.0, "section_count": 4.0, "import_density": 0.01, "string_density": 1.72, "overall_entropy": 2.26, "avg_section_size": 51072.0, "dependency_count": 1.0, "entropy_variance": 1.9, "avg_string_length": 17.14, "max_string_length": 71.0, "wide_string_count": 12.0, "avg_string_entropy": 3.42, "code_to_data_ratio": 98.75, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.99, "string_length_stddev": 9.94, "largest_section_ratio": 0.99, "sentence_string_count": 23.0, "sentence_string_ratio": 0.07, "nonstandard_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 456, ".rsrc" ], [ 495, "@.reloc" ], [ 5193, "2ZHP" ], [ 11575, "LYDH" ], [ 13028, "74GS" ], [ 21108, "29 ez" ], [ 194501, "\u003cModule\u003e" ], [ 194510, "System.Runtime.CompilerServices" ], [ 194542, "RuntimeCompatibilityAttribute" ], [ 194572, ".ctor" ], [ 194578, "CompilationRelaxationsAttribute" ], [ 194610, "System" ], [ 194617, "Object" ], [ 194624, "CompilerGeneratedAttribute" ], [ 194651, "ValueType" ], [ 194661, "System.Collections" ], [ 194680, "Hashtable" ], [ 194690, "System.IO" ], [ 194700, "FileStream" ], [ 194711, "System.Runtime.ExceptionServices" ], [ 194744, "HandleProcessCorruptedStateExceptionsAttribute" ], [ 194791, "Byte" ], [ 194796, "String" ], [ 194810, "System.Text" ], [ 194822, "Encoding" ], [ 194831, "get_ASCII" ], [ 194841, "GetBytes" ], [ 194850, "Contains" ], [ 194863, "BitConverter" ], [ 194876, "ToString" ], [ 194885, "Char" ], [ 194890, "Split" ], [ 194896, "Array" ], [ 194902, "Sort" ], [ 194907, "get_Unicode" ], [ 194919, "get_Length" ], [ 194930, "get_Chars" ], [ 194947, "IndexOf" ], [ 194974, "op_Explicit" ], [ 194986, "System.Runtime.InteropServices" ], [ 195017, "Marshal" ], [ 195025, "Copy" ], [ 195030, "op_Inequality" ], [ 195044, "FileMode" ], [ 195053, "FileAccess" ], [ 195064, "FileShare" ], [ 195074, "Environment" ], [ 195086, "SpecialFolder" ], [ 195100, "GetFolderPath" ], [ 195114, "File" ], [ 195119, "Delete" ], [ 195126, "Stream" ], [ 195133, "Close" ], [ 195139, "Exit" ], [ 195144, "RuntimeHelpers" ], [ 195159, "RuntimeFieldHandle" ], [ 195178, "InitializeArray" ], [ 195194, "Read" ], [ 195199, "Directory" ], [ 195209, "GetDirectories" ], [ 195224, "AppDomain" ], [ 195234, "get_CurrentDomain" ], [ 195252, "get_BaseDirectory" ], [ 195270, "GetFiles" ], [ 195279, "GetCurrentDirectory" ], [ 195299, "Remove" ], [ 195306, "rtc_retsnk.dll" ], [ 195321, "mscorlib" ], [ 195330, "pintlse_l1_1duu" ], [ 195346, "SetProxyCredl1_1_0" ], [ 195365, "WBEMty_Applir3jp" ], [ 195382, "UseplicatgonId_PolicyManagement_PolicyModel" ], [ 195426, "Evenws_Sedlm32" ], [ 195441, "imst_PowTX4P" ], [ 195454, "sppui_Internwcfg" ], [ 195471, "Phoment_RuleGenerator" ], [ 195493, "RDPEs_Accofnnb600" ], [ 195511, "OLEtev_cover" ], [ 195524, "CNBP_m_Wougc" ], [ 195537, "UserDlndows_bdgeo" ], [ 195555, "NDISWm_AddIn_COD" ], [ 195584, "SLUIs_SDEngam32" ], [ 195600, "ReAgild_Tasksrv" ], [ 195616, "lsi_ta_Lisc50" ], [ 195630, "Wxn_Windowxts" ], [ 195644, "CNBSIS_PowX15" ], [ 195658, "rexecmatters_256" ], [ 195675, "system_web_security_ssnglekigniagnosis_SDEngine" ], [ 