{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T09:13:08Z" }, "path": "3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb.dll", "raw": { "v": "5", "fs": [ { "f": "H(Ds)", "x": 3, "ff": { "i": [ [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "LoadLibraryW" ], [ "kernel32", "GetModuleHandleA" ], [ "rasapi32", "RasEnumAutodialAddressesW" ], [ "advapi32", "RegCloseKey" ], [ "user32", "GetFocus" ], [ "oleaut32", "ORDINAL 322" ] ], "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 3.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 340365.0, "dos_stub_modified": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 4.0, "base_relocation_entry_count": 90.0 }, "file": { "size": 327680.0, "entropy": 7.41, "size_bytes": 327680.0 }, "binary": { "is_pie": 1.0, "code_entropy": 3.54, "data_entropy": 5.1, "string_count": 2836.0, "entropy_variance": 6.47, "avg_string_length": 9.61, "max_string_length": 1283.0, "code_to_data_ratio": 0.83, "string_length_stddev": 48.21, "largest_section_ratio": 0.66, "sentence_string_count": 143.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 7.0 }, "sections": { "count": 6.0, "code_size": 20480.0, "entropy_max": 7.86, "entropy_mean": 4.75, "name_entropy": 3.45, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 3.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 5.0 } }, "s": [ [ 200, "u8", "Rich" ], [ 564, "u8", ".rdata0" ], [ 643, "u8", "@.data" ], [ 723, "u8", "@.rsrc" ], [ 763, "u8", "@.reloc" ], [ 26650, "u8", "a91i" ], [ 36867, "u8", "ED_U" ], [ 37083, "u8", "a91Zkj" ], [ 40610, "u8", "mJmd" ], [ 51101, "u8", "b9RUJ" ], [ 53331, "u8", "YAdin" ], [ 55832, "u8", "QP_E" ], [ 58069, "u8", "] @(Q[ZEg" ], [ 62331, "u8", "/EBI" ], [ 68026, "u8", "QYWEN" ], [ 68440, "u8", "4CPD" ], [ 70555, "u8", "QYgEva9" ], [ 74806, "u8", "B5 DG" ], [ 77221, "u8", "Opqm" ], [ 79294, "u8", "cvb9T" ], [ 80414, "u8", "Csb9J" ], [ 81272, "u8", "M xAI" ], [ 86881, "u8", "8a9RB" ], [ 87325, "u8", "W_XM" ], [ 88313, "u8", "M DFe" ], [ 89833, "u8", "YLA4W" ], [ 92321, "u8", "6a9Rgw" ], [ 92364, "u8", "aWnp" ], [ 93857, "u8", "0a91Z" ], [ 95587, "u8", "a9RBl" ], [ 96162, "u8", "BKOJ" ], [ 96963, "u8", "a9Row" ], [ 98833, "u8", "M6cwF" ], [ 100791, "u8", "BSDxC" ], [ 104331, "u8", "TGy2o" ], [ 105124, "u8", "qHXMY" ], [ 107611, "u8", "m H(Q]oE~a9" ], [ 107893, "u8", "h7Rlk" ], [ 107936, "u8", "YgEva9" ], [ 109250, "u8", "sna9RR" ], [ 109448, "u8", "RN\u003c\u003c" ], [ 112708, "u8", "a9RLk" ], [ 114091, "u8", "HZNS" ], [ 115267, "u8", "YTH6f" ], [ 116667, "u8", "]|YHGhY:%_WHK" ], [ 120812, "u8", "vTfy" ], [ 121584, "u8", "Wmhe" ], [ 122203, "u8", "fe2o" ], [ 123057, "u8", "Wohe" ], [ 124093, "u8", "E HIAS" ], [ 125405, "u8", "5 DG" ], [ 127645, "u8", "M H0" ], [ 128097, "u8", "QY_E" ], [ 128416, "u8", "GSY_E" ], [ 128451, "u8", "h NhH~q" ], [ 128765, "u8", "5 PI" ], [ 130912, "u8", "CPD4d" ], [ 130950, "u8", "82LY" ], [ 132738, "u8", "POVFc" ], [ 132753, "u8", "zYlg" ], [ 133186, "u8", "POV2" ], [ 136578, "u8", "u6lq" ], [ 138311, "u8", "LMR n_" ], [ 141578, "u8", "RKD0" ], [ 142149, "u8", "p5oq9" ], [ 144383, "u8", "5 LIZU" ], [ 147619, "u8", "WY7E" ], [ 148863, "u8", "5 DA" ], [ 150971, "u8", "Rllk" ], [ 151337, "u8", "b9Rsn" ], [ 151906, "u8", "XIRU" ], [ 154230, "u8", "CzfSw" ], [ 155014, "u8", "Macc" ], [ 155364, "u8", "QS_E" ], [ 155675, "u8", "Rblb" ], [ 160295, "u8", "WY_W" ], [ 160773, "u8", "PY7E" ], [ 164442, "u8", "NPvvp" ], [ 164478, "u8", "Y~R5 H" ], [ 169697, "u8", "Kero" ], [ 171524, "u8", "BCPD" ], [ 174660, "u8", "pyCPD" ], [ 179171, "u8", "M TIU" ], [ 182053, "u8", "prCGD" ], [ 182182, "u8", "KumIh" ], [ 185060, "u8", "e HIR" ], [ 185988, "u8", "5 TG" ], [ 186211, "u8", "NzQHG" ], [ 188132, "u8", "qyCA9" ], [ 