{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.0032894737, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T08:32:12Z" }, "path": "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe", "raw": { "v": "5", "fs": [ { "f": "O(Dy)H(Po)", "x": 9, "ff": { "i": [ [ "user32", "GetMessageW" ], [ "user32", "DefWindowProcW" ], [ "user32", "DestroyWindow" ], [ "user32", "CreateWindowExW" ], [ "user32", "EndDialog" ], [ "user32", "RegisterClassExW" ], [ "user32", "LoadAcceleratorsW" ], [ "user32", "LoadStringW" ], [ "user32", "ShowWindow" ], [ "user32", "EndPaint" ], [ "user32", "TranslateAcceleratorW" ], [ "user32", "TranslateMessage" ], [ "user32", "LoadIconW" ], [ "user32", "LoadCursorW" ], [ "user32", "PostQuitMessage" ], [ "user32", "DialogBoxParamW" ], [ "user32", "UpdateWindow" ], [ "user32", "BeginPaint" ], [ "user32", "DispatchMessageW" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "HeapSize" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "GetACP" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "FindNextFileW" ], [ "kernel32", "FindFirstFileExW" ], [ "kernel32", "FindClose" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "SetLastError" ], [ "kernel32", "InitializeCriticalSectionAndSpinCount" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsFree" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "GetLocaleInfoW" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "RtlCaptureContext" ], [ "kernel32", "RtlLookupFunctionEntry" ], [ "kernel32", "RtlVirtualUnwind" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "IsProcessorFeaturePresent" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "InitializeSListHead" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "GetStartupInfoW" ], [ "kernel32", "RtlUnwindEx" ], [ "kernel32", "RtlPcToFileHeader" ], [ "kernel32", "RaiseException" ], [ "kernel32", "InterlockedFlushSList" ], [ "kernel32", "GetLastError" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "GetModuleHandleExW" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapFree" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetFileType" ], [ "kernel32", "IsValidLocale" ], [ "kernel32", "GetUserDefaultLCID" ], [ "kernel32", "EnumSystemLocalesW" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "WriteFile" ], [ "kernel32", "GetConsoleCP" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "ReadFile" ], [ "kernel32", "GetFileSizeEx" ], [ "kernel32", "SetFilePointerEx" ], [ "kernel32", "ReadConsoleW" ] ], "m": { "pe": { "has_cfg": 1.0, "checksum": 0.0, "icon_count": 2.0, "checksum_valid": 0.0, "resource_count": 6.0, "checksum_stripped": 1.0, "computed_checksum": 1556391.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 13.0, "base_relocation_entry_count": 1624.0 }, "file": { "size": 1513984.0, "entropy": 5.67, "size_bytes": 1513984.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.37, "data_entropy": 2.97, "string_count": 7977.0, "entropy_variance": 4.24, "avg_string_length": 6.7, "max_string_length": 94.0, "code_to_data_ratio": 1.0, "string_length_stddev": 5.45, "largest_section_ratio": 0.86, "sentence_string_count": 97.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 3.0 }, "exports": { "count": 65.0 }, "imports": { "count": 92.0 }, "sections": { "count": 7.0, "code_size": 1306112.0, "entropy_max": 6.76, "entropy_mean": 4.09, "name_entropy": 3.71, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 1.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 240, "u8", "Rich" ], [ 536, "u8", ".text" ], [ 615, "u8", "@.data" ], [ 656, "u8", ".pdata" ], [ 735, "u8", "@.rsrc" ], [ 775, "u8", "@.reloc" ], [ 2050, "u8", "\\$ UVWAVAWH" ], [ 3466, "stack", "*SRU" ], [ 554680, "stack", "'''''" ], [ 562666, "u8", "VWAWH" ], [ 563295, "u8", "D1XH" ], [ 563300, "u8", "L1HH" ], [ 563783, "u8", "t$ ATAVAWH" ], [ 565468, "u8", "|$ UATAUAVAWH" ], [ 567040, "u8", "@USVWATAVAWH" ], [ 567091, "stack", "ntdl" ], [ 567094, "u8", "ntdlA" ], [ 567243, "stack", "srGe" ], [ 567246, "u8", "srGe" ], [ 568167, "u8", "L$ SUVWH" ], [ 568842, "u8", "UWAVH" ], [ 569840, "u8", "@UATAUAVAWH" ], [ 570154, "u8", "SVWH" ], [ 570408, "stack", "nQ|D" ], [ 570460, "u8", "IBCH" ], [ 571024, "stack", "kV!I" ], [ 573664, "stack", "q;B?" ], [ 573884, "stack", "pnHN" ], [ 573891, "u8", "pnHNH" ], [ 574324, "stack", "s|{?" ], [ 575644, "stack", ",KVI" ], [ 577096, "stack", "E,~R" ], [ 579472, "stack", "g\u00265`" ], [ 582860, "stack", "L8x\\" ], [ 585112, "u8", "S4PH" ], [ 588448, "stack", "L:tp" ], [ 588756, "stack", "BYp%" ], [ 588800, "stack", "$gA[" ], [ 589064, "stack", ":Y7;" ], [ 590252, "stack", "V|A\u003c" ], [ 590472, "stack", "sgMZ" ], [ 590479, "u8", "sgMZH" ], [ 590956, "stack", "^T]\u0026" ], [ 591660, "stack", "^\u0026WA" ], [ 592144, "stack", "H(pn" ], [ 