{ "llm": { "conf": 0.9995224, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.9992871, "class": "benign" }, "outcome": "suspicious", "interpretation": "Trojan with self-delete and beaconing" }, "ml": { "v": "7", "eng": "2.11.0", "lvl": 279, "conf": 80, "mods": [ { "cls": 0, "raw": 0.9992871, "rte": "az", "prob": 0.9992871 }, { "cls": 0, "raw": 0.99914443, "rte": "az/native", "prob": 0.99914443 }, { "cls": 0, "raw": 0.9992313, "rte": "az/pe", "prob": 0.9992313 } ], "prob": 0.9995224, "files": [ { "id": 0, "lvl": 279, "conf": 80, "prob": 0.9995223879814148, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-15T14:47:12Z" }, "path": "Trojan.Danger_Trojan.GenericKD.72677122_321_2.vir", "raw": { "v": "8", "rev": "e86a6", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000[bJB*4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000PVav-\u003cFpC2\u003cFpC2\u003cFpC2I{+1=\u003ea{U4I{+7!\u003c!QL3I{=Tr{OuDlI{=Ws\u003ea{U4)C7vb\u003cd$t1\u003cFpF3She7rI{=*w\u003ea{U4I{+4^\u003c!QL3qFxSO\u003cFpC20000000000000", "ln": 0 }, { "b": "000000000000000000000000000000000000000000000000000000000000rG3i@([\u003eyofHbQ]-FE4Yq=UY\u0026s84}O0CRXQmCE)1mCS!?\u0026Fy1+IacV=mEt}2[RGZcw@e$LH^?jv6:#lJ0e{RdZ\u003e\u003eInIacuVmDxp]\u003e.R:{Iac]\u003cmF8B9{\u003eeRDBUrXe@2!l8p?Tw.kMH*0srG\u003ceGtX5}6=n8V01l?Our-sZ@4(QY\u0026%2F-I@!lZI-1PVkMCF[aWu5c!}p)zXb(Tg0bh0JkMCzMmA\u003e=D{-I*4xGlj@0eTd\u003e@$LISkMCKgJzmR]s7WpT=I[Q[aWu3W}2tEZxWv[/0rpS5-038P7:hcAGuj71ur-sZ@4(QYClO3EI@!lZxC.{U0rpR-l)s\u003e@%jh?v2X\u003cuOab%pQqDJ(k2Q8C", "ln": 976 }, { "b": "0f90c@@r1i1owG5qhH1+@@r1PH2\u0026mk%a#D[@@r1PH3X*s%nJ*:av2{V-2$58\u0026qS=RqJlx$@@r0{y5?#GxAe2j2X\u003cuO0bqH[JQV@E%50Ih@$LUVkMDZp@4(QYYAnclI@!lZ+/[qP+/[qP+VfO/Gxh/U)9(dr0hfxDkMAQUIg^e31onB2gR^3)Ig^dF0rraRGE0w{004\u003eeb=H!A0eVvOTPnz4Ig^dV0rraRGE0@a004\u003eeb!i{Q0b8Go0051ib*lq\u002608J", "ln": 1871 }, { "b": "0ri^\u0026av2{V-1X$2fHbR(Z\u003cci22\u003cw8!003fty7L71cQmW}3KcOhgUT]gJ59Z0BQIbDy5}ok6\u0026l2r0eU1Vwt6?u004{@1C{BBZKOa908({1@$O6EkMA)-BqWfWBQf!%mU#oG(KW:[0@@u36-Yvw0pet{{c$:6gE7}4-=RS6alUM:003f/je43TkMDINBU5wbD]11/xGde20b9]bkMH1]1POK9s+TUk7SO#x@@r2#XC(Ke0o@qt004\u003ckjto22P)OTY06why8V", "ln": 2989 }, { "b": "4M#0tLnODEjPE:n0D!Of^GoEHgR^qk1or9P8:BA66/m3#05IBd%0rsvkMCKkxY{*e0o^\u003e[0093RH+?o@I-04dkMH\u0026nIacGT}2tEB%8!RE70[6*09OR#y6:3*0@@s7GjT@X%22P*kMH\u0026nIacI9hh0+J0rpSbmC%d]\u002682z4\u003cwt(02-yMdav2@b!\u003e\u003eNm0@@sN-0?F\u003e?2zJT%ji%3gE7%uB(rqJQL7A*0lmLa@@r2#\u003eM}j?0e\u003cq3\u003eO%T70k\u0026KS\u003ePo)b09Ni$%5C0z%8!RhqVD^%{T*C2{T\u0026RtubIQ2r\u003ebT!kMFKdcQmVkI$/xNA$sflG$}^i%iMzs1uVQ6[N2RuI#M?/Z:zwE", "ln": 3908 }, { "b": "000000000000000000000000000000000000000000000000000000000000S3}YDUQGLL.ykD+!*QO0()R]m}y8yAng:/wga-Fa94.c\u003c3[RCV[*\u003c+v\u0026W+6f=mw}}UQ/+OLQ(!mFgHW2y+bL^tR2\u003cPc[Ct#5?B1.mL1Jt00000umC{PxES#ZA4g?/CQ-", "ln": 5072 }, { "b": "A@Vh\u003c5c8YX7xsC=6952.1onBLBn#q\u003e0000000000EIUlH0000000000qw?.1uk(cf000000000000000v(2Ac000000SSi2m/SI?u)+{Ou(G7CkRLC6M[Q=9xjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iV@GZv@2T$c[cn\u003cavQr\u003ez/M$eBrCTyv@2T$c[dh1c2v9000000xjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iV@GZv@2T$c[coMB0amKe^.NUxjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iV}{JzF\u003c2}BsnNXeG^I\u003ex(4u\u003eaARJAv@Dm5wN/*8vqYP#xjVfcAbP=se^.NUxjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iV}{JzF\u003c2}BsnNXx(+y)od*LKxjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iV{}7BAzkmxcp+}xM22jz/P}Le?NFhxjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iV{!dzF\u003c2}BzkVhavx%-B7F(m3ig5axjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iYXy7wN/)idiJtCawUS.3ig5axjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iYXxYwN/p=C4ChbwmoN*azC)Tar\u0026axa{[qIxjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iYXxID30RsaAz46wODs0wftPciV].