{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9994513392448425, "class": 2 } ], "prob": 0.99945134, "class": 2, "oprob": 0.77482736, "oclass": 0, "version": "v16.16", "thresholds": [ 0.993587, 0.99945134 ], "analyzed_at": "2026-04-27T02:01:38Z" }, "path": "Virus.Hijack_Gen.Trojan.ShellObject.z8W@aaJDqQc_6_1.vir", "raw": { "v": "4", "fs": [ { "f": "KO₂(C₄As₆)H₃(FPoDb)Md₂(Bi₆Pt)", "x": 245, "id": 0, "is": [ "CIcos", "adj_fptan", "vbaVarMove", "vbaFreeVar", "rtcRgb", "vbaFreeVarList", "vbaEnd", "adj_fdiv_m64", "vbaFreeObjList", "adj_fprem1", "vbaStrCat", "vbaSetSystemError", "vbaHr", "adj_fdiv_m32", "vbaAryDestruct", "rtcRandomNext", "rtcRandomize", "vbaOnError", "vbaObjSet", "adj_fdiv_m16i", "adj_fdivr_m16i", "CIsin", "vbaChkstk", "vbaFileClose", "EVENT_SINK_AddRef", "vbaPutOwner3", "DllFunctionCa", "adj_fpatan", "vbaRedim", "vbaStrR8", "EVENT_SINK_Release", "rtcShell", "CIsqrt", "EVENT_SINK_QueryInterface", "v;aExceptHandler", "adj_fprem", "a^j_fdivr_m64", "vbaFPException", "vbaGetOwner3", "vbaUbound", "vbaStrVarVal", "vbaVarCat", "CIlog", "vbaFileOpen", "vbaNew2", "Ordinal_57914", "vbaR8Str", "adj_fdiv_m32i", "adj_fdivr_m32i", "vbaFreeStrList", "adj_fdivr_m32", "adj_fdiv_r", "ThunRTMain", "vbaI4Var", "vbaVarMod", "CIatan", "vbaStrMove", "allmul", "CItan", "vbaFPInt", "vbaUI1Var", "CIexp", "vbaFreeStr", "vbaFreeObj" ], "ms": { "binary": { "code_size": 176128.0, "file_size": 196709.0, "import_count": 64.0, "string_count": 240.0, "section_count": 3.0, "avg_complexity": 10.25, "function_count": 8.0, "import_density": 0.37, "max_complexity": 45.0, "string_density": 1.4, "overall_entropy": 7.15, "avg_basic_blocks": 23.13, "avg_section_size": 5213696.0, "function_density": 0.05, "avg_function_size": 584.25, "avg_string_length": 18.86, "complexity_per_kb": 0.06, "max_string_length": 753.0, "wide_string_count": 18.0, "writable_sections": 1.0, "avg_string_entropy": 2.83, "code_section_ratio": 0.33, "code_to_data_ratio": 0.01, "data_to_file_ratio": 78.6, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.9, "total_basic_blocks": 185.0, "executable_sections": 1.0, "section_name_entropy": 3.01, "string_length_stddev": 59.02, "largest_section_ratio": 78.6, "sentence_string_count": 15.0, "sentence_string_ratio": 0.06, "function_analysis_depth": 2.0, "has_malformed_structure": true, "normalized_import_count": 0.14, "normalized_section_count": 0.17 } }, "ss": [ [ 77, "!ThisRprogram cannot be run in DOS mode." ], [ 432, ".text" ], [ 512, ".rsrc" ], [ 568, "MSVBVM60.DLL" ], [ 5212, "Unicorn" ], [ 5385, "Adobe Photoshop CC 2018 (Windows)" ], [ 5419, "2019:01:H7 19:44:27" ], [ 5582, "Adobe_CM" ], [ 5597, "Adobe" ], [ 5876, "b34r" ], [ 6498, "Blqm" ], [ 8532, "3b5q" ], [ 9191, "\\Photoshop 3.0" ], [ 9206, "8BIM" ], [ 9261, "N8BIM" ], [ 9288, "printOutput" ], [ 9307, "PstSbool" ], [ 9320, "Inteenum" ], [ 9332, "Inte" ], [ 9340, "Clrm" ], [ 9348, "printSixteenBitbool" ], [ 9372, "printerNameTEXT" ], [ 9397, "printProofSetupObjc" ], [ 9447, "proofSetup" ], [ 9466, "Bltnenum" ], [ 9477, "builtinProof" ], [ 9493, "proofCMYK" ], [ 9530, "printOutputOptions" ], [ 9556, "Cptnbool" ], [ 9569, "Clbrbool" ], [ 9582, "RgsMbool" ], [ 9595, "CrnCbool" ], [ 9608, "CntCbool" ], [ 9621, "Lblsbool" ], [ 9634, "Ngtvbool" ], [ 9647, "EmlDbool" ], [ 9660, "Intrbool" ], [ 