{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 1.0, "class": 2 }, { "m": "az/native", "prob": 1.0, "class": 2 }, { "m": "az/pe", "prob": 1.0, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-12T15:11:16Z" }, "path": "58072", "raw": { "v": "4", "fs": [ { "f": "O(Er)H₅(DbFOsPoU)Md₃(BiHeSi)", "k": { "hash.imp": "ddbb90ebf41500dde8a2155d2d44be6d", "pe.timestamp": 1126713643, "hash.authenti": "063464a8f3521fbcbcd48ef29bfeb8948ba44a73dfad318c4ce63a0f665dcd22", "hash.rich_header": "3bbff362d9f22fad017f973e63ccaaa76c84d8d195a9cfad15fa58e9461d260b", "build.target_arch": "x86", "pe.linker_version": "6.4", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.rich_header.xor_key": "0xa44bf298", "pe.inflated_sections[0]": ".data", "pe.data_directories[0].rva": 5964, "pe.data_directories[1].rva": 40960, "pe.data_directories[2].rva": 4096, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 140, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 3384, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 408, "pe.version_info.company_name": "Macromedia, Inc.", "pe.version_info.file_version": "7,0,0,0", "pe.version_info.product_name": "Shockwave Flash", "pe.version_info.internal_name": "Macromedia Flash Player 7.0", "pe.rich_header_compids[0].count": 1, "pe.rich_header_compids[1].count": 303, "pe.rich_header_compids[2].count": 11, "pe.rich_header_compids[3].count": 2, "pe.rich_header_compids[4].count": 7, "pe.rich_header_compids[5].count": 1, "pe.rich_header_compids[6].count": 1, "pe.rich_header_compids[7].count": 63, "pe.rich_header_compids[8].count": 1, "pe.version_info.legal_copyright": "Copyright © 1996-2009 Macromedia, Inc.", "pe.version_info.product_version": "7,0,0,0", "binary.top_complex_unnamed[0].cc": 29, "pe.rich_header_compids[0].compid": 987075, "pe.rich_header_compids[1].compid": 65536, "pe.rich_header_compids[2].compid": 6098883, "pe.rich_header_compids[3].compid": 6295487, "pe.rich_header_compids[4].compid": 6229955, "pe.rich_header_compids[5].compid": 6033347, "pe.rich_header_compids[6].compid": 6164419, "pe.rich_header_compids[7].compid": 6295491, "pe.rich_header_compids[8].compid": 5902275, "pe.version_info.file_description": "Macromedia Flash Player 7.0", "pe.version_info.legal_trademarks": "Macromedia Flash Player", "binary.top_complex_unnamed[0].bbs": 53, "pe.rich_header_compids[1].product": "Unknown", "pe.version_info.original_filename": "SAFlashPlayer.exe", "binary.top_complex_unnamed[0].addr": "0x401330", "binary.top_complex_unnamed[0].size": 588, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".data", "pe.section_characteristics[2].name": ".rsrc", "pe.section_characteristics[3].name": ".packed", "pe.section_characteristics[4].name": "wasvoib", "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 303, "pe.rich_header.entries[2].use_count": 11, "pe.rich_header.entries[3].use_count": 2, "pe.rich_header.entries[4].use_count": 7, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[7].use_count": 63, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[0].product_id": 15, "pe.rich_header.entries[1].product_id": 1, "pe.rich_header.entries[2].product_id": 93, "pe.rich_header.entries[3].product_id": 96, "pe.rich_header.entries[4].product_id": 95, "pe.rich_header.entries[5].product_id": 92, "pe.rich_header.entries[6].product_id": 94, "pe.rich_header.entries[7].product_id": 96, "pe.rich_header.entries[8].product_id": 90, "pe.rich_header.entries[0].build_number": 4035, "pe.rich_header.entries[0].product_name": "Imp_VC2003", "pe.rich_header.entries[1].