{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.4759615361690521, "class": 0 } ], "prob": 0.47596154, "class": 0, "models": [ { "m": "az", "prob": 0.47596154, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-10T21:21:56Z" }, "path": "194015", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₂Si)", "k": { "hash.imp": "29dfe51c05c452826b0c5c7ef5e5f5fd", "pe.checksum": "0x0000f5f2", "pe.timestamp": 1312281977, "signing.time": 1312282766, "hash.authenti": "9fd6401be82063ac23249d311edb76f8416f4f198ae6d9ae578a96b5814a048b", "debug.pdb_path": "T:\\sts\\x64\\ship\\0\\admsvc\\service\\wssadmin.exe\\mcobfu\\wssadmin.pdb", "pe.codeview.age": 9, "signing.catalog": "authenticode", "pe.codeview.guid": "C1293F47-7BC9-422D-835F-EB53206728A7", "build.target_arch": "x86", "pe.linker_version": "8.0", "signing.cert.issuer": "Microsoft Code Signing PCA", "signing.cert.serial": "6101b29b000000000015", "pe.resource_types[0]": "RT_VERSION", "signing.cert.subject": "Microsoft Corporation", "signing.countersigner": "Microsoft Timestamping PCA", "pe.debug_entries[0].size": 90, "pe.debug_entries[0].type": "codeview", "pe.version_info.comments": "Windows SharePoint Services Administration Service", "pe.data_directories[0].rva": 14628, "pe.data_directories[1].rva": 16384, "pe.data_directories[2].rva": 9216, "pe.data_directories[3].rva": 24576, "pe.data_directories[4].rva": 9468, "pe.data_directories[5].rva": 8192, "pe.data_directories[6].rva": 8200, "signing.validity.not_after": 1337633592, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1496, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 6056, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "debug", "pe.data_directories[4].size": 28, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 8, "pe.data_directories[6].name": "clr_runtime_header", "pe.data_directories[6].size": 72, "pe.debug_directory_types[0]": 2, "signing.validity.not_before": 1298321592, "pe.version_info.company_name": "Microsoft Corporation", "pe.version_info.file_version": "12.0.6607.1000", "pe.version_info.product_name": "Windows SharePoint Services", "signing.cert.thumbprint_sha1": "93859ebf98afdeb488ccfa263899640e81bc49f1", "pe.debug_entries[0].timestamp": 1312281977, "pe.dll_characteristics.no_seh": true, "pe.version_info.internal_name": "wssadmin.exe", "pe.version_info.legal_copyright": "© 2006 Microsoft Corporation. All rights reserved.", "pe.version_info.product_version": "12.0.6607.1000", "pe.dll_characteristics.nx_compat": true, "pe.version_info.file_description": "Windows SharePoint Services Administration Service", "pe.version_info.legal_trademarks": "Microsoft® is a registered trademark of Microsoft Corporation. Windows® is a registered trademark of Microsoft Corporation.", "pe.version_info.original_filename": "wssadmin.exe", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rsrc", "pe.section_characteristics[2].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[0].raw_size": 6656, "pe.section_characteristics[1].raw_size": 1536, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[0].virtual_size": 6532, "pe.section_characteristics[1].virtual_size": 1496, "pe.section_characteristics[2].virtual_size": 12, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 8192, "pe.section_characteristics[1].virtual_address": 16384, "pe.section_characteristics[2].virtual_address": 24576, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "42000040" }, "x": 6, "id": 0, "is": [ "CorExeMain" ], "ms": { "pe": { "entry": 14718.0, "signer": "Microsoft Root Authority, Microsoft Code Signing PCA, Microsoft Corporation, Microsoft Timestamping PCA, Microsoft Time-Stamp Service", "machine": 332.0, "checksum": 