9673, "BckgObjc" ], [ 9691, "RGBC" ], [ 9763, "BrdTUntF#Rlt" ], [ 9787, "Bld UntF#Rlt" ], [ 9811, "RsltUntF#Pxl@b" ], [ 9836, "ectorDatabool" ], [ 9854, "PgPsenum" ], [ 9882, "LeftUntF#Rlt" ], [ 9906, "Top UntF#Rlt" ], [ 9930, "Scl UntF#Prc@Y" ], [ 9954, "cropWhenPrintingbool" ], [ 9979, "cropRectBottomlong" ], [ 10004, "cropRectLeftlong" ], [ 10028, "cropRectRightlong" ], [ 10054, "cropRectToplong" ], [ 10641, "null" ], [ 10653, "boundsObjc" ], [ 10701, "Leftlong" ], [ 10717, "Btomlong" ], [ 10733, "Rghtlong" ], [ 10763, "Objc" ], [ 10777, "slice" ], [ 10790, "sliceIDlong" ], [ 10809, "groupIDlong" ], [ 10828, "originenum" ], [ 10841, "ESliceOrigin" ], [ 10857, "autoGenerated" ], [ 10875, "Typeenum" ], [ 10886, "ESliceType" ], [ 10941, "Top long" ], [ 10989, "Rghtlo" ], [ 11005, "urlTEXT" ], [ 11040, "MsgeTEXT" ], [ 11058, "altTagTEXT" ], [ 11078, "cellTextIsHTMLbool" ], [ 11101, "cellTextTEXT" ], [ 11122, "horzAlignenum" ], [ 11140, "ESliceHorzAlign" ], [ 11159, "default" ], [ 11169, "vertAlignenum" ], [ 11187, "ESliceVertAlign" ], [ 11217, "bgColorTypeenum" ], [ 11236, "ESliceBGColorType" ], [ 11257, "None" ], [ 11264, "topOutsetlong" ], [ 11285, "leftOutsetlong" ], [ 11307, "bottomOutsetlong" ], [ 11332, "rightOutsetlong" ], [ 15066, "wide", "Adobe Photoshop" ], [ 15100, "wide", "Adobe Photoshop CC 2018" ], [ 15173, "zhttp://ns.adobe.com/xap/1.0/" ], [ 15203, "\u003c?xpacket begin=\"" ], [ 15584, "/photoshop/1.0/\" xmlns:xmpMM=\"http://ns.adobe.com/xap/1.0/mm/\" xmlns:stEvt=\"http://ns.adobe.com/xap/1.0/sType/ResourceEvent#\" xm" ], [ 15798, "oshop CC 2018 (Windows)\" xmp:CreateDate=\"2018-12-02T15:50:06+08:00\" xmp:ModifyDate=\"2019-01-07T19:44:27+08:00\" xmp:MetadataDate=" ], [ 16049, "nstanceID=\"xmp.iid:d5974899-ca88-7f42-9516-8e7635808df3\" xmpMM:DocumentID=\"adobe:docid:photoshop:953273c3-3fa6-8f45-b6a0-9baf393" ], [ 16264, "History\u003e \u003crdf:Seq\u003e \u003crdf:li stEvt:action=\"created\" stEvt:instanceID=\"xmp.iid:94317eb3-7085-4449-8680-030e5a0890d3\" stEvt:when=\"20" ], [ 16472, "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85f-119c665623ef\" stEvt:when=\"2018-12-02T16:02:59+" ], [ 16825, "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt:action=\"converted\" stEvt:parameters=\"from image/" ], [ 18048, "I " ], [ 19634, "et end=\"w\"?\u003e" ], [ 19648, "XICC_PROFILE" ], [ 19676, "mntrRGB XYZ" ], [ 19700, "acspMSFT" ], [ 19712, "IEC sRGB" ], [ 19807, "3desc" ], [ 19904, "vued" ], [ 19916, "view" ], [ 19940, "meas" ], [ 19999, "text" ], [ 20008, "Copyright (c) 1998 Hewlett-Packard Company" ], [ 20064, "sRGB IEC61966-2.1" ], [ 20272, "IEC http://www.iec.ch" ], [ 20383, ".IEC 61966-2.1 Default RGB colour space - sRGB" ], [ 20519, ",Reference Viewing Condition in IEC61966-2.1" ], [ 20744, "CRT curv" ], [ 23117, "DTsEF7Gc(UVW" ], [ 23150, "u*9:HIJXYZghijvwxyz" ], [ 30198, "VMI_" ], [ 30665, "BIYS" ], [ 30688, "JVWP" ], [ 32148, "%euWFWGP" ], [ 35312, "9555" ], [ 48457, "/ysw" ], [ 55677, "Noqf" ], [ 56600, "CUO42" ], [ 56714, "xa7 4" ], [ 59228, "KOCCGM" ], [ 59236, "MIGI" ], [ 63278, "Rwwu" ], [ 67922, "t8e6" ], [ 68883, "a7tx" ], [ 69615, "YYYI" ], [ 74070, "Wfiv" ], [ 76486, "KA43" ], [ 77064, "MSUA" ], [ 78586, "3G4R" ], [ 78841, "Yeii" ], [ 91812, "ar2a" ], [ 91845, "7WFS" ], [ 