{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T04:19:53Z" }, "path": "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(Bi₂Si)", "x": 6, "ff": { "i": [ [ "kernel32", "GetModuleHandleA" ] ], "m": { "pe": { "checksum": 2905357.0, "checksum_valid": 0.0, "computed_checksum": 2922745.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 3.0 }, "file": { "size": 2900560.0, "entropy": 7.88, "size_bytes": 2900560.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 7.95, "data_entropy": 7.86, "overlay_size": 10304.0, "string_count": 31396.0, "overlay_ratio": 0.0, "overlay_entropy": 7.49, "entropy_variance": 9.63, "avg_string_length": 4.66, "max_string_length": 76.0, "code_to_data_ratio": 0.97, "string_length_stddev": 1.72, "largest_section_ratio": 0.82, "sentence_string_count": 17.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 11.0, "code_size": 2582016.0, "entropy_max": 7.97, "entropy_mean": 5.35, "name_entropy": 2.66, "writable_count": 4.0, "executable_count": 3.0, "nonstandard_count": 7.0, "executable_writable_count": 1.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 224, "u8", "Rich" ], [ 711, "u8", "@.rsrc" ], [ 751, "u8", "@.idata" ], [ 792, "u8", ".tls" ], [ 832, "u8", ".themida" ], [ 872, "u8", ".boot" ], [ 2521, "u8", "OX8A" ], [ 5825, "u8", "LjejEm" ], [ 5958, "u8", "bn9Ty" ], [ 6411, "u8", "69Kko" ], [ 6810, "u8", "VVL4p" ], [ 6916, "u8", "jdWQN" ], [ 7338, "u8", "PYL4" ], [ 8611, "u8", "kTyz" ], [ 10222, "u8", "smXAO" ], [ 10763, "u8", "G YeYa" ], [ 12427, "u8", "rCWtd" ], [ 13273, "u8", "x1DPS" ], [ 14321, "u8", "LZU1" ], [ 17787, "u8", "j35t" ], [ 17940, "u8", "Q0wWA" ], [ 18290, "u8", "fd14" ], [ 18977, "u8", "kqQi" ], [ 19605, "u8", "zKBOU" ], [ 20001, "u8", "A0IZ" ], [ 20365, "u8", "eKnM4sa" ], [ 20475, "u8", "jAKAz" ], [ 21075, "u8", "nVStC" ], [ 22268, "u8", "L{)x" ], [ 22535, "u8", "u Ty" ], [ 24404, "u8", "gmco_3" ], [ 24922, "u8", "k4w8" ], [ 25837, "u8", "se0c" ], [ 26345, "u8", "ZZOM" ], [ 27425, "u8", "LteZm" ], [ 27640, "u8", "K1B9" ], [ 27672, "u8", "2sayI6" ], [ 29813, "u8", "tcEv" ], [ 29977, "u8", "KtUR6" ], [ 30251, "u8", "QKRS" ], [ 31510, "u8", "6FHP" ], [ 31980, "u8", "YUrjT" ], [ 32897, "u8", "8HKY" ], [ 33273, "u8", "7hoLt" ], [ 33460, "u8", "ieMl" ], [ 35774, "u8", "teId" ], [ 36718, "u8", "}gmeMG[" ], [ 39963, "u8", "NDW4" ], [ 40628, "u8", "NANXCIn" ], [ 41195, "u8", "pAke" ], [ 42480, "u8", "jqEs" ], [ 43288, "u8", "5TR9Z" ], [ 44217, "u8", "19n9i" ], [ 45002, "u8", "O4Y5" ], [ 45059, "u8", "b4l2" ], [ 45346, "u8", "/c3k" ], [ 48856, "u8", "454Pr8" ], [ 48893, "u8", "dmQFL" ], [ 50297, "u8", "9P8NN" ], [ 51071, "u8", "m[A]" ], [ 51246, "u8", "KWN6" ], [ 52976, "u8", "euEf" ], [ 53543, "u8", "BEKU" ], [ 53645, "u8", "acLx" ], [ 54266, "u8", "5AliPl" ], [ 55090, "u8", "lXmu" ], [ 56091, "u8", "i7p5" ], [ 56218, "u8", "jKZLa" ], [ 57618, "u8", "w0oHQg" ], [ 58211, "u8", "D6Oqp" ], [ 58671, "u8", "D5TX" ], [ 58875, "u8", "sGnlu" ], [ 60600, "u8", "Dyol" ], [ 62647, "u8", "WUTM" ], [ 63312, "u8", "KWdDMp\"/tlo" ], [ 63812, "u8", "Ldrm" ], [ 65611, "u8", "gJie" ], [ 66483, "u8", "jC25Uh" ], [ 66692, "u8", "3mIpoLYL" ], [ 66775, "u8", "XA9clp" ], [ 69462, "u8", "sL b" ], [ 69952, "u8", "4ADT" ], [ 70584, "u8", "a1yKM" ], [ 71340, "u8", "Z7J0" ], [ 72894, "u8", "/UPG" ], [ 73717, "u8", "85EOq" ], [ 76089, "u8", "RkIVPA" ], [ 76167, "u8", "oYtj" ], [ 77778, "u8", "RNAG" ], [ 