{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.030150754, "class": 0 }, { "m": "az/pe", "prob": 0.0028985508, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-19T00:04:48Z" }, "path": "33a995a9fb0790de7a522da691ab296e6d0e845b8228cb1fde3acddfff4e0584.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "29dfe51c05c452826b0c5c7ef5e5f5fd", "pe.timestamp": 1528736851, "hash.authenti": "f6a584aaf39f8b5b9a60af7a7606198292f92f5072e1f553692f51686beec5c1", "build.target_arch": "x86", "pe.linker_version": "8.0", "pe.resource_types[0]": "RT_VERSION", "pe.data_directories[0].rva": 103696, "pe.data_directories[1].rva": 106496, "pe.data_directories[2].rva": 114688, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 840, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.version_info.company_name": "chieftain", "pe.version_info.file_version": "1.28.14.52", "pe.version_info.product_name": "frozen", "pe.dll_characteristics.no_seh": true, "pe.version_info.internal_name": "1.exe", "pe.version_info.legal_copyright": "aluminium © gluttonous", "pe.version_info.product_version": "1.28.14.52", "pe.dll_characteristics.nx_compat": true, "pe.version_info.file_description": "approximation", "pe.version_info.original_filename": "1.exe", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rsrc", "pe.section_characteristics[2].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[0].raw_size": 95744, "pe.section_characteristics[1].raw_size": 1024, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[0].virtual_size": 95588, "pe.section_characteristics[1].virtual_size": 840, "pe.section_characteristics[2].virtual_size": 12, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 8192, "pe.section_characteristics[1].virtual_address": 106496, "pe.section_characteristics[2].virtual_address": 114688, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "42000040" }, "x": 5, "id": 0, "is": [ "CorExeMain" ], "ms": { "pe": { "entry": 103774.0, "machine": 332.0, "checksum": 0.0, "is_dotnet": true, "rsrc_size": 1024.0, "subsystem": 2.0, "timestamp": 1528736851.0, "image_base": 4194304.0, "clr_version": "2.5", "rsrc_entropy": 2.75, "entry_section": ".text", "size_of_image": 122880.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 258.0, "overlay_padding": 6208.0, "size_of_headers": 512.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 1.0, "computed_checksum": 130696.0, "section_alignment": 8192.0, "resource_timestamp": 0.0, "dll_characteristics": 34112.0, "has_export_timestamp": false, "linker_major_version": 8.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 104000.0 }, "binary": { "code_size": 95744.0, "has_overlay": true, "code_entropy": 5.67, "import_count": 1.0, "overlay_size": 6208.0, "string_count": 656.0, "overlay_ratio": 0.06, "section_count": 3.0, "import_density": 0.01, "string_density": 7.02, "overall_entropy": 2.84, "overlay_entropy": 7.96, "avg_section_size": 32426.67, "dependency_count": 1.0, "entropy_variance": 2.27, "avg_string_length": 15.45, "max_string_length": 200.0, "wide_string_count": 18.0, "avg_string_entropy": 3.03, "code_to_data_ratio": 62.33, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.92, "string_length_stddev": 13.6, "largest_section_ratio": 0.92, "sentence_string_count": 6.0, "sentence_string_ratio": 0.01 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 455, "@.reloc" ], [ 29512, "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 29669, "hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD" ], [ 29838, "QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" ], [ 29926, "System.Drawing.Bitmap" ], [ 29952, "Data" ], [ 29988, "IHDR" ], [ 33564, "cu8s" ], [ 38647, "AZJQ5" ], [ 38814, "WIRV6KI" ], [ 39624, "Pjwk" ], [ 41263, "WYA79" ], [ 41874, "AVVR" ], [ 43101, "H_G5" ], [ 43672, "wc9i" ], [ 50696, "FITR" ], [ 51085, "IEND" ], [ 51096, "BSJB" ], [ 53267, "mscorlib" ], [ 53276, "UnverifiableCodeAttribute" ], [ 53302, "System.Security" ], [ 53318, ".ctor" ], [ 53324, "\u003cModule\u003e" ], [ 53333, "MusicExpressMain" ], [ 53350, "MusicExpress" ], [ 53363, "System.Windows.Forms" ], [ 53384, "Form" ], [ 53398, "TextBox" ], [ 53406, "richTextBox1" ], [ 53419, "RichTextBox" ], [ 53449, "button1" ], [ 53457, "Button" ], [ 53464, "button2" ], [ 53472, "button3" ], [ 53480, "button4" ], [ 53488, "button5" ], [ 53496, "button6" ], [ 53504, "button7" ], [ 53512, "button8" ], [ 53520, "button9" ], [ 53528, "button10" ], [ 53537, "button11" ], [ 53546, "button12" ], [ 53555, "button13" ], [ 53564, "button14" ], [ 53573, "button15" ], [ 53582, "button16" ], [ 53591, "button17" ], [ 53600, "button18" ], [ 53609, "button19" ], [ 53618, "button20" ], [ 53627, "button21" ], [ 53636, "button22" ], [ 53645, "button23" ], [ 53654, "button24" ], [ 