{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9918919205665588, "class": 0 } ], "prob": 0.9918919, "class": 0, "models": [ { "m": "az", "prob": 0.9918919, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:12:27Z" }, "path": "39f3d52fb102a93f43450d0858adf6dfc63252a01d41ef6543684387c94993f6.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₄Si)", "k": { "hash.imp": "ac54ec9a289a166c2467e144c642077a", "pe.checksum": "0x00031942", "pe.timestamp": 1293205079, "hash.authenti": "7cf34f766b08e65f7a84bcaeb78f9d17043118a0974c63d5b7d5d27b2ef1f308", "debug.pdb_path": "C:\\Hello\\Insert\\Data\\File.exe", "pe.codeview.age": 1, "pe.codeview.guid": "793E0143-652F-4605-AA39-0F9202D130AE", "build.target_arch": "x86", "pe.linker_version": "10.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_STRING", "pe.resource_types[2]": "RT_VERSION", "pe.debug_entries[0].size": 54, "pe.debug_entries[0].type": "codeview", "pe.data_directories[0].rva": 153280, "pe.data_directories[1].rva": 157968, "pe.data_directories[2].rva": 159744, "pe.data_directories[3].rva": 167936, "pe.data_directories[4].rva": 153184, "pe.data_directories[5].rva": 153472, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 179, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 60, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 4340, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 2212, "pe.data_directories[4].name": "debug", "pe.data_directories[4].size": 28, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 108, "pe.debug_directory_types[0]": 2, "pe.version_info.company_name": "TODO: \u003cCompany^Name\u003e", "pe.version_info.file_version": "3.5.0.1", "pe.version_info.product_name": "TODO: \u003cProduct^Name\u003e", "pe.debug_entries[0].timestamp": 1293205079, "pe.version_info.internal_name": "ModifiedData.exe", "pe.version_info.legal_copyright": "Unknown", "pe.version_info.product_version": "3.5.0.1", "binary.top_complex_unnamed[0].cc": 85, "binary.top_complex_unnamed[1].cc": 36, "binary.top_complex_unnamed[2].cc": 22, "binary.top_complex_unnamed[3].cc": 19, "binary.top_complex_unnamed[4].cc": 18, "binary.top_complex_unnamed[5].cc": 16, "binary.top_complex_unnamed[6].cc": 15, "binary.top_complex_unnamed[7].cc": 9, "pe.version_info.file_description": "TODO: \u003cFile^Description\u003e", "binary.top_complex_unnamed[0].bbs": 190, "binary.top_complex_unnamed[1].bbs": 90, "binary.top_complex_unnamed[2].bbs": 50, "binary.top_complex_unnamed[3].bbs": 38, "binary.top_complex_unnamed[4].bbs": 40, "binary.top_complex_unnamed[5].bbs": 33, "binary.top_complex_unnamed[6].bbs": 34, "binary.top_complex_unnamed[7].bbs": 20, "pe.version_info.original_filename": "ModifiedData.exe", "binary.top_complex_unnamed[0].addr": "0x423fc6", "binary.top_complex_unnamed[0].size": 4939, "binary.top_complex_unnamed[1].addr": "0x40c883", "binary.top_complex_unnamed[1].size": 47490, "binary.top_complex_unnamed[2].addr": "0x41f3fa", "binary.top_complex_unnamed[2].size": 16664, "binary.top_complex_unnamed[3].addr": "0x407ec0", "binary.top_complex_unnamed[3].size": 18883, "binary.top_complex_unnamed[4].addr": "0x401000", "binary.top_complex_unnamed[4].size": 19282, "binary.top_complex_unnamed[5].addr": "0x418372", "binary.top_complex_unnamed[5].size": 652, "binary.top_complex_unnamed[6].addr": "0x4185fe", "binary.top_complex_unnamed[6].size": 