195723, "samsift_sAuth" ], [ 195737, "negjoft_Web_Management_Iis_resources" ], [ 195774, "mshwm_DirecGR1" ], [ 195789, "vmbussoft_winBR346" ], [ 195808, "Mirrosoindows_kernel_pnp_events" ], [ 195840, "msvbpIn_rdir" ], [ 195853, "mst_Bridgerjit" ], [ 195868, "hidcldows_System_Displny" ], [ 195893, "systgpr_iTV" ], [ 195905, "CNBBRsoft_xssrv" ], [ 195921, "hpfm_Windient" ], [ 195935, "BingOnlialHost_Resources" ], [ 195960, "Proxws_Gamifig" ], [ 195975, "System_ServiceModel405" ], [ 195998, "ghprShell_rces" ], [ 196013, "NCPropul_logon" ], [ 196028, "adfsr_systeT30" ], [ 196043, "XIn_SmcrtCacmgr" ], [ 196059, "krplBasic_ocom" ], [ 196074, "wmv_Grouploy" ], [ 196087, "NlsLews_Devicvices" ], [ 196106, "CNBJuri1_1_0" ], [ 196119, "atintcurity_AHUNK" ], [ 196137, "bcdl_Cnwdui" ], [ 196149, "qapeb_Mgpc" ], [ 196160, "smtp_m_Windowents" ], [ 196178, "mciwk_HostinUSR" ], [ 196194, "rpc_Desiging" ], [ 196207, "wclm_RPost" ], [ 196218, "wmittem_der" ], [ 196230, "marsthreads_l1_1_0" ], [ 196249, "Angws_syCore" ], [ 196262, "NlsLterop_SeLEDMO" ], [ 196280, "Minek_Luna_nIDRV" ], [ 196297, "audiYour_Miime" ], [ 196312, "Policy_6_0_Micerwater" ], [ 196334, "CNB_Poanui" ], [ 196345, "wslWas_UStore" ], [ 196359, "ftpsads_l1ial" ], [ 196373, "mwmwsoft_Meapi16" ], [ 196390, "DbgMohell_resENCDD" ], [ 196409, "xenra_Policy1_1_0" ], [ 196427, "dhcpm_io_dpipe" ], [ 196442, "winsws_AppEXL32" ], [ 196458, "TaskSchedus_Management_Resources" ], [ 196491, "syso_rxsistry_localregistry_l1_1_0" ], [ 196526, "XFIL_security_sddl_l1_1_0" ], [ 196552, "KBDb_Managictrl" ], [ 196568, "donm_Web_7EM" ], [ 196581, "Skydows_Db0406" ], [ 196596, "WUDFkflow_tec" ], [ 196610, "CMMGWeb_Diagnostics" ], [ 196630, "Clusole_re0401" ], [ 196645, "olethctoryServices_Protocols" ], [ 196674, "printduler_ni_294" ], [ 196692, "MapControoundIntelligentTransfer_Management" ], [ 196736, "EP0NMsoft_210" ], [ 196750, "Crypis_Coyma500at" ], [ 196768, "System_EnterpriseSerutils" ], [ 196794, "Zroxia_MedmGen" ], [ 196809, "msrdsoft_VierIf" ], [ 196825, "ksqws_Gamover" ], [ 196839, "Winr_Resoughe" ], [ 196853, "occacm_Desigpres" ], [ 196870, "System_Data_Entvtymmc" ], [ 196892, "EP0NOfs_Medaxcom" ], [ 196909, "PCLenter_Pset" ], [ 196923, "RDVGHaybaak_MediaPlayer" ], [ 196947, "LXSYSntime_serialization_formatters_soap" ], [ 196988, "TsPnPRiaCenter_iTV" ], [ 197007, "System_Workflow_Canprofiles" ], [ 197035, "System_Data_Entit00J" ], [ 197056, "sm9awm_Data427" ], [ 197071, "psapowo_P0027" ], [ 197085, "EP0NRws_DeNDI" ], [ 197099, "TAPIIsoft_wearts" ], [ 197116, "AWRESdel_Background_TiieBroker" ], [ 197147, "bhp70hics_Prmchat" ], [ 197165, "CNBPws_Dhp015" ], [ 197179, "FXVIt_resouSTR" ], [ 197194, "resetsoft_wista" ], [ 197210, "System_Datl_tup" ], [ 197226, "DWrisoft_MedVCD00" ], [ 197244, "ntmsmsoalC_nment" ], [ 197261, "webs_string_l1_1_0" ], [ 197280, "GAGP3ty_Appupcjrr" ], [ 197298, "sbs_PolicyMPLD" ], [ 197313, "WP9REm_Data_Swuk" ], [ 197330, "MSGSRsoft_PowPrn" ], [ 197347, "ieitem_becu_0162" ], [ 197364, "SPTIdows_Drenum" ], [ 197380, "rbfgices_Pcpi" ], [ 