+wg!h?wN/y(uTW?.uVG.1B-IvXaAIEhyH}PodiHh+mriA!AV!!jaAIEhyH}PodlnN$y?9\u003eMwN/y(uTW?.uVG.1B-IvXaAIEhyH}PodiJtCawUS.3ig5awN/y(uTW?.uVG.1B-IvXay/tczE)s1c[cn\u003cavY^Ny?mc1Bz\u0026piz/fD7v@@\u0026nzY\u003cajA=#2mc)-{-aAhmtBugZU3ig5awN/y(uTW?.uVG.1B-IvXay/tczE)s1c[coMB0amKe^.NUwN/y(uTW?.uVG.1B-IvXax8\u0026?wnb{]az24@zY\u003cduyH}xoe?NFhwN/y(uTW?.uVG.1B-IvXaAIaiwge(HwPz*fAV=VAwg!h?wN/y(uTW?.uVG.1B-IvXaAIaiwge(Hx(+y)oct/elv0V:B0bKnzGE]Zc2v9000000wN/y(uTW?.uVG.1B-IvXaxi2=aARgoBrCTDA+PA7aAIaiBugJ*c37mq00000xjVf(AbP=suUjs%zc{^\u003ezGG]qy\u00260W6iYXxYwN/p=C4ChbwmoN*azC)Tar\u0026aMa{[qIw[=6)uVP}cwGUYdiV].V3ig5a00000v/QuCwb[jZwDl@PwDi?Mf91utaoluXx-J2Jx8\u003c4OeDx${aojn0fAri}eDxU*aoja@aoja@e=WQae=WQae=WQaaojO9aokdpBPujTaoi.*aoj!fwDlJDaohxwc37gMc37mgm@JF(zfWmox(4u#vqPNpash7o00000A:/1GrC(kOy?j-hzY\u0026$qwO%KKc36y[l}6*C00000CvyKLs8@k3wGSpfayYRrwPF#ozY*uE3ig5alU{EFzGE]ZmriA!AV!!jaxIGcq/(C*BAIKJdj$@clU{EFzGE]Zs5Ry-ByxiiB-m", "ln": 5380 }, { "b": "pFiqE00000f!+jmi4#%se?]7r00000toNowvqfK?wft#jazkncaz24@zY\u003c1qA=-BoA=k!qB7GxnwPxyg00000m@JF(v@DmbA=k=gwPw]jz/P}XasgL900000k$11kk#6*AqBakLk#7xBqBJ(Mmn(#Rmg61{c389[wfsoar6.S]pF$7\u003cp/G4O00000c389[wfsoar6.T5od*LKl3diWze:PhzF78lzY\u0026RowN/\u003e8wJy}WA%.)Ez/xo900000c389\u0026z/x/jz/cXrwPq\u003cbA+fqmvqWh@A+xJiwO#PjeIe7\u003ee?g]H00000c389\u0026z/x/jz/cXdz!i#jzF%RtByw@@ayPdgvrc16zdNQbat2e/b}ZV*3ig5a\u00263HX?V)F3rnb@R\u0026000000000000000000000000000000000000000000000000000000000000000000000005cUrUQqWo0rr91qD2$Zu$c%@![nX/Wmsk[II0^J5c8XglPOE\u003ex(mM\u003cAbPSbtZ6[1uT)[^wO#P{qE%VQvrl0+Cwg@4v@b\u003c\u003czGEHIwmtJs0000000000iuwe20000000000000000000000000@@r2#00000^eTdC00000@@r2#0Vsl678Yvq00000@@r2#00000+(v.y00000@@r2#000003lhqh00000@@r2#00000/-h0K00000@@r2#N\u0026K-]T@P+cH:Sl600000000003mV2Q03zmwCQSQ)0000000000c[kh%[e}YhFggD#0000000000g+5F9{-GLp\u00263XN9000", "ln": 6636 }, { "b": "zVx=/2(\u003c%QA@Vh\u003c5c8YX7xsC=6952.1onBLBn#q\u003e00000Vij9xwO2/XQYr=5wNPW(p\u0026ZF:wPI]U004PLm}D^wwO(xQx(4uQvqPNw000Vlm}D^pz!a0bwKZxIwLMVJwKcp@quf72z/YFXvqYQ(wDmw+m}D^wwO(x.vrufG002UXqCGUOgCQN[y?%7K9SYhMwO=fKCX7xcBy^-rq+ftJoFXBRwnD5Zs5Q\u003eYgCQN[y?%7K-070^y\u0026131003QmvruB4000MkuVQa7A+PAkw=QA^Ab]VgBy\u003eHMFDYU7AaJ[!I3mHiwNP9H\u0026rsmgzE-.E[=:8PvqYPQMiy(AA+PSb005h^w]}Q2yYGO3w]?J{yxeIYw[bT}B7CsKArGS\u003cx(dAtgYQlGrZP+tfFCa\u0026y?%7K-q%sOzf6t%wQ4{h003HfuTECSBzUD2zEEM#A@:$@uT)U(x(\u003csPdGS%*CXIm1eDGiXv@MJVx(4)5ASyd:wQ4{h003KguTEI+x(){7B]X-FuUKy(BAz8mz2:", "ln": 7556 }, { "b": "blIp?z!0L.:PC)*zE[6bBo0D=uUaE(wPh-#xKL^?y?mSzuT[1\u003ezeTp(Xb{2KzGY@lwNxT\u0026BAqwr008D*uT[1(BAhqow]I9#008u!nP5SYA+]V7yH}3BCW\u003ez}zF9IX\u003e(KB]By/Gez!0M]wj7oLAa9=#mr\u0026rQvqYZ?007EHnm=jGq!p5xzF0*czddK2z/bKP(hTm\u003cv@C)?p\u0026y5=By/E)ZYWRFA=2Jdvru6SA=kD0B8}rYZYu@pBvgg\u003eA+fcgp\u0026ZF:wPI[)^/-V*xKL^?y?mcCCW\u003er7BzkVhmRMWXwPv+JR36.dBx9i(vqYQ(wN[kOv}xR3x(v(Ux(4)5ASu7wnPNphvS=r@wPyQ/wPIB2Bo6C-l$G\u003eDwmXOQx(n37ASA0tqfuC\u003cC#e6)w]zZbvqYN^lVm9+By/E)Llal=Bw#%:yEr2.zGC\u003cU-q@FuBvgg\u003eA+fcgra{q-vpR@u006?om}D^fB-IIlzGFY}z!0v1B4G)xC(*GEBw)EaBy/q*x(dAEB4f\u003eWwMiwXwDpf.zdNN9wPN[L000000000000000000000000000000000000000000000000000000000000000000000", "ln": 8132 }, { "b": "000000000000000000000000000000000000000000000000000000000000puB*NU]gqA%nSc0%nSc0@@r2#0rr910rr910rr91000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 8656 }, { "b": "00000000000000000000000000000000000000000000000000000000000000000000001onA4000317YTKo7YTL^00000000001onA4000310rr91fAq9600000000001onA4000312)pkdnb@R\u0026su(\u0026^s]!Q6\u003cobC.00000jyJqLwO\u003e))C{4uGy\u0026jqSb6v{zi=!!AwD", "ln": 9168 }, { "b": "j}d\u0026warR^?B7F\u003c7A+PSvj}d\u0026warR^HauTWQADL\u0026lBy!