{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9491884112358093, "class": 0 } ], "prob": 0.9491884, "class": 0, "models": [ { "m": "az", "prob": 0.9491884, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:08:33Z" }, "path": "498009", "raw": { "v": "4", "fs": [ { "f": "Md₂(Si)", "k": { "hash.imp": "31697196adb24b14834f36666bd8a416", "pe.timestamp": 760284611, "hash.authenti": "8fc348bd5abe862aae36b5fe36690592ad1e44431f998e900269fc10729ee107", "hash.rich_header": "3a4041c3cd93a66d55d50ba6d9a10b66378721aaddde16de09a9fdfe3b1466e4", "build.target_arch": "x86", "pe.linker_version": "11.8", "pe.resource_types[0]": "RT_VERSION", "pe.rich_header.xor_key": "0xd57e80d9", "pe.debug_entries[0].size": 41, "pe.debug_entries[0].type": "misc", "pe.debug_entries[1].size": 20, "pe.debug_entries[1].type": "vc_feature", "pe.data_directories[0].rva": 25296, "pe.data_directories[1].rva": 114688, "pe.data_directories[2].rva": 118784, "pe.data_directories[3].rva": 24672, "pe.data_directories[4].rva": 24576, "pe.data_directories[5].rva": 55296, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1032, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 492, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 56, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 96, "pe.data_directories[5].name": "delay_import", "pe.data_directories[5].size": 2344, "pe.debug_directory_types[0]": 4, "pe.debug_directory_types[1]": 12, "pe.version_info.company_name": "Microsoft Corporation", "pe.version_info.file_version": "5.1.7601.17514 (win7sp1_rtm.101119-1850)", "pe.version_info.product_name": "Microsoft® Windows® Operating System", "pe.debug_entries[0].timestamp": 1522240832, "pe.debug_entries[1].timestamp": 1522240832, "pe.version_info.internal_name": "storeview.exe", "pe.dll_characteristics.guard_cf": true, "pe.rich_header_compids[0].count": 7, "pe.rich_header_compids[1].count": 18, "pe.rich_header_compids[2].count": 1, "pe.rich_header_compids[3].count": 1, "pe.rich_header_compids[4].count": 1, "pe.version_info.legal_copyright": "© Microsoft Corporation. All rights reserved.", "pe.version_info.product_version": "5.1.7601.17514", "binary.top_complex_unnamed[0].cc": 15, "binary.top_complex_unnamed[1].cc": 13, "binary.top_complex_unnamed[2].cc": 11, "binary.top_complex_unnamed[3].cc": 8, "binary.top_complex_unnamed[4].cc": 8, "binary.top_complex_unnamed[5].cc": 8, "binary.top_complex_unnamed[6].cc": 7, "binary.top_complex_unnamed[7].cc": 7, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 9664521, "pe.rich_header_compids[1].compid": 65536, "pe.rich_header_compids[3].compid": 14373389, "pe.rich_header_compids[4].compid": 14569997, "pe.version_info.file_description": "Store View Mode Lock EXE", "binary.top_complex_unnamed[0].bbs": 31, "binary.top_complex_unnamed[1].bbs": 27, "binary.top_complex_unnamed[2].bbs": 24, "binary.top_complex_unnamed[3].bbs": 17, "binary.top_complex_unnamed[4].bbs": 15, "binary.top_complex_unnamed[5].bbs": 13, "binary.top_complex_unnamed[6].bbs": 14, "binary.top_complex_unnamed[7].bbs": 14, "pe.rich_header_compids[1].product": "Unknown", "pe.rich_header_compids[2].product": "Unknown", "pe.version_info.original_filename": "storeview.exe", "binary.top_complex_unnamed[0].addr": "0x40186f", "binary.top_complex_unnamed[0].size": 1865, "binary.top_complex_unnamed[1].addr": "0x40371d", "binary.top_complex_unnamed[1].size": 1491, "binary.top_complex_unnamed[2].addr": "0x4040e3", "binary.top_complex_unnamed[2].size": 840, "binary.top_complex_unnamed[3].addr": "0x402149", "binary.top_complex_unnamed[3].size": 1190, "binary.top_complex_unnamed[4].addr": "0x402d71", "binary.top_complex_unnamed[4].size": 493, "binary.top_complex_unnamed[5].addr": "0x402f5e", "binary.top_complex_unnamed[5].size": 414, "binary.top_complex_unnamed[6].addr": "0x403cf0", "binary.top_complex_unnamed[6].size": 701, "binary.top_complex_unnamed[7].addr": "0x40324d", "binary.top_complex_unnamed[7].size": 641, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".qdata", "pe.section_characteristics[2].name": ".rdata", "pe.section_characteristics[3].name": ".data", "pe.section_characteristics[4].name": ".CRT", "pe.section_characteristics[5].name": ".rsrc", "pe.section_characteristics[6].