592812, "u8", "347H" ], [ 592892, "stack", "7bf7" ], [ 592899, "u8", "7bf7H" ], [ 593068, "stack", "II\"E" ], [ 593332, "stack", "7OQ " ], [ 593339, "u8", "7OQ H" ], [ 593464, "stack", "A+ZK" ], [ 594476, "stack", "09OI" ], [ 594483, "u8", "09OIH" ], [ 594652, "stack", "BTJ." ], [ 595004, "stack", "-Aa2" ], [ 599624, "stack", "B,~R" ], [ 603460, "u8", "26CH" ], [ 603628, "stack", " a$[" ], [ 604156, "stack", "3bf7" ], [ 604163, "u8", "3bf7H" ], [ 606136, "stack", ",+ul" ], [ 606180, "stack", "cVAi" ], [ 606187, "u8", "cVAiH" ], [ 606620, "stack", "?BL2" ], [ 610008, "stack", "NK`f" ], [ 612076, "stack", "O4=\\" ], [ 612208, "stack", "[L05" ], [ 616652, "stack", "L8x\\" ], [ 616784, "stack", "K\u003c'v" ], [ 619468, "stack", "kHGb" ], [ 619475, "u8", "kHGbH" ], [ 627168, "stack", "rGB\u003e" ], [ 627256, "stack", "f/_J" ], [ 628620, "stack", "Ihch" ], [ 628627, "u8", "IhchH" ], [ 632800, "stack", "Fv-A" ], [ 636320, "stack", "Gd(e" ], [ 636760, "stack", "IJ8$" ], [ 636980, "stack", "?tXd" ], [ 637156, "stack", "Xfkf" ], [ 637163, "u8", "XfkfH" ], [ 639268, "stack", "a;tC" ], [ 639576, "stack", "ZyIk" ], [ 646528, "stack", " ehP" ], [ 648728, "stack", "+k?p" ], [ 648860, "stack", "y'28" ], [ 651588, "stack", "M\u003eJv" ], [ 651720, "stack", "tFOJ" ], [ 651727, "u8", "tFOJH" ], [ 653788, "stack", "Ai6x" ], [ 657528, "stack", "T`Vf" ], [ 658804, "stack", ";*dA" ], [ 659112, "stack", "\u0026_vo" ], [ 659244, "stack", "sq{o" ], [ 659420, "stack", "~aql" ], [ 660608, "stack", "U7\u003cO" ], [ 661488, "stack", "R\u003eg7" ], [ 662808, "stack", "zj\\6" ], [ 662852, "stack", "\\znR" ], [ 663116, "stack", "@IKx" ], [ 663952, "stack", "bR0R" ], [ 663959, "u8", "bR0RH" ], [ 665456, "u8", "SOKH" ], [ 665536, "stack", "-o'+" ], [ 666372, "stack", "DN2M" ], [ 666379, "u8", "DN2MH" ], [ 670068, "stack", "8g#r" ], [ 671344, "stack", "I.,(" ], [ 672004, "stack", "\u003c'\u003c7" ], [ 674864, "stack", "4PnA" ], [ 674871, "u8", "4PnAH" ], [ 678516, "stack", "jQvG" ], [ 678523, "u8", "jQvGH" ], [ 680794, "u8", "SVWATAUAVAWH" ], [ 681410, "u8", "SoDAm" ], [ 682474, "stack", "PwKW.eu!" ], [ 682996, "u8", "DQC/nMH" ], [ 683045, "u8", "_m AGH" ], [ 683242, "stack", "=FHuAzR-" ], [ 683530, "stack", "Z.g_Milm" ], [ 683722, "stack", "*xf+O4=\\" ], [ 684010, "stack", "9TpWJO}D" ], [ 684346, "stack", "z.kiBD-]" ], [ 684630, "u8", "MgdAH" ], [ 685062, "u8", "km3sH" ], [ 685162, "stack", "=+p]oV4C" ], [ 685210, "stack", "o\\-]$m'7" ], [ 685970, "u8", "6CD ()_@H" ], [ 685978, "stack", "6CD ()_@" ], [ 686170, "stack", "g(pU\\g@T" ], [ 686842, "stack", "\u003eN$9M\u003eJ:" ], [ 686980, "u8", "FI0gK" ], [ 687226, "stack", "m'H|PBC@" ], [ 693367, "u8", "ICDH" ], [ 696870, "u8", "752uH" ], [ 700471, "u8", "SCPH" ], [ 705892, "u8", "tvMy" ], [ 706759, "u8", "W41H" ], [ 710167, "u8", "IBJH" ], [ 714531, "u8", "YBE_" ], [ 718231, "u8", "DI8H" ], [ 723799, "u8", "FOTH" ], [ 726456, "u8", "jq3MH" ], [ 726549, "u8", "i0fx" ], [ 726700, "stack", "n8d+@%ue" ], [ 726840, "u8", "sQZ1H" ], [ 727368, "u8", "SM8 H" ], [ 738097, "u8", "7wAEw0" ], [ 740405, "u8", "37CH" ], [ 741593, "stack", "gxgrgCgxgkgcgwgHggfgfggg" ], [ 741905, "stack", "9uUZXqW]2 0:" ], [ 742171, "stack", "?i)366%)" ], [ 742443, "stack", "((((" ], [ 742491, "stack", "((((" ], [ 742525, "stack", "((((" ], [ 742602, "stack", "%3!\u0026" ], [ 744389, "u8", "UVWATAUAVAWH" ], [ 746944, "u8", "@USVWATAUAVAWH" ], [ 752642, "u8", "\\$ UVWH" ], [ 755634, "u8", "t$ AVH" ], [ 756789, "u8", "UVWH" ], [ 757079, "u8", "K E3" ], [ 760610, "u8", "4WHF" ], [ 761958, "u8", "63WEH" ], [ 762103, "u8", "21IH" ], [ 765797, "u8", "RhwsbH" ], [ 767815, "u8", "52ZH" ], [ 771847, "u8", "761H" ], [ 772899, "u8", "JIuA3" ], [ 774823, "u8", "36CH" ], [ 779578, "u8", "SL0Vn" ], [ 781170, "stack", "ZuL?bVMU" ], [ 787599, "u8", "OH_H" ], [ 792444, "u8", "1KSMt" ], [ 796382, "u8", "a76yH" ], [ 798732, "u8", "80BI" ], [ 801662, "u8", "HnmPH" ], [ 803198, "u8", "GwxrH" ], [ 807083, "u8", "uaZJy" ], [ 807230, "u8", "7BL2H" ], [ 811746, "stack", "|7BrQ`$_" ], [ 812557, "u8", "tz8e" ], [ 815915, "u8", "WC5N" ], [ 816250, "u8", "/WQE" ], [ 825845, "u8", "/\tEc" ], [ 828823, "u8", "JXBH" ], [ 837367, "u8", "FY0H" ], [ 840246, "u8", "CCjaH" ], [ 844902, "u8", "63d2H" ], [ 844950, "u8", "EVfAH" ], [ 845626, "stack", "~M{8$^ls" ], [ 846002, "u8", "4IUQ" ], [ 855059, "u8", "9QQH" ], [ 856352, "u8", "63J4j" ], [ 869992, "u8", "4yW26CH" ], [ 870086, "u8", "L6BsQS" ], [ 880917, "stack", "...." ], [ 882460, "stack", "KO5o" ], [ 882467, "u8", "KO5oH" ], [ 884088, "stack", ")V'j" ], [ 884176, "stack", "y|3V" ], [ 884704, "stack", "|6B|" ], [ 886956, "u8", "PV6H" ], [ 887344, "stack", "?6N6" ], [ 887608, "stack", "F~$G" ], [ 888444, "stack", "|s}'" ], [ 888488, "stack", "xo#@" ], [ 889060, "stack", "@6ZQ" ], [ 889720, "stack", "Q%_}" ], [ 890732, "stack", ".