{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.0032894737, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T13:08:48Z" }, "path": "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 1111869.0, "checksum_valid": 1.0, "computed_checksum": 1111869.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 1061000.0, "entropy": 5.59, "size_bytes": 1061000.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.57, "overlay_size": 5256.0, "string_count": 21580.0, "overlay_ratio": 0.0, "overlay_entropy": 7.24, "entropy_variance": 7.49, "avg_string_length": 29.69, "max_string_length": 503.0, "code_to_data_ratio": 1.0, "string_length_stddev": 12.98, "largest_section_ratio": 0.99, "sentence_string_count": 5.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 1054720.0, "entropy_max": 5.57, "entropy_mean": 2.84, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 6385, "u8", "prKo" ], [ 17725, "u8", "pr{]" ], [ 18015, "u8", "prCc" ], [ 18769, "u8", "prKr" ], [ 31007, "u8", "prCf" ], [ 31761, "u8", "prKu" ], [ 43651, "u8", "prSb" ], [ 43999, "u8", "prCi" ], [ 44753, "u8", "prKx" ], [ 56643, "u8", "prSe" ], [ 56991, "u8", "prCl" ], [ 69635, "u8", "prSh" ], [ 69983, "u8", "prCo" ], [ 82627, "u8", "prSk" ], [ 82975, "u8", "prCr" ], [ 92603, "u8", "pr32" ], [ 95619, "u8", "prSn" ], [ 95967, "u8", "prCu" ], [ 96373, "u8", "pr[}" ], [ 105595, "u8", "pr35" ], [ 107857, "u8", "prKb" ], [ 108611, "u8", "prSq" ], [ 108959, "u8", "prCx" ], [ 118775, "u8", "/\tpr" ], [ 126903, "u8", "?o3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3C" ], [ 127162, "u8", "k8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h8h4d4d" ], [ 127237, "u8", "h8h8" ], [ 127305, "u8", "8h8h" ], [ 127340, "u8", "/w\u0026v\u0026j9i9Y" ], [ 128013, "u8", "f6f5e5e5c3c3$s#s" ], [ 128853, "u8", "6e5e" ], [ 131218, "u8", "p p r!s" ], [ 131234, "u8", "6f6f" ], [ 131853, "u8", "i9i9i" ], [ 132988, "u8", "8g7g" ], [ 133092, "u8", "Tv%u%l\u003cl+{+S" ], [ 133419, "u8", "f6f6" ], [ 133687, "u8", "f5e5e" ], [ 135336, "u8", "f6f0:h2:D" ], [ 135884, "u8", "b5f7" ], [ 135984, "u8", "2c4e" ], [ 136333, "u8", "/~(3a1a1a1a1" ], [ 136466, "u8", "{ +w'w'w'w'" ], [ 136832, "u8", "6f4a" ], [ 137545, "u8", "g6f2" ], [ 137558, "u8", "19a1a" ], [ 138370, "u8", "eu5uy" ], [ 138598, "u8", "YmQUg" ], [ 138737, "u8", "mpVQw4w" ], [ 139173, "u8", "pAeb" ], [ 139969, "u8", "z8vdrA0" ], [ 140383, "u8", "lCtuv" ], [ 141235, "u8", "nsXn" ], [ 141390, "u8", "5ncX0" ], [ 141754, "u8", "ohVA2" ], [ 142013, "u8", "RJbeh" ], [ 142735, "u8", "l.zcr" ], [ 143276, "u8", "DqsuG" ], [ 143702, "u8", "6842" ], [ 144684, "u8", "RxzZ1" ], [ 144726, "u8", "TCKSG_" ], [ 144804, "u8", "jvutN" ], [ 145109, "u8", "ZVRATHZB" ], [ 145922, "u8", "UWDQRs" ], [ 146026, "u8", "Ubgwx" ], [ 146270, "u8", "iMA5x" ], [ 146287, "u8", "{]quy" ], [ 146406, "u8", "ItT86" ], [ 147588, "u8", "2uvwLE" ], [ 148341, "u8", "j9jsu" ], [ 148506, "u8", "aoUAr" ], [ 150231, "u8", "OKNJIChLD" ], [ 151536, "u8", "rkzyMAe" ], [ 152915, "u8", "112C" ], [ 153348, "u8", "8wfuv" ], [ 