62962.0, "pdb_path": "T:\\sts\\x64\\ship\\0\\admsvc\\service\\wssadmin.exe\\mcobfu\\wssadmin.pdb", "is_dotnet": true, "rsrc_size": 1536.0, "subsystem": 3.0, "timestamp": 1312281977.0, "image_base": 4194304.0, "clr_version": "2.5", "leaf_issuer": "Microsoft Code Signing PCA", "leaf_serial": "6101b29b000000000015", "codeview_age": 9.0, "has_checksum": true, "leaf_subject": "Microsoft Corporation", "rsrc_entropy": 3.28, "signing_time": 1312282766.0, "codeview_guid": "C1293F47-7BC9-422D-835F-EB53206728A7", "entry_section": ".text", "has_signature": true, "size_of_image": 32768.0, "checksum_valid": true, "file_alignment": 512.0, "leaf_not_after": 1337633592.0, "primary_signer": "Microsoft Corporation", "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "signature_type": "platform", "characteristics": 258.0, "leaf_not_before": 1298321592.0, "size_of_headers": 512.0, "cert_chain_depth": 4.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 1.0, "signature_digest": "2fde80353b03c71efd4b6ce84ba851d61452a68f", "certificate_count": 1.0, "computed_checksum": 62962.0, "section_alignment": 8192.0, "cert_validity_days": 455.0, "resource_timestamp": 0.0, "signature_verified": true, "signer_info_issuer": "Microsoft Code Signing PCA", "signer_info_serial": "6101b29b000000000015", "debug_timestamp_max": 1312281977.0, "debug_timestamp_min": 1312281977.0, "dll_characteristics": 34112.0, "has_export_timestamp": false, "leaf_thumbprint_sha1": "93859ebf98afdeb488ccfa263899640e81bc49f1", "linker_major_version": 8.0, "debug_directory_types": [ 2.0 ], "leaf_eku_code_signing": true, "certificate_table_size": 6056.0, "has_resource_timestamp": false, "debug_directory_entries": 1.0, "number_of_rva_and_sizes": 16.0, "leaf_signature_algorithm": "sha1WithRSAEncryption", "signer_info_matches_leaf": true, "debug_timestamp_consistent": true, "signature_digest_algorithm": "sha1", "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 15272.0 }, "binary": { "code_size": 6656.0, "code_entropy": 5.54, "import_count": 1.0, "string_count": 183.0, "has_signature": true, "section_count": 3.0, "import_density": 0.15, "string_density": 28.15, "overall_entropy": 2.97, "avg_section_size": 2901.33, "dependency_count": 1.0, "entropy_variance": 2.24, "avg_string_length": 20.26, "max_string_length": 125.0, "wide_string_count": 22.0, "avg_string_entropy": 3.37, "code_to_data_ratio": 3.25, "rsrc_to_file_ratio": 0.1, "text_to_file_ratio": 0.44, "string_length_stddev": 15.04, "debug_reference_count": 1.0, "largest_section_ratio": 0.44, "sentence_string_count": 21.0, "sentence_string_ratio": 0.11 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 455, "@.reloc" ], [ 1840, "unicode-escape", "T:\\stsd\\ship\\0\\admsvc\\service\\wssadmin.exe\\mcobfu\\wssadmin.pdb" ], [ 1908, "BSJB" ], [ 3178, "wide", "YπσφϏϔ" ], [ 3385, "\u003cModule\u003e" ], [ 3394, "System.Reflection" ], [ 3412, "AssemblyProductAttribute" ], [ 3437, ".ctor" ], [ 3443, "System.Runtime.CompilerServices" ], [ 3475, "RuntimeCompatibilityAttribute" ], [ 3505, "AssemblyKeyFileAttribute" ], [ 3530, "AssemblyDelaySignAttribute" ], [ 3557, "AssemblyFileVersionAttribute" ], [ 3586, "AssemblyTrademarkAttribute" ], [ 3613, "AssemblyCopyrightAttribute" ], [ 3640, "AssemblyKeyNameAttribute" ], [ 3665, "AssemblyCompanyAttribute" ], [ 3690, "AssemblyConfigurationAttribute" ], [ 3721, "AssemblyDescriptionAttribute" ], [ 3750, "AssemblyTitleAttribute" ], [ 3773, "CompilationRelaxationsAttribute" ], [ 3805, "System.ServiceProcess" ], [ 3827, "ServiceBase" ], [ 3839, "System.Configuration.Install" ], [ 3868, "Installer" ], [ 3878, "System" ], [ 3885, "Attribute" ], [ 3895, "ServiceControllerStatus" ], [ 3923, "set_AutoLog" ], [ 3935, "set_CanStop" ], [ 3947, "set_CanPauseAndContinue" ], [ 3971, "set_CanShutdown" ], [ 