28156, "binary.top_complex_unnamed[7].addr": "0x425477", "binary.top_complex_unnamed[7].size": 481, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".rsrc", "pe.section_characteristics[3].name": ".reloc", "pe.section_characteristics[0].raw_size": 149504, "pe.section_characteristics[1].raw_size": 3072, "pe.section_characteristics[2].raw_size": 4608, "pe.section_characteristics[3].raw_size": 23552, "pe.section_characteristics[0].virtual_size": 149484, "pe.section_characteristics[1].virtual_size": 2988, "pe.section_characteristics[2].virtual_size": 4340, "pe.section_characteristics[3].virtual_size": 23137, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 155648, "pe.section_characteristics[2].virtual_address": 159744, "pe.section_characteristics[3].virtual_address": 167936, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "42000040" }, "x": 6, "id": 0, "is": [ "SetWindowOrgEx", "SetBitmapBits", "CreateFontIndirectA", "CreateRectRgn", "GetTextExtentPointA", "GetSystemPaletteEntries", "SetAbortProc", "DeleteObject", "CreateDiscardableBitmap", "SetViewportExtEx", "EndPage", "GetSystemDirectoryA", "SetHandleCount", "GetPriorityClass", "AddAtomA", "GetSystemWindowsDirectoryW", "GetBinaryTypeW", "LeaveCriticalSection", "GetShortPathNameA", "FindClose", "CreateFileA", "CreateThread", "ClearCommBreak", "SystemTimeToFileTime", "GetExitCodeThread" ], "ms": { "pe": { "entry": 144658.0, "machine": 332.0, "checksum": 203074.0, "pdb_path": "C:\\Hello\\Insert\\Data\\File.exe", "rsrc_size": 4608.0, "subsystem": 2.0, "timestamp": 1293205079.0, "icon_count": 1.0, "image_base": 4194304.0, "codeview_age": 1.0, "has_checksum": true, "rsrc_entropy": 4.25, "codeview_guid": "793E0143-652F-4605-AA39-0F9202D130AE", "entry_section": ".text", "size_of_image": 192512.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 3.0, "resource_types": [ "RT_ICON", "RT_STRING", "RT_VERSION" ], "characteristics": 258.0, "size_of_headers": 1024.0, "export_timestamp": 1293205079.0, "has_version_info": true, "import_dll_count": 2.0, "computed_checksum": 203074.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1293205079.0, "debug_timestamp_min": 1293205079.0, "has_export_timestamp": true, "linker_major_version": 10.0, "debug_directory_types": [ 2.0 ], "has_resource_timestamp": false, "debug_directory_entries": 1.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 181760.0 }, "binary": { "code_size": 149504.0, "func_count": 13.0, "code_entropy": 7.95, "data_entropy": 5.99, "export_count": 2.0, "func_density": 0.09, "import_count": 25.0, "string_count": 209.0, "avg_func_size": 11467.69, "section_count": 4.0, "avg_complexity": 21.15, "import_density": 0.17, "max_complexity": 85.0, "string_density": 1.43, "overall_entropy": 6.2, "avg_basic_blocks": 47.23, "avg_section_size": 45184.0, "dependency_count": 2.0, "entropy_variance": 1.33, "avg_string_length": 10.34, "complexity_per_kb": 0.14, "max_string_length": 178.0, "wide_string_count": 34.0, "avg_string_entropy": 2.53, "code_to_data_ratio": 4.79, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.82, "total_basic_blocks": 614.