155121, "u8", "OJuT3" ], [ 156503, "u8", "Nbyh" ], [ 158066, "u8", "Ebkz" ], [ 159678, "u8", "g.av" ], [ 159854, "u8", "Pyjst" ], [ 161530, "u8", "cewi" ], [ 161963, "u8", "567N" ], [ 162204, "u8", "aNWA_co" ], [ 163250, "u8", "rPYaf" ], [ 163331, "u8", "tnZGn" ], [ 163689, "u8", "ZQMYE" ], [ 163755, "u8", "Gqlx" ], [ 164738, "u8", "K@+$xIWXSU@" ], [ 164965, "u8", "ewifg" ], [ 165210, "u8", "fFVFl" ], [ 165475, "u8", "LHD0" ], [ 165618, "u8", "f1r3" ], [ 165686, "u8", "atZh" ], [ 166201, "u8", "OQ9O" ], [ 166639, "u8", "QKeZ9" ], [ 167353, "u8", "gMcio" ], [ 168470, "u8", "Eieo" ], [ 169758, "u8", "kdSMQB" ], [ 170045, "u8", "w6ul" ], [ 170842, "u8", "lLZHAjkl" ], [ 172429, "u8", "atgo" ], [ 173239, "u8", "qWjXLv0" ], [ 173584, "u8", "Haryd" ], [ 174921, "u8", "lcZa" ], [ 175139, "u8", "zix5t" ], [ 175878, "u8", "vErOZm" ], [ 176567, "u8", "FDB3" ], [ 177913, "u8", "k4amW4" ], [ 178262, "u8", "Smes" ], [ 178729, "u8", "RLgve" ], [ 178742, "u8", "fETC }jwhz^BQAd" ], [ 178801, "u8", "ZNbjv" ], [ 179300, "u8", "dMpu" ], [ 179562, "u8", "Kgvi" ], [ 181224, "u8", "/oHu" ], [ 184337, "u8", "5E5R" ], [ 184994, "u8", "zox, I" ], [ 186080, "u8", "Xgko" ], [ 186263, "u8", "ALW5" ], [ 186399, "u8", "CNaho" ], [ 186525, "u8", "sNSPM" ], [ 186654, "u8", "tJ][" ], [ 188387, "u8", "2OBRD" ], [ 188607, "u8", "VTRW" ], [ 189069, "u8", "BRRS" ], [ 191977, "u8", "HYJOT" ], [ 194248, "u8", "Wdcb" ], [ 194971, "u8", "VWYfL" ], [ 195265, "u8", "LHE2" ], [ 195438, "u8", "Jexkqopk" ], [ 196189, "u8", "PDXAJ" ], [ 197413, "u8", "NqtLD" ], [ 198598, "u8", "Jo_/iSv" ], [ 199507, "u8", "T19C" ], [ 202580, "u8", "lqQFWHOVp" ], [ 218048, "u8", "G3PG" ], [ 218076, "u8", "5dSXx" ], [ 219236, "u8", "19WZr" ], [ 221033, "u8", "vSrw" ], [ 222435, "u8", "zIqk" ], [ 223052, "u8", "l2hu" ], [ 224353, "u8", "/FKRm" ], [ 227001, "u8", "2JSK" ], [ 230441, "u8", "84TJ" ], [ 233220, "u8", "10em" ], [ 234350, "u8", "/5Ze" ], [ 234752, "u8", "e5jq" ], [ 235072, "u8", "u55h" ], [ 242276, "u8", "N7Q4" ], [ 242299, "u8", "/\tP9" ], [ 243563, "u8", "7OSM" ], [ 244914, "u8", "j7ud" ], [ 246846, "u8", "p(]d" ], [ 250370, "u8", "Hkra" ], [ 251030, "u8", "4ZQL" ], [ 251200, "u8", "/x3N" ], [ 252314, "u8", "A_QHTBw" ], [ 252446, "u8", "gk7e" ], [ 253501, "u8", "QErYJTBm" ], [ 253900, "u8", "VRApNMi" ], [ 260015, "u8", "bAlm" ], [ 260058, "u8", "riWJF" ], [ 261411, "u8", "4X5A" ], [ 261547, "u8", "/REN" ], [ 265345, "u8", "kOmz" ], [ 269861, "u8", "5QNW" ], [ 271290, "u8", "Z}s{" ], [ 272235, "u8", "MJ_=" ], [ 275077, "u8", "xgfEZ" ], [ 275582, "u8", "X2UF" ], [ 276917, "u8", "Kjj a" ], [ 278606, "u8", "JU20v" ], [ 281483, "u8", "OP7Xjo" ], [ 286024, "u8", "thea" ], [ 287906, "u8", "PncR6" ], [ 288394, "u8", "pWbk" ], [ 289689, "u8", "Jzyt" ], [ 295033, "u8", "WEg6D" ], [ 296649, "u8", "vfkTHw" ], [ 297197, "u8", "Tgqc" ], [ 297663, "u8", "3xeGlU" ], [ 300983, "u8", "PQ9GDk" ], [ 301358, "u8", "Unuv" ], [ 302051, "u8", "pfFd" ], [ 302689, "u8", "/Gu9" ], [ 303062, "u8", "4Qim6A" ], [ 303382, "u8", "vohpL" ], [ 