{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.550173, "class": 0 }, { "m": "az/pe", "prob": 0.06984127, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T12:41:03Z" }, "path": "3452d21394117be47db24c103c69427c8e7ea8c61481ccd274623ffde32f2acb.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "kernel32", "AddVectoredExceptionHandler" ], [ "kernel32", "Beep" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "GetProcAddress" ] ], "m": { "pe": { "has_cfg": 0.0, "checksum": 92811.0, "icon_count": 2.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 3.0, "computed_checksum": 88759.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 2.0, "base_relocation_entry_count": 12.0 }, "file": { "size": 58392.0, "entropy": 6.52, "size_bytes": 58392.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.5, "data_entropy": 6.58, "overlay_size": 10264.0, "string_count": 581.0, "overlay_ratio": 0.18, "overlay_entropy": 7.48, "entropy_variance": 6.17, "avg_string_length": 9.13, "max_string_length": 322.0, "code_to_data_ratio": 0.19, "string_length_stddev": 16.35, "largest_section_ratio": 0.34, "sentence_string_count": 16.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 5.0 }, "sections": { "count": 8.0, "code_size": 4608.0, "entropy_max": 6.58, "entropy_mean": 2.64, "name_entropy": 3.64, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 2.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode.$" ], [ 384, "u8", ".text" ], [ 463, "u8", "@.data" ], [ 504, "u8", ".pdata" ], [ 543, "u8", "@.00cfg" ], [ 583, "u8", "@.retplne" ], [ 624, "u8", ".rsrc" ], [ 663, "u8", "@.reloc" ], [ 2087, "stack", "VirtualAlloc" ], [ 2260, "stack", "VirtualFree" ], [ 3217, "stack", "LoadLibraryAGetProcAddressVirtualProtect" ], [ 5311, "u8", "AVVWUSH" ], [ 5950, "wide", "kernel32.dll" ], [ 6114, "u8", "AddVectoredExceptionHandler" ], [ 6144, "u8", "Beep" ], [ 6152, "u8", "CloseHandle" ], [ 6166, "u8", "GetModuleHandleW" ], [ 6186, "u8", "GetProcAddress" ], [ 6202, "u8", "KERNEL32.dll" ], [ 6733, "u8", "\u0026Vokt\"wpheucj\"dcilhv'`b\"uwi\"nl'FHQ'ohfb," ], [ 8064, "u8", "EDVK" ], [ 8587, "u8", "PCQCPJ" ], [ 9095, "u8", "RCQCPJ" ], [ 9117, "u8", "C::f" ], [ 9396, "u8", "KdSW1" ], [ 9931, "u8", "RQQUFVFWFTFUO" ], [ 10506, "u8", "OOG4" ], [ 10671, "u8", "RCSCRCQCPJ" ], [ 11177, "u8", "RTPCQCPJ" ], [ 12021, "u8", "sea9t" ], [ 12382, "u8", "TPCPJ" ], [ 14572, "u8", "v#\"PCSCRCQCPJ" ], [ 14939, "u8", "sHOaT" ], [ 17451, "u8", "PCSCRCQCPJ" ], [ 18566, "u8", "\"RCSCRCQCPJ" ], [ 18708, "u8", "r3NdBWC" ], [ 21949, "u8", "pl9Hm" ], [ 23682, "u8", "Qkgbr" ], [ 23690, "u8", "UuksgWphabqtObohp~" ], [ 23712, "u8", "TnpswfnWphvbasG" ], [ 23732, "u8", "TnpswfnFnkmdG" ], [ 23750, "u8", "PbccRumdgtqJgjmu{" ], [ 23770, "u8", "TnpswfnApbgBz" ], [ 23788, "u8", "rflcGitnphljgivTvukietU" ], [ 23814, "u8", "MwgiRumdgtq" ], [ 23828, "u8", "OhtbDnnbG" ], [ 23854, "u8", "ntvuajrP" ], [ 23866, "u8", "JbcwDugb" ], [ 23878, "u8", "JbcwCknha" ], [ 23890, "u8", "EbvQmkwjgNlamuofvnmiU" ], [ 23914, "u8", "UuksgAkkg" ], [ 23926, "u8", "AugfvbOrvbzP" ], [ 23942, "u8", "UfksDhpTkiekgH`mgdv" ], [ 23964, "u8", "AugfvbDnnbU" ], [ 23978, "u8", "NhccNn`ucu{F" ], [ 23994, "u8", "AkmtgOcifkg" ], [ 24008, "u8", "AugfvbRumdgtqP" ], [ 24026, "u8", "EbvT{tvboPkifhutFnpbasmu{P" ], [ 