{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9134063720703125 } ], "prob": 0.9134064, "models": [ { "m": "az", "raw": 0.36332753, "prob": 0.9134064, "class": 0 }, { "m": "az/source", "raw": 0.019869944, "prob": 0.27272728, "class": 0 }, { "m": "az/c", "raw": 0.009224345, "prob": 0.01607717, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-07T17:31:00Z" }, "path": "Harvester.cpp", "raw": { "v": "6", "fs": [ { "f": "H₂(FPo₂)", "x": 4, "ff": { "i": [ [ "", "strstr" ], [ "", "strstr" ], [ "", "CreateThread" ], [ "", "fopen" ], [ "", "fgetc" ], [ "", "fclose" ], [ "", "fopen" ], [ "", "fgetc" ], [ "", "ftell" ], [ "", "fseek" ], [ "", "fgetc" ], [ "", "rewind" ], [ "", "fseek" ], [ "", "fgetc" ], [ "", "fclose" ], [ "", "fgetc" ], [ "", "massmail_it" ], [ "", "fclose" ], [ "", "RegOpenKeyEx" ], [ "", "RegQueryValueEx" ], [ "", "RegCloseKey" ], [ "", "CreateFile" ], [ "", "CreateFileMapping" ], [ "", "CloseHandle" ], [ "", "MapViewOfFile" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "int" ], [ "", "MAKELONG" ], [ "", "MAKEWORD" ], [ "", "MAKEWORD" ], [ "", "massmail_it" ], [ "", "CloseHandle" ], [ "", "UnmapViewOfFile" ], [ "", "CloseHandle" ], [ "", "GetModuleHandle" ], [ "", "GetModuleFileName" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CopyFile" ], [ "", "CharLower" ], [ "", "strstr" ], [ "", "copy_to" ], [ "", "lstrcpyn" ], [ "", "CharLower" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "lstrcmp" ], [ "", "harvest_textfile" ], [ "", "strcpy" ], [ "", "strlen" ], [ "", "memset" ], [ "", "FindFirstFile" ], [ "", "FindNextFile" ], [ "", "lstrcpy" ], [ "", "strlen" ], [ "", "recursive" ], [ "", "p2p_in" ], [ "", "harvest_extensions" ], [ "", "FindClose" ], [ "", "memset" ], [ "", "strcpy" ], [ "", "GetDriveType" ], [ "", "Sleep" ], [ "", "recursive" ], [ "", "harvest_wab" ], [ "", "harvest_disks" ], [ "", "\u003cstdio.h\u003e" ], [ "", "\u003cwindows.h\u003e" ], [ "", "mailer.h" ] ], "m": { "ast": { "op.eq": 39.0, "op.ge": 7.0, "op.le": 9.0, "op.lt": 4.0, "op.ne": 6.0, "op.add": 13.0, "op.lor": 8.0, "op.mul": 7.0, "op.sub": 5.0, "op.band": 8.0, "op.land": 8.0, "op.lnot": 4.0, "max_depth": 16.0, "op.concat": 6.0, "bind_count": 35.0, "call_count": 135.0, "node_count": 3514.0, "member_count": 3.0, "op_density.eq": 0.01, "op_density.ge": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 126.0, "member_depth_max": 2.0, "op_density.concat": 0.0, "string_literal_count": 56.0, "array_literal_max_length": 15.0, "string_concat_chain_max_length": 4.0 }, "file": { "size": 10111.0, "entropy": 5.35, "size_bytes": 10111.0 }, "text": { "tab_count": 252.0, "digit_ratio": 0.08, "space_count": 1694.0, "total_lines": 453.0, "char_entropy": 5.35, "mixed_indent": 1.0, "unique_chars": 90.0, "escape_density": 0.02, "string_density": 0.12, "ascii_art_lines": 2.0, "avg_line_length": 20.74, "max_line_length": 127.0, "empty_line_ratio": 0.24, "last_line_length": 1.0, "whitespace_ratio": 0.26, "most_common_ratio": 0.05, "identifier_density": 1.28, "line_length_stddev": 21.18, "octal_escape_count": 2.0, "normalized_string_count": 2.63, "repeated_char_sequences": 19.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 51.0, "trailing_whitespace_lines": 104.