303557, "u8", "`s@:`" ], [ 304074, "u8", "KjjYQ" ], [ 304641, "u8", "qJoz" ], [ 306718, "u8", "82ZT" ], [ 307333, "u8", "V2TO" ], [ 309109, "u8", "70GH" ], [ 310280, "u8", "ahiAz" ], [ 311413, "u8", "86LDD" ], [ 311764, "u8", "eopr" ], [ 312755, "u8", "D7KB" ], [ 313488, "u8", "lJsBB" ], [ 316685, "u8", "dBBmw" ], [ 318163, "u8", "-}\"a wiv3" ], [ 320066, "u8", "GaVK4" ], [ 320771, "u8", "q AKc" ], [ 322153, "u8", "Hawol" ], [ 322206, "u8", "uvo4" ], [ 322456, "u8", "ojXps" ], [ 326897, "u8", "w7z4" ], [ 327479, "u8", "jrCh" ], [ 330016, "u8", "bB.l" ], [ 330184, "u8", "2\u003eMa" ], [ 332185, "u8", "HbHZL" ], [ 333973, "u8", "ECaPW" ], [ 334246, "u8", "hsPN7" ], [ 339417, "u8", "gbiz5" ], [ 339511, "u8", "AZ4qB" ], [ 341038, "u8", "mXvz" ], [ 343099, "u8", "yg21" ], [ 343891, "u8", "aRqx" ], [ 344106, "u8", "wWzRO" ], [ 344326, "u8", "I218" ], [ 344378, "u8", "SPDA" ], [ 346719, "u8", "h7fil" ], [ 346729, "u8", "lcZZZJZl" ], [ 347730, "u8", "qg7a1" ], [ 348520, "u8", "9i94d" ], [ 352849, "u8", "d4c3" ], [ 352989, "u8", "f6b2" ], [ 353579, "u8", "5e5e5e2b" ], [ 354228, "u8", "y)y(x" ], [ 355325, "u8", "d4c1" ], [ 355689, "u8", "/hf6B" ], [ 360227, "u8", "8h7g" ], [ 360568, "u8", "e5e4d4d4d4d" ], [ 381984, "u8", "GGjRykSzlT{mm" ], [ 384382, "u8", "f6 p" ], [ 402945, "u8", "e5 p" ], [ 404346, "u8", "a1 p" ], [ 406478, "u8", "i98h" ], [ 406659, "u8", "g76f" ], [ 407987, "u8", "c32b" ], [ 408667, "u8", "j9i9e" ], [ 408826, "u8", "\u003ef6fv\"i9iy%k;k{'l\u003cl|(l\u003cl|(k;k{'i9iy%f6fv\"b2br" ], [ 409807, "u8", "x!qa-k4dt j2br" ], [ 410745, "u8", "i9i9e" ], [ 410920, "u8", "e5e5a" ], [ 414125, "u8", "d46f" ], [ 415384, "u8", "BSJB" ], [ 416581, "u8", "ReadOnlySpan`1" ], [ 416596, "u8", "ToInt32" ], [ 416604, "u8", "NetworkBytesToHostUInt16" ], [ 416629, "u8", "ToInt16" ], [ 416637, "u8", "\u003cModule\u003e" ], [ 416646, "u8", "System.IO" ], [ 416656, "u8", "aacacefdcaaabacedddaaeadaaa" ], [ 416684, "u8", "feeadbeccddabbcdaba" ] ], "v": { "file.stem": "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1602810229, "file.basename": "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe", "pe.image_base": 4194304, "pe.image_size": 1073152, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 1062590, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 5256, "pe.image_hash.sha1": "227364ffafeaf7e304d059934722f90e3a740add", "pe.image_hash.sha256": "920b450319342eeae52497e53aa66279391e7b8c2513b28f9cb0d01b686e80ec", "pe.image_hash.sha384": "e32faca6e7b1ad8688d1a34ddf7afba794cbde9f7c6438024cdad6062c1eb71468415f6567755789d44e7ecca58c6e4a", "pe.image_hash.sha512": "6757dda3a3e0059269faeb854c7853fa8eec0fb70e2917a174b03b873c6462358200bdbf0dfb9e82e798c1600817c5e04fb8c131424f2ae9c7ff815e8e4fe960", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=CN,L=Guangzhou,OU=诶Е伊诶勒诶Е吉吉伊诶吉,O=ААЕ诶吉А勒吉勒А吉А诶伊吉АА,CN=诶伊吉А勒勒А吉诶吉勒", "pe.signatures[0].serial": "00c67bfa8fa476b8459de3bc210899e783", "pe.signatures[0].subject": "C=CN,L=Guangzhou,OU=诶Е伊诶勒诶Е吉吉伊诶吉,O=ААЕ诶吉А勒吉勒А吉А诶伊吉АА,CN=诶伊吉А勒勒А吉诶吉勒", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 