#VA+PYhy?ml\u003cB3p3uarR^HarR^HjAt1MB.bSowN[kOwN/\u003e8x(v(.wP?T3az+RjwO:HNvrk1TC5IecAV#SGx*DlswPI]Qb4+n1B7DKVjtg.^ADL\u0026lBy!#KCX7xcBzkVhoL5xUy^5pnarR^HarS^1A+flkwPI%8wkEqXC4\u003e=7xjVcF4gjj2arS^1B7F\u003c7A+PSvj}d\u0026wauRr0A=(CBnP5cU", "ln": 9432 }, { "b": "l}Hczp^EGqnLR=TswRpKl}Hczp^EGqnLR=TswRpKl}Hczp^EGqnLR=TswRpK01Ybg(\u0026v7^2qwp{wh4:LA4(L\u003eK$-jRRzbkdZa^\u003e!/!zFv@v!ve7+)\u003c4iwA]RoFHloMOCG{Y!NzV:Uzi#(m}-Z@XjWl6/49\u003eh8miFmkwa6v\u003e@3VCRT[bI87wLOID]{VOz", "ln": 9680 }, { "b": "Pu*GH4KW}YP9/H+4+*cmRPv\u0026gQT!]\u003cO=RBj1rQezSL\u003e)H)jof)9@-IEF5g%3U!rffG4T@29RLB{BP$#gWZKC\u00267(2Wb9pvvyyd(avY@$.ITUZFm9oGu\u003cv2(iJZ]F=?{LQ]rO8Qw8*Cl}c:e3eJJ5VNBN+ApL^rm0q=7dtgbiEINNBkm2:gEkG^3UxHy=?YQ8o{bkl0VK4/oh-g0QrH.7@-4Xh\u003e(/l?hr}\u0026My1q\u003c7RK$de:91A\u003cB+jIejGc#7QV%Qbp^0N\u003eywt\u0026CafC3MA^$\u0026P3v+h)S/UJ3RtfeM8P}rLm?Wt]L{?fQ4VgqM7.%^Ic4]J}!w9\u0026hLZ/yL:K\u003clF1eaZ@:#ngFCRlE6p2.E}AA-q1Z^y\u00266@V[O6o4W{)$i+D3S[NHT5W/Z5}\u003cNw\u003c\u0026r{T5(C%gkM-E?5QVJ\u0026*yj5*7!Nb\u0026!V:t@5oFDq^nsk08+7ge9%XK0Kz]KKo.e-Nb0RJ\u0026WybRdK7.E0k@-!:dl5\u0026In[7imJ:KxDh*\u0026{]ehV%\u003cL^$Qq4QtvXVlaOIga!cHdq3nA4o4jcSajZXivkDgZz4fL3}\u003ccPOV1/\u003ekoDX\u003crkz}W3QV66LKa@3lMo\u003cgO/0kZI:9dq4V:DRnFI8\u003cgSw0\u0026Iz]6+1K\u003cO^pZ@zJ:-w[$I7.0j}wo*$qWDD\u003c6uTi32}I$DBH]qMs{0/JScs$c2Qs)]yx2B.veCbijTxSm2o3:vu{]P]xy(y\u003e!6ZTy1}\u0026V*r/2=8zs0NJxN=qI1QUMnou/!lAoQ.\u003eVEV-OG:8WI-=7z?CJe7Lm$.yXG-jY#YTgR3ECfgh?7-n/Gz3SCVIy*iGWQG\u003eA]a3}Gyn.}S67/v", "ln": 11216 } ], "mol": "K(Mc)O₃(AsCS)H₄(Cm₄F₃Po₉Ti)Md₂(Bi₆Si)", "sha": "45991f795d2b597801f08dfd2f37dcd578de1a03a88a54bf65b2355c6de2c55d", "path": "/data/samples/bad/datasets/pe/datamaliciousorder/Trojan.Danger_Trojan.GenericKD.72677122_321_2.vir", "risk": 86, "size": 20816, "supp": [ { "by": [ { "id": "metadata/binary/section/label::pe-code-data-standard-section", "spans": [ [ 1024, 5 ], [ 5120, 6 ], [ 8704, 5 ], [ 9216, 5 ], [ 9728, 6 ] ] }, { "id": "metadata/binary/section/label::pe-resource-section", "spans": [ [ 1024, 5 ], [ 5120, 6 ], [ 8704, 5 ], [ 9216, 5 ], [ 9728, 6 ] ] }, { "id": "metadata/binary/section/label::pe-runtime-standard-section", "spans": [ [ 1024, 5 ], [ 5120, 6 ], [ 8704, 5 ], [ 9216, 5 ], [ 9728, 6 ] ] }, { "id": "metadata/binary/section/label::reloc-section-presence", "spans": [ [ 1024, 5 ], [ 5120, 6 ], [ 8704, 5 ], [ 9216, 5 ], [ 9728, 6 ] ] } ], "id": "objectives/anti-static/pack/section-anomaly::tiny-executable-obfuscation-section", "crit": "suspicious", "kind": "unless" }, { "by": [ { "id": "metadata/binary/resource/identity::pe-single-version-resource", "spans": [ [ 0, 24 ], [ 9480, 60 ] ] }, { "id": "metadata/binary/resource/identity::rich-header-present", "spans": [ [ 0, 24 ], [ 9480, 60 ] ] }, { "id": "metadata/binary/resource/manifest::asinvoker-resource-manifest-flex", "spans": [ [ 0, 24 ], [ 9480, 60 ] ] }, { "id": "metadata/binary/resource/size::pe-few-resource-entries", "spans": [ [ 0, 24 ], [ 9480, 60 ] ] } ], "id": "metadata/binary/layout/overlay::has-overlay", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "value" } ], "id": "metadata/binary/signing::signed-pe-small-noncertificate-overlay", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "well-known/lib/runtime/compiled/msvc-runtime::runtime-import-marker", "spans": [ [ 7862, 12 ] ] } ], "id": "metadata/file/extension/identity::pe-content-extension-mismatch", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/symbols/count::many-imports-40", "spans": [ [ 0, 21 ] ] } ], "id": "micro-behaviors/communications/socket/init::winsock-client-ordinal-imports", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "well-known/lib/runtime/compiled/msvc-runtime::runtime-import-marker", "spans": [ [ 7862, 12 ] ] } ], "id": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "well-known/lib/runtime/compiled/msvc-runtime::runtime-import-marker", "spans": [ [ 7862, 12 ] ] } ], "id": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/fs/temp/directory::get-temp-file-name", "spans": [ [ 7620, 16 ] ] } ], "id": "micro-behaviors/os/api-resolution/manual::gettempfilename-staged", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/process/create/spawn::create-process-a", "spans": [ [ 8196, 14 ] ] } ], "id": "micro-behaviors/process/create/launch::create-process-api-name", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/resource/identity::pe-single-version-resource", "spans": [ [ 0, 24 ], [ 9480, 60 ] ] }, { "id": "metadata/binary/resource/identity::rich-header-present", "spans": [ [ 0, 24 ], [ 9480, 60 ] ] }, { "id": "metadata/binary/resource/manifest::asinvoker-resource-manifest-flex", "spans": [ [ 0, 24 ], [ 9480, 60 ] ] }, { "id": "metadata/binary/resource/size::pe-few-resource-entries", "spans": [ [ 0, 24 ], [ 9480, 60 ] ] } ], "id": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "well-known/lib/runtime/compiled/msvc-runtime::runtime-import-marker", "spans": [ [ 7862, 12 ] ] } ], "id": "objectives/anti-static/obfuscation/imports::mz-magic-check", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/build/manifest::pe-has-manifest" } ], "id": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/layout/checksum::pe-checksum-populated", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/layout/overlay::overlay-over-30pct", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/layout/ratio::low-overall-entropy", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/layout/ratio::many-readable-strings", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/layout/size::small-pe", "spans": [ [ 0, 22 ] ] } ], "id": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "crit": "notable", "kind": "unless" } ], "type": "pe", "facts": { "imp": [ [ "kernel32", "Sleep" ], [ "kernel32", "CreateProcessA" ], [ "kernel32", "GetTempFileNameA" ], [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "GetTempPathA" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "InterlockedCompareExchange" ], [ "kernel32", "InterlockedExchange" ], [ "kernel32", "HeapSetInformation" ], [ "shell32", "ShellExecuteA" ], [ "ws2_32", "ORDINAL 11" ], [ "ws2_32", "ORDINAL 111" ], [ "ws2_32", "ORDINAL 9" ], [ "ws2_32", "ORDINAL 115" ], [ "ws2_32", "ORDINAL 16" ], [ "ws2_32", "ORDINAL 23" ], [ "ws2_32", "ORDINAL 19" ], [ "ws2_32", "ORDINAL 4" ], [ "ws2_32", "ORDINAL 116" ], [ "msvcr100", "printf" ], [ "msvcr100", "fopen" ], [ "msvcr100", "fread" ], [ "msvcr100", "rand" ], [ "msvcr100", "srand" ], [ "msvcr100", "fwrite" ], [ "msvcr100", "ftell" ], [ "msvcr100", "fseek" ], [ "msvcr100", "fclose" ], [ "msvcr100", "time64" ], [ "msvcr100", "snprintf" ], [ "msvcr100", "amsg_exit" ], [ "msvcr100", "getmainargs" ], [ "msvcr100", "cexit" ], [ "msvcr100", "exit" ], [ "msvcr100", "XcptFilter" ], [ "msvcr100", "exit" ], [ "msvcr100", "initenv" ], [ "msvcr100", "initterm" ], [ "msvcr100", "initterm_e" ], [ "msvcr100", "configthreadlocale" ], [ "msvcr100", "setusermatherr" ], [ "msvcr100", "commode" ], [ "msvcr100", "fmode" ], [ "msvcr100", "set_app_type" ], [ "msvcr100", "crt_debugger_hook" ], [ "msvcr100", "?terminate@@YAXXZ" ], [ "msvcr100", "unlock" ], [ "msvcr100", "dllonexit" ], [ "msvcr100", "lock" ], [ "msvcr100", "onexit" ], [ "msvcr100", "except_handler4_common" ], [ "msvcr100", "invoke_watson" ], [ "msvcr100", "controlfp_s" ], [ "msvcr100", "atoi" ], [ "msvcr100", "malloc" ], [ "msvcr100", "memset" ] ], "sec": [ [ ".text", 1024, 4096, 6.0, "r-x" ], [ ".rdata", 5120, 3584, 5.09, "r--" ], [ ".data", 8704, 512, 0.38, "rw-" ], [ ".rsrc", 9216, 512, 5.1, "r--" ], [ ".reloc", 9728, 1024, 4.22, "r--" ] ], "metrics": { "pe": { "checksum": 54828, "timestamp": 1344615267, "image_size": 24576, "has_overlay": 1, "overlay_end": 20816, "has_manifest": 1, "has_safe_seh": 1, "headers_size": 1024, "overlay_size": 10064, "checksum_valid": 0, "file_alignment": 512, "overlay_offset": 10752, "resource_count": 1, "overlay_padding": 10064, "computed_checksum": 40648, "headers_size_ratio": 0.05, "prose_section_count": 0, "reloc_overhang_bytes": 496, "reloc_overhang_ratio": 0.48, "bss_like_section_count": 0, "section_overflow_count": 0, "misaligned_section_count": 0, "base_relocation_block_count": 2, "base_relocation_entry_count": 256, "declared_data_directory_count": 6, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 20816, "entropy": 5.91 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 6, "data_entropy": 0.38, "overlay_size": 10064, "string_count": 117, "overlay_ratio": 0.48, "overlay_entropy": 5.93, "entropy_variance": 3.88, "avg_string_length": 21.46, "max_string_length": 89, "peak_region_bytes": 5456, "code_to_data_ratio": 0.89, "peak_region_entropy": 7.84, "string_length_stddev": 18.28, "largest_section_ratio": 0.2, "sentence_string_count": 35, "sentence_string_ratio": 0.3, "high_entropy_string_count": 0 }, "imports": { "count": 68 }, "sections": { "count": 5, "code_size": 4096, "entropy_max": 6, "entropy_mean": 4.16, "name_entropy": 3.21, "writable_count": 1, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.binary_as_unknown": 1 }, "dependencies": { "count": 4 } } }, "ident": { "trust": "unsigned", "build_path": { "value": "C:\\ping_pong\\win_client\\Release\\win_client.pdb", "source": "pe.debug.pdb.path", "verified": false } }, "traits": [ { "id": "metadata/binary/debug::pdb-absolute-path", "conf": 0.72, "crit": 3, "desc": "Embedded absolute PDB path", "spans": [ [ 7032, 46 ] ] }, { "id": "metadata/binary/debug::pdb-visual-studio", "conf": 0.5, "crit": 3, "desc": "Visual Studio PDB build path", "spans": [ [ 7032, 46 ] ] }, { "id": "metadata/binary/instruction::x86-global-pointer-indirect-call", "conf": 0.9, "crit": 3, "desc": "x86 indirect call through a global pointer", "spans": [ [ 1168, 11 ], [ 3972, 11 ], [ 4045, 11 ] ] }, { "id": "metadata/binary/layout/checksum::pe-checksum-populated", "conf": 1.0, "crit": 2, "desc": "PE checksum field holds a non-zero value", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/binary/layout/overlay::overlay-over-30pct", "conf": 0.9, "crit": 3, "desc": "PE overlay exceeds thirty percent", "spans": [ [ 0, 27 ] ] }, { "id": "metadata/binary/layout/size::small-pe", "conf": 0.6, "crit": 3, "desc": "Small PE binary (\u003c100KB)", "spans": [ [ 0, 98 ] ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-11", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 11 by number", "spans": [ [ 8440, 10 ] ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-115", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 115 by number", "spans": [ [ 8452, 11 ] ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-116", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 116 by number", "spans": [ [ 8472, 11 ] ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-16", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 