78076, "u8", "tss-W/" ], [ 78282, "u8", "bi4u" ], [ 78823, "u8", "S ff" ], [ 84049, "u8", "ycHel" ], [ 84205, "u8", "XWwQn" ], [ 84624, "u8", "ZDSD" ], [ 85093, "u8", "vtZl" ], [ 86037, "u8", "wIqDpf" ], [ 86858, "u8", "q1skG" ], [ 86911, "u8", "ACA5f" ], [ 87364, "u8", "auqk" ], [ 88076, "u8", "kvQyh" ], [ 88361, "u8", "Tsd j;A" ], [ 89391, "u8", "/AEG" ], [ 90247, "u8", "VVHO" ], [ 93484, "u8", "J4YN" ], [ 93526, "u8", "MCFl4" ], [ 93759, "u8", "aS y" ], [ 94881, "u8", "K95If" ], [ 96696, "u8", "dWmv" ], [ 97689, "u8", "5izo" ], [ 97800, "u8", "m095S" ], [ 98686, "u8", "ePHPu" ], [ 100784, "u8", "9KEF" ], [ 101439, "u8", "upC0O" ], [ 102179, "u8", "XDX0" ], [ 103180, "u8", "f0s0" ], [ 103255, "u8", "zHeGBM" ], [ 103591, "u8", "MqeX9" ], [ 103699, "u8", "KNQ1" ], [ 104150, "u8", "zNjPLOL" ], [ 105546, "u8", "336P" ], [ 106508, "u8", "PILD" ], [ 107266, "u8", "Lira" ], [ 109794, "u8", "gTX8D" ], [ 110446, "u8", "eoTl" ], [ 111618, "u8", "4T9hi" ], [ 112069, "u8", "7JHZ" ], [ 112164, "u8", "Iiyd" ], [ 115141, "u8", "84Lc7" ], [ 116157, "u8", "J1Y8" ], [ 116571, "u8", "sHvPH" ], [ 117099, "u8", "gB.z" ], [ 117290, "u8", "*5K JJ" ], [ 117846, "u8", "DTIBb" ], [ 119212, "u8", "qlUm" ], [ 119540, "u8", "Ijsr" ], [ 120692, "u8", "rKtiJ" ], [ 122060, "u8", "CB-I?gAVZ1B^" ], [ 122424, "u8", "PxAYa" ], [ 122865, "u8", "eOUFW" ], [ 124511, "u8", "CJGtL" ], [ 124531, "u8", "9 lj" ], [ 124819, "u8", "GD4siV" ], [ 126478, "u8", "f86Tt" ], [ 126725, "u8", "xIdAL" ], [ 127752, "u8", "3ZJE" ], [ 130943, "u8", "WiNyp" ], [ 131260, "u8", "ybRNM" ], [ 132240, "u8", "uuHu89" ], [ 132343, "u8", "GgnAY" ], [ 132724, "u8", "fvKNI" ], [ 135111, "u8", "KZgM5" ], [ 135288, "u8", "W39K" ], [ 136123, "u8", "A45qL" ], [ 136187, "u8", "sATgmcA7" ], [ 137619, "u8", "T@TZr nR" ], [ 138533, "u8", "LD3M" ], [ 139154, "u8", "QB09" ], [ 140664, "u8", "9 4FB" ], [ 141712, "u8", "dZUqL" ], [ 144606, "u8", "6EVM" ], [ 146518, "u8", "Gi(}y" ], [ 147719, "u8", "HJetA" ], [ 148673, "u8", "TWYD" ], [ 149642, "u8", "rdhGI" ], [ 150142, "u8", "LA7N" ], [ 151245, "u8", "3PvPA" ], [ 151267, "u8", "PjVcNH" ], [ 151495, "u8", "GJYkNGrV" ], [ 151780, "u8", "3URYPC" ], [ 152670, "u8", "pDpnQaq" ], [ 155527, "u8", "nhLPG" ], [ 155746, "u8", "qHjs" ], [ 155958, "u8", "dcFP3" ], [ 156018, "u8", "OZAL" ], [ 157146, "u8", "HXph5" ], [ 158451, "u8", "DYbCP" ], [ 159164, "u8", "h9zei" ], [ 159595, "u8", "Y3NK8" ], [ 159666, "u8", "pTaq" ], [ 161398, "u8", "PPB_" ], [ 162151, "u8", "u67rf" ], [ 162491, "u8", "NJ5b2" ], [ 163024, "u8", "GL1IyR" ], [ 163154, "u8", "gyEp" ], [ 163471, "u8", "Uykl" ], [ 163740, "u8", "LQL9" ], [ 165711, "u8", "TBDM" ], [ 165756, "u8", "Bf3EDC" ], [ 165863, "u8", "KHx2n" ], [ 166230, "u8", "LOMD" ], [ 166782, "u8", "ihMk" ], [ 168147, "u8", "MKDT" ], [ 168588, "u8", "9Gyw6O" ], [ 168597, "u8", "3K7M" ], [ 168756, "u8", "P50C" ], [ 170399, "u8", "V1Fry" ], [ 173671, "u8", "kouTv" ], [ 175096, "u8", "sXqsG" ], [ 175752, "u8", "sUir" ], [ 175790, "u8", "gNkv" ], [ 176096, "u8", "zdBw" ], [ 178006, "u8", "8Yv3eo" ], [ 180765, "u8", "NWbjL" ], [ 181423, "u8", "jvDuZ" ], [ 181590, "u8", "JE1W" ], [ 182120, "u8", "RZOT6" ], [ 182160, "u8", "TbTTuxW" ], [ 183400, "u8", "O.yr" ], [ 185354, "u8", "PPJya" ], [ 186153, "u8", "X5UME" ], [ 187352, "u8", "YA9W" ], [ 189031, "u8", "HZ8pm" ], [ 189977, "u8", "zjaN6M" ], [ 190131, "u8", "QGnqO" ], [ 192144, "u8", "D1yODk" ], [ 