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[2].build_number": 4035, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 4031, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 4035, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 4035, "pe.rich_header.entries[5].product_name": "Linker_VS2005_LTCG", "pe.rich_header.entries[6].build_number": 4035, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 4035, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 4035, "pe.rich_header.entries[8].product_name": "C_VS2005_LTCG", "pe.section_characteristics[0].raw_size": 10240, "pe.section_characteristics[1].raw_size": 4096, "pe.section_characteristics[2].raw_size": 3584, "pe.section_characteristics[3].raw_size": 90112, "pe.section_characteristics[0].virtual_size": 10006, "pe.section_characteristics[1].virtual_size": 24113, "pe.section_characteristics[2].virtual_size": 3384, "pe.section_characteristics[3].virtual_size": 118381, "pe.section_characteristics[4].virtual_size": 81920, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 16384, "pe.section_characteristics[2].virtual_address": 40960, "pe.section_characteristics[3].virtual_address": 45056, "pe.section_characteristics[4].virtual_address": 163840, "pe.section_characteristics[0].characteristics_hex": "e0000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "400000c0", "pe.section_characteristics[3].characteristics_hex": "e0000060", "pe.section_characteristics[4].characteristics_hex": "e0000000" }, "x": 84, "id": 0, "is": [ "VariantChangeTypeEx", "SysStringLen", "SysAllocStringLen", "VariantCopyInd", "VariantClear", "VerQueryValueW", "GetFileVersionInfoSizeW", "GetFileVersionInfoW", "RegQueryValueExA", "RegCloseKey", "OpenProcessToken", "RegOpenKeyExA", "LookupPrivilegeValueA", "SetCommConfig", "CreateFileA", "CloseHandle", "FindResourceA", "Sleep", "DeleteFileA", "VirtualFree", "SetFilePointer", "SetErrorMode", "GetSystemInfo", "RemoveDirectoryA", "ReadFile", "GetUserDefaultLangID", "OutputDebugStringA", "GetEnvironmentVariableA", "GetWindowsDirectoryA", "GetLocaleInfoA", "LoadLibraryA", "GetACP", "LockResource", "GetFileSize", "FormatMessageA", "FlushViewOfFile", "GetExitCodeProcess", "GetFullPathNameA", "GetLastError", "GetSystemDefaultLCID", "SetEndOfFile", "GetFileAttributesA", "LoadResource", "VirtualQuery", "GetCurrentProcess", "SizeofResource", "GetProcAddress", "GetVersionExA", "GetModuleHandleA", "GetCommandLineA", "GetModuleFileNameA", "IsDBCSLeadByte", "CreateProcessA", "VirtualProtect", "CreateDirectoryA", "VirtualAlloc", "InterlockedExchange", "WriteFile", "MessageBoxA", "SetWindowLongA", "CharPrevA", "ExitWindowsEx", "TranslateMessage", "MsgWaitForMultipleObjects", "LoadStringA", "CallWindowProcA", "DestroyWindow", "CreateWindowExA", "PeekMessageA", "DispatchMessageA", "ReadFile", "GetCommandLineA", "GetModuleHandleA", "GetLastError", "GetStdHandle", "CreateFileA", "GetFileSize", "ExitProcess", "WideCharToMultiByte", "LocalAlloc", "TlsSetValue", "VirtualAlloc", "LocalFree", "WriteFile", "LeaveCriticalSection", "GetFileType", "SetEndOfFile", "TlsGetValue", "SetFilePointer", "CloseHandle", "VirtualFree", "MultiByteToWideChar", "GetSystemTime", "RaiseException", "EnterCriticalSection", "DeleteCriticalSection" ], "ms": { "pe": { "entry": 4540.