16 by number", "spans": [ [ 8456, 10 ] ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-19", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 19 by number", "spans": [ [ 8464, 10 ] ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-23", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 23 by number", "spans": [ [ 8460, 10 ] ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-4", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 4 by number", "spans": [ [ 8468, 9 ] ] }, { "id": "metadata/binary/symbols/imports::ordinal-import-9", "conf": 0.7, "crit": 3, "desc": "PE imports ordinal 9 by number", "spans": [ [ 8448, 9 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 6285, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 5640, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::pingpong-data-corrupt", "conf": 0.8, "crit": 4, "desc": "Text-based beaconing string (data corrupt)", "spans": [ [ 6760, 19 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::pingpong-echo-return", "conf": 0.8, "crit": 4, "desc": "Text-based beaconing string (echo_return)", "spans": [ [ 5944, 50 ], [ 5996, 32 ], [ 6032, 68 ], [ 6104, 33 ], [ 6140, 38 ], [ 6180, 34 ], [ 6216, 47 ], [ 6268, 43 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::pingpong-get-port", "conf": 0.8, "crit": 4, "desc": "Text-based beaconing string (get_port)", "spans": [ [ 5476, 59 ], [ 5540, 41 ], [ 5584, 69 ], [ 5656, 42 ], [ 5700, 46 ], [ 5748, 44 ], [ 5796, 40 ], [ 5840, 49 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "conf": 0.4, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 8308, 0 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "conf": 0.5, "crit": 2, "desc": "References the CRT fseek file-position routine", "spans": [ [ 7836, 0 ] ] }, { "id": "micro-behaviors/fs/file/binary::ftell-import", "conf": 0.7, "crit": 2, "desc": "References the CRT ftell position routine", "spans": [ [ 8304, 0 ] ] }, { "id": "micro-behaviors/fs/temp/directory::get-temp-file-name", "conf": 0.75, "crit": 2, "desc": "Build temporary file name via GetTempFileName", "spans": [ [ 7620, 0 ] ] }, { "id": "micro-behaviors/fs/write/file/handle::write--fwrite", "conf": 0.66, "crit": 2, "desc": "References fwrite file-write API", "spans": [ [ 8300, 0 ] ] }, { "id": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "conf": 0.86, "crit": 2, "desc": "Register unhandled exception filter", "spans": [ [ 8244, 0 ] ] }, { "id": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "conf": 0.84, "crit": 2, "desc": "Invoke unhandled exception filter", "spans": [ [ 8248, 0 ] ] }, { "id": "micro-behaviors/os/random/crypto::rand-symbol", "conf": 0.3, "crit": 2, "desc": "Random number generation (rand)", "spans": [ [ 8292, 0 ] ] }, { "id": "micro-behaviors/os/random/crypto::srand-symbol", "conf": 0.4, "crit": 2, "desc": "Random seed initialization (srand)", "spans": [ [ 8296, 0 ] ] }, { "id": "micro-behaviors/process/create/exec::shell-execute-a", "atk": "T1059.001", "conf": 0.75, "crit": 3, "desc": "Execute shell command (ShellExecuteA)", "spans": [ [ 8432, 13 ] ] }, { "id": "micro-behaviors/process/create/flags::x86-create-no-window-immediate", "conf": 0.96, "crit": 3, "desc": "x86 CREATE_NO_WINDOW stack argument", "spans": [ [ 1935, 14 ] ] }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Windows shell command-mode invocation syntax", "spans": [ [ 6392, 10 ] ] }, { "id": "micro-behaviors/process/create/shell/script-host::cmd-exe-c-command", "conf": 0.85, "crit": 3, "desc": "Runs commands through cmd.exe /c", "spans": [ [ 6392, 10 ] ] }, { "id": "micro-behaviors/process/create/shellexec::shell-execute-call", "atk": "T1059.001", "conf": 