192581, "u8", "Kmi Dg" ], [ 192629, "u8", "/XNe" ], [ 193127, "u8", "fA m" ], [ 193284, "u8", "md_hlo" ], [ 193697, "u8", "Utql" ], [ 194182, "u8", "lrKraI" ], [ 196543, "u8", "kaR7f" ], [ 196627, "u8", "A phN" ], [ 197995, "u8", "dxPl" ], [ 200693, "u8", "PDhvp" ], [ 201520, "u8", "58QHI" ], [ 201661, "u8", "Igif" ], [ 201694, "u8", "bea7" ], [ 203993, "u8", "3iUQk" ], [ 204573, "u8", "nLai" ], [ 207516, "u8", "zkEe" ], [ 212493, "u8", "PsnN4Y3" ], [ 215058, "u8", "pwuxW" ], [ 217644, "u8", "LpFG4" ], [ 218620, "u8", "qLUgZ" ], [ 218645, "u8", "NW8E" ], [ 218937, "u8", "jYfe" ], [ 219035, "u8", "F1lzh" ], [ 221263, "u8", "ZL8Q" ], [ 222377, "u8", "akKb" ], [ 226246, "u8", "U3LN" ], [ 226995, "u8", "iTmz" ], [ 227406, "u8", "tBtb2R" ], [ 227578, "u8", "yNVhs" ], [ 227968, "u8", "9P1F" ], [ 229118, "u8", "tBLb2" ], [ 231054, "u8", "JGWZsvz" ], [ 232034, "u8", "uTQW3" ], [ 232695, "u8", "ar4ih" ], [ 232988, "u8", "Xda6U" ], [ 233350, "u8", "JlVmr" ], [ 233409, "u8", "xf7Kp" ], [ 234326, "u8", "wRhe" ], [ 234743, "u8", "Z84R" ] ], "v": { "file.stem": "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da", "pe.imphash": "a56f115ee5ef2625bd949acaeec66b76", "pe.machine": "x86_64", "pe.rich.key": 4285849883, "pe.rich.hash": "eefce4ffb82fb4897da86813878473b3", "pe.subsystem": "windows_gui", "pe.timestamp": 1758063275, "file.basename": "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe", "pe.image_base": 5368709120, "pe.image_size": 7294976, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 4919384, "pe.headers_size": 1024, "pe.entry_section": ".boot", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 10304, "pe.image_hash.sha1": "28558dfe2bf83f9b670b579f66e4f47df5ddc7e7", "pe.image_hash.sha256": "2b484e807b632151328c666fba3b85f713f59fbd5fd10b957db9194323e1c997", "pe.image_hash.sha384": "bb04b6e324232873686cec7346744c0db5fefa25ebe08c5171ca31cdcb0e7fcc610fb83b9fbe79ab24a5bb8885b37ba1", "pe.image_hash.sha512": "a413040359381ab393a6d7e86962e9fec0cfa69c3f49ba95009f084a44120633349f6a0a2ef91229f7a2abb3e71bf01c4fa4230d4ddde1414180780e13f0f74c", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.inflated_sections[0]": ".idata", "pe.inflated_sections[1]": ".tls", "pe.inflated_sections[2]": ".reloc", "pe.linker_major_version": 14, "pe.linker_minor_version": 43, "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].serial": "330000047f2f422a735308deea00000000047f", "build.toolchain.compiler": "msvc", "pe.signatures[0].subject": "CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 1019936, "pe.data_directories[1].rva": 843776, "pe.data_directories[2].rva": 4731644, "pe.data_directories[3].rva": 2890256, "pe.data_directories[4].rva": 7290880, "pe.data_directories[5].rva": 1024024, "pe.dll_characteristics_raw": 32800, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2026-05-15T18:49:10Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 64, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 173072, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 17052, "pe.data_directories[3].name": "certificate", "pe.data_directories[3].size": 10304, "pe.data_directories[4].name": "base_relocation", "pe.data_directories[4].size": 16, "pe.data_directories[5].name": "tls", "pe.data_directories[5].size": 40, "pe.rich.entries[0].build_id": 259, "pe.rich.entries[1].build_id": 261, "pe.rich.entries[2].build_id": 