3987, "set_CanHandlePowerEvent" ], [ 4011, "set_ServiceName" ], [ 4027, "System.Threading" ], [ 4044, "Monitor" ], [ 4052, "Exit" ], [ 4057, "Enter" ], [ 4063, "Dispose" ], [ 4071, "Microsoft.SharePoint.AdministrationOperation" ], [ 4116, "SPConstants" ], [ 4128, "AdminServiceName" ], [ 4145, "InvalidOperationException" ], [ 4171, "Type" ], [ 4176, "RuntimeTypeHandle" ], [ 4194, "GetTypeFromHandle" ], [ 4212, "Object" ], [ 4219, "ToString" ], [ 4228, "ObjectDisposedException" ], [ 4252, "System.Collections" ], [ 4271, "IDictionary" ], [ 4283, "System.Runtime.Remoting.Channels.Ipc" ], [ 4320, "IpcChannel" ], [ 4331, "Hashtable" ], [ 4341, "set_Item" ], [ 4350, "FarmAdminGroupName" ], [ 4369, "Microsoft.SharePoint.AdministrationOperation.Win32" ], [ 4431, "get_CanAddMembersToLocalGroups" ], [ 4462, "NetLocalGroupGetMembers" ], [ 4486, "System.Runtime.Remoting.Channels" ], [ 4519, "IClientChannelSinkProvider" ], [ 4546, "IServerChannelSinkProvider" ], [ 4573, "ChannelServices" ], [ 4589, "IChannel" ], [ 4598, "RegisterChannel" ], [ 4614, "SPAdministrationOperation" ], [ 4640, "System.Runtime.Remoting" ], [ 4664, "RemotingConfiguration" ], [ 4686, "WellKnownObjectMode" ], [ 4706, "RegisterWellKnownServiceType" ], [ 4735, "Microsoft.Win32" ], [ 4751, "RegistryKey" ], [ 4763, "Registry" ], [ 4772, "LocalMachine" ], [ 4796, "GetValue" ], [ 4811, "Thread" ], [ 4818, "Sleep" ], [ 4824, "Exception" ], [ 4834, "System.ComponentModel" ], [ 4856, "RunInstallerAttribute" ], [ 4878, "ServiceProcessInstaller" ], [ 4902, "ServiceInstaller" ], [ 4919, "ServiceAccount" ], [ 4934, "set_Account" ], [ 4946, "ServiceStartMode" ], [ 4963, "set_StartType" ], [ 4977, "set_DisplayName" ], [ 4993, "InstallerCollection" ], [ 5013, "get_Installers" ], [ 5032, "AttributeUsageAttribute" ], [ 5056, "AttributeTargets" ], [ 5073, "wssadmin.exe" ], [ 5086, "mscorlib" ], [ 5095, "DotfuscatorAttribute" ], [ 5116, "SPAdministrationService" ], [ 5140, "Microsoft.SharePoint.AdministrationService" ], [ 5183, "SPAdministrationServiceInstaller" ], [ 5218, "m_name" ], [ 5225, "m_displayName" ], [ 5239, "m_isDisposed" ], [ 5252, "s_status" ], [ 5261, "Main" ], [ 5266, "disposing" ], [ 5276, "get_Name" ], [ 5285, "get_DisplayName" ], [ 5301, "OnStart" ], [ 5321, "OnPause" ], [ 5329, "OnContinue" ], [ 5340, "RegisterSPAdministrationOperation" ], [ 5374, "ServiceSleep" ], [ 5387, ".cctor" ], [ 5396, "Name" ], [ 5401, "DisplayName" ], [ 5413, "wssadmin" ], [ 5422, "System.Diagnostics" ], [ 5441, "DebuggableAttribute" ], [ 5461, "DebuggingModes" ], [ 5478, "Windows SharePoint Services Administration" ], [ 5564, "portName" ], [ 5582, "localhost" ], [ 5602, "secure" ], [ 5616, "true" ], [ 5626, "NT AUTHORITY\\NetworkService" ], [ 5682, "authorizedGroup" ], [ 5714, "SPAdministrationOperation.rem" ], [ 5775, "Software\\Microsoft\\Shared Tools\\Web Server Extensions\\12.0\\WSS\\SPAdmin" ], [ 5917, "SleepOnStart" ], [ 6297, "RSA1" ], [ 6457, "Windows SharePoint Services" ], [ 6494, "WrapNonExceptionThrows" ], [ 6547, "}Microsoft" ], [ 6559, "is a registered trademark of Microsoft Corporation. Windows" ], [ 6621, "is a registered trademark of Microsoft Corporation." ], [ 6681, "2006 Microsoft Corporation. All rights reserved." ], [ 6737, "Microsoft Corporation" ], [ 6763, "2Windows SharePoint Services Administration Service" ], [ 6827, "'=^]\\_]g_ic_bafhhhfkrlos\u003e?" ], [ 6857, "64241:1:3.0.2321.28136" ], [ 7022, "mscoree.dll" ], [ 7262, "wide", "VS_VERSION_INFO" ], [ 7354, "wide", "VarFileInfo" ], [ 7386, "wide", "Translation" ], [ 7422, "wide", "StringFileInfo" ], [ 7482, "wide", "Comments" ], [ 7500, "wide", "Windows SharePoint Services Administration Service" ], [ 7610, "wide", "CompanyName" ], [ 