{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9994148015975952, "class": 1 } ], "prob": 0.9994148, "class": 1, "models": [ { "m": "az", "prob": 0.99901116, "class": 1 }, { "m": "az/native", "prob": 0.9994148, "class": 0 }, { "m": "az/pe", "prob": 0.9992956, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9958679, 0.99937946 ], "analyzed_at": "2026-05-05T12:35:08Z" }, "path": "6922", "raw": { "v": "4", "fs": [ { "f": "KO₆(As₈C₅Er₃IPS)H₂(Cm₃Po₃)Md₃(Bi₅HeSi)", "k": { "pe.checksum": "0x00052403", "pe.timestamp": 1390151683, "hashes.imphash": "9e0e194919a69e694bda91a4a90a11c4", "build.target_arch": "x86", "pe.linker_version": "9.0", "pe.resource_types[0]": "RT_VERSION", "pe.version_info.company_name": "(", "pe.version_info.file_version": "1.0.0.394", "pe.version_info.product_name": ",\u0004\u0001ProductVersion", "pe.version_info.internal_name": "\u003e\r\u0001LegalCopyright", "pe.load_config.security_cookie": "0x60fba", "pe.version_info.legal_copyright": "Copyright ? ", "pe.version_info.product_version": "1.0", "binary.top_complex_unnamed[0].cc": 36, "binary.top_complex_unnamed[1].cc": 29, "binary.top_complex_unnamed[2].cc": 28, "binary.top_complex_unnamed[3].cc": 25, "binary.top_complex_unnamed[4].cc": 25, "binary.top_complex_unnamed[5].cc": 24, "binary.top_complex_unnamed[6].cc": 23, "binary.top_complex_unnamed[7].cc": 23, "pe.version_info.file_description": "4\n\u0001FileVersion", "binary.top_complex_unnamed[0].bbs": 58, "binary.top_complex_unnamed[1].bbs": 45, "binary.top_complex_unnamed[2].bbs": 47, "binary.top_complex_unnamed[3].bbs": 35, "binary.top_complex_unnamed[4].bbs": 34, "binary.top_complex_unnamed[5].bbs": 37, "binary.top_complex_unnamed[6].bbs": 38, "binary.top_complex_unnamed[7].bbs": 29, "pe.version_info.original_filename": " ", "binary.top_complex_unnamed[0].addr": "0x12596", "binary.top_complex_unnamed[0].size": 1039, "binary.top_complex_unnamed[1].addr": "0x15bee", "binary.top_complex_unnamed[1].size": 1103, "binary.top_complex_unnamed[2].addr": "0x12004", "binary.top_complex_unnamed[2].size": 912, "binary.top_complex_unnamed[3].addr": "0x14dd4", "binary.top_complex_unnamed[3].size": 711, "binary.top_complex_unnamed[4].addr": "0x16ec0", "binary.top_complex_unnamed[4].size": 456, "binary.top_complex_unnamed[5].addr": "0x14bfa", "binary.top_complex_unnamed[5].size": 428, "binary.top_complex_unnamed[6].addr": "0x10cd6", "binary.top_complex_unnamed[6].size": 376, "binary.top_complex_unnamed[7].addr": "0x11d78", "binary.top_complex_unnamed[7].size": 191 }, "x": 81, "id": 0, "is": [ "PsGetVersion", "KfReleaseSpinLock", "IoAllocateMdl", "MmProbeAndLockPages", "MmMapLockedPagesSpecifyCache", "MmUnlockPages", "IoFreeMdl", "ExAllocatePool", "ExFreePool", "NtQuerySystemInformation", "HalMakeBeep" ], "ms": { "pe": { "machine": 332.0, "checksum": 336899.0, "rsrc_size": 768.0, "subsystem": 1.0, "timestamp": 1390151683.0, "image_base": 65536.0, "rsrc_entropy": 2.81, "entry_section": ".vmp1", "size_of_image": 334720.0, "timestamp_day": 19.0, "checksum_valid": true, "file_alignment": 128.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "timestamp_year": 2014.0, "characteristics": 258.0, "entry_point_rva": 285931.0, "security_cookie": 397242.0, "size_of_headers": 1152.0, "timestamp_month": 1.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 2.0, "computed_checksum": 336899.0, "section_alignment": 128.0, "unusual_alignment": true, "number_of_sections": 8.0, "resource_timestamp": 0.