260, "pe.rich.entries[3].build_id": 259, "pe.rich.entries[4].build_id": 260, "pe.rich.entries[5].build_id": 261, "pe.rich.entries[6].build_id": 257, "pe.rich.entries[7].build_id": 1, "pe.rich.entries[8].build_id": 265, "pe.rich.entries[9].build_id": 258, "pe.signatures[0].not_before": "2025-05-15T18:49:10Z", "pe.rich.entries[0].use_count": 6, "pe.rich.entries[1].use_count": 170, "pe.rich.entries[2].use_count": 18, "pe.rich.entries[3].use_count": 10, "pe.rich.entries[4].use_count": 16, "pe.rich.entries[5].use_count": 87, "pe.rich.entries[6].use_count": 3, "pe.rich.entries[7].use_count": 126, "pe.rich.entries[8].use_count": 12, "pe.rich.entries[9].use_count": 1, "pe.coff.dos_header_pe_pointer": 248, "pe.rich.entries[0].product_id": 30795, "pe.rich.entries[1].product_id": 30795, "pe.rich.entries[2].product_id": 30795, "pe.rich.entries[3].product_id": 34321, "pe.rich.entries[4].product_id": 34321, "pe.rich.entries[5].product_id": 34321, "pe.rich.entries[6].product_id": 30795, "pe.rich.entries[8].product_id": 34809, "pe.rich.entries[9].product_id": 34809, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 3, "pe.signatures[0].thumbprint_sha1": "ea2f8cbc69a1a01142a1edd8b1256fecbc1d9f2d", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 2, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "eaa55544018e0151b3cf455da68c5873dbc8004ec422912fe6a5cbf923463e8f", "pe.signatures[0].thumbprint_sha256": "58b5021c22dd86d7838350b38ec5a702b48634125acb6ded71022de07836f768", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ " ", 1024, 211968, 7.97, "r-x" ], [ " ", 212992, 41472, 7.95, "r--" ], [ " ", 254464, 79360, 7.95, "rw-" ], [ " ", 333824, 9728, 7.59, "r--" ], [ " ", 343552, 2048, 7.28, "r--" ], [ ".rsrc", 345600, 173568, 3.58, "r--" ], [ ".idata", 519168, 512, 0.65, "rw-" ], [ ".tls", 519680, 512, 0.28, "rw-" ], [ ".themida", 520192, 0, 0.0, "rwx" ], [ ".boot", 520192, 2370048, 7.95, "r-x" ], [ ".reloc", 2890240, 16, 2.27, "r--" ] ] }, "id": 0, "sz": 2900560, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/unknown::microsoft-corporation", "l": 2 }, { "c": 1.0, "d": "Signed by Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/leaf::microsoft-corporation", "l": 3 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Themida or ASProtect section", "e": [ ".themida" ], "i": "objectives/anti-static/pack/detect::themida-or-asprotect", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 31396.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x7ec00" ] }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0x54887" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 31396.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.9599999785423279, "d": "Themida memory-only RWX section", "e": [ ".themida (size: 0, perms: rwx)" ], "i": "objectives/anti-static/pack/detect::themida-memory-section", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x7e72e" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 31396.