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 13.83, "debug_reference_count": 1.0, "largest_section_ratio": 0.82, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "writable_section_count": 1.0, "executable_section_count": 1.0, "high_complexity_func_count": 1.0, "unnamed_complex_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 472, ".text" ], [ 552, ".rsrc" ], [ 591, "@.reloc" ], [ 1376, "7ABV" ], [ 4367, "y\u003c\u003c8" ], [ 5934, "2\u003eQp" ], [ 8839, "SKHJ" ], [ 14724, "Zgqd" ], [ 15026, "ZnssK.R" ], [ 18029, "/lTrG" ], [ 22739, "LM4N2" ], [ 25344, "I1RP" ], [ 30368, "wa62" ], [ 34854, "kl70" ], [ 36329, "NOAI" ], [ 43151, "x0oha" ], [ 44769, "377a" ], [ 47406, "6D6I" ], [ 48147, "37ABV" ], [ 50509, "JihWECEy" ], [ 54237, "F2UA" ], [ 54493, "Yyub" ], [ 60844, "MQKL1" ], [ 64811, "Brom" ], [ 70662, "Zrel" ], [ 71574, "2Y8Q" ], [ 72246, "D997" ], [ 76963, "/hqj" ], [ 77050, "/xI3" ], [ 77448, "RFYI" ], [ 80740, "Sblgx" ], [ 87159, "O123" ], [ 90389, "DADX" ], [ 94592, "y847" ], [ 97762, "UXMO" ], [ 98647, "WSHD" ], [ 100017, "Mlyj" ], [ 100049, "E5TO" ], [ 100653, "W7CE" ], [ 101872, "7 OQ" ], [ 106726, "2w4t" ], [ 109509, "/rP5" ], [ 112662, "7YTU" ], [ 116248, "Dhjn" ], [ 116942, "B3VM" ], [ 118608, ".eal" ], [ 119918, "J3WF" ], [ 123395, "i183" ], [ 128415, "FKY_" ], [ 128471, "Nrrg" ], [ 128961, "MFUN" ], [ 135357, "QEP8" ], [ 143481, "7ABVP" ], [ 150144, "RSDSC" ], [ 150168, "C:\\Hello\\Insert\\Data\\File.exe" ], [ 150268, "SectionData.exe" ], [ 150284, "_SetMessageExtraInfoSetMessageExtraInfo@0" ], [ 150326, "_SetMessageExtraInfoSetMessageExtraInfoSetMessageExtraInfo@0" ], [ 150528, "CPL_RBW36_MJ2L" ], [ 150543, "WT5_2BST" ], [ 150552, "EC367_JKN" ], [ 150562, "UPM_2G90" ], [ 150571, "IS8_38D_ZT4Q71" ], [ 150586, "FOH_GO2G9_9RQHS" ], [ 150602, "SIC_H4U_8U1_23" ], [ 150617, "W509_U4Q8_Z5" ], [ 150630, "JB1_0804" ], [ 150639, "Z810_49XJ_3" ], [ 150651, "L4677_S0H0AI" ], [ 150664, "R3517_6L" ], [ 150673, "IST10_D557D9_3" ], [ 150688, "AEC_H4JO_R" ], [ 150699, "N42_DVQ_LI" ], [ 150710, "XHG_F627F" ], [ 150720, "MH6_I1BW" ], [ 150729, "NUE_UEX_6G5_9XA" ], [ 150745, "JGH_DYF574W" ], [ 150757, "KVT5_EO6CL" ], [ 150768, "SPF7_ASO51V" ], [ 150780, "IPD_GOAI" ], [ 150789, "VZV_KZH_0Z8_Q7M" ], [ 150805, "W9W_2RC_UWMR" ], [ 150818, "S3V_RV80_Q" ], [ 150829, "F3D_DGG8X" ], [ 150839, "UMT_D2I372" ], [ 150850, "DOK_Z6R7R_MX3NE" ], [ 150864, "wide", "EAVX_KXSK_8S6" ], [ 150892, "wide", "HUV_0JPDER" ], [ 150914, "wide", "AQ5_7WM7_QUH2" ], [ 150942, "wide", "H5L_HVCTJ2_J7Z" ], [ 150972, "wide", "N1414_93YAM" ], [ 150996, "wide", "MD7_W6C_N1RK_A" ], [ 151026, "wide", "GR15_7007" ], [ 151046, "wide", "WGI_YIBHX4C" ], [ 151070, "wide", "THV422_0" ], [ 151088, "wide", "E1I_173B" ], [ 151106, "wide", "NLX_RIL9" ], [ 151124, "wide", "A6A_7ENY4_5" ], [ 151148, "wide", "WEU9_FXZ_X836" ], [ 151176, "wide", "G4C_IODP7" ], [ 151216, "xynsiQJmangDHcKkhfB" ], [ 151367, "N1NY" ], [ 151469, "N0NY" ], [ 151503, "N7NY" ], [ 151916, "fgkldjghlkdfkjlh;gfdkjlhfdhdf" ], [ 151971, "OHNKN" ], [ 152054, "i,i\u003ci\\ili}irisipiqiviwitiui" ], [ 152172, "Nhyy" ], [ 152188, "RRWtCYCduBIgSMQeMapM" ], [ 152228, "lzZzslmdCRpujecblGEzrMZKCpUBd" ], [ 152258, "hVbyXblCTJmdRjGR" ], [ 152276, "woulcdLudEy" ], [ 152288, "zhZABXWsAHlV" ], [ 152304, "MFuUvmoIChthpDsCCnjDzvQqgkywCxHgtiDPknUMgZRMqRswEoEtrikMiYPtPnKwSlBaKwvDrdxvxkwYenHoNNNZhfSGPIxHrYNBNwntXBAmcmuDfxcGUDukXtqznwVq" ], [ 153018, "SetWindowOrgEx" ], [ 153036, "SetBitmapBits" ], [ 153052, "CreateFontIndirectA" ], [ 153074, "CreateRectRgn" ], [ 153090, "GetTextExtentPointA" ], [ 