197394, "crcback_p81k" ], [ 197407, "audisoft_hUX" ], [ 197420, "kz_SnapIn_neamci" ], [ 197437, "rsjows_procjenter" ], [ 197455, "KBDPolicy_Psis" ], [ 197470, "lsi_soft_vdmoe" ], [ 197485, "ecescst_Retsvc" ], [ 197512, "sysa_SpeechfpTg" ], [ 197528, "kbdins_CommUtils" ], [ 197545, "tsp_resourcerAPI" ], [ 197562, "Evennecte_Dtc" ], [ 197576, "netsic_Compatibilizy_Data" ], [ 197602, "dt_ctime_SB03S" ], [ 197617, "cjimws_Web_Ha0407" ], [ 197635, "secinm_Data_S0258" ], [ 197653, "msjm_Runtork" ], [ 197666, "nddenell_Costkmc" ], [ 197683, "Winkjel_Screedmin" ], [ 197701, "hsfcdministration_resourcvs" ], [ 197729, "smlmmands_WriteDiagProgress" ], [ 197757, "safm_SenapIn" ], [ 197770, "Micrm_DS100" ], [ 197782, "CYB_0nds_Wri800" ], [ 197798, "fhlhssoft_Pext" ], [ 197813, "System_WicessLockFramework" ], [ 197840, "BRUauor_net" ], [ 197852, "dirjer_Intup" ], [ 197865, "CVT16nal_crips" ], [ 197880, "tetheeb_RegularExpressions" ], [ 197907, "snmptm_Web_Enown" ], [ 197924, "chkrzdows_syguph" ], [ 197941, "kxsum_Manapter" ], [ 197956, "usrows_MapContqols" ], [ 197975, "mshdia_BafkNRJ8I" ], [ 197992, "DeviceM_Core" ], [ 198005, "WBEMrvices_narkup" ], [ 198023, "system_runtime_serialiTmpl" ], [ 198050, "mpsols_Homefiflt" ], [ 198067, "OLEACnet_resontr" ], [ 198084, "fvecpem_locbdsw" ], [ 198100, "Micros_MapConback" ], [ 198118, "Licenb_Management_Aspnet_resourceo" ], [ 198153, "Micro_handle_MEM" ], [ 198170, "Sens_InstalTAT" ], [ 198197, "XRXM1soft_Vitscc" ], [ 198214, "xrWPuxity_AdCtl" ], [ 198230, "C_G18soft_W032" ], [ 198245, "iprtrter_Udide" ], [ 198260, "Iphlpsvcem_Launcher" ], [ 198280, "EP0NMhics_Prpiw" ], [ 198296, "system_directoryservHelp_Runtime" ], [ 198329, "DsmUss_Storage_Search" ], [ 198351, "CNB_hell_ut_32" ], [ 198366, "PserAccountControlSety_Design" ], [ 198396, "wercews_Gra4svc" ], [ 198412, "tspr_Contctrr" ], [ 198426, "cryiedows_system_wrofile_l1_1_0" ], [ 198458, "spdwsystem_prsle" ], [ 198475, "shppads_l1hio" ], [ 198489, "mcsmiws_Sec0011" ], [ 198505, "dfres_Se895PJ" ], [ 198519, "CNBP_sofj_Poial" ], [ 198535, "sbs_system_confnguratioionId_RuleWizard" ], [ 198575, "MMEFXrdo_dm_Vtio" ], [ 198592, "CNBP_y_qvents" ], [ 198606, "IKEEer_iTvdp2" ], [ 198620, "syncs_Sbug" ], [ 198631, "system_wemail" ], [ 198653, "AppMedia_Dtdspx" ], [ 198669, "System_Data_DatE3P" ], [ 198688, "System_DirectoryServicesetup" ], [ 198717, "fxssour_ComFWSD" ], [ 198733, "ntocsvft_all" ], [ 198746, "OLOCn_Wdsvd" ] ], "sz": 205312, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x2ee08" ], "i": "metadata/dotnet/bsjb-signature", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_419f5d358cea22a18e7ea3f465658eae" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.9900000095367432, "d": ".rsrc section present", "e": [ ".rsrc" ], "i": "well-known/malware/worm/mydoom::section-rsrc", "l": 1 }, { "a": "T1036", "c": 0.949999988079071, "d": "PE FileDescription is single-character placeholder", "e": [ " " ], "i": "objectives/evasion/masquerade/identity/fabricated::pe-file-description-single-char", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.26" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 237568.