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_present": false, "resource_timestamp_present": false, "entry_in_nonstandard_section": true }, "file": { "size": 334724.0 }, "binary": { "code_size": 316800.0, "func_count": 617.0, "entry_point": 285931.0, "has_overlay": true, "wx_sections": 3.0, "code_entropy": 7.35, "data_entropy": 2.97, "func_density": 1.99, "import_count": 11.0, "overlay_size": 4.0, "string_count": 211.0, "avg_func_size": 42972.82, "overlay_ratio": 0.0, "section_count": 8.0, "avg_complexity": 2.27, "import_density": 0.04, "max_complexity": 36.0, "string_density": 0.68, "overall_entropy": 5.53, "overlay_entropy": 0.81, "avg_basic_blocks": 4.67, "avg_section_size": 41696.0, "dependency_count": 2.0, "entropy_variance": 2.53, "avg_string_length": 10.32, "complexity_per_kb": 0.01, "max_string_length": 152.0, "wide_string_count": 28.0, "writable_sections": 4.0, "avg_string_entropy": 2.39, "code_to_data_ratio": 18.89, "data_to_file_ratio": 0.04, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.09, "total_basic_blocks": 2884.0, "executable_sections": 4.0, "func_analysis_depth": 2.0, "high_entropy_regions": 2.0, "string_length_stddev": 15.37, "largest_section_ratio": 0.71, "sentence_string_count": 5.0, "sentence_string_ratio": 0.02, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 3.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 415, "h.rdata" ], [ 455, "H.data" ], [ 496, "INIT" ], [ 536, ".vmp0" ], [ 576, ".vmp1" ], [ 616, ".reloc" ], [ 655, "B.rsrc" ], [ 1513, "QQSV" ], [ 5231, "PQSSSS" ], [ 6052, "SSPR" ], [ 6441, "SSSV" ], [ 7956, "HPQV" ], [ 15405, "QQV3" ], [ 15413, "t99u" ], [ 15446, "7PVVV" ], [ 17145, "RZPXRZ" ], [ 17190, "WRZRZQYQY" ], [ 19021, "QSVW" ], [ 20302, "RZQY" ], [ 20352, "QYRZW" ], [ 20392, "RZPX" ], [ 20818, "RZRZ" ], [ 21098, "Whzy" ], [ 21146, "Whby" ], [ 22904, "YYVP" ], [ 23206, "E W3" ], [ 26257, "DSVW3" ], [ 26304, "PXRZ" ], [ 26570, "SPVVV" ], [ 27241, "Xj.f" ], [ 27476, "Shbd" ], [ 28115, "Xjuf" ], [ 29627, "URPQQh/t" ], [ 29841, "UVWS" ], [ 29956, "\\SystemRoot\\system32\\" ], [ 29978, "list.dat" ], [ 29988, "wide", "\\Device\\Tcp" ], [ 30036, "%u.%u.%u.%u" ], [ 30048, "TransportAddress" ], [ 30066, "ConnectionContext" ], [ 30086, "https://" ], [ 30096, "http://" ], [ 30122, "HTTP/1.1 200 OK" ], [ 30138, "GET /%s HTTP/1.1\r\nAccept: */*\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)\r\nHost: %s" ], [ 30156, "Accept: */*" ], [ 30169, "Accept-Language: zh-cn" ], [ 30193, "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" ], [ 30268, "Connection: Keep-Alive" ], [ 30312, "Content-Length:" ], [ 30332, "%s?t=%s\u0026m=%s" ], [ 30350, "8.8.8.8" ], [ 30424, "fYk6Rd6JdXEegzpzf33U" ], [ 30450, "gHmDiDoecR7U" ], [ 30464, "hYR4cYhxOh5xHtQ=" ], [ 30482, "hYR4cYhxOoR8hNQ=" ], [ 30500, "fIiIhEY/P3x/fXU6RUE6c399P0lCQULeQUxI1A==" ], [ 30542, "fIiIhEY/P4g6QUJDOnN/fT9EQkxDQ0RJRERD1A==" ], [ 30584, "fIiIhEY/P4g6gYE6c399P3d/eHF4eIl5enfU" ], [ 30622, "fIiIhEY/P46Af3c6g3l6cTpzf306c3o/gz+OgH93L3NFdY5ESN5IREFEQXp6Q4A6fIh9gNQ=" ], [ 30696, "fIiIhEY/P3x5Oo5xeXiFOnN/fT9F3oR7dz95iHV9P0VFQUlBRERIR0FzcnNBckJDRUlJRN5yeNQ=" ], [ 30784, "wide", "DependOnService" ], [ 30816, "wide", "DependOnGroup" ], [ 30844, "wide", "Group" ], [ 30856, "wide", "Start" ], [ 30868, "wide", "Type" ], [ 30878, "wide", "ImagePath" ], [ 30898, "wide", "ErrorControl" ], [ 30936, "wide", "PNP_TDI" ], [ 30962, "wide", "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\" ], [ 31074, "wide", "%s\\Security" ], [ 31114, "\\SystemRoot\\System32\\" ], [ 31136, ".sys" ], [ 31142, "%d.%d.%d.%d:%d" ], [ 31158, "%d.%d.%d.