92661, "DAQN" ], [ 94655, "p3x7" ], [ 96258, "]M[%v_g" ], [ 97299, "KQEY" ], [ 99585, "KQN9" ], [ 103589, "UMQV" ], [ 105173, "i2xe" ], [ 105473, "T8LF" ], [ 105996, "BMQO" ], [ 106548, "BKIB" ], [ 109668, "Ocdv" ], [ 113912, "URSR" ], [ 115581, "VQPSMY]44tt" ], [ 117307, "PC_M4" ], [ 118252, "OKWN" ], [ 118257, "IMYK2" ], [ 120215, "YSBMG" ], [ 125147, "Scki" ], [ 133566, "s4pe0" ], [ 133657, "HVJ2" ], [ 135996, "6OWB" ], [ 136114, "AMOSMR" ], [ 138314, "XYIR" ], [ 139794, "74PC-]%5FN" ], [ 141956, "UC_O" ], [ 142782, "/Zmz" ], [ 145170, "j2\u003eG" ], [ 146186, "Wfbi" ], [ 147311, "QUEA" ], [ 148580, "PFEEA" ], [ 151084, "PARA" ], [ 151960, "IMCGO" ], [ 153335, "KJBC" ], [ 155978, "SUL1" ], [ 156698, "5RK4R" ], [ 157552, "U5CU" ], [ 158048, "Gqjv" ], [ 162087, "xur0z" ], [ 162684, "XZ9H" ], [ 165158, "SUMCOQ" ], [ 168256, "MS Sans Serif" ], [ 168384, "VB5!6\u0026vb6chs.dll" ], [ 168508, "ii-Unicorn" ], [ 168519, "Kawaii-Unicorn" ], [ 170216, "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 170404, "user32" ], [ 170416, "SetLayeredWindowAttributes" ], [ 170500, "GetWindowLongA" ], [ 170572, "SetWindowLongA" ], [ 170728, "wide", ".exe" ], [ 170828, "wide", "cmd /c rename \"" ], [ 170884, "wide", ".die" ], [ 170896, "VBA6.DLL" ], [ 170908, "__vbaEnd" ], [ 170944, "__vbaFreeVarList" ], [ 170992, "__vbaAryDestruct" ], [ 171012, "__vbaPutOwner3" ], [ 171028, "__vbaFreeObj" ], [ 171044, "__vbaFreeStr" ], [ 171112, "__vbaUbound" ], [ 171124, "__vbaFPInt" ], [ 171136, "__vbaVarMove" ], [ 171152, "__vbaFileClose" ], [ 171180, "__vbaGetOwner3" ], [ 171196, "__vbaRedim" ], [ 171208, "__vbaFreeObjList" ], [ 171228, "__vbaFreeStrList" ], [ 171268, "__vbaStrMove" ], [ 171284, "__vbaFileOpen" ], [ 171300, "__vbaFreeVar" ], [ 171316, "__vbaSetSystemError" ], [ 171336, "__vbaHresultCheckObj" ], [ 171360, "__vbaOnError" ], [ 176026, "_adj_fptan" ], [ 176140, "_adj_fprem1" ], [ 176190, "__vbaHr" ], [ 176198, "sultCheckObj" ], [ 176326, "__vbaChkstk" ], [ 176358, "EVENT_SINK_AddRef" ], [ 176396, "DllFunctionCa" ], [ 176414, "_adj_fpatan" ], [ 176456, "EVENT_SINK_Release" ], [ 176478, "_CIsqrt" ], [ 176488, "EVENT_SINK_QueryInterface" ], [ 176516, "__v;aExceptHandler" ], [ 176538, "_adj_fprem" ], [ 176570, "__vbaFPException" ], [ 176762, "_adj_fdivr_m32" ], [ 176780, "_adj_fdiv_r" ], [ 176822, "_CIatan" ], [ 176848, "_allmul" ], [ 184662, "wide", "VS_VERSION_INDO" ], [ 184754, "wide", "VarFileInfo" ], [ 184786, "wide", "Translation" ], [ 184822, "wide", "StringFileInfo" ], [ 184882, "wide", "CompanyName" ], [ 184926, "wide", "ProductName" ], [ 184952, "wide", "Kawaii-Unicorn" ], [ 184990, "wide", "FileVersion" ], [ 185016, "wide", "1.00" ], [ 185034, "wide", "ProductVersion" ], [ 185082, "wide", "InternalName" ], [ 185146, "wide", "OriginalFilename" ], [ 185180, "wide", "Kawaii-Unicorn.exe" ] ], "sz": 196709, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE header too corrupted to parse: Malformed entity: ResourceString value_len (105) exceeds available bytes (80)", "e": [ "Malformed entity: ResourceString value_len (105) exceeds available bytes (80)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.function_count = 8.00" ], "i": "metadata/binary/metrics::few-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 64.