{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.015269435942173004, "class": 0 } ], "prob": 0.015269436, "class": 0, "models": [ { "m": "az", "prob": 0.0062637734, "class": 0 }, { "m": "az/native", "prob": 0.015269436, "class": 0 }, { "m": "az/pe", "prob": 0.0037351027, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T10:09:17Z" }, "path": "BOOTX64.EFI", "raw": { "v": "4", "fs": [ { "f": "O₄(Al₂As₇Er₂C₃)H₄(DbMgOsPo)Md₅(Bi₅PtSiPa)", "x": 9, "id": 0, "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "subsystem": 10.0, "entry_section": ".text", "size_of_image": 319488.0, "file_alignment": 4096.0, "characteristics": 518.0, "entry_point_rva": 217088.0, "size_of_headers": 4096.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "computed_checksum": 343258.0, "section_alignment": 4096.0, "timestamp_anomaly": true, "timestamp_is_zero": true, "unusual_alignment": true, "number_of_sections": 3.0, "resource_timestamp": 0.0, "linker_major_version": 2.0, "linker_minor_version": 38.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 217088.0, "file_size": 319488.0, "entry_point": 217088.0, "code_entropy": 6.41, "data_entropy": 4.13, "string_count": 1002.0, "section_count": 3.0, "avg_complexity": 21.88, "function_count": 329.0, "max_complexity": 987.0, "string_density": 4.73, "overall_entropy": 3.52, "avg_basic_blocks": 29.75, "avg_section_size": 105130.66, "entropy_variance": 2.65, "function_density": 1.55, "avg_function_size": 674.19, "avg_string_length": 24.02, "complexity_per_kb": 0.1, "max_string_length": 154.0, "wide_string_count": 20.0, "writable_sections": 1.0, "avg_string_entropy": 3.38, "code_to_data_ratio": 2.21, "data_to_file_ratio": 0.29, "entry_point_is_rva": true, "text_to_file_ratio": 0.68, "total_basic_blocks": 9787.0, "executable_sections": 1.0, "string_length_stddev": 17.62, "largest_section_ratio": 0.68, "sentence_string_count": 398.0, "sentence_string_ratio": 0.4, "function_analysis_depth": 2.0, "high_complexity_functions": 25.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 312, ".text" ], [ 391, "B.data" ], [ 4100, "AWAVATSH" ], [ 4676, "AWAVAUATSH" ], [ 4797, "H3AHH" ], [ 4912, "H3API" ], [ 11426, "fffff." ], [ 12804, "AWAVAUATSPL" ], [ 14225, "ffffff." ], [ 14484, "AVSH" ], [ 22916, "AWAVSPI" ], [ 24257, "Bfffff." ], [ 25348, "AWAVAUATSPI" ], [ 27908, "AWAVATS" ], [ 30340, "AWAVSH" ], [ 31673, "N8E1" ], [ 38885, "UUUUUUUUI" ], [ 39472, "-ffffff." ], [ 42945, "cfffff." ], [ 43706, "T5 H9" ], [ 47409, "AVAUSASAR" ], [ 48473, "VVVUUUVVV" ], [ 52212, "AWAVSPH" ], [ 54177, "/fffff." ], [ 55407, "t%ffffff." ], [ 58116, "AWAVAUATSPH" ], [ 66652, "9ppu" ], [ 67168, "VTH9U" ], [ 74833, "K0I9" ], [ 76192, "K0H9" ], [ 76720, "sffffff." ], [ 87669, "VUUUH" ], [ 97006, "QDHI" ], [ 97018, "RDHI" ], [ 97030, "ETLP" ], [ 97342, "TADI" ], [ 98065, "pfffff." ], [ 98382, "DNEI" ], [ 110708, "AWAVATSI" ], [ 112452, "AWAVSP" ], [ 113885, "AWAVATSIc" ], [ 120223, "AWAVATSD" ], [ 122254, "AWAVAUATSP" ], [ 124548, "AWAVSPD" ], [ 124871, "AWAVSASARP" ], [ 146813, "ASPAR" ], [ 155728, "wide", "Boot" ], [ 156840, "ASSAVAW" ], [ 157120, "I9T8" ], [ 157170, "I9L8" ], [ 157204, "M9T8" ], [ 159658, "9Y2H" ], [ 163881, "L7 L" ], [ 163886, "L3 H" ], [ 164920, "D3HH" ], [ 164929, "D08H" ], [ 165709, "SARAT" ], [ 165720, "ASAV" ], [ 169536, "stack", "EL64" ], [ 169543, "EL64H" ], [ 173700, "AWAVATSE" ], [ 185876, "AWAVAUATSPD" ], [ 197773, "lu91" ], [ 202558, "AWAVSD" ], [ 205348, "AWAVATSL" ], [ 212868, "AWAVSPA" ], [ 217184, "PQRVWAPAQARAS" ], [ 217202, "A[AZAYAX_^ZYXH" ], [ 217290, "APAQQRVW" ], [ 225280, "/boot/limine/limine.conf" ], [ 225305, "CD001" ], [ 225311, "XSDP" ], [ 225316, "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" ], [ 225445, "config: Macro name too long (max %U)" ], [ 225482, "elf: Unresolved symbol \"%s\"" ], [ 