`d0" ], [ 890776, "stack", "-4h^" ], [ 890864, "stack", "DGKW" ], [ 890871, "u8", "DGKWH" ], [ 891568, "stack", "|maE" ], [ 893328, "stack", "X9zV" ], [ 893335, "u8", "X9zVH" ], [ 893988, "stack", "5Kcy" ], [ 893995, "u8", "5KcyH" ], [ 896100, "stack", "'Q}8" ], [ 897200, "stack", "kV!." ], [ 897244, "stack", "SGoy" ], [ 897251, "u8", "SGoyH" ], [ 898300, "stack", "wLC#" ], [ 898836, "u8", "TOZH" ], [ 901468, "stack", "4O7'" ], [ 901996, "stack", "Ouz$" ], [ 902040, "stack", "2#tH" ], [ 902524, "stack", "`[}D" ], [ 907232, "stack", "~6Bs" ], [ 909740, "stack", "@{[T" ], [ 910312, "stack", "|F/G" ], [ 911720, "stack", "GtI4" ], [ 914668, "stack", " mw\\" ], [ 915240, "stack", ";IC#" ], [ 922148, "stack", "6ZGn" ], [ 922155, "u8", "6ZGnH" ], [ 926944, "stack", "+xfb" ], [ 928800, "u8", "GH6H" ], [ 929452, "stack", "0C_q" ], [ 929936, "stack", "=~_'" ], [ 929980, "stack", "]M08" ], [ 930288, "stack", "m^+3" ], [ 930772, "stack", "$o!." ], [ 930816, "stack", "R\"MA" ], [ 931080, "stack", "6CDi" ], [ 931087, "u8", "6CDiH" ], [ 931784, "stack", "3\u0026[M" ], [ 932092, "stack", "pUG%" ], [ 932400, "stack", "Lmrw" ], [ 932407, "u8", "LmrwH" ], [ 932796, "stack", "?BL2" ], [ 933324, "stack", ",\\ F" ], [ 933500, "stack", "|8RY" ], [ 933676, "stack", "IdG*" ] ], "v": { "file.stem": "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1", "pe.imphash": "5a7099f150d97e1a63c112090146d5ac", "pe.machine": "x86_64", "pe.rich.key": 216997815, "pe.rich.hash": "5f7114931fbce5eba19f9002341f1a99", "pe.subsystem": "windows_gui", "pe.timestamp": 1616416151, "file.basename": "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe", "pe.image_base": 6442450944, "pe.image_size": 1531904, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 6512, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "dff96c13f02f6674c90d0db9284d35db94c3bcc6", "pe.export_timestamp": 4294967295, "pe.load_config.size": 304, "pe.image_hash.sha256": "431da946e7b89858cf8144dbcb5173a76945a9ae81d61bf751c863ed3fffb3b2", "pe.image_hash.sha384": "d68e062dfad136cbc9f0a9f95f5711d48cb82f7504ebd13c9cc65ec545a7b825672a9a4cf21bd4ae09f70d8d49d9be26", "pe.image_hash.sha512": "8f6c1f2fa979c99d98702aaa7a81b4bd12bf778ebdee594b8bcd6d350ac3537c312da45e7398ee1207da599334a549e9198a1b28d1aa9fb0878a819c911aa0e1", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_MENU", "pe.resource_types[2]": "RT_DIALOG", "pe.resource_types[3]": "RT_STRING", "pe.resource_types[4]": "RT_ACCELERATOR", "pe.resource_types[5]": "RT_GROUP_ICON", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8226, "pe.linker_major_version": 14, "pe.linker_minor_version": 27, "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "pogo", "pe.debug.entries[1].type": "iltcg", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.data_directories[0].rva": 1476640, "pe.data_directories[1].rva": 1479244, "pe.data_directories[2].rva": 1511424, "pe.data_directories[3].rva": 1495040, "pe.data_directories[4].rva": 1527808, "pe.data_directories[5].rva": 1460032, "pe.data_directories[6].rva": 1460096, "pe.data_directories[7].rva": 1310720, "pe.dll_characteristics_raw": 352, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 2604, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 60, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 16040, "pe.data_directories[3].name": "exception", "pe.data_directories[3].size": 10584, "pe.data_directories[4].name": "base_relocation", "pe.data_directories[4].size": 3364, "pe.data_directories[5].name": "debug", "pe.data_directories[5].size": 56, "pe.data_directories[6].name": "load_config", "pe.data_directories[6].size": 304, "pe.data_directories[7].name": "iat", "pe.data_directories[7].size": 752, "pe.debug.entries[0].type_id": 13, "pe.debug.entries[1].type_id": 14, "pe.rich.entries[0].build_id": 260, "pe.rich.entries[1].build_id": 259, "pe.rich.entries[2].build_id": 261, "pe.rich.entries[3].build_id": 260, "pe.rich.entries[4].build_id": 259, "pe.rich.entries[5].build_id": 257, "pe.rich.entries[6].build_id": 1, "pe.rich.entries[7].build_id": 261, "pe.rich.entries[8].build_id": 265, "pe.rich.entries[9].build_id": 256, "pe.rich.entries[0].use_count": 18, "pe.rich.entries[10].build_id": 255, "pe.rich.entries[11].build_id": 258, "pe.rich.entries[1].use_count": 11, "pe.rich.entries[2].use_count": 162, "pe.rich.entries[3].use_count": 14, "pe.rich.entries[4].use_count": 10, "pe.rich.entries[5].use_count": 5, "pe.rich.entries[6].use_count": 110, "pe.rich.entries[7].use_count": 72, "pe.rich.entries[8].use_count": 13, "pe.rich.entries[9].use_count": 1, "pe.coff.dos_header_pe_pointer": 272, "pe.load_config.guard_flags[0]": "cf_instrumented", "pe.rich.entries[0].product_id": 26715, "pe.rich.entries[10].use_count": 