53663, "button25" ], [ 53672, "button26" ], [ 53681, "button27" ], [ 53690, "button28" ], [ 53699, "button29" ], [ 53708, "button30" ], [ 53717, "button31" ], [ 53726, "button32" ], [ 53735, "button33" ], [ 53744, "button34" ], [ 53753, "button35" ], [ 53762, "button36" ], [ 53771, "button37" ], [ 53780, "button38" ], [ 53798, "button39" ], [ 53807, "button40" ], [ 53816, "button41" ], [ 53825, "button42" ], [ 53834, "button43" ], [ 53843, "button44" ], [ 53852, "button45" ], [ 53861, "button46" ], [ 53870, "button47" ], [ 53879, "button48" ], [ 53888, "button49" ], [ 53897, "button50" ], [ 53906, "button51" ], [ 53915, "button52" ], [ 53924, "button53" ], [ 53933, "button54" ], [ 53942, "button55" ], [ 53951, "button56" ], [ 53960, "button57" ], [ 53969, "button58" ], [ 53978, "button59" ], [ 53987, "button60" ], [ 53996, "button61" ], [ 54005, "button62" ], [ 54014, "button63" ], [ 54023, "button64" ], [ 54059, "button65" ], [ 54068, "button66" ], [ 54077, "button67" ], [ 54086, "button68" ], [ 54095, "button69" ], [ 54104, "button70" ], [ 54113, "button71" ], [ 54122, "button72" ], [ 54131, "button73" ], [ 54140, "button74" ], [ 54149, "button75" ], [ 54158, "button76" ], [ 54177, "CheckBox" ], [ 54425, "label1" ], [ 54432, "Label" ], [ 54438, "label2" ], [ 54445, "label3" ], [ 54452, "label4" ], [ 54459, "label5" ], [ 54466, "label6" ], [ 54473, "label7" ], [ 54480, "label8" ], [ 54487, "label9" ], [ 54494, "label10" ], [ 54502, "label11" ], [ 54510, "label12" ], [ 54518, "label13" ], [ 54526, "label14" ], [ 54534, "label15" ], [ 54542, "button77" ], [ 54551, "button78" ], [ 54560, "button79" ], [ 54569, "button80" ], [ 54578, "button81" ], [ 54587, "button82" ], [ 54596, "button83" ], [ 54605, "button84" ], [ 54614, "button85" ], [ 54623, "button86" ], [ 54632, "button87" ], [ 54641, "button88" ], [ 54650, "button89" ], [ 54659, "button90" ], [ 54668, "button91" ], [ 54677, "button92" ], [ 54686, "button93" ], [ 54695, "button94" ], [ 54704, "button95" ], [ 54713, "button96" ], [ 54722, "button97" ], [ 54731, "button98" ], [ 54740, "button99" ], [ 54749, "button100" ], [ 54769, "components" ], [ 54780, "System" ], [ 54787, "IContainer" ], [ 54798, "System.ComponentModel" ], [ 54820, "InitializeComponent" ], [ 54840, "init" ], [ 54845, "Browse" ], [ 54852, "data" ], [ 54857, "domain" ], [ 54864, "GetMusic" ], [ 54873, "Play" ], [ 54878, "path" ], [ 54883, "MusicExpressMain_Load" ], [ 54905, "EventArgs" ], [ 54915, "sender" ], [ 54924, "MusicReader" ], [ 54936, "Object" ], [ 54943, "get_Path" ], [ 54952, "_getPath" ], [ 54961, "Path" ], [ 54966, "Program" ], [ 54974, "Main" ], [ 54981, "AssemblyCopyrightAttribute" ], [ 55008, "System.Reflection" ], [ 55026, "AssemblyFileVersionAttribute" ], [ 55055, "GuidAttribute" ], [ 55069, "System.Runtime.InteropServices" ], [ 55100, "ComVisibleAttribute" ], [ 55120, "AssemblyTrademarkAttribute" ], [ 55147, "AssemblyConfigurationAttribute" ], [ 55178, "AssemblyProductAttribute" ], [ 55203, "AssemblyCompanyAttribute" ], [ 55228, "AssemblyTitleAttribute" ], [ 55251, "RuntimeCompatibilityAttribute" ], [ 55281, "System.Runtime.CompilerServices" ], [ 55313, "AssemblyDescriptionAttribute" ], [ 55342, "CompilationRelaxationsAttribute" ], [ 55374, "STAThreadAttribute" ], [ 55393, "26fc2.resources" ], [ 55409, "Control" ], [ 55417, "SuspendLayout" ], [ 55431, "System.Drawing" ], [ 55446, "Point" ], [ 55452, "set_Location" ], [ 55465, "set_Name" ], [ 55474, "Size" ], [ 55479, "set_Size" ], [ 55488, "set_TabIndex" ], [ 55501, "set_Text" ], [ 55510, "TextBoxBase" ], [ 55522, "set_Multiline" ], [ 55536, "ButtonBase" ], [ 55547, "set_UseVisualStyleBackColor" ], [ 55575, "set_AutoSize" ], [ 55588, "set_RightToLeft" ], [ 55604, "RightToLeft" ], [ 55616, "set_TextAlign" ], [ 55630, "HorizontalAlignment" ], [ 55650, "SystemColors" ], [ 55663, "get_ActiveCaptionText" ], [ 55685, "Color" ], [ 55691, "set_BackColor" ], [ 55705, "set_ClientSize" ], [ 55720, "get_Controls" ], [ 55733, "ControlCollection" ], [ 55755, "EventHandler" ], [ 55777, "ResumeLayout" ], [ 55790, "PerformLayout" ], [ 55804, "AppDomain" ], [ 55814, "Assembly" ], [ 55823, "get_CurrentDomain" ], [ 55841, "CreateInstance" ], [ 55856, "Type" ], [ 55861, "GetTypeFromHandle" ], [ 55879, "RuntimeTypeHandle" ], [ 55897, "InvokeMember" ], [ 55910, "BindingFlags" ], [ 55923, "Binder" ], [ 55930, "String" ], [ 55937, "get_Length" ], [ 55948, "Byte" ], [ 55953, "Substring" ], [ 55963, "Convert" ], [ 55978, "Join" ], [ 55990, "System.Collections.Generic" ], [ 56017, "ToArray" ], [ 56025, "Application" ], [ 56064, "SWq423ZHx3zTj5m05QS2dL8d9s5qsNJcZt4bJ" ], [ 56140, "richTextBox1" ], [ 56167, "H7rrlW34uZ4g7TG29m695QHDWNDM6maH760RUMe2fvs6fBSV9ArU3xwZc58t79bYW92J4Kch8bJvQTXR7ZSLOpr16aCx9Y9b8sq08YK78X7af00cL6y1OAAaRhD2nS88" ], [ 56605, "button1" ], [ 56621, "button2" ], [ 56637, "button3" ], [ 56653, "button4" ], [ 56669, "button5" ], [ 56685, "button6" ], [ 56701, "button7" ], [ 56717, "button8" ], [ 56733, "button9" ], [ 56749, "button10" ], [ 56767, "button11" ], [ 56785, "button12" ], [ 56803, "button13" ], [ 56821, "button14" ], [ 56839, "button15" ], [ 56857, "button16" ] ], "sz": 104000, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0xc798" ], "i": "metadata/dotnet/bsjb-signature", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1528736851.