{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.33898306, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T10:57:33Z" }, "path": "40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a.exe", "raw": { "v": "5", "fs": [ { "f": "O(Er)H(Os)", "x": 4, "ff": { "i": [ [ "ntoskrnl.exe", "RtlCopyUnicodeString" ], [ "ntoskrnl.exe", "ExAllocatePoolWithTag" ], [ "ntoskrnl.exe", "MmUnmapIoSpace" ], [ "ntoskrnl.exe", "MmMapIoSpace" ], [ "ntoskrnl.exe", "ZwClose" ], [ "ntoskrnl.exe", "ZwQueryValueKey" ], [ "ntoskrnl.exe", "RtlInitUnicodeString" ], [ "ntoskrnl.exe", "ZwOpenKey" ], [ "ntoskrnl.exe", "MmGetPhysicalAddress" ], [ "ntoskrnl.exe", "ZwEnumerateKey" ], [ "ntoskrnl.exe", "IoRegisterBootDriverReinitialization" ], [ "ntoskrnl.exe", "RtlImageNtHeader" ], [ "ntoskrnl.exe", "memcpy" ], [ "ntoskrnl.exe", "ZwWriteFile" ], [ "ntoskrnl.exe", "RtlRandomEx" ], [ "ntoskrnl.exe", "ZwReadFile" ], [ "ntoskrnl.exe", "ZwQueryFullAttributesFile" ], [ "ntoskrnl.exe", "ZwCreateFile" ], [ "ntoskrnl.exe", "KeTickCount" ], [ "ntoskrnl.exe", "KeBugCheckEx" ], [ "ntoskrnl.exe", "RtlUnwind" ], [ "ntoskrnl.exe", "memset" ], [ "ntoskrnl.exe", "ExFreePoolWithTag" ], [ "ntoskrnl.exe", "MmGetSystemRoutineAddress" ], [ "ntoskrnl.exe", "PsGetVersion" ], [ "ntoskrnl.exe", "ExAllocatePoolWithQuotaTag" ], [ "ntoskrnl.exe", "ZwQuerySystemInformation" ], [ "hal", "x86BiosCall" ] ], "m": { "pe": { "checksum": 32535.0, "has_safe_seh": 1.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "computed_checksum": 71834.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "entry_in_writable_section": 1.0, "base_relocation_block_count": 5.0, "base_relocation_entry_count": 268.0 }, "file": { "size": 28160.0, "entropy": 6.69, "size_bytes": 28160.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.99, "data_entropy": 0.24, "string_count": 389.0, "entropy_variance": 5.4, "avg_string_length": 8.06, "max_string_length": 96.0, "code_to_data_ratio": 0.95, "string_length_stddev": 8.85, "largest_section_ratio": 0.45, "sentence_string_count": 8.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 28.0 }, "sections": { "count": 9.0, "code_size": 10240.0, "entropy_max": 7.59, "entropy_mean": 3.87, "name_entropy": 4.12, "writable_count": 2.0, "executable_count": 3.0, "nonstandard_count": 4.0, "executable_writable_count": 1.0 }, "dependencies": { "count": 2.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 189, "u8", "wi1Rich" ], [ 472, "u8", ".text" ], [ 511, "u8", "h.rdata" ], [ 551, "u8", "H.data" ], [ 592, "u8", "seg1" ], [ 631, "u8", "Hseg2" ], [ 671, "u8", "HPAGE" ], [ 752, "u8", ".rsrc" ], [ 791, "u8", "B.reloc" ], [ 3263, "u8", "0SVWj" ], [ 3776, "u8", "tFVWj" ], [ 4100, "u8", "AACCN" ], [ 6594, "u8", "SSjbj" ], [ 6816, "u8", "WPSSS" ], [ 6853, "u8", "Sj h" ], [ 8063, "u8", "URPQQh" ], [ 8290, "u8", "UVWS" ], [ 8421, "u8", "UQPXY]Y[" ], [ 8552, "wide", "Configuration Data" ], [ 8590, "wide", "ACPI BIOS" ], [ 8610, "wide", "Identifier" ], [ 8636, "wide", "\\SystemRoot\\system32\\DRIVERS\\oem-drv86.sys" ], [ 8722, "u8", "\\SystemRoot\\system32\\DRIVERS\\oem-drv86.sys" ], [ 9372, "wide", "RtlQueryModuleInformation" ], [ 9504, "u8", "RSDSZ" ], [ 9528, "u8", "oem-drv86.pdb" ], [ 11327, "u8", "ND7WYN" ], [ 11711, "u8", "7S0Q" ], [ 11790, "u8", "X2K4" ], [ 13701, "u8", "YZ_TZ" ], [ 14513, "u8", "om8Ut5" ], [ 14888, "u8", "PQrIH" ], [ 15464, "u8", "PcwQJ" ], [ 15782, "u8", "BCBX" ], [ 16008, "u8", "ATjOO" ], [ 16208, "u8", "ONja8SP" ], [ 16393, "u8", "RM81" ], [ 17016, "u8", "VOhHe]Sa.l3r" ], [ 17293, "u8", "snCi" ], [ 17512, "u8", "AdmSI" ], [ 17659, "u8", "eq8AJ" ], [ 17897, "u8", "TP841" ], [ 17952, "u8", "/zqR" ], [ 18173, "u8", "RS; 