191788, "u8", "YIHwY" ], [ 191916, "u8", "evUy" ], [ 192717, "u8", "O_8R" ], [ 193003, "u8", "WEJI" ], [ 194373, "u8", "e @CGD" ], [ 194440, "u8", "IJQ 5" ], [ 199055, "u8", "LO1Z" ], [ 200677, "u8", "AE ZIU" ], [ 201772, "u8", "I0PS" ], [ 202925, "u8", "I0I_" ], [ 203622, "u8", "AE8TF" ], [ 207925, "u8", "7cycKM" ], [ 209329, "u8", "ao8J ." ], [ 209420, "u8", "GG2rrz" ], [ 212967, "u8", "ZT2T" ], [ 215487, "u8", "ZSO4R" ], [ 217501, "u8", "XXHV" ], [ 219135, "u8", "Plbb" ], [ 220432, "u8", "7RTN" ], [ 220679, "u8", "edhe" ], [ 220799, "u8", "yjUzv" ], [ 223799, "u8", "ofVq" ], [ 226352, "u8", "j8918" ], [ 226860, "u8", "Sudh" ], [ 230713, "u8", "PZt/xcuik" ], [ 230799, "u8", "rPxax" ], [ 236716, "u8", "kQqz" ], [ 238764, "wide", "estapp" ], [ 238788, "wide", "self.ex" ], [ 238935, "u8", "zO48w6NN4_Ma2AF0J" ], [ 238956, "u8", "RSDS" ], [ 238980, "u8", "DFBNKR.pdb" ], [ 239250, "u8", "GetModuleHandleA" ], [ 239270, "u8", "LoadLibraryW" ], [ 239286, "u8", "GetModuleHandleW" ], [ 239304, "u8", "KERNEL32.dll" ], [ 239320, "u8", "RasEnumAutodialAddressesW" ], [ 239346, "u8", "RASAPI32.dll" ], [ 239362, "u8", "RegCloseKey" ], [ 239374, "u8", "ADVAPI32.dll" ], [ 239390, "u8", "GetFocus" ], [ 239400, "u8", "USER32.dll" ], [ 239412, "u8", "OLEAUT32.dll" ], [ 242633, "u8", "eHoqzHo" ], [ 248633, "u8", "EO_X" ], [ 252701, "u8", "PCT_" ], [ 253047, "u8", "KL0D" ], [ 253301, "u8", "XLW).X@a" ], [ 253584, "u8", "P.yr" ], [ 253622, "u8", "Pb6MZ" ], [ 254189, "u8", "wEmfr" ], [ 257455, "u8", "U.sd" ], [ 257495, "u8", "PbPMX" ], [ 260144, "u8", "Qqzo" ], [ 265585, "u8", "gEba9" ], [ 265787, "u8", "XLy F" ], [ 269323, "u8", "aM `$`" ], [ 269748, "u8", "Kc9HQ" ], [ 271369, "u8", "fbmYaK" ], [ 274937, "u8", "5 PG" ], [ 275721, "u8", "4LEP" ], [ 276157, "u8", "YX91e" ], [ 276874, "u8", "LH Wo\\" ], [ 278353, "u8", "dbKEwO" ], [ 278685, "u8", "MY.1@p(" ], [ 278952, "u8", "muTdw" ], [ 278965, "u8", "h48t" ], [ 280832, "u8", "I0HC" ], [ 284323, "u8", "a9HXkR" ], [ 284666, "u8", "E xC#D" ], [ 285500, "u8", "791X" ], [ 287359, "u8", "D8H0" ], [ 289878, "u8", "R_U=" ], [ 290116, "u8", "me9Ro" ], [ 292907, "u8", "L TFy" ], [ 299718, "wide", "Java-Plug-in-Warnung" ], [ 299762, "wide", "MS Sans Serif" ], [ 299814, "wide", "IDI_DUKE_ICON" ], [ 299926, "wide", "Advertencia de Java Plug-in" ], [ 300158, "wide", "Avertissement du plug-in Java" ], [ 300382, "wide", "Avvertenza plugin Java" ], [ 300598, "wide", "Java Plug-in: varning" ], [ 300806, "wide", "Java Plug-in" ], [ 301014, "wide", "Java Plug-in Warning" ], [ 301252, "wide", "MS UI Gothic" ], [ 301422, "wide", "Java" ], [ 301622, "wide", "Advertência do Plug-in Java" ], [ 302038, "wide", "Los applet de esta página HTML necesitan una versión de Java distinta de la que está utilizando actualmente el explorador. Pa" ], [ 303330, "wide", "Consola de Sun JavaʼnSun Java no es la opción de Java seleccionada por defecto para el explorador.\nLa Consola de Sun Java es la" ], [ 305316, "wide", "Console Sun JavaĺSun Java n'est actuellement pas sélectionné comme Java par défaut du navigateur.\nL'option Console Sun Java " ], [ 306006, "wide", "L'applet o le applet presenti in questa pagina HTML richiedono una versione di Java differente da quella utilizzata attualmente " ], [ 307360, "wide", "Sun Java ConsoleńSun Java non è attualmente selezionato come funzionalità Java predefinita del browser.\nL'opzione Sun Java Co" ], [ 308068, "wide", "ÞAppletarna på den här HTML-sidan kräver en annan Javaversion än den webbläsaren använder nu. För att köra appletarna p" ], [ 309124, "wide", "Sun Java-konsolþSun Java är för närvarande inte standardjava för webbläsaren.