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "0.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 340.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/metrics/structural::minimal-exports", "l": 3 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": ".text section present", "e": [ ".text" ], "i": "well-known/malware/worm/mydoom::section-text", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "a": "T1046", "c": 0.8500000238418579, "d": "DirectorySearcher API usage", "e": [ "System.DirectoryServices" ], "i": "objectives/discovery/network/scan/internal-port::dotnet-directory-searcher", "l": 1, "m": "E1046" }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.42" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2 }, { "c": 0.6000000238418579, "d": "AppDomain.CurrentDomain accessor", "e": [ "get_CurrentDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.9900000095367432, "d": "Exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "well-known/malware/worm/mydoom::metric-section-count-4", "l": 1 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "Policy_6_0_Micerwater" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-79", "l": 1 }, { "c": 1.0, "d": "scanner word", "e": [ "Scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "ValueType" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8399999737739563, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8450.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 1.0, "d": ".NET binary (PE with BSJB metadata)", "e": [ "pe.is_dotnet = 1.00" ], "i": "metadata/binary/metrics/threshold::dotnet-binary", "l": 1 }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1 }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ToString", "webs_string_l1_1_0", "String", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.26" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1441136226.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2 }, { "c": 0.75, "d": "Text section dominates file", "e": [ "binary.text_to_file_ratio = 0.99" ], "i": "metadata/binary/layout::text-section-dominates-file", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.42" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "ddemlntCache_l32" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 1441136226.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree.dll (CorDllMain)", "e": [ "mscoree.dll" ], "i": "metadata/dylib::mscoree/dll", "l": 2 }, { "c": 1.0, "d": ".NET Assembly (mscoree.dll)", "e": [ "BSJB", "pe.is_dotnet = 1.00" ], "i": "metadata/binary/framework::dotnet-assembly", "l": 2 }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1 }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "0.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1 } ], "sha": "32a0de73c2941f936ab9f203f9caa7a6fb6ebd57b52da2bf3b01f5d1370493fd", "path": "/data/samples/bad/datasets/various/VirusShare/VirusShare_419f5d358cea22a18e7ea3f465658eae", "type": "pe" } ], "tv": "60127" } }