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x7e7c6" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.95" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x2c2126" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x7e94a" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x7e90a" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x7e92c" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.95" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 0.8199999928474426, "d": "Encoded Microsoft OCSP URL", "e": [ "Nhttp://www.microsoft.com/pkiops/crl/Microsoft Time-Stamp PCA 2010(1).crl0l", "Phttp://www.microsoft.com/pkiops/certs/Microsoft Time-Stamp PCA 2010(1).crt0" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-ms-ocsp-url", "l": 1, "el": [ "0x2c3067", "0x2c30d3" ] }, { "c": 0.949999988079071, "d": "Microsoft timestamp certificate chain", "e": [ "Microsoft Time-Stamp Service", "Microsoft Time-Stamp PCA 2010" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "l": 2, "el": [ "0x2c2c22", "0x2c2cd4" ] }, { "c": 1.0, "d": "Issued by a Microsoft Code Signing PCA", "e": [ "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US" ], "i": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca", "l": 2, "el": [ "value:pe.signatures[0].issuer" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 31396.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.949999988079071, "d": "Microsoft code-signing certificate chain", "e": [ "Microsoft Code Signing PCA 2011" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "l": 2, "el": [ "0x2c1b37" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 31396.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0xf9048" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x7e7fa" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x7e78a" ] }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 173568)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 0.9399999976158142, "d": "High-entropy .boot packer section", "e": [ ".boot (size: 2370048, entropy: 7.95, perms: r-x)" ], "i": "objectives/anti-static/pack/detect::boot-packed-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KG token", "e": [ "KG " ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-kg", "l": 1, "m": "B0007.003", "el": [ "0xa073d" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x7e82a" ] }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 31396.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 31396.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with single import", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.95" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 11.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".boot (size: 2370048, perms: r-x)", " (size: 211968, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x7ec00" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.66" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 31396.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x7e92c" ] }, { "c": 0.8799999952316284, "d": "Large low-entropy PE resources", "e": [ ".rsrc (size: 173568, entropy: 3.58)" ], "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.82" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links kernel32 (GetModuleHandleA)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "1 symbols" ] }, { "c": 1.0, "d": "Microsoft certificate chain markers", "e": [ "Microsoft Code Signing PCA 2011", "Microsoft Time-Stamp PCA 2010", "Microsoft Corporation", "Microsoft Time-Stamp Service" ], "i": "metadata/signed/platform::microsoft-certificate-chain", "l": 1, "el": [ "0x2c1b37", "0x2c2cd4", "", "0x2c2c22" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da", "path": "45121e439299cbf2621a0f69a0bed1dc5306a7ba9eb59fda8a0072b037a176da.exe", "type": "pe" } ], "tv": "52045" } }