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 7, "pe.rich_header.entries[1].use_count": 18, "pe.rich_header.entries[2].use_count": 1, "pe.rich_header.entries[3].use_count": 1, "pe.rich_header.entries[4].use_count": 1, "pe.rich_header.entries[0].product_id": 147, "pe.rich_header.entries[1].product_id": 1, "pe.rich_header.entries[3].product_id": 219, "pe.rich_header.entries[4].product_id": 222, "pe.rich_header.entries[0].build_number": 30729, "pe.rich_header.entries[0].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[1].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 21005, "pe.rich_header.entries[3].product_name": "C_VS2012", "pe.rich_header.entries[4].build_number": 21005, "pe.rich_header.entries[4].product_name": "Linker_VS2012_LTCG", "pe.section_characteristics[0].raw_size": 13824, "pe.section_characteristics[1].raw_size": 1024, "pe.section_characteristics[2].raw_size": 1536, "pe.section_characteristics[3].raw_size": 2560, "pe.section_characteristics[4].raw_size": 74752, "pe.section_characteristics[5].raw_size": 1536, "pe.section_characteristics[6].raw_size": 512, "pe.section_characteristics[0].virtual_size": 13596, "pe.section_characteristics[1].virtual_size": 659, "pe.section_characteristics[2].virtual_size": 1374, "pe.section_characteristics[3].virtual_size": 6636, "pe.section_characteristics[4].virtual_size": 74474, "pe.section_characteristics[5].virtual_size": 1032, "pe.section_characteristics[6].virtual_size": 492, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 20480, "pe.section_characteristics[2].virtual_address": 24576, "pe.section_characteristics[3].virtual_address": 28672, "pe.section_characteristics[4].virtual_address": 36864, "pe.section_characteristics[5].virtual_address": 114688, "pe.section_characteristics[6].virtual_address": 118784, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "60000020", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "c0000040", "pe.section_characteristics[4].characteristics_hex": "40000040", "pe.section_characteristics[5].characteristics_hex": "40000040", "pe.section_characteristics[6].characteristics_hex": "42000040" }, "x": 6, "id": 0, "is": [ "AnimateWindow", "GetSysColorBrush", "GetThreadDesktop", "SetCursor", "GetUserObjectInformationA", "WaitForInputIdle", "EnumJobsW", "GetColorProfileHeader", "JetMakeKey", "GetSystemDefaultLocaleName", "LocalLock", "GetSystemTimeAsFileTime", "WriteTapemark", "WaitForSingleObject", "GetFileTime", "GetCurrentThreadId", "GetConsoleScreenBufferInfo", "DeleteTimerQueueEx", "GetCommandLineA" ], "ms": { "pe": { "entry": 21034.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 760284611.0, "image_base": 4194304.0, "rsrc_entropy": 2.51, "entry_section": ".qdata", "size_of_image": 122880.0, "file_alignment": 512.0, "has_vc_feature": true, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 258.0, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 5.0, "computed_checksum": 112014.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "timestamp_pre_2000": true, "debug_timestamp_max": 1522240832.0, "debug_timestamp_min": 1522240832.0, "dll_characteristics": 49472.0, "has_export_timestamp": false, "linker_major_version": 11.0, "linker_minor_version": 8.0, "debug_directory_types": [ 4.0, 12.0 ], "has_resource_timestamp": false, "debug_directory_entries": 2.0, "delay_load_import_count": 1.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "entry_in_nonstandard_section": true, "debug_timestamp_nonzero_count": 2.0 }, "file": { "size": 96768.0 }, "binary": { "code_size": 14848.0, "func_count": 34.0, "code_entropy": 5.26, "data_entropy": 5.85, "func_density": 2.34, "import_count": 19.0, "string_count": 86.0, "avg_func_size": 407.0, "section_count": 7.0, "avg_complexity": 4.56, "import_density": 1.31, "max_complexity": 15.0, "string_density": 5.93, "overall_entropy": 5.48, "avg_basic_blocks": 8.35, "avg_section_size": 13677.71, "dependency_count": 5.0, "entropy_variance": 1.7, "avg_string_length": 12.97, "complexity_per_kb": 0.31, "max_string_length": 46.0, "wide_string_count": 18.0, "avg_string_entropy": 2.94, "code_to_data_ratio": 0.18, "data_to_file_ratio": 0.03, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.14, "total_basic_blocks": 284.