0.85, "crit": 3, "desc": "ShellExecute API call", "spans": [ [ 7706, 13 ] ] }, { "id": "micro-behaviors/process/create/spawn::create-process-a", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "Create process (ANSI)", "spans": [ [ 8196, 14 ] ] }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-string", "conf": 0.9, "crit": 3, "desc": "IsDebuggerPresent API name in PE strings", "spans": [ [ 8400, 17 ] ] }, { "id": "micro-behaviors/time/query::get-tick-count", "conf": 0.9, "crit": 3, "desc": "Get tick count", "spans": [ [ 8228, 12 ] ] }, { "id": "objectives/supply-chain/trojanized/app/replace::labeled-client-distribution-dir", "atk": "T1195.002,T1505.003", "mbc": "B0030", "conf": 0.92, "crit": 3, "desc": "Labeled client distribution directory", "spans": [ [ 7049, 15 ] ] }, { "id": "well-known/malware/dropper/ping-pong::controller-port-banner", "atk": "T1105", "mbc": "B0024", "conf": 0.96, "crit": 4, "desc": "Ping-pong controller port banner", "spans": [ [ 5700, 46 ] ] }, { "id": "well-known/malware/dropper/ping-pong::echo-token-banner", "atk": "T1105", "mbc": "B0024", "conf": 0.96, "crit": 4, "desc": "Ping-pong echo token banner", "spans": [ [ 6140, 38 ] ] }, { "id": "well-known/malware/dropper/ping-pong::echo-token-string", "atk": "T1105", "mbc": "B0024", "conf": 0.99, "crit": 4, "desc": "Hardcoded ping-pong echo token", "spans": [ [ 6732, 25 ] ] }, { "id": "well-known/malware/dropper/ping-pong::ping-del-self-delete", "atk": "T1105", "mbc": "B0024", "conf": 0.98, "crit": 4, "desc": "Delayed ping-and-del self-delete", "spans": [ [ 6392, 46 ] ] }, { "id": "well-known/malware/dropper/ping-pong::ping-pong-pdb-path", "atk": "T1105", "mbc": "B0024", "conf": 0.98, "crit": 4, "desc": "Ping-pong client PDB path", "spans": [ [ 7032, 46 ] ] }, { "id": "metadata/binary/layout/checksum::pe-checksum-content-invalid", "conf": 1.0, "crit": 2, "desc": "PE checksum does not match content", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/binary/layout/overlay::overlay-dominates-third", "conf": 0.92, "crit": 3, "desc": "Overlay exceeds one-third", "spans": [ [ 0, 27 ] ] }, { "id": "metadata/binary/layout/ratio::overlay-over-35pct", "conf": 0.94, "crit": 3, "desc": "PE overlay exceeds thirty-five percent", "spans": [ [ 0, 27 ] ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 3, "desc": "PE lacks signature record" }, { "id": "micro-behaviors/communications/http/websocket::ping-pong-pair", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "PING/PONG protocol marker", "spans": [ [ 7035, 9 ] ] }, { "id": "micro-behaviors/communications/icmp/ping::ping", "conf": 0.9, "crit": 3, "desc": "References the ping network-reachability command", "spans": [ [ 6403, 23 ] ] }, { "id": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "conf": 0.7, "crit": 3, "desc": "WS2_32 Winsock DLL import", "spans": [ [ 7732, 10 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.66, "crit": 3, "desc": "References C fopen file-open API", "spans": [ [ 8284, 5 ] ] }, { "id": "micro-behaviors/fs/temp/directory::get-temp-path-name", "conf": 0.66, "crit": 2, "desc": "GetTempPath named without a call site", "spans": [ [ 7676, 0 ] ] }, { "id": "micro-behaviors/process/create/exec::cmd-exe-reference", "conf": 0.8, "crit": 3, "desc": "References Windows cmd.exe interpreter", "spans": [ [ 6392, 8 ] ] }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-import", "conf": 0.9, "crit": 3, "desc": "References the IsDebuggerPresent API", "spans": [ [ 8240, 17 ] ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process", "mbc": "C0018", "conf": 0.95, "crit": 3, "desc": "Process termination