225510, "TERM_PALETTE_BRIGHT" ], [ 225530, "Attempted volume_read() on pxe" ], [ 225561, "0-pixel image" ], [ 225575, "invalid filter" ], [ 225590, "bad code lengths" ], [ 225607, "bad sizes" ], [ 225618, "[31mConfiguration is INVALID." ], [ 225652, "Default entry is not valid or directory, booting to menu." ], [ 225711, "GPT_GUID" ], [ 225720, "pmm: Integer overflow in memory range calculation" ], [ 225770, "efi: Allocation failure" ], [ 225794, "limine: Base revision: %u" ], [ 225823, "linux: Kernel file too small for real mode code" ], [ 225871, "linux: Failed to allocate memory for modules" ], [ 225916, "multiboot1: Header checksum is invalid" ], [ 225955, "multiboot1: Illegal load address" ], [ 225988, "multiboot1: info size overflow" ], [ 226019, "multiboot2: Invalid magic" ], [ 226045, "config: Macro value too long (max %U)" ], [ 226083, "Font size too large for provided font file. Not loading." ], [ 226141, "efi: Exited boot services." ], [ 226169, "bad ctype" ], [ 226179, "outofdata" ], [ 226189, "no IDAT" ], [ 226197, "bad COM len" ], [ 226209, "bad SOF len" ], [ 226221, "bios_chainload" ], [ 226241, "chainload: Alignment overflow" ], [ 226271, "efi: HandleProtocol failure (%X)" ], [ 226304, "limine: ranges_count == 0" ], [ 226330, "multiboot1: ELF32 load failure" ], [ 226361, "PXE somehow didn't use DHCP?" ], [ 226391, "Sorry, unsupported: PXE IPv6" ], [ 226421, "elf: Lower half PHDRs are not allowed" ], [ 226459, "elf: ELF file attempts to load a dynamically linked library" ], [ 226519, "elf: Relocation requires symbol table but none present" ], [ 226574, "menu" ], [ 226579, "pe: Lower half images are not allowed" ], [ 226617, "tRNS before PLTE" ], [ 226634, "bad DRI len" ], [ 226646, "Blake2b hash for URI `%#` does not match!" ], [ 226688, "efi_boot_entry" ], [ 226703, "MBR_ID" ], [ 226714, "Memory map exhausted." ], [ 226736, "ext_mem_alloc: count overflows when aligning" ], [ 226781, "limine: Conflict detected for request ID %X %X" ], [ 226828, "linux: Alignment overflow" ], [ 226854, "multiboot1: Cannot use text mode with UEFI." ], [ 226898, "multiboot: info alloc overflow" ], [ 226929, "multiboot2: Load end address less than load address" ], [ 226981, "multiboot2: Relocatable tag has align=0" ], [ 227021, "FDT_ERR_EXISTS" ], [ 227036, "FDT_ERR_BADSTATE" ], [ 227053, "gop: Failed to set video mode %X, moving on..." ], [ 227101, "WARNING: Failed to disable watchdog timer!" ], [ 227145, "pe: SectionAlignment is not a power of 2" ], [ 227186, "pe: Image wants to load too high" ], [ 227219, "pe: Import directory VirtualAddress out of bounds" ], [ 227269, "pe: Relocation offset out of bounds" ], [ 227305, "pe: Alignment overflow" ], [ 227328, "bad png sig" ], [ 227340, "Adobe" ], [ 227346, "bad SOS len" ], [ 227358, "bad compression" ], [ 227374, "Drive number cannot be omitted for hdd():/ and odd():/" ], [ 227429, "tftp: Invalid ipv4 address: %s" ], [ 227464, "Failed to reboot to firmware UI" ], [ 227507, "Memory allocation overflow." ], [ 227535, "Unexpected page size in get_next_level" ], [ 227574, "limine: Firmware had x2APIC enabled, reverted to xAPIC mode" ], [ 227635, "linux: Boot protocol: %u.%u" ], [ 227664, "multiboot1: Invalid ELF file bitness" ], [ 227725, "multiboot2: Invalid ELF file bitness" ], [ 227762, "multiboot2: ELF section table size overflow" ], [ 227806, "IVRS" ], [ 227811, "Press any key to continue..." ], [ 227841, "No volume contained a Limine configuration file" ], [ 227889, "elf: RELA vaddr translation failed or out of bounds" ], [ 227941, "elf: rela_size not a multiple of rela_ent" ], [ 227983, "TERM_FONT_SIZE" ], [ 227998, "pe: Kernel must not have any imports" ], [ 228035, "pe: File too small for DOS header" ], [ 228069, "bad filter method" ], [ 228087, "first not IHDR" ], [ 228109, "bad codelengths" ], [ 228125, "SERIAL" ], [ 