1062500, "pe.data_directories[1].rva": 1055744, "pe.data_directories[2].rva": 1064960, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-10-16T01:03:49Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 5256, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-10-16T01:03:49Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "40c7d9a39ed7916d9a6ec29de2215631ba46abf1", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "920b450319342eeae52497e53aa66279391e7b8c2513b28f9cb0d01b686e80ec", "pe.signatures[0].thumbprint_sha256": "5191e9697c97eac07fc456a7aef810870e0f5fa458bc9b0b011e3ea335523168", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 1054720, 5.57, "r-x" ], [ ".reloc", 1055232, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 1061000, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x65698" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x65698" ] }, { "c": 1.0, "d": "Authenticode chain CN: 诶伊吉А勒勒А吉诶吉勒", "e": [ "诶伊吉А勒勒А吉诶吉勒" ], "i": "metadata/signed/unknown::诶伊吉а勒勒а吉诶吉勒", "l": 2 }, { "c": 1.0, "d": "Signed by ААЕ诶吉А勒吉勒А吉А诶伊吉АА", "e": [ "ААЕ诶吉А勒吉勒А吉А诶伊吉АА" ], "i": "metadata/signed/leaf::аае诶吉а勒吉勒а吉а诶伊吉аа", "l": 3 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0x1022f5" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x661ec" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "0x65fe0" ] }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 21580.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x1018ae" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x661c2" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 21580.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x65d2b" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "c5" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014", "el": [ "0x235af" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 21580.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8600000143051147, "d": "VB late binding token", "e": [ "LateCall" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-latecall-token", "l": 1, "el": [ "0x66141" ] }, { "c": 0.949999988079071, "d": "DigiCert timestamp certificate chain", "e": [ "DigiCert SHA2 Assured ID Timestamping CA" ], "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain", "l": 2, "el": [ "0x1022f5" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.57" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x746a" ] }, { "c": 0.9399999976158142, "d": "Dominant largest PE section", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "metadata/binary/layout::large-dominant-section", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1046", "c": 0.699999988079071, "d": "RDP port 3389", "e": [ "3389" ], "i": "objectives/discovery/network/scan/internal-port::rdp-port", "l": 1, "m": "E1046", "el": [ "0xc03dc" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x1018ae" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c6" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0x22b9d" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x66044" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0xae6a" ] }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 21580.