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 78.60" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 64.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 8.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "a": "T1059", "c": 0.949999988079071, "d": "VB6 rtcShell command execution", "e": [ "rtcShell" ], "i": "micro-behaviors/process/create/shell::vb6-rtcshell", "l": 3, "m": "E1059" }, { "c": 0.9800000190734863, "d": "user32 dynamic dispatch target", "e": [ "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target", "l": 1 }, { "a": "T1027.009", "c": 0.9700000286102295, "d": "Embedded cmd rename command", "e": [ "cmd /c rename \"" ], "i": "objectives/command-and-control/dropper/binder::cmd-rename-command", "l": 1 }, { "c": 0.949999988079071, "d": "cmd interpreter marker encoded", "e": [ "cmd /c rename \"" ], "i": "metadata/lang/encoded/wide::shell-interpreter-cmd", "l": 1 }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 0.00" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "c": 0.9980000257492065, "d": "Kawaii-Unicorn original filename", "e": [ "Kawaii-Unicorn.exe" ], "i": "well-known/malware/trojan/shellobject/hijack::kawaii-unicorn-original-filename", "l": 4 }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 7.15" ], "i": "objectives/command-and-control/dropper/staging::high-entropy-binary", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "VB6 __vbaVarCat string concatenation", "e": [ "vbaVarCat" ], "i": "micro-behaviors/data/string/operations::vb6-string-construction-cat", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.83" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.9399999976158142, "d": "VB6 runtime DLL reference", "e": [ "MSVBVM60.DLL" ], "i": "metadata/binary/framework::vb6-runtime-dll", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "VB6 randomize helper", "e": [ "rtcRandomize" ], "i": "micro-behaviors/os/random/generator::vb6-rtc-randomize", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.9950000047683716, "d": "Adobe Photoshop CC decoy tag", "e": [ "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: Adobe Photoshop CC 2018 (Windows))", "History\u003e \u003crdf:Seq\u003e \u003crdf:li stEvt:action=\"created\" stEvt:instanceID=\"xmp.iid:9431 (contains: Adobe Photoshop CC 2018 (Windows))", "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85 (contains: Adobe Photoshop CC 2018 (Windows))", "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))" ], "i": "well-known/malware/trojan/shellobject/hijack::photoshop-cc-decoy", "l": 4 }, { "a": "T1027.009", "c": 0.9800000190734863, "d": "Dropped .die extension marker", "e": [ ".die" ], "i": "objectives/command-and-control/dropper/binder::die-extension", "l": 1 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.function_count = 8.00" ], "i": "metadata/binary/metrics/markers::low-function-count-marker", "l": 1 }, { "c": 0.9900000095367432, "d": "Embedded cmd rename command", "e": [ "cmd /c rename \"" ], "i": "well-known/malware/trojan/shellobject/hijack::rename-command", "l": 1 }, { "c": 0.949999988079071, "d": "VB6 runtime binary file write", "e": [ "vbaPutOwner3" ], "i": "micro-behaviors/fs/file/write::vb6-put-owner3", "l": 3 }, { "c": 0.9800000190734863, "d": "XMP converted PNG to JPEG trail", "e": [ "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: converted from image/png to image/jp" ], "i": "well-known/malware/trojan/shellobject/hijack::xmp-png-jpeg-derivation", "l": 4 }, { "c": 0.9900000095367432, "d": "Layered window opacity API", "e": [ "SetLayeredWindowAttributes" ], "i": "well-known/malware/trojan/shellobject/hijack::layered-window-attributes", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "VB6 runtime entrypoint marker", "e": [ "ThunRTMain" ], "i": "metadata/binary/framework::vb6-runtime-entry", "l": 2 }, { "c": 0.9900000095367432, "d": ".die extension payload marker", "e": [ ".die" ], "i": "well-known/malware/trojan/shellobject/hijack::die-extension", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.9900000095367432, "d": "MSVBVM60 runtime marker", "e": [ "MSVBVM60.DLL" ], "i": "well-known/malware/trojan/shellobject::msvbvm60-runtime", "l": 1 }, { "c": 0.8999999761581421, "d": "VB6 event sink helper", "e": [ "EVENT_SINK_AddRef", "EVENT_SINK_Release", "EVENT_SINK_QueryInterface" ], "i": "metadata/binary/framework::vb6-runtime-event-helper", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 64.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.9900000095367432, "d": "MSVBVM60 runtime marker", "e": [ "MSVBVM60.DLL" ], "i": "well-known/malware/worm/ludbaruma::msvbvm60-runtime", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 64.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.9950000047683716, "d": "Kawaii-Unicorn version identity", "e": [ "Kawaii-Unicorn (contains: Kawaii-Unicorn)", "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)" ], "i": "well-known/malware/trojan/shellobject/hijack::kawaii-unicorn-product", "l": 4 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.9300000071525574, "d": "VB6 runtime file open helper", "e": [ "vbaFileOpen" ], "i": "micro-behaviors/fs/file/write::vb6-file-open", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 240.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.996999979019165, "d": "Photoshop XMP history agent", "e": [ "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85 (contains: stEvt:softwareAgent=\"Adobe Photoshop", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: stEvt:softwareAgent=\"Adobe Photoshop" ], "i": "well-known/malware/trojan/shellobject/hijack::photoshop-xmp-history-agent", "l": 4 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 64.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 196709.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 64.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "VB6 random number helper", "e": [ "rtcRandomNext" ], "i": "micro-behaviors/os/random/generator::vb6-rtc-random-next", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".rsrc (size: 4096, entropy: 0.00, perms: -r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 10.25" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "binary.has_malformed_structure = 1.00" ], "i": "metadata/binary/metrics::malformed-pe-structure", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SetLayeredWindowAttributes" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 78.60" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.function_count = 8.