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 14.28 }, "binds": { "count": 35.0 }, "calls": { "count": 135.0 }, "binary": { "overall_entropy": 5.35 }, "source": { "function_count": 9.0 }, "imports": { "count": 3.0, "unique_modules": 3.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "members": { "count": 3.0 }, "strings": { "total": 56.0, "avg_length": 18.43, "max_length": 78.0, "avg_entropy": 2.3, "empty_count": 1.0, "total_bytes": 1032.0, "entropy_stddev": 1.09 }, "comments": { "chars": 934.0, "lines": 23.0, "total": 9.0, "to_code_ratio": 0.05 }, "functions": { "count": 9.0 }, "identifiers": { "count": 126.0, "total": 581.0, "avg_length": 7.83, "max_length": 24.0, "min_length": 1.0, "avg_entropy": 2.36, "reuse_ratio": 0.22, "unique_count": 126.0, "length_stddev": 4.62, "has_digit_ratio": 0.19, "sequential_names": 4.0, "single_char_count": 4.0, "single_char_ratio": 0.03, "high_entropy_count": 3.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.44, "all_uppercase_ratio": 0.18, "numeric_suffix_count": 21.0 } }, "s": [ [ 9, "u8", "\u003cstdio.h\u003e" ], [ 32, "u8", "\u003cwindows.h\u003e" ], [ 55, "u8", "mailer.h" ], [ 56, "u8", "mailer.h" ], [ 143, "u8", "@symantec" ], [ 144, "u8", "@symantec" ], [ 156, "u8", "@panda" ], [ 157, "u8", "@panda" ], [ 166, "u8", "@avp" ], [ 167, "u8", "@avp" ], [ 174, "u8", "@microsoft" ], [ 175, "u8", "@microsoft" ], [ 193, "u8", "@msn" ], [ 194, "u8", "@msn" ], [ 201, "u8", "@sopho" ], [ 202, "u8", "@sopho" ], [ 211, "u8", "@mm" ], [ 212, "u8", "@mm" ], [ 218, "u8", "@norman" ], [ 219, "u8", "@norman" ], [ 229, "u8", "@norton" ], [ 230, "u8", "@norton" ], [ 240, "u8", "@noreply" ], [ 241, "u8", "@noreply" ], [ 252, "u8", "@virusli" ], [ 253, "u8", "@virusli" ], [ 264, "u8", "@fsecure" ], [ 265, "u8", "@fsecure" ], [ 279, "u8", "@hotmail" ], [ 280, "u8", "@hotmail" ], [ 297, "u8", "\\n\\n\\n" ], [ 338, "10", "0" ], [ 432, "u8", "." ], [ 433, "u8", "." ], [ 479, "10", "0" ], [ 482, "10", "0" ], [ 511, "10", "0" ], [ 846, "10", "0" ], [ 867, "10", "0" ], [ 887, "10", "200" ], [ 921, "10", "0" ], [ 970, "u8", "rb" ], [ 971, "u8", "rb" ], [ 1003, "10", "0" ], [ 1157, "u8", "rb" ], [ 1158, "u8", "rb" ], [ 1184, "10", "0" ], [ 1213, "10", "0" ], [ 1355, "10", "1" ], [ 1377, "10", "1" ], [ 1412, "10", "0" ], [ 1642, "10", "0" ], [ 1746, "10", "0" ], [ 1860, "10", "0" ], [ 1926, "10", "0" ], [ 1975, "10", "1" ], [ 2017, "10", "1" ], [ 2059, "10", "1" ], [ 2101, "10", "1" ], [ 2143, "10", "1" ], [ 2373, "10", "0" ], [ 3154, "10", "800" ], [ 3205, "u8", "Software\\\\Microsoft\\\\WAB\\\\WAB4\\\\Wab File Name" ], [ 3206, "u8", "Software" ], [ 3216, "u8", "Microsoft" ], [ 3227, "u8", "WAB" ], [ 3232, "u8", "WAB4" ], [ 3238, "u8", "Wab File Name" ], [ 3255, "10", "0" ], [ 3334, "10", "0" ], [ 3336, "10", "0" ], [ 3603, "10", "0" ], [ 3619, "10", "0" ], [ 3621, "10", "0" ], [ 3623, "10", "0" ], [ 3696, "10", "0" ], [ 3763, "10", "0" ], [ 3765, "10", "0" ], [ 3767, "10", "0" ], [ 3870, "10", "0" ], [ 3918, "16", "100" ], [ 3968, "16", "96" ], [ 3983, "16", "97" ], [ 4042, "16", "98" ], [ 4057, "16", "99" ], [ 4087, "10", "300" ], [ 4107, "10", "0" ], [ 4138, "10", "0" ], [ 4149, "10", "68" ], [ 4158, "10", "68" ], [ 4180, "10", "0" ], [ 4186, "10", "68" ], [ 4271, "10", "2" ], [ 4305, "10", "68" ], [ 4316, "10", "0" ], [ 