228132, "%sARROWS" ], [ 228145, "[0m Select %sENTER" ], [ 228194, "limine: failed to find node: '%s'" ], [ 228228, "multiboot1: load_size + bss_size overflow" ], [ 228270, "multiboot1: Failed to open module with path `%#`. Is the path correct?" ], [ 228341, "multiboot2: Illegal load address" ], [ 228374, "multiboot2: Using address tag but entry address tag missing" ], [ 228434, "multiboot2: Firmware had x2APIC enabled, reverted to xAPIC mode" ], [ 228499, "acpi: Found %s at %p" ], [ 228521, "elf: phdr_size \u003c sizeof(struct elf32_phdr)" ], [ 228564, "elf: Unknown relocation type: %x" ], [ 228597, "TERM_PALETTE" ], [ 228610, "TERM_FONT_SCALE" ], [ 228626, "invalid PLTE" ], [ 228639, "not enough pixels" ], [ 228657, "read past buffer" ], [ 228682, "mtrr: Attempted restore without prior save" ], [ 228725, "paging: 1GiB pages are %s!" ], [ 228753, "limine: Executable path not specified" ], [ 228791, "limine: Executable's paging max_mode lower than min_mode" ], [ 228848, "limine: Unknown kernel executable format" ], [ 228889, "linux: Total module size overflow" ], [ 228923, "multiboot1: ELF section entry size too small" ], [ 228968, "Limine 11.4.1" ], [ 228982, "multiboot2: ELF32 load failure" ], [ 229013, "multiboot2: ELF section headers out of bounds" ], [ 229059, "multiboot2: Cannot allocate module" ], [ 229094, "LocateHandle for BLOCK_IO_PROTOCOL failed. Machine not supported by Limine UEFI." ], [ 229175, "/EFI/limine/limine.conf" ], [ 229199, "acpi: Found SMBIOS 32-bit entry point at %p" ], [ 229244, "XSDT" ], [ 229249, "Config file too large" ], [ 229274, "elf: Image wants to load too high" ], [ 229308, "elf: rela_ent \u003c sizeof(struct elf64_rela)" ], [ 229350, "fb: Alignment overflow" ], [ 229373, "BACKDROP" ], [ 229382, "dtb: loaded dtb at %p from file `%#`" ], [ 229420, "pe: 32-bit relocations are incompatible with higher-half loading" ], [ 229485, "pe: Not a valid PE32+ file" ], [ 229512, "tRNS with alpha" ], [ 229528, "bad offset" ], [ 229539, "bad AC huff" ], [ 229551, "WARNING: Blake2b hash for URI `%#` does not match!\n Press Y to continue, press any other key to return to menu..." ], [ 229602, "Press Y to continue, press any other key to return to menu..." ], [ 229675, "Collapse" ], [ 229684, "Expand" ], [ 229705, "limine: ELF64 load failure" ], [ 229732, "5level" ], [ 229739, "limine: Invalid MAX_PAGING_MODE: `%s`" ], [ 229777, "limine: Executable's minimum supported paging mode higher than maximum allowable paging mode" ], [ 229870, "limine: Internal module path too long" ], [ 229908, "multiboot1: Failed to open executable with path `%#`. Is the path correct?" ], [ 229983, "multiboot: info size overflow" ], [ 230013, "multiboot1: Module disappeared unexpectedly" ], [ 230057, "multiboot2: Cannot allocate elf sections" ], [ 230098, "multiboot2: Firmware has x2APIC enabled and it could not be disabled" ], [ 230168, "smp: FAILED to bring-up AP" ], [ 230196, "FDT_ERR_BADVALUE" ], [ 230214, "elf: Executable has no loadable segments" ], [ 230255, "TERM_FOREGROUND_BRIGHT" ], [ 230278, "dtb_path" ], [ 230287, "dtb: failed to set #size-cells: '%s'" ], [ 230324, "pe: Section %U exceeds image bounds" ], [ 230360, "pe: Unsupported relocation type %u" ], [ 230406, "[config file contains no valid entries]" ], [ 230450, "[0m Firmware Setup" ], [ 230469, "linux" ], [ 230475, "PARTITION" ], [ 230489, "not supported" ], [ 230503, "efi_boot_entry: Failed to set BootNext variable (%X)" ], [ 230556, "limine: Top of HHDM: %X" ], [ 230585, "multiboot1: ELF section table size overflow" ], [ 230629, "String: \"%s\"" ], [ 230655, "smp: [xAPIC] Found candidate AP for bring-up. LAPIC ID: %u" ], [ 230715, "gop: Requested resolution of %ux%ux%u" ], [ 230754, "fat32: cluster chain read failed (corrupted filesystem?)" ], [ 230811, "RSDT" ], [ 230816, "elf: Program header table