%d" ], [ 31186, "CONNECT" ], [ 31194, "POST" ], [ 31204, "\u003cmeta http-equiv=\"refresh\" content=\"0; url=http://%s\"\u003e" ], [ 31260, "wide", "\\DosDevices\\PowerChange" ], [ 31308, "wide", "\\Device\\PowerChange" ], [ 31348, "IoRegisterShutdownNotification" ], [ 31896, "RSDS" ], [ 31920, "d:\\p\\loser\\loser\\loser\\objfre_wxp_x86\\i386\\loser.pdb" ], [ 32200, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], [ 32277, "4SVW" ], [ 50779, "HT05" ], [ 51448, "4mya" ], [ 56152, "MAHO" ], [ 59381, "ZWET" ], [ 59387, "ug-hWED" ], [ 59427, "WED54" ], [ 60996, "RIK1P" ], [ 61253, "RIK1" ], [ 61622, "648J" ], [ 63329, "iiut" ], [ 63549, "Qqnb" ], [ 68500, "32zv" ], [ 70147, "Aimf" ], [ 73318, "wC5s2\u003e" ], [ 73787, "3ROO" ], [ 74587, "i7 x" ], [ 74968, "WY9S" ], [ 75144, "Heia" ], [ 76713, "6rdi" ], [ 81122, "7uui" ], [ 81426, "6PDJ" ], [ 89365, "l2\u003eu" ], [ 90950, "D$()#@aS" ], [ 103974, "CRF3F" ], [ 104182, "CC3F" ], [ 108193, "EDPO" ], [ 108909, "Wvec" ], [ 109886, "87WK" ], [ 110147, "MSFN" ], [ 117326, "Ggtx" ], [ 120243, "eim8" ], [ 127684, "et4j" ], [ 129463, "i1nl" ], [ 134000, "LLB6" ], [ 135556, "220n" ], [ 136440, "S5Q0T" ], [ 146056, "LKR2L" ], [ 146258, "3 xw" ], [ 149392, ".nzh" ], [ 152226, "eedd" ], [ 155078, "`-@`" ], [ 156279, "BYY0" ], [ 163116, "Allj" ], [ 163361, "ww66" ], [ 163593, "Jjjh" ], [ 164878, "Kvvt" ], [ 171735, "4q1g" ], [ 172042, "3w7m" ], [ 172561, "Z2OM" ], [ 172722, "h6os" ], [ 174721, "s38w" ], [ 174976, "FF99" ], [ 179626, "j8vu" ], [ 180334, "TLR7" ], [ 190223, "X0MK" ], [ 192733, "ihyi" ], [ 197872, "LKSG2" ], [ 198999, "8q0i" ], [ 211451, "8 0nn" ], [ 220547, "FRRP" ], [ 223329, "FD76" ], [ 226749, "::x8cca" ], [ 227170, "y900" ], [ 236241, "CRB4X" ], [ 237714, "OJ51" ], [ 240919, "ed42" ], [ 241827, "Utqq" ], [ 244369, "MK08_" ], [ 245084, "p05u" ], [ 246724, "b8p2" ], [ 248096, "132Q" ], [ 249796, "VVHF" ], [ 261494, "RIK1R" ], [ 268597, "JIQU" ], [ 273818, "xv83" ], [ 275286, "ffee" ], [ 276119, "98ca" ], [ 276577, "32\u003e." ], [ 276989, "Aulo" ], [ 280886, "#a@00.lK" ], [ 281988, "18NK" ], [ 283466, "maia" ], [ 284185, "ntoskrnl.exe" ], [ 284469, "VVNG" ], [ 284529, "VHAL.dll" ], [ 285707, "MmUnlockPages" ], [ 287353, "Zzkl" ], [ 298239, "MmProbeAndLockPages" ], [ 299105, "\u003c\u003czy" ], [ 300169, "NtQuerySystemInformation" ], [ 300854, "JIUR" ], [ 301237, "LRJC" ], [ 302145, "IoAllocateMdl" ], [ 304107, "WIW7" ], [ 304418, "KfReleaseSpinLock" ], [ 304569, "Puwa" ], [ 305981, "PsGetVersion" ], [ 306632, "54SR" ], [ 306696, "Xvvi" ], [ 307365, "ExAllocatePool" ], [ 309317, "hal.dll" ], [ 312731, "HalMakeBeep" ], [ 314528, "l262" ], [ 314658, "P10O" ], [ 315315, "Juuh" ], [ 317594, "MmMapLockedPagesSpecifyCache" ], [ 317873, "588v" ], [ 332873, "131.2" ], [ 333019, "506-9X9" ], [ 333336, "/1G1" ], [ 334046, "wide", "VS_VERSION_INFO" ], [ 334138, "wide", "StringFileInfo" ], [ 334198, "wide", "Author" ], [ 334218, "wide", "CompanyName" ], [ 334250, "wide", "FileDescription" ], [ 334290, "wide", "FileVersion" ], [ 334342, "wide", "InternalName" ], [ 334374, "wide", "LegalCopyright" ], [ 334404, "wide", "Copyright ?" ], [ 334438, "wide", "OriginalFilename" ], [ 334478, "wide", "ProductName" ], [ 334510, "wide", "ProductVersion" ], [ 334554, "wide", "Website" ], [ 334578, "wide", "VarFileInfo" ], [ 334610, "wide", "Translation" ] ], "sz": 334724, "ts": [ { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 5.83)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.39" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.550000011920929, "d": ".NET Start method token", "e": [ "Start" ], "i": "micro-behaviors/process/create/spawn::start-method-token-dotnet", "l": 1 