6J" ], [ 18264, "u8", "QWNOK" ], [ 18472, "u8", "0AwQJ" ], [ 18847, "u8", "aXAWYN" ], [ 18901, "u8", "/NCzg" ], [ 19394, "u8", "conyH" ], [ 19825, "u8", "gHRMrs" ], [ 19901, "u8", "Syxp" ], [ 20148, "u8", "3QcedOsaS" ], [ 20401, "u8", "Cx[p)" ], [ 20408, "u8", "Pocr" ], [ 20904, "u8", "TOsQJ" ], [ 23575, "u8", "u4PPP" ], [ 24060, "u8", "hAuxK" ], [ 25018, "u8", "ExFreePoolWithTag" ], [ 25038, "u8", "IoRegisterBootDriverReinitialization" ], [ 25078, "u8", "RtlCopyUnicodeString" ], [ 25102, "u8", "ExAllocatePoolWithTag" ], [ 25126, "u8", "MmUnmapIoSpace" ], [ 25144, "u8", "MmMapIoSpace" ], [ 25160, "u8", "ZwClose" ], [ 25170, "u8", "ZwQueryValueKey" ], [ 25188, "u8", "RtlInitUnicodeString" ], [ 25212, "u8", "ZwOpenKey" ], [ 25224, "u8", "MmGetPhysicalAddress" ], [ 25248, "u8", "ZwEnumerateKey" ], [ 25266, "u8", "memset" ], [ 25276, "u8", "RtlImageNtHeader" ], [ 25296, "u8", "memcpy" ], [ 25306, "u8", "ZwWriteFile" ], [ 25320, "u8", "RtlRandomEx" ], [ 25334, "u8", "ZwReadFile" ], [ 25348, "u8", "ZwQueryFullAttributesFile" ], [ 25376, "u8", "ZwCreateFile" ], [ 25392, "u8", "KeTickCount" ], [ 25406, "u8", "KeBugCheckEx" ], [ 25420, "u8", "ntoskrnl.exe" ], [ 25436, "u8", "RtlUnwind" ], [ 25448, "u8", "x86BiosCall" ], [ 25460, "u8", "HAL.dll" ], [ 25470, "u8", "MmGetSystemRoutineAddress" ], [ 25498, "u8", "PsGetVersion" ], [ 25514, "u8", "ExAllocatePoolWithQuotaTag" ], [ 25544, "u8", "ZwQuerySystemInformation" ], [ 25702, "wide", "VS_VERSION_INFO" ], [ 25794, "wide", "StringFileInfo" ], [ 25830, "wide", "040904B0" ], [ 25854, "wide", "CompanyName" ], [ 25880, "wide", "secr9tos" ], [ 25906, "wide", "FileDescription" ], [ 25940, "wide", "oem-drv.sys is used to privode SLIC2.1 support for OEM activation of WindowsNT6.1 based systems." ], [ 26142, "wide", "FileVersion" ], [ 26168, "wide", "1.2.0.4 built by: WinDDK" ], [ 26226, "wide", "InternalName" ], [ 26252, "wide", "oem-drv.sys" ], [ 26282, "wide", "LegalCopyright" ], [ 26312, "wide", "Copyright © secr9tos" ], [ 26362, "wide", "OriginalFilename" ], [ 26426, "wide", "ProductName" ], [ 26452, "wide", "OEM-SLP2.1 ACPI Patch Driver (HPD86)" ], [ 26534, "wide", "ProductVersion" ], [ 26564, "wide", "1.2.0.4" ], [ 26586, "wide", "VarFileInfo" ], [ 26618, "wide", "Translation" ] ], "v": { "file.stem": "40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a", "pe.imphash": "374095e6782b89ee46c48ba80e2606ec", "pe.machine": "i386", "pe.rich.key": 828995509, "pe.rich.hash": "431e5f23b611fb21f5bff0101e9d17fd", "pe.subsystem": "native", "pe.timestamp": 1276615715, "file.basename": "40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a.exe", "pe.image_base": 65536, "pe.image_size": 53968, "pe.machine_id": 332, "pe.os_version": "6.1", "pe.version.os": "windows_nt_windows32", "pe.entry_point": 45300, "pe.headers_size": 1024, "pe.version.type": "drv", "pe.debug.pdb.age": 1, "pe.entry_section": "INIT", "pe.subsystem_raw": 1, "pe.debug.pdb.guid": "307cf95a-15db-4cdf-8764-8101d63f691a", "pe.debug.pdb.path": "oem-drv86.pdb", "pe.debug.pdb.stem": "oem-drv86", "pe.file_alignment": 512, "pe.image_hash.sha1": "f3f52f0cb3d5bd143080f1724587ec22ba5323f5", "pe.version.company": "secr9tos", "pe.version.subtype": "system", "pe.load_config.size": 72, "pe.version.flags[0]": "private_build", "pe.image_hash.sha256": "9d29260b0112dcba800001682aafe730efab9428189d0ed70426a886ee17b8f3", "pe.image_hash.sha384": "e374c2266fead0622f4d4e2782ced325d7c698965f6e018b29f2e9d3586350c0ff901dcbabbb9b0edcbf24537a399724", "pe.image_hash.sha512": "8aa0f5af094ae414bcce04c8ab8486bc73e025d9cf8518b299b0a43d9d3ae2e5e860e9b9c8dd9a1b0f8d44f1976560024602c784d7f47ded50e22a0f8c68fc37", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "6.1", "pe.version.copyright": "Copyright © secr9tos", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.debug.pdb.basename": "oem-drv86.pdb", "pe.characteristics_raw": 258, "pe.debug.pdb.timestamp": 1276615715, "pe.version.description": "oem-drv.sys is used to privode SLIC2.1 support for OEM activation of WindowsNT6.1 based systems.", "pe.linker_major_version": 9, "pe.version.file_version": "1.2.0.4 built by: WinDDK", "pe.version.product_name": "OEM-SLP2.1 ACPI Patch Driver (HPD86)", "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "codeview", "pe.version.internal_name": "oem-drv.sys", "pe.data_directories[0].rva": 45316, "pe.data_directories[1].rva": 49152, "pe.data_directories[2].rva": 53248, "pe.data_directories[3].rva": 12416, "pe.data_directories[4].rva": 12504, "pe.data_directories[5].rva": 12288, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1.2.0.4", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 60, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1048, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 584, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "load_config", "pe.data_directories[4].size": 64, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 120, "pe.debug.entries[0].type_id": 2, "pe.rich.entries[0].build_id": 1, "pe.rich.entries[1].build_id": 147, "pe.rich.entries[2].build_id": 149, "pe.rich.entries[3].build_id": 131, "pe.rich.entries[4].build_id": 148, "pe.rich.entries[5].build_id": 145, "pe.rich.entries[0].use_count": 30, "pe.rich.entries[1].use_count": 5, "pe.rich.entries[2].use_count": 6, "pe.rich.entries[3].use_count": 13, "pe.rich.entries[4].use_count": 1, "pe.rich.entries[5].use_count": 1, "pe.version.original_filename": "oem-drv.sys", "pe.coff.dos_header_pe_pointer": 224, "pe.rich.entries[1].product_id": 30729, "pe.rich.entries[2].product_id": 30729, "pe.rich.entries[3].product_id": 30729, "pe.rich.entries[4].product_id": 30729, "pe.rich.entries[5].product_id": 30729, "pe.debug.entries[0].size_bytes": 38, "pe.load_config.security_cookie": 81920, "pe.base_relocations.block_count": 5, "pe.base_relocations.entry_count": 268, "pe.load_config.se_handler_count": 2, "pe.load_config.se_handler_table": 78160, "pe.base_relocations.padding_count": 4, "pe.debug.entries[0].timestamp_unix": 1276615715 }, "id": "pe", "sc": [ [ ".text", 1024, 8192, 6.26, "r-x" ], [ ".rdata", 9216, 512, 3.31, "r--" ], [ ".data", 9728, 512, 0.24, "rw-" ], [ "seg1", 10240, 12800, 7.59, "r--" ], [ "seg2", 23040, 512, 0.64, "r--" ], [ "PAGE", 23552, 1024, 4.2, "r-x" ], [ "INIT", 24576, 1024, 5.6, "rwx" ], [ ".rsrc", 25600, 1536, 2.54, "r--" ], [ ".reloc", 27136, 1024, 4.41, "r--" ] ] }, "id": 0, "sz": 28160, "ts": [ { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x3038" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Kernel pool memory allocation", "e": [ "ExAllocatePoolWithTag" ], "i": "micro-behaviors/mem/alloc/executable::kernel-pool-alloc", "l": 2, "el": [ "0x300c" ] }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © secr9tos" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.9800000190734863, "d": "PE native subsystem", "e": [ "native" ], "i": "micro-behaviors/os/kernel/module::native-subsystem", "l": 1, "el": [ "value:pe.subsystem" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "oem-drv.sys is used to privode SLIC2.1 support for OEM activation of WindowsNT6.1 based systems." ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x66c8" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x6374" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 28.