153112, "GetSystemPaletteEntries" ], [ 153138, "SetAbortProc" ], [ 153154, "DeleteObject" ], [ 153170, "CreateDiscardableBitmap" ], [ 153196, "SetViewportExtEx" ], [ 153216, "EndPage" ], [ 153224, "GDI32.dll" ], [ 153236, "GetSystemDirectoryA" ], [ 153258, "SetHandleCount" ], [ 153276, "GetPriorityClass" ], [ 153308, "GetSystemWindowsDirectoryW" ], [ 153338, "GetBinaryTypeW" ], [ 153356, "LeaveCriticalSection" ], [ 153380, "GetShortPathNameA" ], [ 153400, "FindClose" ], [ 153412, "CreateFileA" ], [ 153426, "CreateThread" ], [ 153442, "ClearCommBreak" ], [ 153460, "SystemTimeToFileTime" ], [ 153484, "GetExitCodeThread" ], [ 153502, "KERNEL32.dll" ], [ 157108, "wide", "Pruqszdthvivwsuv" ], [ 157142, "wide", "Nbotsxtebphxtnnyki" ], [ 157186, "wide", "VS_VERSION_INFO" ], [ 157278, "wide", "StringFileInfo" ], [ 157338, "wide", "CompanyName" ], [ 157364, "wide", "TODO: \u003cCompany^Name\u003e" ], [ 157414, "wide", "FileDescription" ], [ 157448, "wide", "TODO: \u003cFile^Description\u003e" ], [ 157506, "wide", "FileVersion" ], [ 157532, "wide", "3.5.0.1" ], [ 157554, "wide", "InternalName" ], [ 157580, "wide", "ModifiedData.exe" ], [ 157622, "wide", "LegalCopyright" ], [ 157652, "wide", "Unknown" ], [ 157674, "wide", "OriginalFilename" ], [ 157750, "wide", "ProductName" ], [ 157776, "wide", "TODO: \u003cProduct^Name\u003e" ], [ 157826, "wide", "ProductVersion" ], [ 157878, "wide", "VarFileInfo" ], [ 157910, "wide", "Translation" ], [ 159943, "9%9.979=9C9Z9`9l9r9x9" ], [ 161585, "Phaa" ], [ 161688, "/cbb" ], [ 161810, "Tcbb" ], [ 162265, "Cbbaa" ], [ 162307, "haabr" ], [ 162788, ".cbb" ], [ 162984, "`\\bb-`" ], [ 163705, "Mxaa" ], [ 163831, "Lhaabr" ], [ 163845, "Hhaab" ], [ 164171, "ahaa" ], [ 164356, "Ohaa" ], [ 164533, "zhaa" ], [ 165449, "Thaa" ], [ 166009, "Kcbb" ], [ 166357, "(cbbaaaab" ], [ 166383, "m2aa" ], [ 166400, "b.aa" ], [ 166457, "Hcbb" ], [ 166503, "Pcbb" ], [ 166571, "Xcbb" ], [ 168174, "Lcbb" ], [ 168555, "Wcbb" ], [ 168569, "Mcbb" ], [ 170458, "Lhaa" ], [ 170483, "haabrb" ], [ 171912, "nrhaa" ], [ 172190, "Taaa" ], [ 172770, "Oaaa" ], [ 173035, "ngaaa" ], [ 173696, "VQVI" ], [ 174021, "Hhaa" ], [ 174253, "nyhaa" ], [ 175648, "aaab" ], [ 175907, "VGVB" ], [ 176084, "BViVP-I" ], [ 176812, "Fcbb" ], [ 177914, "haab" ], [ 177972, "Laaa" ], [ 178022, "gaaa" ], [ 179184, "RVYE" ], [ 179738, "Jhaa" ], [ 179748, "nchaa" ], [ 180395, "Eibb" ], [ 180816, "zaraab" ], [ 180867, "Acbb" ], [ 180927, "13bb" ] ], "sz": 181760, "ts": [ { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.95)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 192512.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 25.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 5.99)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "c": 0.800000011920929, "d": "AddAtomA API atom table access", "e": [ "AddAtomA" ], "i": "objectives/evasion/process/injection/atom-bombing::addatoma-api", "l": 1, "m": "C0041" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "39f3d52fb102a93f43450d0858adf6dfc63252a01d41ef6543684387c94993f6.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.53" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 614.