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".data", ".data = 8778.2% of text (15460864 / 176128 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 78.60" ], "i": "objectives/anti-static/obfuscation/binary-metrics::dominant-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Large .data section (\u003e70% of", "e": [ "binary.data_to_file_ratio = 78.60" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::large-data-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 78.60" ], "i": "objectives/anti-static/obfuscation/payload::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High overall file entropy (likely", "e": [ "binary.overall_entropy = 7.15" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-overall-entropy", "l": 3, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 78.60" ], "i": "metadata/binary/metrics::dominant-section", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Packed loader code-to-data ratio below 0.4", "e": [ "binary.code_to_data_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-low-code-to-data-ratio", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned-pe-executable", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVBVM60.DLL (CIcos, adj_fptan, vbaVarMove, vbaFreeVar, rtcRgb, ... +59 more)", "e": [ "MSVBVM60.DLL" ], "i": "metadata/dylib::msvbvm60/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Visual Basic 6 application framework", "e": [ "EVENT_SINK_Release", "EVENT_SINK_AddRef", "MSVBVM60.DLL", "EVENT_SINK_QueryInterface", "ThunRTMain" ], "i": "metadata/binary/framework::vb6-application-framework", "l": 2 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 renames executables to .die", "e": [ "cmd /c rename \"", ".die", ".exe", "rtcShell" ], "i": "objectives/command-and-control/dropper/binder::vb6-rename-executable-to-die", "l": 4 }, { "c": 0.9200000166893005, "d": "VB6 runtime PRNG helpers", "e": [ "rtcRandomize", "rtcRandomNext" ], "i": "micro-behaviors/os/random/generator::vb6-runtime-prng", "l": 2 }, { "c": 0.949999988079071, "d": "VB6 runtime opens and writes file", "e": [ "vbaPutOwner3", "vbaFileOpen" ], "i": "micro-behaviors/fs/file/write::vb6-binary-file-write", "l": 3 }, { "c": 0.949999988079071, "d": "VB6 shell execution primitive", "e": [ "ThunRTMain", "rtcShell" ], "i": "micro-behaviors/process/create/shell::vb6-shell-execution", "l": 3 }, { "a": "T1027.009", "c": 0.9800000190734863, "d": "VB6 writes .die payload then renames and executes", "e": [ ".exe", "vbaFileOpen", "binary.section_count = 3.00", "cmd /c rename \"", ".die", "binary.function_count = 8.00", "rtcShell", "vbaPutOwner3" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-rename-exec-dropper", "l": 5 }, { "c": 0.9950000047683716, "d": "Rename executable extension to .die", "e": [ ".exe", "cmd /c rename \"", ".die" ], "i": "well-known/malware/trojan/shellobject/hijack::rename-to-die", "l": 4 }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 disables executables via .die rename", "e": [ "binary.function_count = 8.00", ".die", "cmd /c rename \"", ".exe", "rtcShell", "binary.section_count = 3.00" ], "i": "objectives/command-and-control/dropper/binder::vb6-executable-sabotage-via-die-rename", "l": 5 }, { "c": 0.996999979019165, "d": "VB6 hidden window user32 dispatch", "e": [ "GetWindowLongA", "MSVBVM60.DLL", "EVENT_SINK_Release", "user32", "SetWindowLongA", "EVENT_SINK_AddRef", "EVENT_SINK_QueryInterface", "ThunRTMain", "SetLayeredWindowAttributes" ], "i": "well-known/malware/trojan/shellobject/hijack::hidden-window-user32-dispatch", "l": 4 }, { "c": 0.9950000047683716, "d": "Renames executable aside to .die", "e": [ "cmd /c rename \"", ".die", "Kawaii-Unicorn.exe", "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)", ".exe", "Kawaii-Unicorn (contains: Kawaii-Unicorn)" ], "i": "well-known/malware/trojan/shellobject/hijack::die-rename-hijack-primitive", "l": 4 }, { "c": 0.9990000128746033, "d": "ShellObject VB6 hidden-window hijacker", "e": [ "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: converted from image/png to image/jp", "EVENT_SINK_Release", "SetWindowLongA", "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))", "Kawaii-Unicorn (contains: Kawaii-Unicorn)", "EVENT_SINK_AddRef", "Kawaii-Unicorn.exe", "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85 (contains: Adobe Photoshop CC 2018 (Windows))", "cmd /c rename \"", "user32", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: Adobe Photoshop CC 2018 (Windows))", "GetWindowLongA", "History\u003e \u003crdf:Seq\u003e \u003crdf:li stEvt:action=\"created\" stEvt:instanceID=\"xmp.iid:9431 (contains: Adobe Photoshop CC 2018 (Windows))", "SetLayeredWindowAttributes", "EVENT_SINK_QueryInterface" ], "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-hidden-window-hijacker", "l": 5 }, { "c": 0.9990000128746033, "d": "Kawaii VB6 Photoshop history rename sabotage", "e": [ "SetWindowLongA", "Kawaii-Unicorn (contains: Kawaii-Unicorn)", "EVENT_SINK_QueryInterface", "EVENT_SINK_Release", "EVENT_SINK_AddRef", "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85 (contains: stEvt:softwareAgent=\"Adobe Photoshop", ".die", "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)", "MSVBVM60.DLL", "ThunRTMain", "SetLayeredWindowAttributes", "cmd /c rename \"", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: converted from image/png to image/jp", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: stEvt:softwareAgent=\"Adobe Photoshop", "Kawaii-Unicorn.exe", "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-photoshop-history-rename", "l": 5 }, { "c": 0.9990000128746033, "d": "ShellObject VB6 Adobe history hijacker", "e": [ "EVENT_SINK_Release", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: Adobe Photoshop CC 2018 (Windows))", "History\u003e \u003crdf:Seq\u003e \u003crdf:li stEvt:action=\"created\" stEvt:instanceID=\"xmp.iid:9431 (contains: Adobe Photoshop CC 2018 (Windows))", "Kawaii-Unicorn.exe", "SetLayeredWindowAttributes", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: stEvt:softwareAgent=\"Adobe Photoshop", "GetWindowLongA", "EVENT_SINK_QueryInterface", "SetWindowLongA", "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85 (contains: Adobe Photoshop CC 2018 (Windows))", "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))", "EVENT_SINK_AddRef", ".exe", "ThunRTMain", ".die", "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::vb6-adobe-history-hijacker", "l": 5 }, { "c": 0.9990000128746033, "d": "Kawaii-Unicorn VB6 dropper cluster", "e": [ "EVENT_SINK_QueryInterface", "SetWindowLongA", ".die", "EVENT_SINK_AddRef", "vbaFileOpen", "GetWindowLongA", "ThunRTMain", "rtcShell", "cmd /c rename \"", ".exe", "vbaPutOwner3", "Kawaii-Unicorn.exe", "user32", "MSVBVM60.DLL", "Kawaii-Unicorn (contains: Kawaii-Unicorn)", "binary.section_count = 3.00" ], "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-unicorn-dropper", "l": 5 }, { "c": 0.9990000128746033, "d": "Kawaii VB6 JPEG decoy hijacker", "e": [ "GetWindowLongA", "SetLayeredWindowAttributes", "ThunRTMain", "SetWindowLongA", ".exe", ".die", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: converted from image/png to image/jp", "MSVBVM60.DLL", "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)", "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85 (contains: Adobe Photoshop CC 2018 (Windows))", "EVENT_SINK_AddRef", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: Adobe Photoshop CC 2018 (Windows))", "cmd /c rename \"", "Kawaii-Unicorn (contains: Kawaii-Unicorn)", "EVENT_SINK_QueryInterface", "Kawaii-Unicorn.exe" ], "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-jpeg-decoy-hijacker", "l": 5 }, { "c": 0.9990000128746033, "d": "Kawaii-Unicorn VB6 .die rename sabotage", "e": [ ".die", "MSVBVM60.DLL", "SetWindowLongA", "EVENT_SINK_QueryInterface", "ThunRTMain", "user32", "SetLayeredWindowAttributes", "GetWindowLongA", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: Adobe Photoshop CC 2018 (Windows))", ".exe", "Kawaii-Unicorn.exe", "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)", "Kawaii-Unicorn (contains: Kawaii-Unicorn)", "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))", "cmd /c rename \"", "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85 (contains: Adobe Photoshop CC 2018 (Windows))" ], "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-rename-sabotage", "l": 5 }, { "c": 0.9990000128746033, "d": "Kawaii VB6 write and rename dropper", "e": [ ".die", "rtcShell", "vbaFileOpen", ".exe", "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)", "Kawaii-Unicorn (contains: Kawaii-Unicorn)", "ThunRTMain", "Kawaii-Unicorn.exe", "cmd /c rename \"", "vbaPutOwner3" ], "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-write-rename-dropper", "l": 5 }, { "c": 0.9990000128746033, "d": "ShellObject VB6 Adobe decoy hijacker", "e": [ "Kawaii-Unicorn.exe", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: converted from image/png to image/jp", "History\u003e \u003crdf:Seq\u003e \u003crdf:li stEvt:action=\"created\" stEvt:instanceID=\"xmp.iid:9431 (contains: Adobe Photoshop CC 2018 (Windows))", "Adobe Photoshop CC 2018 (Windows) (contains: Adobe Photoshop CC 2018 (Windows))", "/\u003e \u003crdf:li stEvt:action=\"saved\" stEvt:instanceID=\"xmp.iid:bda3dc4b-caee-fd46-b85 (contains: Adobe Photoshop CC 2018 (Windows))", "cmd /c rename \"", "wareAgent=\"Adobe Photoshop CC 2018 (Windows)\"(stEvt:changed=\"/\"/\u003e \u003crdf:li stEvt: (contains: Adobe Photoshop CC 2018 (Windows))", ".exe", ".die", "Kawaii-Unicorn.exe (contains: Kawaii-Unicorn)", "MSVBVM60.DLL", "binary.section_count = 3.00", "binary.largest_section_ratio = 78.60", "Kawaii-Unicorn (contains: Kawaii-Unicorn)" ], "i": "well-known/malware/trojan/shellobject/hijack::vb6-kawaii-adobe-hijacker", "l": 5 } ], "sha": "36bc07968376cc73eb532bd41fa5651bfcde863ce1fb0b5c7d0365ffac415daf", "path": "Virus.Hijack_Gen.Trojan.ShellObject.z8W@aaJDqQc_6_1.vir", "type": "pe" } ], "tv": "bf48d" } }