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 3584.0, "subsystem": 2.0, "timestamp": 1126713643.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 3.97, "entry_section": ".text", "size_of_image": 245760.0, "file_alignment": 512.0, "resource_count": 3.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON", "RT_VERSION" ], "characteristics": 258.0, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 5.0, "computed_checksum": 121592.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "linker_minor_version": 4.0, "bss_like_section_count": 1.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "api_hashing_indicator_count": 1.0, "max_section_inflation_ratio": 5.89 }, "file": { "size": 109056.0 }, "binary": { "code_size": 100352.0, "func_count": 2.0, "code_entropy": 4.02, "data_entropy": 4.29, "func_density": 0.02, "import_count": 96.0, "string_count": 313.0, "avg_func_size": 348.0, "section_count": 5.0, "avg_complexity": 15.0, "import_density": 0.98, "max_complexity": 29.0, "string_density": 3.19, "overall_entropy": 4.06, "avg_basic_blocks": 27.0, "avg_section_size": 21606.4, "dependency_count": 5.0, "entropy_variance": 2.25, "wx_section_count": 3.0, "avg_string_length": 9.62, "complexity_per_kb": 0.15, "max_string_length": 201.0, "wide_string_count": 24.0, "avg_string_entropy": 2.57, "code_to_data_ratio": 13.07, "data_to_file_ratio": 0.04, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.09, "total_basic_blocks": 54.0, "func_analysis_depth": 2.0, "string_length_stddev": 12.39, "largest_section_ratio": 0.83, "sentence_string_count": 4.0, "sentence_string_ratio": 0.01, "writable_section_count": 4.0, "behavioral_import_ratio": 0.06, "entry_in_writable_region": true, "executable_section_count": 3.0, "nonstandard_section_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 480, ".text" ], [ 520, ".data" ], [ 560, ".rsrc" ], [ 599, "@.packed" ], [ 640, "wasvoib" ], [ 2803, "8ECB" ], [ 2839, "GBCG86EK" ], [ 3442, "VariantChangeTypeEx" ], [ 3464, "SysStringLen" ], [ 3479, "SysAllocStringLen" ], [ 3499, "VariantCopyInd" ], [ 3516, "VariantClear" ], [ 3529, "oleaut32.dll" ], [ 3544, "VerQueryValueW" ], [ 3561, "GetFileVersionInfoSizeW" ], [ 3587, "GetFileVersionInfoW" ], [ 3607, "VERSION.dll" ], [ 3621, "RegQueryValueExA" ], [ 3640, "RegCloseKey" ], [ 3654, "OpenProcessToken" ], [ 3673, "RegOpenKeyExA" ], [ 3689, "LookupPrivilegeValueA" ], [ 3711, "advapi32.dll" ], [ 3726, "SetCommConfig" ], [ 3742, "CreateFileA" ], [ 3756, "CloseHandle" ], [ 3770, "FindResourceA" ], [ 3786, "Sleep" ], [ 3794, "DeleteFileA" ], [ 3808, "VirtualFree" ], [ 3822, "SetFilePointer" ], [ 3839, "SetErrorMode" ], [ 3854, "GetSystemInfo" ], [ 3870, "RemoveDirectoryA" ], [ 3889, "ReadFile" ], [ 3900, "GetUserDefaultLangID" ], [ 3923, "OutputDebugStringA" ], [ 3944, "GetEnvironmentVariableA" ], [ 3970, "GetWindowsDirectoryA" ], [ 3993, "GetLocaleInfoA" ], [ 4010, "LoadLibraryA" ], [ 4034, "LockResource" ], [ 4049, "GetFileSize" ], [ 4063, "FormatMessageA" ], [ 4080, "FlushViewOfFile" ], [ 4098, "GetExitCodeProcess" ], [ 4119, "GetFullPathNameA" ], [ 4138, "GetLastError" ], [ 4153, "GetSystemDefaultLCID" ], [ 4176, "SetEndOfFile" ], [ 4191, "GetFileAttributesA" ], [ 4212, "LoadResource" ], [ 4227, "VirtualQuery" ], [ 4242, "GetCurrentProcess" ], [ 