4474, "10", "0" ], [ 4496, "10", "256" ], [ 4548, "10", "256" ], [ 5074, "10", "256" ], [ 5488, "u8", "\\\\ACDSEE10.exe" ], [ 5491, "u8", "ACDSEE10.exe" ], [ 5521, "u8", "\\\\Adobe Photoshop Full Version.exe" ], [ 5524, "u8", "Adobe Photoshop Full Version.exe" ], [ 5575, "u8", "\\\\Cisco source code.zip .exe" ], [ 5578, "u8", "Cisco source code.zip .exe" ], [ 5645, "u8", "\\\\WinAmp 6.exe" ], [ 5648, "u8", "WinAmp 6.exe" ], [ 5679, "u8", "\\\\WinRAR.exe" ], [ 5682, "u8", "WinRAR.exe" ], [ 5711, "u8", "\\\\Windows Longhorn Beta.exe" ], [ 5714, "u8", "Windows Longhorn Beta.exe" ], [ 5758, "u8", "\\\\WINDOWS SOURCE CODE.zip .exe" ], [ 5761, "u8", "WINDOWS SOURCE CODE.zip .exe" ], [ 5835, "u8", "\\\\jenna jameson screensaver.scr" ], [ 5838, "u8", "jenna jameson screensaver.scr" ], [ 5886, "u8", "\\\\Opera Registered version.exe" ], [ 5889, "u8", "Opera Registered version.exe" ], [ 5937, "u8", "\\\\Snood new version.exe" ], [ 5940, "u8", "Snood new version.exe" ], [ 5981, "u8", "\\\\Brianna banks and jenna jameson.mpeg .exe" ], [ 5984, "u8", "Brianna banks and jenna jameson.mpeg .exe" ], [ 6068, "u8", "\\\\Norton AntiVirus 2004.exe" ], [ 6071, "u8", "Norton AntiVirus 2004.exe" ], [ 6116, "u8", "\\\\Battlefield 1942.exe" ], [ 6119, "u8", "Battlefield 1942.exe" ], [ 6159, "u8", "\\\\NETSKY SOURCE CODE.zip .exe" ], [ 6162, "u8", "NETSKY SOURCE CODE.zip .exe" ], [ 6243, "u8", "\\\\Kazaa Lite.zip .exe" ], [ 6246, "u8", "Kazaa Lite.zip .exe" ], [ 6318, "u8", "\\\\Windows crack.zip .exe" ], [ 6321, "u8", "Windows crack.zip .exe" ], [ 6408, "u8", "\\\\Teen Porn.mpeg .exe" ], [ 6411, "u8", "Teen Porn.mpeg .exe" ], [ 6494, "u8", "\\\\Britney spears naked.jpeg .exe" ], [ 6497, "u8", "Britney spears naked.jpeg .exe" ], [ 6589, "u8", "\\\\DVD Xcopy xpress.exe" ], [ 6592, "u8", "DVD Xcopy xpress.exe" ], [ 6632, "u8", "\\\\Visual Studio.NET.zip .exe" ], [ 6635, "u8", "Visual Studio.NET.zip .exe" ], [ 6745, "10", "0" ], [ 6773, "10", "0" ], [ 6801, "10", "0" ], [ 6829, "10", "0" ], [ 6857, "10", "0" ], [ 6885, "10", "0" ], [ 6913, "10", "0" ], [ 6941, "10", "0" ], [ 6969, "10", "0" ], [ 6998, "10", "0" ], [ 7027, "10", "0" ], [ 7056, "10", "0" ], [ 7085, "10", "0" ], [ 7114, "10", "0" ], [ 7143, "10", "0" ], [ 7172, "10", "0" ], [ 7201, "10", "0" ], [ 7230, "10", "0" ], [ 7259, "10", "0" ], [ 7288, "10", "0" ], [ 7400, "u8", "shar" ], [ 7401, "u8", "shar" ], [ 7586, "10", "0" ], [ 7623, "10", "255" ], [ 7685, "10", "0" ], [ 7702, "10", "0" ], [ 7707, "10", "0" ], [ 7762, "10", "1" ], [ 7783, "10", "1" ], [ 7829, "10", "1" ], [ 7861, "u8", "html" ], [ 7862, "u8", "html" ], [ 7872, "10", "0" ], [ 7905, "u8", "htm" ], [ 7906, "u8", "htm" ], [ 7915, "10", "0" ], [ 7948, "u8", "txt" ], [ 7949, "u8", "txt" ], [ 7958, "10", "0" ], [ 7992, "u8", "xml" ], [ 7993, "u8", "xml" ], [ 8002, "10", "0" ], [ 8036, "u8", "doc" ], [ 8037, "u8", "doc" ], [ 8046, "10", "0" ], [ 8080, "u8", "rtf" ], [ 8081, "u8", "rtf" ], [ 8090, "10", "0" ], [ 8124, "u8", "jsp" ], [ 8125, "u8", "jsp" ], [ 8134, "10", "0" ], [ 8168, "u8", "asp" ], [ 8169, "u8", "asp" ], [ 8178, "10", "0" ], [ 8212, "u8", "jsp" ], [ 8213, "u8", "jsp" ], [ 8222, "10", "0" ], [ 8256, "u8", "adb" ], [ 8257, "u8", "adb" ], [ 8266, "10", "0" ], [ 8299, "u8", "dbx" ], [ 8300, "u8", "dbx" ], [ 8309, "10", "0" ], [ 8328, "10", "0" ], [ 8353, "10", "0" ], [ 8359, "10", "0" ], [ 8373, "10", "0" ], [ 8400, "10", "0" ], [ 8416, "10", "1" ], [ 8528, "10", "280" ], [ 8595, "10", "0" ], [ 8624, "10", "1" ], [ 8637, "10", "0" ], [ 8643, "10", "0" ], [ 8653, "10", "1" ], [ 8707, "10", "1" ], [ 8734, "u8", "\\\\" ], [ 8757, "u8", "*.