24056, "u8", "ntvuajrnU" ], [ 24068, "u8", "TnpswfnApbg" ], [ 24082, "u8", "TnpswfnFnkmd" ], [ 24098, "u8", "VbpjkicsgWphabqt" ], [ 24118, "u8", "Uhu16TgsVopbccAhlsg" ], [ 24142, "u8", "Uhu16@gsVopbccAhlsg" ], [ 24166, "u8", "PbqrobVopbcc" ], [ 24182, "u8", "AugfvbVopbcc" ], [ 24198, "u8", "EbvSjugffDmivbzs" ], [ 24218, "u8", "QbvSjugffDmivbzs" ], [ 24236, "u8", "IBPIGK15,cnk" ], [ 24252, "u8", "utrukivaU" ], [ 24264, "u8", "QblcObqtc`gP" ], [ 24280, "u8", "DnlcUnlcmpU" ], [ 24294, "u8", "EbvPkifhuSjugffWphabqtKc" ], [ 24350, "u8", "PbeTgsTfnrgBzP" ], [ 24382, "u8", "EbvRqbpIcjgP" ], [ 24396, "u8", "CCTFRN15,cnk" ], [ 24412, "u8", "JsvwMwgiPbsrgtvP" ], [ 24432, "u8", "KivbpigsMwgiU" ], [ 24448, "u8", "KivbpigsAkmtgOcifkg" ], [ 24470, "u8", "KivbpigsAhligdvP" ], [ 24490, "u8", "JsvwQblcPbsrgtvF" ], [ 24510, "u8", "KivbpigsPbccDnnb" ], [ 24528, "u8", "UNLNLBV)fkn" ], [ 27136, "u8", "RetpolineV1" ], [ 28266, "wide", "ICON1" ], [ 28278, "wide", "ICON2" ], [ 28290, "wide", "ICON3" ], [ 28302, "wide", "ICON4" ], [ 29975, "u8", "DNEE\u003c\u003c??\u003e22+(\u0026\u0026\u0026'3" ], [ 30062, "u8", "SQRQPNNDDD??,((,(,,+33222',6" ], [ 30110, "u8", "MNNEDDDDDI,2,,2233232,2,,2C+" ], [ 30207, "u8", "?IIIIILILL?GC?CC\u003eGGGG\u003eGCC?C," ], [ 30255, "u8", "DIILOOO" ], [ 30265, "u8", "CKGGGGGGDCCCCCGGG" ], [ 30315, "u8", "LLLLLILKK" ], [ 30327, "u8", "GLCL2" ], [ 30369, "u8", "LLLLIIIILIC" ], [ 30472, "u8", "LOLSI" ], [ 30570, "u8", "LLLC" ], [ 34051, "u8", "gQkQml" ], [ 35602, "u8", "|r8kr33.33m" ], [ 35682, "u8", "x8r3" ], [ 35850, "u8", "f_UUURTP" ], [ 35869, "u8", "gbXOOLOZ[dbp" ], [ 37112, "u8", "GXXXXXXXXXX" ], [ 37270, "u8", "KHFE@330." ], [ 38519, "u8", "774_kki" ], [ 38875, "u8", "4ida" ], [ 39228, "u8", "SHC3" ], [ 47152, "u8", "\u003c?xml version=\"1.0\" standalone=\"yes\"?\u003e" ], [ 47191, "u8", "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\"" ], [ 47242, "u8", "manifestVersion=\"1.0\"\u003e" ], [ 47275, "u8", "\u003ctrustInfo\u003e" ], [ 47289, "u8", "\u003csecurity\u003e" ], [ 47304, "u8", "\u003crequestedPrivileges\u003e" ], [ 47332, "u8", "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false'/\u003e" ], [ 47403, "u8", "\u003c/requestedPrivileges\u003e" ], [ 47432, "u8", "\u003c/security\u003e" ], [ 47448, "u8", "\u003c/trustInfo\u003e" ], [ 47463, "u8", "\u003c/assembly\u003e" ], [ 48782, "u8", "ugQm" ], [ 49027, "u8", "Washington1" ], [ 49048, "u8", "Redmond1" ], [ 49066, "u8", "Microsoft Corporation1.0," ], [ 49097, "u8", "%Microsoft Windows Production PCA 20110" ], [ 49139, "u8", "220127193119Z" ], [ 49154, "u8", "230126193119Z0z1" ], [ 49232, "u8", "Microsoft Corporation1$0\"" ], [ 49264, "u8", "Microsoft Windows Publisher0" ], [ 49694, "u8", "$Microsoft Ireland Operations Limited1" ], [ 49742, "u8", "230280+4690830" ], [ 49796, "u8", "M0K0I" ], [ 49806, "u8", "Chttp://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" ], [ 49887, "u8", "U0S0Q" ], [ 49903, "u8", "Ehttp://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" ], [ 50369, "u8", "Microsoft Corporation1200" ], [ 50400, "u8", ")Microsoft Root Certificate Authority 20100" ], [ 50446, "u8", "111019184142Z" ], [ 50461, "u8", "261019185142Z0" ], [ 51058, "u8", "O0M0K" ], [ 51068, "u8", "Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" ], [ 