1, "pe.rich.entries[11].use_count": 1, "pe.rich.entries[1].product_id": 26715, "pe.rich.entries[2].product_id": 26715, "pe.rich.entries[3].product_id": 28920, "pe.rich.entries[4].product_id": 28920, "pe.rich.entries[5].product_id": 26715, "pe.rich.entries[7].product_id": 28920, "pe.rich.entries[8].product_id": 29111, "pe.rich.entries[9].product_id": 29111, "pe.debug.entries[0].size_bytes": 788, "pe.load_config.guard_flags_raw": 256, "pe.load_config.security_cookie": 6443933840, "pe.rich.entries[10].product_id": 29111, "pe.rich.entries[11].product_id": 29111, "pe.base_relocations.block_count": 13, "pe.base_relocations.entry_count": 1624, "pe.base_relocations.padding_count": 6, "pe.debug.entries[0].timestamp_unix": 1616416151, "pe.debug.entries[1].timestamp_unix": 1616416151, "pe.load_config.guard_cf_check_function_pointer": 6443762416, "pe.load_config.guard_cf_dispatch_function_pointer": 6443762432 }, "x": [ [ "?ABuSkZcEcAsxMbuncaupbFQxZGzDVBHAAnmwcHPplIeN@@YA_NXZ" ], [ "?BPLRTitFjKADI@@YA_NXZ" ], [ "?BisMgtzBUCKTaMBSWzBhBjXID@@YA_NXZ" ], [ "?DPMDjzJZSj@@YA_NXZ" ], [ "?DeQydZeULjgOIVzbvGzKR@@YA_NXZ" ], [ "?DilXqHcRqeZO@@YA_NXZ" ], [ "?EZNdIYreesliIJMDxkgrs@@YA_NXZ" ], [ "?FwexXSFiaElNafkXqik@@YA_NXZ" ], [ "?GLRLpKCyXUxuo@@YA_NXZ" ], [ "?HOXMOGGXpCJEZdbcL@@YA_NXZ" ], [ "?HVwMtragmwaAepBVYVfcQRkkcgnJoEO@@YA_NXZ" ], [ "?HnFURpvALZqCzSbEgTssMLOOwyazryT@@YA_NXZ" ], [ "?IyEAcURAgayIvj@@YA_NXZ" ], [ "?JBtimwxrZxW@@YA_NXZ" ], [ "?JwECSTpRhEbrxKRUUbtuWaIf@@YA_NXZ" ], [ "?KOgJJKnWOqmPqJ@@YA_NXZ" ], [ "?LOqQnxypdrrm@@YA_NXZ" ], [ "?NPGrNGBEFWR@@YA_NXZ" ], [ "?OkHKffJewFfUQsGmflCwqsCiSodSgT@@YA_NXZ" ], [ "?OqOElcavNxY@@YA_NXZ" ], [ "?PobMqnMAvQ@@YA_NXZ" ], [ "?QUONYcPpuYgyf@@YA_NXZ" ], [ "?QnzGWHvkAUCfivPCQJfcmPEFoa@@YA_NXZ" ], [ "?TCstJlKKwzzSwHXWT@@YA_NXZ" ], [ "?TfSApzjyGmtpsFLgp@@YA_NXZ" ], [ "?TthixNsdJKMGOTouyqPnfpAOJakQ@@YA_NXZ" ], [ "?TvKpfbwkQrTJgWArylDfgti@@YA_NXZ" ], [ "?UjGJRgUxVEqpHD@@YA_NXZ" ], [ "?VIyIUjjHItzhGxPqXYoAIemnqfgr@@YA_NXZ" ], [ "?WzWMBORQeLwuT@@YA_NXZ" ], [ "?XGlvvIeVkZnXCkfwsQ@@YA_NXZ" ], [ "?XKQajrqkeWIxDRjZs@@YA_NXZ" ], [ "?bJyrBjUKISQBWdpUEriVItATjWF@@YA_NXZ" ], [ "?cdoRizPenQyISwFuRtljNKdIyH@@YA_NXZ" ], [ "?cjxbJCLtxxipSNIRPSUDb@@YA_NXZ" ], [ "?cysLbDhbwtiyWfICeYTJwwoIstOPtvlnZ@@YA_NXZ" ], [ "?dSUaAFDJNz@@YA_NXZ" ], [ "?eDgyfyOztibRdDQqzrW@@YA_NXZ" ], [ "?ebvyXjoPOxDPMhWy@@YA_NXZ" ], [ "?gRHljgbqbiLSdIJmfPA@@YA_NXZ" ], [ "?gzIRBtPZPPqYOhjc@@YA_NXZ" ], [ "?iCjhxyLLmMsfNRAzwI@@YA_NXZ" ], [ "?icUllhuOixNwhKkBsRAPKgCX@@YA_NXZ" ], [ "?jWQdxKeSTbxOrKRrIdScDf@@YA_NXZ" ], [ "?kySUnCBBnnNvuyXSJideJcufUjdlClqNpXASVt@@YA_NXZ" ], [ "?lFEOPWokkcFtSTHb@@YA_NXZ" ], [ "?ljNiQEiBSmbHHjnfSVCDe@@YA_NXZ" ], [ "?oKAPNLrcVZjogHvPWtDL@@YA_NXZ" ], [ "?oXgaCkahqrYfcuNhFNKpbnzrkJz@@YA_NXZ" ], [ "?oqppdgLoRwldAG@@YA_NXZ" ], [ "?pNZcJbRVNWRTY@@YA_NXZ" ], [ "?pNeLbgYWVSKLfHfQWWcpE@@YA_NXZ" ], [ "?phKIUtMKIjRXD@@YA_NXZ" ], [ "?qByMMXrqrLrBPtijOgPe@@YA_NXZ" ], [ "?qaUGvrCqAxZ@@YA_NXZ" ], [ "?tDxCWfbzVnor@@YA_NXZ" ], [ "?wZSkgAZSNSFQtHYukU@@YA_NXZ" ], [ "?xEpAerUDrRHV@@YA_NXZ" ], [ "?xInLfMUrihwCHDToH@@YA_NXZ" ], [ "?xXyYTJOJkEbRWABjYdEP@@YA_NXZ" ], [ "?xdCAecqrlDoCMaunra@@YA_NXZ" ], [ "?yXUYhsndyISgDiGraFvxWUNwMuU@@YA_NXZ" ], [ "?ypEayWRKAAWbBJRYoUfcdKGsjRkYCXuyZr@@YA_NXZ" ], [ "?zZMTvoetmFCNShprnxwpZIE@@YA_NXZ" ], [ "StartW" ] ], "id": "pe", "sc": [ [ ".text", 1024, 1306112, 5.37, "r-x" ], [ ".rdata", 1307136, 171008, 6.76, "r--" ], [ ".data", 1478144, 4608, 2.97, "rw-" ], [ ".pdata", 1482752, 10752, 5.64, "r--" ], [ "_RDATA", 1493504, 512, 1.45, "r--" ], [ ".rsrc", 1494016, 16384, 1.13, "r--" ], [ ".reloc", 1510400, 3584, 5.32, "r--" ] ] }, "id": 0, "sz": 1513984, "ts": [ { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 6.76)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "0x1400c0" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x1401c8" ] }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-core-xstate-l2-1-0", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-localization-l1-2-1", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-winrt-l1-1-0", "api-ms-", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-sysinfo-l1-2-1" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1, "el": [ "0x149220", "0x149260", "0x149160", "0x149020", "0x149060", "0x1492b0", "0x1490b0", "0x1493e0", "0x1450b8", "0x148fe0", "0x149110", "0x1491e0", "0x145150", "0x1450f8", "0x1491a0" ] }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "0x168bc0" ] }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1, "el": [ "0x140d40" ] }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2, "el": [ "0x140108" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x140928" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "0x140158" ] }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "0x1401c0" ] }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage/control::post-quit-message", "l": 2, "el": [ "0x1402c0" ] }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "exports.count = 65.