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 9.97, "debug_reference_count": 2.0, "largest_section_ratio": 0.77, "sentence_string_count": 4.0, "sentence_string_ratio": 0.05, "writable_section_count": 1.0, "executable_section_count": 2.0, "nonstandard_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 116, "xor", "ihy_WerObjec" ], [ 184, "Rich" ], [ 456, ".text" ], [ 575, "@.data" ], [ 616, ".CRT" ], [ 655, "@.rsrc" ], [ 695, "@.reloc" ], [ 1010, "xor", "GetUserObjectI;" ], [ 7398, "xor", "Aj搴!Vcbjec" ], [ 7411, "D$()" ], [ 10087, "|$()" ], [ 12002, "L$()" ], [ 14805, "xor", "GetUserObjectInformationAGetUserObjectInfor8" ], [ 16035, "HDPC" ], [ 16040, "6547547" ], [ 16048, "strdline" ], [ 16448, "RSDS" ], [ 16472, "tz_SS_k47gSjm.pdb" ], [ 16810, "GetUserObjectInformationA" ], [ 16838, "GetSysColorBrush" ], [ 16858, "GetThreadDesktop" ], [ 16878, "SetCursor" ], [ 16890, "WaitForInputIdle" ], [ 16910, "AnimateWindow" ], [ 16924, "USER32.dll" ], [ 16948, "WINSPOOL.DRV" ], [ 16964, "GetColorProfileHeader" ], [ 16986, "mscms.dll" ], [ 17010, "ESENT.dll" ], [ 17022, "DeleteTimerQueueEx" ], [ 17044, "GetConsoleScreenBufferInfo" ], [ 17074, "GetCurrentThreadId" ], [ 17096, "GetFileTime" ], [ 17110, "GetCommandLineA" ], [ 17128, "WriteTapemark" ], [ 17144, "GetSystemTimeAsFileTime" ], [ 17170, "LocalLock" ], [ 17182, "GetSystemDefaultLocaleName" ], [ 17212, "WaitForSingleObject" ], [ 17232, "KERNEL32.dll" ], [ 24338, "xor", "GetUserObjecG0N" ], [ 34474, "7EKC" ], [ 35982, "x3y 2" ], [ 39277, "Zsyu" ], [ 41260, "AOT5" ], [ 43359, "39OG" ], [ 44258, "uXAOGSS" ], [ 50843, "2I2K" ], [ 56462, "f2l7" ], [ 59221, "u5v7" ], [ 59424, "D7XS" ], [ 63807, ".plj" ], [ 64740, "Xyhh" ], [ 69019, "DJRZ" ], [ 70675, "rx7i" ], [ 70824, "8O0C" ], [ 72723, "ts75" ], [ 73234, "406X" ], [ 80297, "xor", "GetUserObjectIn0micUV)BҊ" ], [ 82127, "3J4AUS" ], [ 87453, "DEHA" ], [ 89839, "X_705" ], [ 94822, "wide", "VS_VERSION_INFO" ], [ 94914, "wide", "StringFileInfo" ], [ 94974, "wide", "CompanyName" ], [ 95000, "wide", "Microsoft Corporation" ], [ 95050, "wide", "FileDescription" ], [ 95084, "wide", "Store View Mode Lock EXE" ], [ 95142, "wide", "FileVersion" ], [ 95168, "wide", "5.1.7601.17514 (win7sp1_rtm.101119-1850)" ], [ 95186, "xor", "veCUFeCOVjEc\\I" ], [ 95224, "xor", "veDUBeCOSj\\cYI_" ], [ 95258, "wide", "InternalName" ], [ 95284, "wide", "storeview.exe" ], [ 95318, "wide", "LegalCopyright" ], [ 95348, "wide", "© Microsoft Corporation. All rights reserved." ], [ 95446, "wide", "OriginalFilename" ], [ 95514, "wide", "ProductName" ], [ 95540, "wide", "Microsoft® Windows® Operating System" ], [ 95622, "wide", "ProductVersion" ], [ 95690, "wide", "VarFileInfo" ], [ 95722, "wide", "Translation" ], [ 96230, "xor", "GetUserObjectInformationAGedUsIrOb}W~FY]0\\" ], [ 96408, "xor", "G5tU_erOyZ\"S*y" ], [ 96511, "xor", "uiFEAq@WPvWCF" ] ], "sz": 96768, "ts": [ { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 122880.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8500000238418579, "d": "Windows spooler library dependency", "e": [ "WINSPOOL.DRV" ], "i": "micro-behaviors/os/service/export::winspool-drv-dependency", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.48" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "Control Flow Guard enabled", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-cfg", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "498009" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.94" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 2560)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004" }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "© Microsoft Corporation. All rights reserved." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.56" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Store View Mode Lock EXE" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.94" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48", "40" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.77" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "5.1.7601.17514 (win7sp1_rtm.101119-1850)" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Windows operating system product string", "e": [ "Microsoft® Windows® Operating System" ], "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 760284611.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "tz_SS_k47gSjm.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Microsoft® Windows® Operating System" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.03" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "GetConsoleScreenBufferInfo API", "e": [ "GetConsoleScreenBufferInfo" ], "i": "micro-behaviors/os/sysinfo/console::console-screen-buffer-info", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 34.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 34.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.02" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.77" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 19.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".data (entropy: 7.25, perms: rw-)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemDefaultLocaleName", "GetUserObjectInformationAGedUsIrOb", "GetConsoleScreenBufferInfo", "GetSystemTimeAsFileTime", "GetUserObjectInformationA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation.", "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp predates 2000", "e": [ "pe.timestamp_pre_2000 = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "l": 1 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 19.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 19.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Packed loader code-to-data ratio below 0.4", "e": [ "binary.code_to_data_ratio = 0.18" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-low-code-to-data-ratio", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.code_to_data_ratio = 0.18" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-0--inline-29187", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data (entropy: 7.25, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.77" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "binary.code_to_data_ratio = 0.18" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-0--inline-29196", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links USER32.dll (AnimateWindow, GetSysColorBrush, GetThreadDesktop, SetCursor, GetUserObjectInformationA, ... +1 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ESENT.dll (JetMakeKey)", "e": [ "ESENT.dll" ], "i": "metadata/dylib::esent/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINSPOOL.DRV (EnumJobsW)", "e": [ "WINSPOOL.DRV" ], "i": "metadata/dylib::winspool/drv", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetSystemDefaultLocaleName, LocalLock, GetSystemTimeAsFileTime, WriteTapemark, WaitForSingleObject, ... +5 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links mscms.dll (GetColorProfileHeader)", "e": [ "mscms.dll" ], "i": "metadata/dylib::mscms/dll", "l": 2 }, { "c": 1.0, "d": "Modern PE hardening (ASLR + DEP + CFG)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-modern-hardening", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor → base64", "e": [ "\u003cbinary data\u003e \u003cxor+base64\u003e" ], "i": "metadata/encoded-payload/xor-base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "GetUserObjectInformationAGedUsIrOb}W~FY] \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "3ce50b63191ae563f6b8e8f2fcd99b995b012b055ce50cd8a6e7ea4bf13d58df", "path": "498009", "type": "pe" } ], "tv": "46790" } }