size overflow" ], [ 230856, "WALLPAPER_STYLE" ], [ 230872, "#address-cells" ], [ 230887, "too large" ], [ 230904, "bad DQT type" ], [ 230927, "KERNEL_CMDLINE" ], [ 230942, "Boot protocol not specified for this entry" ], [ 230985, "MODULE_CMDLINE" ], [ 231000, "RANDOMISE_HHDM_BASE" ], [ 231020, "RANDOMIZE_HHDM_BASE" ], [ 231040, "MAX_PAGING_MODE" ], [ 231056, "DRIVE" ], [ 231062, "GPT_UUID" ], [ 231071, "efi: LoadImage failure (%X)" ], [ 231099, "limine: Loading executable `%#`..." ], [ 231135, "limine: Failed to register framebuffer in memory map" ], [ 231188, "multiboot1: Cannot allocate elf sections" ] ], "sz": 319488, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Import count is exactly zero", "e": [ "binary.import_count = 0.00" ], "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 319488.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1002.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 9787.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "AWAVATSH", "AWAVAUATSH", "AWAVAUATSPL", "AWAVAUATSPI", "UUUUUUUUI", "AVAUSASAR", "VVVUUUVVV", "AWAVAUATSPH", "AWAVATSI", "AWAVATSD", "AWAVAUATSP", "AWAVSASARP", "AWAVATSE", "AWAVAUATSPD", "AWAVATSL", "APAQQRVW" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1497.001", "c": 0.699999988079071, "d": "Adapter description checks for virtual", "e": [ "Virtual", "Virtual" ], "i": "objectives/anti-analysis/vm-detect::adapter-virtual-keyword", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8", "b8", "b8", "b8", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "a": "T1620", "c": 0.75, "d": "NT headers parsing reference", "e": [ "NT headers" ], "i": "objectives/evasion/process/injection::nt-headers-parse", "l": 3 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PE signature validation in code", "e": [ "3c 0f", "3c 07" ], "i": "objectives/anti-static/obfuscation/imports::pe-signature-check", "l": 1, "m": "B0032.014" }, { "d": "PATH environment variable", "e": [ "PATH" ], "i": "micro-behaviors/os/env/vars::path-var", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 0.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense short mixed-case data tokens", "e": [ "Macro", "Attempted", "Default", "Integer", "Kernel", "Failed", "Header", "Illegal", "Invalid", "Macro", "Exited", "Alignment", "Sorry", "Lower", "Lower", "Memory" ], "i": "objectives/anti-static/obfuscation/string::dense-short-mixedcase-data-tokens", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.8500000238418579, "d": "XOR byte then zero-extend", "e": [ "f9 2f", "f1 01", "f1 01", "f1 01" ], "i": "micro-behaviors/crypto/symmetric/xor::x64-xor-imm8-widen-loop", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5", "41 FF D5", "41 FF D5", "41 FF D5", "41 FF D5", "41 FF D5", "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 329.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.38" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.40" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.52" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4f", "47" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.52" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 319488.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 21.88" ], "i": "metadata/binary/metrics/markers::high-complexity-marker", "l": 1 }, { "d": "overflow keyword", "e": [ "linux: Alignment overflow", "multiboot: info alloc overflow", "multiboot1: info size overflow", "elf: p_paddr + p_memsz overflow", "linux: Total module size overflow", "multiboot2: ELF section table size overflow", "elf: Program header table size overflow", "Memory allocation overflow.", "ext_mem_alloc: count overflows when aligning", "multiboot1: ELF section table size overflow", "multiboot: info size overflow", "multiboot1: load_size + bss_size overflow", "fb: Alignment