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x3a6a" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 21580.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.Net", "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x66256", "0x65b86" ] }, { "c": 0.7200000286102295, "d": "Docker TLS API port", "e": [ "2376" ], "i": "micro-behaviors/os/container/runtime::docker-api-port-2376", "l": 1, "el": [ "0xca088" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "00196de5-4939-48e9-81e6-5bc2dd2c2c66", "73ae4f49-2c96-4843-a0b4-06311e809e0b", "a5e57750-4a49-4940-b1a7-3b170d042eaa", "a7ee4ece-ce6f-4c86-b753-77b83d06b18c", "45c551de-56e9-4410-9178-cc837e598ae6", "57e5c61f-4a83-498d-92ab-870719bc9eae", "650d58e1-8035-49d5-a29b-6ae884000088", "253eea3d-d407-4d0a-8c9e-43728e0f97b9", "260ef65c-c09c-4f50-a018-188f7795ced8", "4ab5d17c-f34d-4b0f-a50e-eecdc6d08f63", "d0bdf3f9-a71b-48ac-96b7-0e835cc8ce01", "69cd7219-f222-47d2-a163-7b1c2b2ed2da", "084bb58a-b7b0-4d1c-a523-1034fe3708b2", "adf58e1d-59bf-4839-848b-e3b878780d7a", "388783c5-45b5-4ae3-972c-3ac25ae496e8", "6c8286ef-825b-4239-af0f-778b10b067b3" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030", "el": [ "0x66782", "0x66454", "0x666ee", "0x667cc", "0x6649e", "0x6665a", "0x665c6", "0x66532", "0x66738", "0x6640a", "0x66610", "0x666a4", "0x663c0", "0x6657c", "0x66376", "0x664e8" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ToString", "GetString", "StringComparison" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x66123", "0x6612c", "0x661a7" ] }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic", "Microsoft.VisualBasic.CompilerServices" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x65dde", "0x6620b" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.949999988079071, "d": "PE has exactly two sections", "e": [ "sections.count = 2.00" ], "i": "well-known/malware/virus/virlock::two-section-layout", "l": 1 }, { "a": "T1140", "c": 0.9200000166893005, "d": "VB NewLateBinding dispatch helper", "e": [ "NewLateBinding" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-newlatebinding", "l": 1, "m": "B0030", "el": [ "0x66114" ] }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "0x661c2" ] }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 21580.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 21580.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 1054720, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 21580.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GxetxMaxnxifxxexsxtResxouxrcxxeSxtxrxexamx", "MissingManifestResourceException" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xf50c0", "0x66186" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35", "path": "386ed6c1d347e18b70c1951b0f1329d17d2cabefac4a7235ce47fd64b5bc7d35.exe", "type": "pe" } ], "tv": "52045" } }