51151, "u8", "N0L0J" ], [ 51167, "u8", "\u003ehttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" ], [ 51873, "u8", "%Microsoft Windows Production PCA 2011" ], [ 52140, "wide", "\"Microsoft Window" ], [ 52178, "u8", "http://www.microsoft.com/windows0" ], [ 52242, "u8", "kOpq" ], [ 52650, "u8", "bkY5Y" ], [ 52755, "u8", "Microsoft Corporation1)0'" ], [ 52786, "u8", "Microsoft Operations Puerto Rico1\u00260$" ], [ 52830, "u8", "Thales TSS ESN:32BD-E3D5-3B1D1%0#" ], [ 52870, "u8", "Microsoft Time-Stamp Service" ], [ 53016, "u8", "Microsoft Corporation1\u00260$" ], [ 53048, "u8", "Microsoft Time-Stamp PCA 20100" ], [ 53081, "u8", "220302185136Z" ], [ 53096, "u8", "230511185136Z0" ], [ 53290, "u8", "Microsoft Time-Stamp Service0" ], [ 53948, "u8", "X0V0T" ], [ 53958, "url", "Nhttp://www.microsoft.com/pkiops/crl/Microsoft Time-Stamp PCA 2010(1).crl0l" ], [ 54066, "url", "Phttp://www.microsoft.com/pkiops/certs/Microsoft Time-Stamp PCA 2010(1).crt0" ], [ 54906, "u8", "210930182225Z" ], [ 55748, "u8", "3http://www.microsoft.com/pkiops/Docs/Repository.htm0" ], [ 57049, "u8", "20220514191647Z" ], [ 57066, "u8", "20220515191647Z0w0=" ], [ 57460, "u8", "Microsoft Time-Stamp PCA 2010" ], [ 57854, "u8", "(w}d" ] ], "v": { "file.stem": "3452d21394117be47db24c103c69427c8e7ea8c61481ccd274623ffde32f2acb", "pe.imphash": "1355e152cc34dd24c6aaccc6d1fa3a77", "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "pe.timestamp": 1658784651, "file.basename": "3452d21394117be47db24c103c69427c8e7ea8c61481ccd274623ffde32f2acb.exe", "pe.image_base": 5368709120, "pe.image_size": 73728, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 8383, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 10264, "pe.image_hash.sha1": "a334f0e03442c08037d0d31aecf240d4a0d0cafa", "pe.load_config.size": 312, "pe.image_hash.sha256": "44dcdc63e360f8c85b2a85a38ebf24ae299f40918512f8cb8b2d7c54f660d26b", "pe.image_hash.sha384": "795e94a84322cbc1cc231e065857626d825de8db94dd6f44303ac927a51a2e69a2e6ae992b569b995ebdc66a0979bcaa", "pe.image_hash.sha512": "8d1ae28255af9f017461289e08b820d27cacb3593e9e0ff13d9eb5c9bf309a326776c73fc0c26151d3f9a397c51bbd5db49e8b35080fa56f853ef1dead49481c", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 34, "pe.linker_major_version": 14, "pe.signatures[0].issuer": "CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].serial": "330000036ce57eeb5d1cc2be1700000000036c", "pe.signatures[0].subject": "CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 12632, "pe.data_directories[1].rva": 49152, "pe.data_directories[2].rva": 36864, "pe.data_directories[3].rva": 48128, "pe.data_directories[4].rva": 69632, "pe.data_directories[5].rva": 12288, "pe.data_directories[6].rva": 12720, "pe.dll_characteristics_raw": 33120, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2023-01-26T19:31:19Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 19827, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 36, "pe.data_directories[3].name": "certificate", "pe.data_directories[3].size": 10264, "pe.data_directories[4].name": "base_relocation", "pe.data_directories[4].size": 44, "pe.data_directories[5].name": "load_config", "pe.data_directories[5].size": 312, "pe.data_directories[6].name": "iat", "pe.data_directories[6].size": 