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.35" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:" ], "i": "micro-behaviors/communications/http/request::user-agent-header", "l": 2, "m": "C0002" }, { "c": 0.6000000238418579, "d": "System32 substring reference", "e": [ "\\SystemRoot\\System32\\" ], "i": "micro-behaviors/fs/path/system::system32-substr", "l": 2 }, { "c": 0.699999988079071, "d": "HTTP GET method", "e": [ "GET /%s HTTP/1.1" ], "i": "micro-behaviors/communications/http/get::get", "l": 3 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_func_size = 42972.82" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 0.81" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "a": "T1071.001", "d": "Old Mozilla 4.0 User-Agent", "e": [ "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)", "…age: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01;…" ], "i": "micro-behaviors/communications/http/headers::ua-mozilla-old", "l": 2, "m": "C0002" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 617.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "d": "SYSTEMROOT environment variable", "e": [ "\\SystemRoot\\system32\\", "\\SystemRoot\\System32\\" ], "i": "micro-behaviors/os/env/vars/system-info::systemroot-var", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 11.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.53" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "GET /%s HTTP/1.1\r\nAccept: */*\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)\r\nHost: %s", "Connection: Keep-Alive" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-5", "l": 1, "m": "F0004" }, { "c": 0.8600000143051147, "d": "Extremely large average function size", "e": [ "binary.avg_func_size = 42972.82" ], "i": "metadata/binary/metrics::giant-average-function", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.70)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP request-line literal", "e": [ "GET /%s HTTP/1.1" ], "i": "objectives/command-and-control/channel/http/protocol::http-request-line", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 617.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 768.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "WRZRZQYQY" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "6922" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1055", "c": 1.0, "d": "Windows kernel driver marker (ntoskrnl/storport)", "e": [ "ntoskrnl" ], "i": "objectives/anti-static/obfuscation/binary-structure::kernel-driver-string", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 211.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 2.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "a": "T1071.001", "c": 0.75, "d": "HTTP POST method string in binary", "e": [ "POST" ], "i": "micro-behaviors/communications/http/post::post-string-pe", "l": 1, "m": "C0002" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "Hardcoded GET method string", "e": [ "GET /%s HTTP/1.1\r\nAccept: */*…" ], "i": "objectives/command-and-control/channel/http/protocol::http-method-get", "l": 1 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "14 7b 01 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 2884.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 13184)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1071.001", "d": "HTTP header syntax marker", "e": [ "HTTP/1.1\r\nAccept: " ], "i": "objectives/command-and-control/channel/http/protocol::http-delimiter", "l": 1 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "GET /%s HTTP/1.1\r\nAccept: */*\r\nAccept-L…", "HTTP/1.1 200 OK" ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 334720.