*" ], [ 8758, "u8", "*.*" ], [ 8781, "10", "0" ], [ 8813, "10", "0" ], [ 8838, "10", "0" ], [ 8939, "10", "0" ], [ 8959, "10", "0" ], [ 9029, "10", "0" ], [ 9065, "10", "0" ], [ 9104, "10", "1" ], [ 9110, "10", "0" ], [ 9150, "10", "1" ], [ 9185, "10", "2" ], [ 9191, "10", "0" ], [ 9273, "10", "1" ], [ 9300, "u8", "\\\\" ], [ 9461, "10", "1" ], [ 9597, "10", "0" ], [ 9628, "10", "0" ], [ 9709, "10", "0" ], [ 9748, "10", "0" ], [ 9768, "10", "1" ], [ 9771, "u8", "\\\\" ], [ 9794, "10", "0" ], [ 9813, "10", "0" ], [ 9829, "10", "0" ], [ 9854, "10", "0" ], [ 10008, "10", "3000" ], [ 10035, "10", "15" ] ], "v": { "file.stem": "Harvester", "file.basename": "Harvester.cpp", "source.language": "c", "source.imports[0]": "\u003cstdio.h\u003e", "source.imports[1]": "\u003cwindows.h\u003e", "source.imports[2]": "CharLower", "source.imports[3]": "CloseHandle", "source.imports[4]": "CopyFile", "source.imports[5]": "CreateFile", "source.imports[6]": "CreateFileMapping", "source.imports[7]": "CreateThread", "source.imports[8]": "FindClose", "source.imports[9]": "FindFirstFile", "source.strings[0]": "\u003cstdio.h\u003e", "source.strings[1]": "\u003cwindows.h\u003e", "source.strings[2]": "@fsecure", "source.strings[3]": "@hotmail", "source.strings[4]": "@microsoft", "source.strings[5]": "@noreply", "source.strings[6]": "@norman", "source.strings[7]": "@norton", "source.strings[8]": "@panda", "source.strings[9]": "@sopho", "source.has_imports": true, "source.imports[10]": "FindNextFile", "source.imports[11]": "GetDriveType", "source.imports[12]": "GetModuleFileName", "source.imports[13]": "GetModuleHandle", "source.imports[14]": "MAKELONG", "source.imports[15]": "MAKEWORD", "source.imports[16]": "MapViewOfFile", "source.imports[17]": "RegCloseKey", "source.imports[18]": "RegOpenKeyEx", "source.imports[19]": "RegQueryValueEx", "source.imports[20]": "Sleep", "source.imports[21]": "UnmapViewOfFile", "source.imports[22]": "copy_to", "source.imports[23]": "fclose", "source.imports[24]": "fgetc", "source.imports[25]": "fopen", "source.imports[26]": "fseek", "source.imports[27]": "ftell", "source.imports[28]": "harvest_disks", "source.imports[29]": "harvest_extensions", "source.imports[30]": "harvest_textfile", "source.imports[31]": "harvest_wab", "source.imports[32]": "int", "source.imports[33]": "lstrcmp", "source.imports[34]": "lstrcpy", "source.imports[35]": "lstrcpyn", "source.imports[36]": "mailer.h", "source.imports[37]": "massmail_it", "source.imports[38]": "memset", "source.imports[39]": "p2p_in", "source.imports[40]": "recursive", "source.imports[41]": "rewind", "source.imports[42]": "strcat", "source.imports[43]": "strcpy", "source.imports[44]": "strlen", "source.imports[45]": "strstr", "source.strings[10]": "@symantec", "source.strings[11]": "@virusli", "source.strings[12]": "ACDSEE10.exe", "source.strings[13]": "Adobe Photoshop Full Version.exe", "source.strings[14]": "Battlefield 