\nAlternativet Sun Java-konsol är endast till" ], [ 309696, "wide", "HTML" ], [ 309716, "wide", "Applet" ], [ 309738, "wide", "java" ], [ 310070, "wide", "Netscape" ], [ 310206, "wide", "Sun Java" ], [ 310230, "wide", "zSun Java" ], [ 311626, "wide", "Sun Java ConsoleĉSun Java is not currently selected as the default Java for the browser.\nThe Sun Java Console option is only av" ], [ 313664, "wide", ". HTML" ], [ 314056, "wide", ". Sun Java" ], [ 314198, "wide", "O(s) applet(s) desta página HTML requere(m) uma versão do Java diferente da usada atualmente pelo browser. Para executar o(s) " ], [ 315422, "wide", "Console Sun JavaďO Sun Java não está selecionado atualmente como o browser padrão Java.\nA opção Console Sun Java está dis" ], [ 316622, "wide", ", Sun Java" ], [ 316798, "wide", "VS_VERSION_INFO" ], [ 316890, "wide", "StringFileInfo" ], [ 316926, "wide", "040904e4" ], [ 316950, "wide", "CompanyName" ], [ 316976, "wide", "Oracle Corporation" ], [ 317022, "wide", "FileDescription" ], [ 317056, "wide", "Classic Java Plug-in 10.60.2 for Netscape and Mozilla" ], [ 317170, "wide", "FileExtents" ], [ 317206, "wide", "FileOpenName" ], [ 317232, "wide", "Java Applet|JavaBeans" ], [ 317282, "wide", "FileVersion" ], [ 317308, "wide", "04.27.9.00" ], [ 317338, "wide", "Full Version" ], [ 317394, "wide", "InternalName" ], [ 317420, "wide", "Hill Etsq-hj" ], [ 317454, "wide", "LegalCopyright" ], [ 317484, "wide", "Copyright © 2014" ], [ 317526, "wide", "MIMEType" ], [ 317544, "wide", "application/x-java-applet;jpi-version=1.7.0_60|application/x-java-bean;jpi-version=1.7.0_60|application/x-java-applet;version=1." ], [ 320118, "wide", "OriginalFilename" ], [ 320152, "wide", "hille10602.dll" ], [ 320190, "wide", "ProductName" ], [ 320216, "wide", "Hill(ET) Uhjeuepi HI 7 A60" ], [ 320278, "wide", "ProductVersion" ], [ 320338, "wide", "VarFileInfo" ], [ 320370, "wide", "Translation" ], [ 323791, "u8", "8 9d9" ] ], "v": { "file.stem": "3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb", "pe.imphash": "afdd0bfecd1f03e354c24a9efdc42559", "pe.machine": "i386", "pe.rich.key": 2882954909, "pe.rich.hash": "2062b84fa302d1fc803bdaf237864a53", "pe.subsystem": "windows_gui", "pe.timestamp": 1600981154, "file.basename": "3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb.dll", "pe.image_base": 4194304, "pe.image_size": 327680, "pe.machine_id": 332, "pe.os_version": "5.0", "pe.version.os": "unknown", "pe.entry_point": 17910, "pe.headers_size": 4096, "pe.version.type": "dll", "pe.entry_section": ".rdata0", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.cert_table_size": 1, "pe.image_hash.sha1": "a6080960db898f6073abfdfcaa93abd9a648e917", "pe.version.company": "Oracle Corporation", "pe.image_hash.sha256": "8c0097f493fc7d2015c8a6013f808f8ab50a497f85ecb9cfe3f16b2c19f5ca96", "pe.image_hash.sha384": "a6120bea0be9ba93fea737ff380012fbe48096e36165f5daada24ed572a53153d633b7bfe671fbadaac1a66487474964", "pe.image_hash.sha512": "52d35df5d74765408ac06ff7a0a72bef1ed1f8ec352838b067b70fff329ce68d4e72861f5ca0c9e4586ed4d5215c42e7bd8db451ee49b37e868134d326a222f6", "pe.resource_types[0]": "RT_DIALOG", "pe.resource_types[1]": "RT_STRING", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "5.1", "pe.version.copyright": "Copyright © 2014", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8450, "pe.version.description": "Classic Java Plug-in 10.60.2 for Netscape and Mozilla", "pe.linker_major_version": 12, "pe.linker_minor_version": 1, "pe.version.file_version": "04.27.9.00", "pe.version.product_name": "Hill(ET) Uhjeuepi HI 7 A60", "build.toolchain.compiler": "msvc", "pe.version.internal_name": "Hill Etsq-hj", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.data_directories[0].rva": 239080, "pe.data_directories[1].rva": 