{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.00023250407, "class": 0 }, { "m": "az/pe", "prob": 0.014245354, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-18T01:50:49Z" }, "path": "VirusShare_3bca5ab05a6b0c49494fe318d44a6e8e", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "aaf2d12a8026b55815150f45501909d7", "pe.timestamp": 1163448461, "hash.authenti": "00af02e8689d0bdb80b5ed33ee686e77ae6e45c808b92b19dc0a264641c75a6c", "hash.rich_header": "1865f06071337af81ec5d2c3a4e5279cab97f4e3c93229ebf9314d64aa7815aa", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.resource_types[0]": "RT_VERSION", "pe.rich_header.xor_key": "0xe53f7667", "pe.data_directories[0].rva": 12420, "pe.data_directories[1].rva": 20480, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 784, "pe.version_info.company_name": "Microsoft Corporation", "pe.version_info.file_version": "4.00", "pe.version_info.product_name": "Microsoft", "pe.version_info.internal_name": "r'\u0001LegalCopyright", "pe.rich_header_compids[0].count": 11, "pe.rich_header_compids[1].count": 1, "pe.rich_header_compids[2].count": 2, "pe.rich_header_compids[3].count": 5, "pe.rich_header_compids[4].count": 26, "pe.rich_header_compids[5].count": 1, "pe.rich_header_compids[6].count": 1, "pe.version_info.legal_copyright": "Copyright © Microsoft Corp. ", "pe.version_info.product_version": "4.00", "pe.rich_header_compids[0].compid": 663528, "pe.rich_header_compids[1].compid": 924803, "pe.rich_header_compids[2].compid": 270312, "pe.rich_header_compids[3].compid": 6098883, "pe.rich_header_compids[4].compid": 65536, "pe.rich_header_compids[5].compid": 729064, "pe.rich_header_compids[6].compid": 394936, "pe.version_info.file_description": "Microsoft", "pe.rich_header_compids[4].product": "Unknown", "pe.version_info.original_filename": "4\n\u0001ProductName", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.rich_header.entries[0].use_count": 11, "pe.rich_header.entries[1].use_count": 1, "pe.rich_header.entries[2].use_count": 2, "pe.rich_header.entries[3].use_count": 5, "pe.rich_header.entries[4].use_count": 26, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 10, "pe.rich_header.entries[1].product_id": 14, "pe.rich_header.entries[2].product_id": 4, "pe.rich_header.entries[3].product_id": 93, "pe.rich_header.entries[4].product_id": 1, "pe.rich_header.entries[5].product_id": 11, "pe.rich_header.entries[6].product_id": 6, "pe.rich_header.entries[0].build_number": 8168, "pe.rich_header.entries[0].product_name": "Linker_v6", "pe.rich_header.entries[1].build_number": 7299, "pe.rich_header.entries[1].product_name": "Export_VC2003", "pe.rich_header.entries[2].build_number": 8168, "pe.rich_header.entries[2].product_name": "Linker_VS_v6_or_earlier", "pe.rich_header.entries[3].build_number": 4035, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[5].build_number": 8168, "pe.rich_header.entries[5].product_name": "Cvt_Omf", "pe.rich_header.entries[6].build_number": 1720, "pe.rich_header.entries[6].product_name": "Cvt_Pgo_VS_v6_or_earlier", "pe.section_characteristics[0].raw_size": 8192, "pe.section_characteristics[1].raw_size": 4096, "pe.section_characteristics[2].raw_size": 4096, "pe.section_characteristics[3].raw_size": 4096, "pe.section_characteristics[0].virtual_size": 5548, "pe.section_characteristics[1].virtual_size": 700, "pe.section_characteristics[2].virtual_size": 384, "pe.section_characteristics[3].virtual_size": 784, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 12288, "pe.section_characteristics[2].virtual_address": 16384, "pe.section_characteristics[3].virtual_address": 20480, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040" }, "x": 4, "id": 0, "is": [ "GetModuleFileNameA", "GetSystemWindowsDirectoryA", "GetModuleHandleA", "GetStartupInfoA", "fclose", "fwrite", "fread", "fopen", "srand", "time", "exit", "XcptFilter", "exit", "getmainargs", "initterm", "setusermatherr", "adjust_fdiv", "p__commode", "p__fmode", "set_app_type", "except_handler3", "controlfp", "acmdln", "SHSetValueA" ], "ms": { "pe": { "entry": 9236.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 4096.0, "subsystem": 2.0, "timestamp": 1163448461.0, "image_base": 4194304.0, "rsrc_entropy": 0.8, "entry_section": ".text", "size_of_image": 24576.0, "file_alignment": 4096.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 271.0, "has_rich_header": true, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 3.0, "computed_checksum": 32932.