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "OEM-SLP2.1 ACPI Patch Driver (HPD86)" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x6466" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 389.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x64fe" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.99" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1055", "c": 1.0, "d": "Windows kernel driver marker (ntoskrnl/storport)", "e": [ "ntoskrnl" ], "i": "objectives/anti-static/obfuscation/binary-structure::kernel-driver-string", "l": 1, "el": [ "0x634c" ] }, { "d": "SYSTEMROOT environment variable", "e": [ "\\SystemRoot\\system32\\DRIVERS\\oem-drv86.sys" ], "i": "micro-behaviors/os/env/vars/system-info::systemroot-var", "l": 2, "el": [ "0x21bc" ] }, { "c": 0.949999988079071, "d": "Kernel driver ntoskrnl in INIT", "e": [ "ntoskrnl.exe" ], "i": "metadata/binary/resource::kernel-driver-init", "l": 2, "el": [ "0x634c" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.2.0.4" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x6672" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.2.0.4 built by: WinDDK" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "oem-drv86.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "0x2538" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x66fa" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 28.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x634c" ] }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2, "el": [ "0x3058" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "41" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x15e6" ] }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.31)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "ZwQueryValueKey" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x6252" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x673a" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "RtlInitUnicodeString", "StringFileInfo", "RtlCopyUnicodeString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x6264", "0x64c2", "0x61f6" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "0x305c" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x6532" ] }, { "c": 1.0, "d": "Dynamically resolves kernel routine addresses", "e": [ "MmGetSystemRoutineAddress" ], "i": "micro-behaviors/os/kernel/routines::dynamic-resolution-symbol", "l": 3, "el": [ "0x3064" ] }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 28.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 28.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x223c" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 28.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x634c" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "RtlQueryModuleInformation" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x249c" ] }, { "a": "T1036.005", "c": 0.8500000238418579, "d": "PE stem disagrees with embedded PDB stem", "e": [ "file.stem != pe.debug.pdb.stem (\"40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a\" != \"oem-drv86\")" ], "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "l": 3, "el": [ "value:file.stem" ] }, { "c": 0.949999988079071, "d": "links hal (x86BiosCall)", "e": [ "hal" ], "i": "metadata/dylib::hal", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links ntoskrnl.exe (RtlCopyUnicodeString, ExAllocatePoolWithTag, MmUnmapIoSpace, MmMapIoSpace, ZwClose, ... +22 more)", "e": [ "ntoskrnl.exe" ], "i": "metadata/dylib::ntoskrnl/exe", "l": 2, "el": [ "27 symbols" ] } ], "sha": "40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a", "path": "40d3b699353c2edeeb57a8645f31dcfeb9f8faa55c95ab7701cc798abbbc4e7a.exe", "type": "pe" } ], "tv": "52045" } }