299008, "pe.data_directories[2].rva": 4096, "pe.data_directories[3].rva": 323584, "pe.data_directories[4].rva": 1, "pe.data_directories[5].rva": 24576, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "0.4.279.00", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 21392, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 1, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 216, "pe.data_directories[4].name": "debug", "pe.data_directories[4].size": 56, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 48, "pe.rich.entries[0].build_id": 255, "pe.rich.entries[1].build_id": 120, "pe.rich.entries[2].build_id": 154, "pe.rich.entries[3].build_id": 158, "pe.rich.entries[4].build_id": 155, "pe.rich.entries[5].build_id": 261, "pe.rich.entries[6].build_id": 147, "pe.rich.entries[7].build_id": 157, "pe.rich.entries[8].build_id": 258, "pe.rich.entries[9].build_id": 223, "pe.rich.entries[0].use_count": 475, "pe.rich.entries[10].build_id": 259, "pe.rich.entries[11].build_id": 207, "pe.rich.entries[12].build_id": 1, "pe.rich.entries[14].build_id": 259, "pe.rich.entries[1].use_count": 175, "pe.rich.entries[2].use_count": 425, "pe.rich.entries[3].use_count": 482, "pe.rich.entries[4].use_count": 108, "pe.rich.entries[5].use_count": 346, "pe.rich.entries[6].use_count": 463, "pe.rich.entries[7].use_count": 326, "pe.rich.entries[8].use_count": 223, "pe.rich.entries[9].use_count": 197, "pe.version.original_filename": "hille10602.dll", "pe.coff.dos_header_pe_pointer": 316, "pe.rich.entries[0].product_id": 23918, "pe.rich.entries[10].use_count": 264, "pe.rich.entries[11].use_count": 447, "pe.rich.entries[12].use_count": 175, "pe.rich.entries[13].use_count": 25, "pe.rich.entries[14].use_count": 107, "pe.rich.entries[1].product_id": 50727, "pe.rich.entries[2].product_id": 40219, "pe.rich.entries[3].product_id": 40219, "pe.rich.entries[4].product_id": 40219, "pe.rich.entries[5].product_id": 23918, "pe.rich.entries[6].product_id": 21022, "pe.rich.entries[7].product_id": 40219, "pe.rich.entries[8].product_id": 25834, "pe.rich.entries[9].product_id": 40629, "pe.rich.entries[10].product_id": 23918, "pe.rich.entries[11].product_id": 60610, "pe.rich.entries[14].product_id": 23506, "pe.base_relocations.block_count": 4, "pe.base_relocations.entry_count": 90, "pe.base_relocations.padding_count": 2 }, "id": "pe", "sc": [ [ ".rdata0", 4096, 20480, 3.54, "r-x" ], [ ".Rdata", 24576, 217088, 7.86, "r-x" ], [ ".data", 241664, 4096, 5.1, "rw-" ], [ ".CRT", 245760, 53248, 7.72, "r--" ], [ ".rsrc", 299008, 24576, 3.77, "r--" ], [ ".reloc", 323584, 4096, 0.53, "r--" ] ] }, "id": 0, "sz": 327680, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 2014" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Classic Java Plug-in 10.60.2 for Netscape and Mozilla" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x4d82c" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "04.27.9.00" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025", "el": [ "0x3a734" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x3a6c8" ] }, { "c": 0.8199999928474426, "d": "Opaque generated DLL original filename", "e": [ "hille10602.dll" ], "i": "metadata/lang/compiler/generated::dotnet-generated-dll-original-filename", "l": 1, "el": [ "value:pe.version.original_filename" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Hill(ET) Uhjeuepi HI 7 A60" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2836.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2, "el": [ "0x3a70e" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x4d57e" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2836.