4262, "SizeofResource" ], [ 4279, "GetProcAddress" ], [ 4296, "GetVersionExA" ], [ 4312, "GetModuleHandleA" ], [ 4331, "GetCommandLineA" ], [ 4349, "GetModuleFileNameA" ], [ 4370, "IsDBCSLeadByte" ], [ 4387, "CreateProcessA" ], [ 4404, "VirtualProtect" ], [ 4421, "CreateDirectoryA" ], [ 4440, "VirtualAlloc" ], [ 4455, "InterlockedExchange" ], [ 4477, "WriteFile" ], [ 4487, "kernel32.dll" ], [ 4502, "MessageBoxA" ], [ 4516, "SetWindowLongA" ], [ 4545, "ExitWindowsEx" ], [ 4561, "TranslateMessage" ], [ 4580, "MsgWaitForMultipleObjects" ], [ 4608, "LoadStringA" ], [ 4622, "CallWindowProcA" ], [ 4640, "DestroyWindow" ], [ 4656, "CreateWindowExA" ], [ 4674, "PeekMessageA" ], [ 4689, "DispatchMessageA" ], [ 4706, "user32.dll" ], [ 4782, "GetStdHandle" ], [ 4825, "ExitProcess" ], [ 4839, "WideCharToMultiByte" ], [ 4861, "LocalAlloc" ], [ 4874, "TlsSetValue" ], [ 4903, "LocalFree" ], [ 4927, "LeaveCriticalSection" ], [ 4950, "GetFileType" ], [ 4979, "TlsGetValue" ], [ 5038, "MultiByteToWideChar" ], [ 5060, "GetSystemTime" ], [ 5076, "RaiseException" ], [ 5093, "EnterCriticalSection" ], [ 5116, "DeleteCriticalSection" ], [ 5171, "E8G6" ], [ 5198, "75NO2\u003e" ], [ 5205, "0EIEGA7" ], [ 5239, "80254" ], [ 5276, "MHB1" ], [ 5411, "F722D" ], [ 5428, "D7FAEIAAC" ], [ 5457, "50=2\u003e;9N9" ], [ 5486, "FAGH" ], [ 5531, "AN90DM583=5922J" ], [ 5585, "IA78" ], [ 5640, "9DHO8BIJ" ], [ 5662, "74F8GI" ], [ 5732, "BKN3GFE" ], [ 5803, "D8MC?NAC8OF@NJ" ], [ 5888, "99KN" ], [ 6045, "OI9CBB" ], [ 6186, "732D" ], [ 6198, "KBD9I" ], [ 6253, "L\u003c@B8L77H5CL\u003eI2?ED5E" ], [ 6321, "33NE5A" ], [ 6522, "MM2\u003eD7" ], [ 6536, "F3JCM" ], [ 6604, "DE90E" ], [ 6691, "J\u003c\u003cLI?G" ], [ 6769, "L51KG" ], [ 6807, "9EEH" ], [ 6842, "B7MK" ], [ 7052, "I2DE" ], [ 7072, "JHJN3C" ], [ 7084, "32BL" ], [ 7107, "731BAA" ], [ 7170, "5EMLII" ], [ 7188, "A6::" ], [ 7195, "5LC0C" ], [ 7279, "JB96" ], [ 7314, "B1LL" ], [ 7349, "AO85" ], [ 7416, "50NC8EA" ], [ 7430, "6F987N" ], [ 7488, "J66FFN719" ], [ 7521, "GLIO" ], [ 7566, "8COHJ" ], [ 7689, "D6LG6" ], [ 7848, "E4KNL" ], [ 7902, "wide", "MD04" ], [ 7954, "FNMJ" ], [ 8202, "wide", "5J5G" ], [ 8317, "O553104" ], [ 8358, "78H4B" ], [ 8364, "L7A8" ], [ 8380, "JBCD" ], [ 8385, "BCEMN" ], [ 8402, "NKDN" ], [ 8426, "7H4F" ], [ 8495, "520MC1GNJ4" ], [ 8513, "LBBKHG1=:;1" ], [ 8528, "wide", "8E2A" ], [ 8552, "AC46" ], [ 8691, "DBK7" ], [ 8694, "wide", "7323" ], [ 8881, "K0LAG" ], [ 8992, "MAFIL0" ], [ 9006, "wide", "DHBJ1" ], [ 9255, "4H9ED" ], [ 9304, "5AAL" ], [ 9364, "GKE02" ], [ 9403, "JDF7" ], [ 9486, "A5LMD" ], [ 9492, "GHIC" ], [ 9527, "BHN4" ], [ 9659, "HB6L3" ], [ 9718, "GK01" ], [ 9765, "EM43" ], [ 9844, "7JLHM" ], [ 9877, "JB1HD" ], [ 10064, "KFD0" ], [ 10097, "MG7E2" ], [ 10189, "00LFD5K" ], [ 10367, "AA9G92" ], [ 10393, "NG4B" ], [ 10623, "9LMA" ], [ 10661, "IAOCE86KLN" ], [ 10833, "46OL" ], [ 10847, "N93EA6" ], [ 10945, "GHEA" ], [ 11029, "GELC86" ], [ 11079, "FH17KA" ], [ 11117, "JGK9G" ], [ 11141, "B8DB" ], [ 11200, "FD6K0" ], [ 11216, "HL6LFDH9" ], [ 11272, "2024" ], [ 11277, "122100" ], [ 11315, "3433224" ], [ 11330, "43301" ], [ 11341, "34443" ], [ 11349, "1013" ], [ 11355, "0230" ], [ 11396, "1342130" ], [ 11408, "42304" ], [ 11449, "3120104" ], [ 11481, "42033" ], [ 11500, "2003" ], [ 11512, "11221" ], [ 11518, "133421" ], [ 11577, "hex", "!