1942.exe", "source.strings[15]": "Brianna banks and jenna jameson.mpeg .exe", "source.strings[16]": "Britney spears naked.jpeg .exe", "source.strings[17]": "Cisco source code.zip .exe", "source.strings[18]": "DVD Xcopy xpress.exe", "source.strings[19]": "Kazaa Lite.zip .exe", "source.strings[20]": "Microsoft", "source.strings[21]": "NETSKY SOURCE CODE.zip .exe", "source.strings[22]": "Norton AntiVirus 2004.exe", "source.strings[23]": "Opera Registered version.exe", "source.strings[24]": "Snood new version.exe", "source.strings[25]": "Software", "source.strings[26]": "Software\\\\Microsoft\\\\WAB\\\\WAB4\\\\Wab File Name", "source.strings[27]": "Teen Porn.mpeg .exe", "source.strings[28]": "Visual Studio.NET.zip .exe", "source.strings[29]": "WINDOWS SOURCE CODE.zip .exe", "source.strings[30]": "Wab File Name", "source.strings[31]": "WinAmp 6.exe", "source.strings[32]": "WinRAR.exe", "source.strings[33]": "Windows Longhorn Beta.exe", "source.strings[34]": "Windows crack.zip .exe", "source.strings[35]": "\\\\ACDSEE10.exe", "source.strings[36]": "\\\\Adobe Photoshop Full Version.exe", "source.strings[37]": "\\\\Battlefield 1942.exe", "source.strings[38]": "\\\\Brianna banks and jenna jameson.mpeg .exe", "source.strings[39]": "\\\\Britney spears naked.jpeg .exe", "source.strings[40]": "\\\\Cisco source code.zip .exe", "source.strings[41]": "\\\\DVD Xcopy xpress.exe", "source.strings[42]": "\\\\Kazaa Lite.zip .exe", "source.strings[43]": "\\\\NETSKY SOURCE CODE.zip .exe", "source.strings[44]": "\\\\Norton AntiVirus 2004.exe", "source.strings[45]": "\\\\Opera Registered version.exe", "source.strings[46]": "\\\\Snood new version.exe", "source.strings[47]": "\\\\Teen Porn.mpeg .exe", "source.strings[48]": "\\\\Visual Studio.NET.zip .exe", "source.strings[49]": "\\\\WINDOWS SOURCE CODE.zip .exe", "source.strings[50]": "\\\\WinAmp 6.exe", "source.strings[51]": "\\\\WinRAR.exe", "source.strings[52]": "\\\\Windows Longhorn Beta.exe", "source.strings[53]": "\\\\Windows crack.zip .exe", "source.strings[54]": "\\\\jenna jameson screensaver.scr", "source.strings[55]": "\\n\\n\\n", "source.strings[56]": "jenna jameson screensaver.scr", "source.strings[57]": "mailer.h", "source.functions[0]": "copy_to(char *p2p)", "source.functions[1]": "harvest_disks()", "source.functions[2]": "harvest_extensions(const char *destination, WIN32_FIND_DATA *finder)", "source.functions[3]": "harvest_main()", "source.functions[4]": "harvest_textfile(const char *text_file)", "source.functions[5]": "harvest_wab()", "source.functions[6]": "massmail_it(char *address)", "source.functions[7]": "p2p_in(char *path)", "source.functions[8]": "recursive(const char *path, int max_level)" }, "ct": [ "CharLower", "CloseHandle", "CopyFile", "CreateFile", "CreateFileMapping", "CreateThread", "FindClose", "FindFirstFile", "FindNextFile", "GetDriveType", "GetModuleFileName", "GetModuleHandle", "MAKELONG", "MAKEWORD", "MapViewOfFile", "RegCloseKey", "RegOpenKeyEx", "RegQueryValueEx", "Sleep", "UnmapViewOfFile", "copy_to", "fclose", "fgetc", "fopen", "fseek", "ftell", "harvest_disks", "harvest_extensions", "harvest_textfile", "harvest_wab", "int", "lstrcmp", "lstrcpy", "lstrcpyn", "massmail_it", "memset", "p2p_in", "recursive", "rewind", "strcat", "strcpy", "strlen", "strstr" ], "id": "c", "mc": [ "data.cFileName", "data.dwFileAttributes", "finder.cFileName" ] }, "id": 0, "sz": 10111, "ts": [ { "c": 0.8799999952316284, "d": "FindNextFile ANSI call in C source", "e": [ "FindNextFile" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-undecorated-source", "l": 2, "el": [ "2326" ] }, { "c": 0.8999999761581421, "d": "CreateThread usage in source", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread-source", "l": 3 }, { "c": 0.9700000286102295, "d": "Validation vocabulary number", "e": [ "number" ], "i": "metadata/file/text/format::vocab-number", "l": 1 }, { "c": 0.8799999952316284, "d": "FindFirstFile ANSI call in C source", "e": [ "FindFirstFile" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-undecorated-source", "l": 2, "el": [ "229d" ] }, { "c": 0.8999999761581421, "d": "Get module handle", "e": [ "GetModuleHandle" ], "i": "micro-behaviors/process/info/thread::get-module-handle", "l": 3 }, { "a": "T1497.001", "c": 0.8999999761581421, "d": "RegOpenKeyEx source call", "e": [ "RegOpenKeyEx" ], "i": "objectives/anti-analysis/vm-detect/registry::reg-open-key-source", "l": 1, "m": "B0009", "el": [ "c5c" ] }, { "c": 0.8799999952316284, "d": "Source or test deletion target", "e": [ "source code" ], "i": "micro-behaviors/data/text/keywords/lexicon::target-source-test", "l": 1 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2, "el": [ "3b9" ] }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2, "el": [ "d1f" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Delay execution with Sleep in source", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-source", "l": 2, "el": [ "2712" ] }, { "c": 0.699999988079071, "d": "antivirus keyword", "e": [ "AntiVirus" ], "i": "micro-behaviors/data/text/keywords/lexicon::antivirus-keyword", "l": 1 }, { "a": "T1497.001", "c": 0.8999999761581421, "d": "RegQueryValueEx source call", "e": [ "RegQueryValueEx" ], "i": "objectives/anti-analysis/vm-detect/registry::reg-query-value-source", "l": 1, "m": "B0009", "el": [ "cdd" ] }, { "a": "T1083", "c": 0.8799999952316284, "d": "GetDriveType API in source", "e": [ "GetDriveType" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type-source", "l": 2, "el": [ "26a1" ] }, { "c": 0.8799999952316284, "d": "Codebase deletion target", "e": [ "code" ], "i": "micro-behaviors/data/text/keywords/lexicon::target-codebase", "l": 1 }, { "a": "T1547.001", "c": 0.8500000238418579, "d": "HKCU registry hive string", "e": [ "HKEY_CURRENT_USER" ], "i": "objectives/persistence/login/startup/registry::hkcu-registry-hive", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary email", "e": [ "email" ], "i": "metadata/file/text/format::vocab-email", "l": 1 }, { "c": 0.6200000047683716, "d": "fopen API string", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen-text", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory walker using ANSI undecorated Win32 find", "e": [ "FindFirstFile", "FindNextFile" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-undecorated-source-walker", "l": 3, "el": [ "229d", "2326" ] } ], "sha": "3e1de9e9a96d52ee571ab966985c980c437322092928637efa61615ddf7eb036", "path": "/data/samples/bad/projects/ToxicDatabase/Source codes/NetSky.AE-Source-main/Harvester.cpp", "type": "c" } ], "tv": "318d5" } }