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x4d616" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.9800000190734863, "d": "Oracle Java version-resource identity", "e": [ "{\"os\":\"unknown\",\"type\":\"dll\",\"company\":\"Oracle Corporation\",\"description\":\"Classic Java Plug-in 10.60.2 for Netscape and Mozilla" ], "i": "metadata/binary/vendor::oracle-java-versioninfo", "l": 1, "el": [ "value:pe.version" ] }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "0x6008" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "0.4.279.00" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 1.0, "d": "PE has RT_DIALOG in resources list", "e": [ "[RT_DIALOG, RT_STRING, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-dialog-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb.dll" ], "i": "objectives/evasion/masquerade/dll/name::dll-basename", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x4d7d2" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "04.27.9.00" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "DFBNKR.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "0x3a584" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x4e276" ] }, { "c": 0.949999988079071, "d": "Oracle Corporation string", "e": [ "Oracle Corporation" ], "i": "micro-behaviors/data/text/keywords/vendor::oracle-corporation-string", "l": 1, "el": [ "0x4d630" ] }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "0x3a728" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 2836.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2836.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x6010" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x4e2be" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x4d5da" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 7.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0x600c" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2, "el": [ "0x6000" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x4d65e" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2836.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-w", "l": 3, "el": [ "0x600c" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 7.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".Rdata (size: 217088, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.9900000095367432, "d": "Exactly seven imports", "e": [ "imports.count = 7.00" ], "i": "well-known/malware/worm/mydoom::metric-import-count-7", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 7.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "RasEnumAutodialAddressesW" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x3a6d8" ] }, { "c": 0.949999988079071, "d": "links user32 (GetFocus)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (GetModuleHandleW, LoadLibraryW, GetModuleHandleA)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "3 symbols" ] }, { "c": 0.949999988079071, "d": "links advapi32 (RegCloseKey)", "e": [ "advapi32" ], "i": "metadata/dylib::advapi32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links rasapi32 (RasEnumAutodialAddressesW)", "e": [ "rasapi32" ], "i": "metadata/dylib::rasapi32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links oleaut32 (ORDINAL 322)", "e": [ "oleaut32" ], "i": "metadata/dylib::oleaut32", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "04.27.9.00", "0.4.279.00" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version", "value:pe.version.product_version" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "0.4.279.00", "04.27.9.00" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.product_version", "value:pe.version.file_version" ] } ], "sha": "3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb", "path": "3ab48ca45cd8a40aa0100279752afd3e89003bb85bf420c8b1be62e019f4c9eb.dll", "type": "pe" } ], "tv": "52045" } }