\u0004D11\u0011\u0003!" ], [ 11596, "hex", "32\u0011BB2321\u0001$1\u0014" ], [ 11637, "3312" ], [ 11647, "00304" ], [ 11713, "03423" ], [ 11719, "200214" ], [ 11738, "02124" ], [ 11751, "301332" ], [ 11758, "1413202" ], [ 11783, "410431" ], [ 11806, "hex", "\u0003$!\u00124\u0013#$" ], [ 11829, "3142014" ], [ 11860, "2142" ], [ 11873, "2122110" ], [ 11881, "220232" ], [ 11888, "104120" ], [ 11895, "4322" ], [ 11900, "0111" ], [ 11906, "2301140" ], [ 11916, "001021" ], [ 11923, "22412" ], [ 11961, "1142" ], [ 11966, "11102" ], [ 11972, "013413" ], [ 11986, "331134" ], [ 11993, "30304" ], [ 12027, "hex", "\u0011\u00113\u0010\u0012\u0013\u0010" ], [ 12259, "`\"B`" ], [ 17834, "wide", "VS_VERSION_INFO" ], [ 17926, "wide", "StringFileInfo" ], [ 17986, "wide", "CompanyName" ], [ 18012, "wide", "Macromedia, Inc." ], [ 18054, "wide", "FileDescription" ], [ 18088, "wide", "Macromedia Flash Player 7.0" ], [ 18150, "wide", "FileVersion" ], [ 18198, "wide", "InternalName" ], [ 18286, "wide", "LegalCopyright" ], [ 18316, "wide", "Copyright © 1996-2009 Macromedia, Inc." ], [ 18402, "wide", "LegalTrademarks" ], [ 18436, "wide", "Macromedia Flash Player" ], [ 18490, "wide", "OriginalFilename" ], [ 18524, "wide", "SAFlashPlayer.exe" ], [ 18566, "wide", "ProductName" ], [ 18592, "wide", "Shockwave Flash" ], [ 18630, "wide", "ProductVersion" ], [ 18682, "wide", "VarFileInfo" ], [ 18714, "wide", "Translation" ], [ 18744, "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ], [ 21308, "7XNE" ], [ 23310, "5MNQ" ], [ 24608, "dd8dtNN4V5d5X$@" ], [ 24696, "G3u6l.U+il9gu\u0026" ], [ 24920, "K%URK8Y" ], [ 26079, "u45c91" ] ], "sz": 109056, "ts": [ { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 5.89" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.57" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.57" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage/control::exit-windows-ex", "l": 3 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringA" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 3 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage/control::destroy-window", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "7,0,0,0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.06" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.03" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 15.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 3584.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.04" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 313.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Macromedia Flash Player 7.0" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "d": "VERSION word (uppercase)", "e": [ "VERSION" ], "i": "metadata/package/versioning::version-upper", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "SysStringLen", "OutputDebugStringA", "LoadStringA", "StringFileInfo", "SysAllocStringLen" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.06" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX7" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 245760.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 96.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 1996-2009 Macromedia, Inc." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1126713643.