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "MmMapLockedPagesSpecifyCache" ], "i": "objectives/command-and-control/dropper/staging::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1390151683.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query system information", "e": [ "NtQuerySystemInformation" ], "i": "micro-behaviors/os/exception/handler::query-system-information", "l": 2, "m": "C0046" }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "47", "49" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.1" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "loser.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": "Mozilla/4.0 MSIE user agent", "e": [ "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)", "GET /%s HTTP/1.1\r\nAccept: */*\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)\r\nHost: %s" ], "i": "well-known/malware/rat/cobalt-strike::ua-msie-4", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "ConnectionContext", "GET /%s HTTP/1.1\r\nAccept: */*\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)\r\nHost: %s", "Connection: Keep-Alive" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 2.27" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.949999988079071, "d": "VMProtect packed binary section name", "e": [ ".vmp0", ".vmp1" ], "i": "objectives/anti-static/pack/detect::vmprotect-section", "l": 4, "m": "F0001" }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 617.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.949999988079071, "d": "Three or more writable executable sections", "e": [ "binary.wx_sections = 3.00" ], "i": "metadata/hardening/memory::three-plus-wx-sections", "l": 3 }, { "a": "T1195.002", "c": 0.8500000238418579, "d": "Extremely large average function size", "e": [ "binary.avg_func_size = 42972.82" ], "i": "objectives/command-and-control/backdoor/binary::massive-code-blob", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 617.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "Hardcoded IP address in PE version resource", "e": [ "8.8.8.8" ], "i": "well-known/malware/trojan/expiro::expiro-version-ip", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 617.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 11.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 768)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload::unusual-alignment-pe", "l": 4 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 3 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "INIT (size: 1920, perms: rwx)", ".vmp0 (size: 236160, perms: rwx)", ".vmp1 (size: 48384, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 2.27" ], "i": "metadata/binary/metrics::low-average-complexity", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 11.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links ntoskrnl.exe (PsGetVersion, IoAllocateMdl, MmProbeAndLockPages, MmMapLockedPagesSpecifyCache, MmUnlockPages, ... +4 more)", "e": [ "ntoskrnl.exe" ], "i": "metadata/dylib::ntoskrnl/exe", "l": 2 }, { "c": 0.949999988079071, "d": "links HAL.dll (KfReleaseSpinLock, HalMakeBeep)", "e": [ "HAL.dll" ], "i": "metadata/dylib::hal/dll", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "GET method with HTTP delimiter", "e": [ "HTTP/1.1\r\nAccept: ", "GET /%s HTTP/1.1\r\nAccept: */*…" ], "i": "objectives/command-and-control/channel/http/protocol::method-fragment-with-delimiter-get", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "41521eaf29edc31f9a2cb18f86b80763ac3e0c88344aacfb2cf34526d63f6331", "path": "6922", "type": "pe" } ], "tv": "27ac5" } }