7636, "wide", "Microsoft Corporation" ], [ 7686, "wide", "FileDescription" ], [ 7830, "wide", "FileVersion" ], [ 7894, "wide", "InternalName" ], [ 7920, "wide", "wssadmin.exe" ], [ 7954, "wide", "LegalCopyright" ], [ 7984, "wide", "© 2006 Microsoft Corporation. All rights reserved." ], [ 8094, "wide", "LegalTrademarks" ], [ 8128, "wide", "Microsoft® is a registered trademark of Microsoft Corporation. Windows® is a registered trademark of Microsoft Corporation." ], [ 8382, "wide", "OriginalFilename" ], [ 8450, "wide", "ProductName" ], [ 8476, "wide", "Windows SharePoint Services" ], [ 8538, "wide", "ProductVersion" ], [ 8606, "wide", "Assembly Version" ], [ 9278, "Z0X03" ], [ 9421, "\"Copyright (c) 1997 Microsoft Corp.1" ], [ 9467, "Microsoft Corporation1!0" ], [ 9499, "Microsoft Root Authority0" ], [ 9581, "Washington1" ], [ 9620, "Microsoft Corporation1#0!" ], [ 9652, "Microsoft Code Signing PCA0" ], [ 10123, "Microsoft Root Authority" ], [ 10758, "Microsoft Corporation1" ], [ 10790, "MOPR1" ], [ 10805, "Microsoft Corporation0" ], [ 11245, "3http://crl.microsoft.com/pki/crl/products/CSPCA.crl0H" ], [ 11326, ",http://www.microsoft.com/pki/certs/CSPCA.crt0" ], [ 11936, "Microsoft Timestamping PCA0" ], [ 13140, "nCipher DSE ESN:85D3-305C-5BCF1%0#" ], [ 13181, "Microsoft Time-Stamp Service0" ], [ 13591, "3http://crl.microsoft.com/pki/crl/products/tspca.crl0H" ], [ 13672, ",http://www.microsoft.com/pki/certs/tspca.crt0" ], [ 14141, "Microsoft Code Signing PCA" ], [ 14416, "http://office.microsoft.com 0" ], [ 14849, "Microsoft Timestamping PCA" ] ], "sz": 15272, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x774" ], "i": "metadata/dotnet/bsjb-signature", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Root Authority", "e": [ "Microsoft Root Authority" ], "i": "metadata/signed/platform::microsoft-root-authority", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Code Signing PCA", "e": [ "Microsoft Code Signing PCA" ], "i": "metadata/signed/platform::microsoft-code-signing-pca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/platform::microsoft-corporation", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Timestamping PCA", "e": [ "Microsoft Timestamping PCA" ], "i": "metadata/signed/platform::microsoft-timestamping-pca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Time-Stamp Service", "e": [ "Microsoft Time-Stamp Service" ], "i": "metadata/signed/platform::microsoft-time-stamp-service", "l": 2 }, { "c": 1.0, "d": "Signed by Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/leaf::microsoft-corporation", "l": 3 }, { "c": 0.8999999761581421, "d": "PE certificate table entry populated", "e": [ "pe.certificate_table_size = 6056.00" ], "i": "metadata/binary/layout::cert-table-present", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Security product displayName field", "e": [ "m_displayName" ], "i": "objectives/evasion/anti-av/edr-detect/wmi::display-name-field", "l": 2, "m": "B0013" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.97" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 1.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 1.0, "d": "Issued by a Microsoft Code Signing PCA", "e": [ "Microsoft Code Signing PCA" ], "i": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca", "l": 2 }, { "c": 1.0, "d": "Modification of HTTP context items", "e": [ "set_Item" ], "i": "micro-behaviors/communications/http/server/managed::http-item-setter", "l": 1 }, { "d": "PDB path on non-standard drive letter", "e": [ "T:\\sts\\x64\\ship\\0\\admsvc\\service\\wssadmin.exe\\mcobfu\\wssadmin.pdb" ], "i": "metadata/binary/debug::pdb-nonstandard-drive", "l": 3 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.44999998807907104, "d": "PDB in numbered directory (build artifacts)", "e": [ "T:\\sts\\x64\\ship\\0\\admsvc\\service\\wssadmin.exe\\mcobfu\\wssadmin.pdb" ], "i": "metadata/binary/debug::pdb-numbered-path", "l": 3 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "wssadmin.