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8500000238418579, "d": "Inline MZ header validation constant", "e": [ "B8 4D 5A 00 00" ], "i": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "l": 1, "el": [ "0xb4ec2" ] }, { "c": 0.8999999761581421, "d": "High export count metric", "e": [ "exports.count = 65.00" ], "i": "micro-behaviors/communications/socket/route::high-export-count", "l": 1 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "exports.count = 65.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "exports.count = 65.00" ], "i": "objectives/command-and-control/backdoor/loader/native-reflect::runtime-loader-with-encoded-data-cond-4--inline-14359", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Inline PE signature validation constant", "e": [ "3c 10" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-signature-check", "l": 1, "el": [ "0xb4f18" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 7977.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2, "el": [ "0x140160" ] }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "0x140098" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2, "el": [ "0x1401e0" ] }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2, "el": [ "0x1402c8" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "c9" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014", "el": [ "0xb556f" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 7977.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2, "el": [ "0x1401f0" ] }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "40", "48", "77", "41", "42", "70", "4e" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014", "el": [ "0xb4f14", "0x12bbe8", "0x8a809", "0x8b116", "0x8b1fe", "0xb4f78", "0x8b27d" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0x140138" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x140008" ] }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2, "el": [ "0x140000" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "0x1400a8" ] }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2, "el": [ "0x140180" ] }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2, "el": [ "0x1401a0" ] }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2, "el": [ "0x140088" ] }, { "c": 1.0, "d": "PE has RT_MENU in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-menu-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x140038", "0x140040" ] }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage/control::def-window-proc", "l": 2, "el": [ "0x140258" ] }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2, "el": [ "0x140068" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "0x140030" ] }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2, "el": [ "0x140228" ] }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2, "el": [ "0x140178" ] }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "0x1400e8" ] }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2, "el": [ "0x1402b8" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2, "el": [ "0x140128" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "0x1400d0" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "0x1401c0" ] }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2, "el": [ "0x148270" ] }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2, "el": [ "0x1409f8" ] }, { "c": 0.8600000143051147, "d": "Uppercase _RDATA companion section", "e": [ "_RDATA" ], "i": "metadata/binary/section/metrics::uppercase-rdata-section", "l": 2 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x68f0f" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x140198" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x140650" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "0x140078" ] }, { "c": 1.0, "d": "PE has RT_DIALOG in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-dialog-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform/defender::etw-blinding-patch-bytes", "l": 1, "el": [ "0x120bcf" ] }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2, "el": [ "0x1400f8" ] }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage/control::dispatch-message", "l": 2, "el": [ "0x1402e0" ] }, { "c": 1.0, "d": "PE has RT_ACCELERATOR resources", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-accelerator-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2, "el": [ "0x140070" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2, "el": [ "0x140238" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x148258" ] }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2, "el": [ "0x1689f4" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 92.