overflow", "pmm: Integer overflow in memory range calculation", "chainload: Alignment overflow", "pe: Alignment overflow" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.9900000095367432, "d": "PE subsystem is EFI (application/driver)", "e": [ "pe.subsystem = 10.00" ], "i": "metadata/binary/layout::efi-pe-subsystem", "l": 1 }, { "c": 0.8500000238418579, "d": "PE linked with binutils 2.x (MinGW/GCC)", "e": [ "pe.linker_major_version = 2.00" ], "i": "metadata/lang/compiler/native::linker-binutils-2x", "l": 3 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 0.00" ], "i": "metadata/binary/symbols::pe-imports-max-six", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.41)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.30000001192092896, "d": "zlib compression reference", "e": [ "zlib", "zlib" ], "i": "micro-behaviors/dylib/library::zlib-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 329.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 329.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".reloc (size: 4096, entropy: 0.01, perms: r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "a": "T1552.001", "c": 0.4000000059604645, "d": "Config file extension", "e": [ ".conf", ".conf", ".conf", ".conf", ".conf", ".conf", ".conf" ], "i": "objectives/collection/file-targeting/filter::conf-extension", "l": 1, "m": "B0024" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output buffer limit" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 0.00" ], "i": "metadata/binary/symbols::single-import-raw", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1002.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 0.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.6000000238418579, "d": "Hardware/Unique ID in telemetry context", "e": [ "guid" ], "i": "micro-behaviors/os/telemetry/logging::hardware-id-guid", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload::unusual-alignment-pe", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.699999988079071, "d": "No imported symbols", "e": [ "binary.import_density = 0.00" ], "i": "metadata/binary/metrics::no-imports", "l": 3 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with single import", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE timestamp anomaly detected", "e": [ "pe.timestamp_anomaly = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::timestamp-anomaly", "l": 2 }, { "c": 0.699999988079071, "d": "Extremely high max function complexity", "e": [ "binary.max_complexity = 987.00" ], "i": "metadata/binary/metrics::extreme-max-complexity", "l": 1 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1622", "c": 0.9399999976158142, "d": "Paired RDTSC instructions (timing delta check)", "e": [ "0F 31 [0-32] 0F 31", "0F 31 [0-32] 0F 31", "0F 31 [0-32] 0F 31", "0F 31 [0-32] 0F 31", "0F 31 [0-32] 0F 31", "0F 31 [0-32] 0F 31", "0F 31 [0-32] 0F 31", "0F 31 [0-32] 0F 31", "0F 31 [0-32] 0F 31" ], "i": "objectives/anti-analysis/debugger-detect/check::paired-rdtsc-timing", "l": 3, "m": "B0001" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "LimineLastBootedEntry", "LoaderConfigTimeoutOneShot" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "binary.import_count = 0.00" ], "i": "metadata/binary/symbols::few-import-count", "l": 3 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1002.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.699999988079071, "d": "PE with single import", "e": [ "binary.import_count = 0.00" ], "i": "metadata/binary/symbols::single-import-count", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 329.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports", "l": 1 } ], "sha": "333f7a69379b1f47e019be215885cdc078b9edd6e9255cbe2f706d6c5ec0ef06", "path": "/data/samples/good/archlinux/usr/share/limine/BOOTX64.EFI", "type": "pe" } ], "tv": "b2c18" } }