48, "pe.signatures[0].not_before": "2022-01-27T19:31:19Z", "pe.coff.dos_header_pe_pointer": 120, "pe.load_config.security_cookie": 5368744488, "pe.base_relocations.block_count": 2, "pe.base_relocations.entry_count": 12, "pe.signatures[0].thumbprint_sha1": "c60a14a6bd925780e9f0463ba19c3f37d5473e8b", "pe.base_relocations.padding_count": 2, "pe.signatures[0].cert_chain_depth": 2, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "c5b30718753807fa40ef115c94d3725091502e6257dcec13265d6566f4715654", "pe.signatures[0].thumbprint_sha256": "6f1ee3b86130d15010459132338ef2f3617283ffa802c4fa6061273604cc0cda", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.manifest.requested_execution_level": "asInvoker", "pe.signatures[0].signature_digest_algorithm": "sha256", "pe.load_config.guard_cf_check_function_pointer": 5368750080, "pe.load_config.guard_cf_dispatch_function_pointer": 5368750088 }, "id": "pe", "sc": [ [ ".text", 1024, 4608, 5.5, "r-x" ], [ ".rdata", 5632, 1024, 1.61, "r--" ], [ ".data", 6656, 19456, 6.58, "rw-" ], [ ".pdata", 26112, 512, 0.33, "r--" ], [ ".00cfg", 26624, 512, 0.33, "r--" ], [ ".retplne", 27136, 512, 1.05, "" ], [ ".rsrc", 27648, 19968, 5.22, "r--" ], [ ".reloc", 47616, 512, 0.46, "r--" ] ] }, "id": 0, "sz": 58392, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Microsoft Windows Publisher", "e": [ "Microsoft Windows Publisher" ], "i": "metadata/signed/unknown::microsoft-windows-publisher", "l": 2 }, { "c": 1.0, "d": "Signed by Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/leaf::microsoft-corporation", "l": 3 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014", "el": [ "0x400" ] }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0xc4e0" ] }, { "c": 0.8199999928474426, "d": "Encoded Microsoft OCSP URL", "e": [ "Nhttp://www.microsoft.com/pkiops/crl/Microsoft Time-Stamp PCA 2010(1).crl0l", "Phttp://www.microsoft.com/pkiops/certs/Microsoft Time-Stamp PCA 2010(1).crt0" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-ms-ocsp-url", "l": 1, "el": [ "0xd2c6", "0xd332" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x173e" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "40" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014", "el": [ "0x68d" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 581.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "Microsoft timestamp certificate chain", "e": [ "Microsoft Time-Stamp PCA 2010", "Microsoft Time-Stamp Service" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "l": 2, "el": [ "0xcf38", "0xce86" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 5.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 5.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\"}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2, "el": [ "value:pe.manifest.requested_execution_level" ] }, { "a": "T1622", "c": 0.8999999761581421, "d": "PEB getter helper (mov rax gs:0x60; ret)", "e": [ "65 48 8b 04 25 60 00 00 00 c3" ], "i": "objectives/anti-analysis/debugger-detect/check::peb-helper-getter", "l": 1, "m": "B0001", "el": [ "0x400" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 