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2, "el": [ "0x140220" ] }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-processthreads-l1-1-2" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1, "el": [ "0x1491a0", "0x149160", "0x149220", "0x149020", "0x1491e0", "0x1450b8", "0x148fe0", "0x1450f8", "0x149060", "0x1490b0", "0x149110" ] }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2, "el": [ "0x140018" ] }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014", "el": [ "0xb4ef2" ] }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage/control::register-class", "l": 2, "el": [ "0x140278" ] }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2, "el": [ "0x140118" ] }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "0x1688b2" ] }, { "c": 0.800000011920929, "d": "In-code MZ/PE compare immediate", "e": [ "MZf9\bu3HcH\u003cH\u0003ȁ9PE" ], "i": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x58ef7" ] }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1, "el": [ "0x124555" ] }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2, "el": [ "0x140208" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2, "el": [ "0x1400c8" ] }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2, "el": [ "0x140290" ] }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2, "el": [ "0x140158" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 92.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2, "el": [ "0x1401b8" ] }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1, "el": [ "0x1455c0" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "49", "4f" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x125f4d", "0x12620b" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2, "el": [ "0x1400e0" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 7977.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x11f74a" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x78ef0" ] }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2, "el": [ "0x140120" ] }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2, "el": [ "0x140170" ] }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "0x140030", "0x140028" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 7977.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2, "el": [ "0x1400b8" ] }, { "a": "T1574.002", "c": 0.8799999952316284, "d": "LoadLibraryExW API string", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w-string", "l": 2, "el": [ "0x168b8a" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "TlsGetValue", "FlsGetValue", "value too large", "FlsSetValue", "TlsSetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x168998", "0x140960", "0x140718", "0x140970", "0x1689a6" ] }, { "a": "T1070", "c": 0.6000000238418579, "d": "Vectorized zero-fill blocks (xorps + movups stores)", "e": [ "0F 57 C0 0F 11" ], "i": "objectives/evasion/indicator-removal/cleanup::vectorized-zero-density", "l": 1, "el": [ "0x9c4" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "0x140130" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2, "el": [ "0x140270" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2, "el": [ "0x140188" ] }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2, "el": [ "0x140060" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x140020" ] }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2, "el": [ "0x140100" ] }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols/exports::gui-import-cluster-beginpaint", "l": 1, "el": [ "0x1402d8" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x140210" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x168c48" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x1401b0" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "0x140028" ] }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2, "el": [ "0x148258" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata", ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2, "el": [ "0x140250" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LCMapStringW", "CompareStringEx", "string too long", "FreeEnvironmentStringsW", "invalid string position", "GetEnvironmentStringsW", "GetStringTypeW", "api-ms-win-core-string-l1-1-0", "LCMapStringEx", "LoadStringW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x1689e4", "0x140cf0", "0x14f418", "0x168d7c", "0x163798", "0x168d62", "0x168a06", "0x149160", "0x140d10", "0x168830" ] }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2, "el": [ "0x140190" ] }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage/control::destroy-window", "l": 2, "el": [ "0x140260" ] }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "0x1400a0" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1, "el": [ "0xa61a3", "0x133f47" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2, "el": [ "0x1400d8" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.01" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x1689d2" ] }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2, "el": [ "0x149310", "0x149360" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4608)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1, "el": [ "0x8a82d", "0xb4e5c" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x1401d0" ] }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2, "el": [ "0x149470", "0x168c32" ] }, { "c": 0.9800000190734863, "d": "GetFileSizeEx import symbol", "e": [ "GetFileSizeEx" ], "i": "metadata/binary/symbols/imports::getfilesizeex-import", "l": 1, "el": [ "0x140230" ] }, { "a": "T1027.002", "c": 0.8999999761581421, "d": "CorExitProcess decoy string", "e": [ "CorExitProcess" ], "i": "well-known/malware/trojan/guloader::corexitprocess-decoy", "l": 1, "m": "F0001", "el": [ "0x148270" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "l": 2, "el": [ "0x1401f8" ] }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "0x1401d8" ] }, { "c": 1.0, "d": "High export count metric", "e": [ "exports.count = 65.00" ], "i": "metadata/binary/metrics/anomaly::high-export-count-marker", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "exports.count = 65.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "0x140140" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x168dc4" ] }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009", "el": [ "0x140150" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 7977.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "06 00 a0 bb", "06 00 00 bc", "16 00 0c 64", "16 00 49 64" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1, "el": [ "0x165314", "0x165338", "0x1655fd", "0x165641" ] }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "0x140148" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "exports.count = 65.00" ], "i": "objectives/anti-static/obfuscation/payload/section::versioned-export-heavy-library-cond-1--inline-29160", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "exports.count = 65.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-10--inline-29172", "l": 1, "m": "B0032" }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales callback API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 1, "m": "E1106", "el": [ "0x1401f8" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x140928" ] }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "01 48 ef 01 75", "00 41 3e 2d 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1, "el": [ "0xb7447", "0x12e5a7" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 2.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x13f0b0" ] }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1, "el": [ "0x148258" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Many stack-constructed strings detected", "e": [ "q;B?", "ntdl", "BYp%", "'''''", ",KVI", "kV!I", "*SRU", "srGe", "E,~R", "L:tp", "g\u00265`", "s|{?", "$gA[", "pnHN", "nQ|D", "L8x\\" ], "i": "objectives/anti-static/obfuscation/string/anomaly::many-stack-strings", "l": 1, "m": "B0032", "el": [ "0x8c0e0", "0x8a733", "0x8fbd4", "0x876b8", "0x8c89c", "0x8b690", "0xd8a", "0x8a7cb", "0x8ce48", "0x8faa0", "0x8d790", "0x8c374", "0x8fc00", "0x8c1bc", "0x8b428", "0x8e4cc" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x1400f0" ] }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001", "el": [ "0x168afa" ] }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "l": 2, "el": [ "0x140268" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "FreeLibraryWhenCallbackReturns", "ReleaseSRWLockExclusive", "GetFileInformationByHandleEx", "SleepConditionVariableCS", "GetCurrentPackageId", "EnumSystemLocalesEx", "InitializeCriticalSectionEx", "TryAcquireSRWLockExclusive", "GetSystemTimePreciseAsFileTime", "FlushProcessWriteBuffers", "InitializeConditionVariable", "AcquireSRWLockExclusive", "SleepConditionVariableSRW", "GetUserDefaultLocaleName", "WaitForThreadpoolTimerCallbacks", "GetCurrentProcessorNumber" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x140ac8", "0x140c70", "0x140b48", "0x140c00", "0x140b20", "0x149470", "0x140980", "0x140c50", "0x140b88", "0x140aa8", "0x140ba8", "0x140c38", "0x140c88", "0x1494e8", "0x140a28", "0x140ae8" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 92.