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 32768.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_valid = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.97" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "T:\\sts\\x64\\ship\\0\\admsvc\\service\\wssadmin.exe\\mcobfu\\wssadmin.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004" }, { "a": "T1036", "c": 0.8999999761581421, "d": "Dense Microsoft certificate text", "e": [ "Microsoft Corporation", "Microsoft Corporation1!0", "Microsoft® is a registered trademark of Microsoft Corporation. Windows® is a registered trademark of Microsoft Corporation.", "2006 Microsoft Corporation. All rights reserved.", "Microsoft Corporation1", "is a registered trademark of Microsoft Corporation. Windows", "© 2006 Microsoft Corporation. All rights reserved.", "is a registered trademark of Microsoft Corporation.", "Microsoft Corporation0", "Microsoft Corporation1#0!" ], "i": "objectives/evasion/masquerade/binary::dense-microsoft-cert-text", "l": 1, "m": "OB0006" }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M" ], "i": "objectives/anti-static/obfuscation/payload/registry::hkcu-software-text", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "PE Authenticode signature cryptographically valid", "e": [ "pe.signature_verified = 1.00" ], "i": "metadata/signed/certificate::pe-signature-verified", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.54" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.949999988079071, "d": "Microsoft timestamp certificate chain", "e": [ "Microsoft Time-Stamp Service" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "12.0.6607.1000" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1 }, { "c": 0.8799999952316284, "d": "Sparse function count stub", "e": [ "binary.func_count = 0.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::sparse-function-stub", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.37" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny PE single-function stub", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/layout::tiny-single-function-pe", "l": 3 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ToString", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": ".NET binary (PE with BSJB metadata)", "e": [ "pe.is_dotnet = 1.00" ], "i": "metadata/binary/metrics/threshold::dotnet-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 183.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1312281977.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "PE has an Authenticode signature", "e": [ "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-is-authenticode-signed", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "194015" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation.", "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Microsoft Corporation" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::low-volume-aliased-exports-benign-context-cond-3--inline-30354", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.949999988079071, "d": "links mscoree.dll (CorExeMain)", "e": [ "mscoree.dll" ], "i": "metadata/dylib::mscoree/dll", "l": 2 }, { "c": 1.0, "d": ".NET Assembly (mscoree.dll)", "e": [ "mscoree.dll", "BSJB" ], "i": "metadata/binary/framework::dotnet-assembly", "l": 2 } ], "sha": "32e1ea463468146a70afc51f9a7b9eb15456c0759fd0ae570a726f9846ceab8f", "path": "/data/samples/good/datasets/pe-machine-learning-dataset/194015", "type": "pe" } ], "tv": "6f60c" } }