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/metrics/structural::minimal-exports", "l": 3 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 21.15" ], "i": "metadata/binary/metrics/anomaly::high-complexity-marker", "l": 1 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_STRING, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.7400000095367432, "d": "Create rectangular GDI region", "e": [ "CreateRectRgn" ], "i": "micro-behaviors/ui/window/manage/control::create-rect-rgn", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Unknown" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "TODO: \u003cFile^Description\u003e" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "39f3d52fb102a93f43450d0858adf6dfc63252a01d41ef6543684387c94993f6.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.53" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 7.95, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "3.5.0.1" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.95" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1293205079.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.95" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 209.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "TODO: \u003cProduct^Name\u003e" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_func_size = 11467.69" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4608.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 25.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8799999952316284, "d": "Get system Windows directory path", "e": [ "GetSystemWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-windows-directory", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 13.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 6.20" ], "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.03" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "a": "T1071", "c": 1.0, "d": "CreateRectRgn/PolygonRgn/RoundRectRgn import", "e": [ "CreateRectRgn" ], "i": "objectives/command-and-control/backdoor/shell/com::create-region-import", "l": 1, "m": "B0025" }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 25.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemPaletteEntries", "SystemTimeToFileTime", "GetSystemWindowsDirectoryW", "GetSystemDirectoryA", "CreateFontIndirectA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 7.95, perms: r-x)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 25.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 25.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.95" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 1293205079.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "39f3d52fb102a93f43450d0858adf6dfc63252a01d41ef6543684387c94993f6.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.7200000286102295, "d": "Writable .rdata section permissions", "e": [ ".rdata (perms: rw-)" ], "i": "metadata/binary/section/names::writable-rdata", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links GDI32.dll (SetWindowOrgEx, SetBitmapBits, CreateFontIndirectA, CreateRectRgn, GetTextExtentPointA, ... +6 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetSystemDirectoryA, SetHandleCount, GetPriorityClass, AddAtomA, GetSystemWindowsDirectoryW, ... +9 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 } ], "sha": "39f3d52fb102a93f43450d0858adf6dfc63252a01d41ef6543684387c94993f6", "path": "39f3d52fb102a93f43450d0858adf6dfc63252a01d41ef6543684387c94993f6.exe", "type": "pe" } ], "tv": "46790" } }