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.4000000059604645, "d": "Stack string construction pattern (5+", "e": [ "bd 77 be 67 bf 48 c0 67 c1 08", "be 67 bf 48 c0 67 c1 08 c2 67", "b6 67 b7 78 b8 67 b9 6b ba 67", "b3 72 b4 67 b5 43 b6 67 b7 78", "b5 43 b6 67 b7 78 b8 67 b9 6b", "bb 63 bc 67 bd 77 be 67 bf 48", "c0 67 c1 08 c2 67 c3 66 c4 67", "ba 67 bb 63 bc 67 bd 77 be 67", "b4 67 b5 43 b6 67 b7 78 b8 67", "b7 78 b8 67 b9 6b ba 67 bb 63", "b8 67 b9 6b ba 67 bb 63 bc 67", "b1 78 b2 67 b3 72 b4 67 b5 43", "b9 6b ba 67 bb 63 bc 67 bd 77", "b2 67 b3 72 b4 67 b5 43 b6 67", "bf 48 c0 67 c1 08 c2 67 c3 66", "bc 67 bd 77 be 67 bf 48 c0 67" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::stack-string-construction", "l": 1, "el": [ "0xb5110", "0xb5114", "0xb50f4", "0xb50e8", "0xb50f0", "0xb5108", "0xb511c", "0xb5104", "0xb50ec", "0xb50f8", "0xb50fc", "0xb50e0", "0xb5100", "0xb50e4", "0xb5118", "0xb510c" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "0x140148" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032", "el": [ "0x140168" ] }, { "c": 0.949999988079071, "d": "links kernel32 (WriteConsoleW, CreateFileW, HeapSize, SetStdHandle, GetProcessHeap, ... +68 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "73 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (GetMessageW, DefWindowProcW, DestroyWindow, CreateWindowExW, EndDialog, ... +14 more)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "19 symbols" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetUserDefaultLCID", "EnumSystemLocalesW", "EnumSystemLocalesEx", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2, "el": [ "0x1401f0", "0x168c32", "0x149470", "0x1689f4" ] }, { "c": 0.8999999761581421, "d": "Inline PE header validation sequence", "e": [ "MZf9\bu3HcH\u003cH\u0003ȁ9PE", "4f", "B8 4D 5A 00 00", "49", "3c 10" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-validation-sequence", "l": 1, "el": [ "", "0x12620b", "0xb4ec2", "0x125f4d", "0xb4f18" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "PostQuitMessage", "DefWindowProcW", "RegisterClassExW", "CreateWindowExW", "GetMessageW", "DispatchMessageW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1, "el": [ "0x1402c0", "0x140258", "0x140278", "0x140268", "0x140250", "0x1402e0" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2, "el": [ "0x140030", "0x140028" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleExW", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x1400f0", "0x1401b8", "0x1400e8" ] }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetUserDefaultLCID", "EnumSystemLocalesW", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-fingerprinting-imports", "l": 2, "el": [ "0x1401f0", "0x1401f8", "0x140100" ] }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InitializeSListHead", "InterlockedFlushSList" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2, "el": [ "0x140160", "0x140190" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 1, "el": [ "0x140130", "0x140138" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "EnumSystemLocalesW", "FreeEnvironmentStringsW", "EnumSystemLocalesEx", "GetEnvironmentStringsW", "GetLocaleInfoW", "GetUserDefaultLCID" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082", "el": [ "0x168c32", "0x140028", "0x149470", "0x140030", "0x1689f4", "0x1401f0" ] }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "FreeEnvironmentStringsW", "GetCommandLineA", "EnumSystemLocalesW", "GetCommandLineW", "GetEnvironmentStringsW", "GetUserDefaultLCID", "GetLocaleInfoW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082", "el": [ "0x140028", "0x140040", "0x1401f8", "0x140038", "0x140030", "0x1401f0", "0x140100" ] }, { "c": 0.9200000166893005, "d": "Custom API resolver logic (manual module/export resolution)", "e": [ "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-synch-l1-2-0", "GetModuleHandleExW", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-string-l1-1-0", "GetProcAddress", "api-ms-win-core-localization-l1-2-1", "41 B8 00 08 00 00", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-localization-obsolete-l1-2-0" ], "i": "micro-behaviors/os/api-resolution/manual::custom-api-resolver-logic", "l": 2, "el": [ "0x149220", "0x1450f8", "0x1401b8", "0x149020", "0x149110", "0x1491e0", "0x149160", "0x1400f0", "0x149060", "0x124555", "0x1491a0", "0x145150", "0x149260", "0x1450b8", "0x148fe0", "0x1490b0" ] }, { "a": "T1497", "c": 0.8500000238418579, "d": "Adaptive behavior based on environment", "e": [ "IsDebuggerPresent", "exports.count = 65.00", "imports.count = 92.00", "GetEnvironmentStringsW", "IsProcessorFeaturePresent", "IsDebuggerPresent", "FreeEnvironmentStringsW" ], "i": "objectives/anti-analysis/environment-detect/runtime::environment-adaptive-behavior", "l": 2, "m": "B0001", "el": [ "0x168afa", "", "", "0x140030", "0x140150", "0x140168", "0x140028" ] } ], "sha": "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1", "path": "407efed8e868c0a3e8ef9dfbce26b48bdcd03b80dabdb39fadc4b16094e89bd1.exe", "type": "pe" } ], "tv": "52045" } }