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "approximation" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 122880.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.28.14.52" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "33a995a9fb0790de7a522da691ab296e6d0e845b8228cb1fde3acddfff4e0584.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "frozen" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "PNG image magic in text section", "e": [ "89 50 4E 47 0D 0A 1A 0A" ], "i": "metadata/binary/resource::png-magic-in-text", "l": 1 }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.28.14.52" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.28.14.52" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 7.96" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.03" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R", "mscorlib", "System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 656.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "a": "T1140", "c": 0.8399999737739563, "d": "CreateInstance activation token", "e": [ "CreateInstance" ], "i": "objectives/command-and-control/dropper/staging/embedded::createinstance-token", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "String", "Substring", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2 }, { "c": 0.6000000238418579, "d": "AppDomain.CurrentDomain accessor", "e": [ "get_CurrentDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "l": 1 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2 }, { "c": 0.8199999928474426, "d": "Type.InvokeMember reflection token", "e": [ "InvokeMember" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "33a995a9fb0790de7a522da691ab296e6d0e845b8228cb1fde3acddfff4e0584.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "binary.section_count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.67" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "aluminium © gluttonous" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": ".NET binary (PE with BSJB metadata)", "e": [ "pe.is_dotnet = 1.00" ], "i": "metadata/binary/metrics/threshold::dotnet-binary", "l": 1 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.Security" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.84" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.03" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.84" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1027.003", "c": 0.8199999928474426, "d": ".NET Bitmap type reference", "e": [ "System.Drawing.Bitmap" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-bitmap-type-token", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=2.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2 }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "33a995a9fb0790de7a522da691ab296e6d0e845b8228cb1fde3acddfff4e0584.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.7200000286102295, "d": "WinForms Button control token", "e": [ "Button" ], "i": "micro-behaviors/ui/controls/widget::winforms-button", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.7200000286102295, "d": "WinForms Label control token", "e": [ "Label" ], "i": "micro-behaviors/ui/controls/widget::winforms-label", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "get_Path", "Path", "_getPath" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree.dll (CorExeMain)", "e": [ "mscoree.dll" ], "i": "metadata/dylib::mscoree/dll", "l": 2 }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.28.14.52" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1 }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.28.14.52" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1 }, { "c": 1.0, "d": ".NET Assembly (mscoree.dll)", "e": [ "pe.is_dotnet = 1.00", "BSJB" ], "i": "metadata/binary/framework::dotnet-assembly", "l": 2 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00", "binary.has_signature = 0.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "33a995a9fb0790de7a522da691ab296e6d0e845b8228cb1fde3acddfff4e0584", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-10/33a995a9fb0790de7a522da691ab296e6d0e845b8228cb1fde3acddfff4e0584.exe", "type": "pe" } ], "tv": "012f9" } }