1.61)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x1808" ] }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false'/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "0xb8e4" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "0x31c8" ] }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x182a" ] }, { "c": 0.800000011920929, "d": "Random lowercase PE section name", "e": [ ".retplne (size: 512)" ], "i": "metadata/binary/section/metrics::random-lowercase-section-name", "l": 1 }, { "c": 0.949999988079071, "d": "Microsoft code-signing certificate chain", "e": [ "Microsoft Windows Production PCA 2011" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "l": 2, "el": [ "0xbfc9" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "3452d21394117be47db24c103c69427c8e7ea8c61481ccd274623ffde32f2acb.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "3452d21394117be47db24c103c69427c8e7ea8c61481ccd274623ffde32f2acb.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1, "el": [ "0xf4f" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".data", ".rdata", ".pdata", ".rdata+.data+.pdata = 455.6% of text (20992 / 4608 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "LoadLibraryAGetProcAddressVirtualProtect", "EbvQmkwjgNlamuofvnmiU", "EbvPkifhuSjugffWphabqtKc", "AddVectoredExceptionHandler" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xc91", "0x5d52", "0x5ee6", "0x17e2" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "3452d21394117be47db24c103c69427c8e7ea8c61481ccd274623ffde32f2acb.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1, "el": [ "0x827" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Data section significantly larger than code", "e": [ ".data", ".pdata", ".rdata+.data+.pdata = 455.6% of text (20992 / 4608 bytes)", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::data-section-dominant", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 5.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x173e" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x31d0" ] }, { "c": 0.8999999761581421, "d": "Register vectored exception handler", "e": [ "AddVectoredExceptionHandler" ], "i": "micro-behaviors/os/exception/error-handling::add-vectored-exception-handler", "l": 2, "m": "B0001", "el": [ "0x31b0" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 5.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".pdata", ".data", ".rdata+.data+.pdata = 455.6% of text (20992 / 4608 bytes)", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".pdata", ".rdata", ".data", ".rdata+.data+.pdata = 455.6% of text (20992 / 4608 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links kernel32 (AddVectoredExceptionHandler, Beep, CloseHandle, GetModuleHandleW, GetProcAddress)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "5 symbols" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x31d0", "0x31c8" ] }, { "c": 1.0, "d": "Microsoft certificate chain markers", "e": [ "Microsoft Time-Stamp Service", "Microsoft Time-Stamp PCA 2010", "Microsoft Corporation", "Microsoft Windows Production PCA 2011" ], "i": "metadata/signed/platform::microsoft-certificate-chain", "l": 1, "el": [ "0xce86", "0xcf38", "", "0xbfc9" ] } ], "sha": "3452d21394117be47db24c103c69427c8e7ea8c61481ccd274623ffde32f2acb", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-08/3452d21394117be47db24c103c69427c8e7ea8c61481ccd274623ffde32f2acb.exe", "type": "pe" } ], "tv": "52045" } }