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 3 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Shockwave Flash" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "58072" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 96.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 3 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::lock-resource", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".text (size: 10240, perms: rwx)", ".packed (size: 90112, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Three or more writable executable sections", "e": [ "binary.wx_section_count = 3.00" ], "i": "metadata/hardening/memory::three-plus-wx-sections", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.9900000095367432, "d": "Two-function stub layout", "e": [ "binary.func_count = 2.00" ], "i": "well-known/malware/worm/ludbaruma::metric-function-count-2", "l": 1 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueA" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.9200000166893005, "d": "Writable .text section (custom packer indicator)", "e": [ ".text (size: 10240, entropy: 5.34, perms: rwx)" ], "i": "metadata/binary/section/metrics::writable-text-section", "l": 4 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "WideCharToMultiByte", "MultiByteToWideChar", "GetEnvironmentVariableA", "GetSystemDefaultLCID", "GetFileVersionInfoSizeW", "GetWindowsDirectoryA", "GetModuleFileNameA", "MsgWaitForMultipleObjects" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1045", "c": 0.949999988079071, "d": "Multiple W+X sections (packer pattern)", "e": [ "binary.wx_section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-wx-sections", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariableA" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links oleaut32.dll (VariantChangeTypeEx, SysStringLen, SysAllocStringLen, VariantCopyInd, VariantClear)", "e": [ "oleaut32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links advapi32.dll (RegQueryValueExA, RegCloseKey, OpenProcessToken, RegOpenKeyExA, LookupPrivilegeValueA)", "e": [ "advapi32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (MessageBoxA, SetWindowLongA, CharPrevA, ExitWindowsEx, TranslateMessage, ... +7 more)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links kernel32.dll (SetCommConfig, CreateFileA, CloseHandle, FindResourceA, Sleep, ... +66 more)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 96.00", "pe.has_rich_header = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "ReadFile", "GetFileSize", "CreateFileA", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1070.004", "c": 0.8999999761581421, "d": "Self-delete with inflated import table (evasion via padding)", "e": [ "DeleteFileA", "binary.func_count = 2.00", "DeleteFileA", "GetModuleFileNameA", "binary.import_count = 96.00" ], "i": "objectives/evasion/self-delete/file/script::padded-imports-self-delete", "l": 4, "m": "F0007" }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "LoadResource", "LockResource", "SizeofResource", "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-full-extraction", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "LockResource", "LoadResource", "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file/script::module-path-delete", "l": 2, "m": "F0007" } ], "sha": "3f97cb04b5a7694533d96f7ef5704bbecf87ce2a1bdb3e25f3d55c5df49bf41b", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/58072", "type": "pe" } ], "tv": "4872c" } }