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 24576.0 }, "binary": { "code_size": 8192.0, "func_count": 2.0, "code_entropy": 4.25, "data_entropy": 0.84, "func_density": 0.25, "import_count": 24.0, "string_count": 53.0, "avg_func_size": 2719.0, "section_count": 4.0, "avg_complexity": 12.0, "import_density": 3.0, "max_complexity": 14.0, "string_density": 6.63, "overall_entropy": 1.68, "avg_basic_blocks": 16.5, "avg_section_size": 5120.0, "dependency_count": 3.0, "entropy_variance": 1.48, "avg_string_length": 15.81, "complexity_per_kb": 1.5, "max_string_length": 112.0, "wide_string_count": 16.0, "avg_string_entropy": 3.15, "code_to_data_ratio": 0.67, "data_to_file_ratio": 0.17, "rsrc_to_file_ratio": 0.17, "text_to_file_ratio": 0.33, "total_basic_blocks": 33.0, "func_analysis_depth": 2.0, "string_length_stddev": 16.57, "largest_section_ratio": 0.33, "sentence_string_count": 2.0, "sentence_string_ratio": 0.04, "writable_section_count": 1.0, "behavioral_import_ratio": 0.13, "executable_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 472, ".text" ], [ 551, "@.data" ], [ 592, ".rsrc" ], [ 9527, "XPVSS" ], [ 12608, "KERNEL32.DLL" ], [ 12621, "MSVCRT.dll" ], [ 12632, "SHLWAPI.dll" ], [ 12646, "GetModuleFileNameA" ], [ 12666, "GetSystemWindowsDirectoryA" ], [ 12694, "GetModuleHandleA" ], [ 12712, "GetStartupInfoA" ], [ 12730, "fclose" ], [ 12738, "fwrite" ], [ 12746, "fread" ], [ 12754, "fopen" ], [ 12770, "time" ], [ 12784, "_XcptFilter" ], [ 12798, "exit" ], [ 12804, "__getmainargs" ], [ 12820, "_initterm" ], [ 12832, "__setusermatherr" ], [ 12850, "_adjust_fdiv" ], [ 12864, "__p__commode" ], [ 12878, "__p__fmode" ], [ 12890, "__set_app_type" ], [ 12906, "_except_handler3" ], [ 12924, "_controlfp" ], [ 12936, "_acmdln" ], [ 12946, "SHSetValueA" ], [ 16400, "INBIGrwrXCMr" ], [ 16416, "sPdMjFvvmeeLfWKBahriamYAKqtHbUPKcfwFUFRYN" ], [ 16460, "mVOItHVYArcdbWvTlmVPlGpWb" ], [ 16508, "TKDKqcoHgbSqnkyLlDfCsCIOPyNKDqYYxiMVxYKGjYNuLSDdcMHRNeDWhpHFFpngpeKgMdEQXmQlTFiexBRrOijcRFQXGpekISLRJIxmqKsqpTuu" ], [ 16624, "aGbQQVGaNHmoCLBhJm" ], [ 16644, "BWFyMYeOfsTKIiRUMCHjJtDMFJrxSnapxHUGWELngCEYBlGmILPfRQekQDr" ], [ 16716, "UeQwiWyCPwRioN" ], [ 20582, "wide", "VS_VERSION_INFO" ], [ 20674, "wide", "StringFileInfo" ], [ 20734, "wide", "CompanyName" ], [ 20760, "wide", "Microsoft Corporation" ], [ 20810, "wide", "FileDescription" ], [ 20844, "wide", "Microsoft" ], [ 20870, "wide", "FileVersion" ], [ 20896, "wide", "4.00" ], [ 20914, "wide", "InternalName" ], [ 20946, "wide", "LegalCopyright" ], [ 20976, "wide", "Copyright © Microsoft Corp." ], [ 21062, "wide", "OriginalFilename" ], [ 21102, "wide", "ProductName" ], [ 21154, "wide", "ProductVersion" ], [ 21202, "wide", "VarFileInfo" ], [ 21234, "wide", "Translation" ] ], "sz": 24576, "ts": [ { "c": 0.6200000047683716, "d": "fread API string", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread-text", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Microsoft" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Microsoft short company name", "e": [ "Microsoft" ], "i": "objectives/evasion/masquerade/version-resource/claim::microsoft-company-name-short", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 1.68" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "4.00" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 12.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 24576.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current calendar time (seconds)", "e": [ "time" ], "i": "micro-behaviors/time/query::time", "l": 2, "m": "T1124" }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Microsoft" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Close stdio file", "e": [ "fclose" ], "i": "micro-behaviors/os/stdio::fclose", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 0.89)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.15" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 3.00" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © Microsoft Corp. " ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.699999988079071, "d": "Read stream (fread)", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8799999952316284, "d": "Get system Windows directory path", "e": [ "GetSystemWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-windows-directory", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_3bca5ab05a6b0c49494fe318d44a6e8e" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1163448461.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.6200000047683716, "d": "fopen API string", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 1.68" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "SHSetValueA" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4096.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 24.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 24.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation", "Microsoft Corp." ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemWindowsDirectoryA", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 24.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 24.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (SHSetValueA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCRT.dll (fclose, fwrite, fread, fopen, srand, ... +14 more)", "e": [ "MSVCRT.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (GetModuleFileNameA, GetSystemWindowsDirectoryA, GetModuleHandleA, GetStartupInfoA)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 } ], "sha": "3493a7b36b7007b838e451e59999cf7930868fb5d05405f788c84fff2d6080d4", "path": "VirusShare_3bca5ab05a6b0c49494fe318d44a6e8e", "type": "pe" } ], "tv": "60127" } }