via TerminateProcess", "spans": [ [ 8256, 16 ] ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process-name-text", "mbc": "C0018", "conf": 0.92, "crit": 3, "desc": "TerminateProcess API name in binary strings", "spans": [ [ 8302, 16 ] ] }, { "id": "micro-behaviors/time/timing/delay::query-performance-counter", "conf": 0.7, "crit": 2, "desc": "QueryPerformanceCounter timing API", "spans": [ [ 8232, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/imports::teb-peb-access", "atk": "T1027.007", "mbc": "B0032.014", "conf": 0.85, "crit": 3, "desc": "Reads the 32-bit Windows TEB self pointer", "spans": [ [ 3053, 17 ] ] }, { "id": "micro-behaviors/communications/socket/init::connect-api-ordinal", "conf": 0.88, "crit": 3, "desc": "Winsock outbound connect import", "uses": [ 13, 50 ], "spans": [ [ 7732, 10 ], [ 8468, 9 ] ] }, { "id": "micro-behaviors/communications/socket/init::htons-api-ordinal", "conf": 0.84, "crit": 3, "desc": "Network byte order conversion", "uses": [ 14, 50 ], "spans": [ [ 7732, 10 ], [ 8448, 9 ] ] }, { "id": "micro-behaviors/communications/socket/init::inet-addr-api-ordinal", "conf": 0.84, "crit": 3, "desc": "IPv4 string conversion import", "uses": [ 7, 50 ], "spans": [ [ 7732, 10 ], [ 8440, 10 ] ] }, { "id": "micro-behaviors/communications/socket/init::recv-api-ordinal", "conf": 0.86, "crit": 3, "desc": "Winsock receive import", "uses": [ 10, 50 ], "spans": [ [ 7732, 10 ], [ 8456, 10 ] ] }, { "id": "micro-behaviors/communications/socket/init::send-api-ordinal", "conf": 0.86, "crit": 3, "desc": "Winsock send import", "uses": [ 11, 50 ], "spans": [ [ 7732, 10 ], [ 8464, 10 ] ] }, { "id": "micro-behaviors/communications/socket/init::socket-api-ordinal", "conf": 0.88, "crit": 3, "desc": "Winsock socket creation import", "uses": [ 12, 50 ], "spans": [ [ 7732, 10 ], [ 8460, 10 ] ] }, { "id": "micro-behaviors/communications/socket/init::winsock-startup-ordinal", "conf": 0.86, "crit": 3, "desc": "Initialize Winsock library", "uses": [ 8, 50 ], "spans": [ [ 7732, 10 ], [ 8452, 11 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-position-api", "conf": 0.78, "crit": 3, "desc": "References a file-position API", "uses": [ 21, 22, 23 ], "spans": [ [ 7836, 5 ], [ 8304, 5 ], [ 8308, 5 ] ] }, { "id": "micro-behaviors/fs/write/file/descriptor::write", "conf": 0.66, "crit": 2, "desc": "CRT or POSIX file-write capability", "uses": [ 25 ], "spans": [ [ 8300, 0 ] ] }, { "id": "objectives/command-and-control/dropper/staging/temp::temp-dropper", "conf": 0.8, "crit": 3, "desc": "Writes file to Temp directory and executes it", "uses": [ 30, 35, 51, 52 ], "spans": [ [ 7676, 12 ], [ 8196, 14 ], [ 8284, 5 ], [ 8432, 13 ] ] }, { "id": "well-known/malware/dropper/ping-pong::ping-pong-controller-beacon", "atk": "T1105", "mbc": "B0024", "conf": 0.97, "crit": 4, "desc": "Ping-pong controller beacon workflow", "uses": [ 39, 40, 41 ], "spans": [ [ 5700, 46 ], [ 6140, 38 ], [ 6732, 25 ] ] }, { "id": "micro-behaviors/communications/socket/init::winsock-client-ordinal-api-set", "conf": 0.9, "crit": 3, "desc": "Winsock client ordinal connect send recv set", "uses": [ 59, 62, 63, 64 ], "spans": [ [ 7732, 10 ], [ 8456, 10 ], [ 8460, 10 ], [ 8464, 10 ], [ 8468, 9 ] ] }, { "id": "micro-behaviors/fs/file/binary::seek-and-descriptor-io", "conf": 0.8, "crit": 3, "desc": "Reads or writes a seeked file descriptor", "uses": [ 66, 67 ], "spans": [ [ 7836, 5 ], [ 8300, 6 ], [ 8304, 5 ], [ 8308, 5 ] ] }, { "id": "micro-behaviors/communications/socket/init::winsock-client-lifecycle", "conf": 0.9, "crit": 3, "desc": "Winsock client connection lifecycle", "uses": [ 50, 70 ], "spans": [ [ 7732, 10 ], [ 8456, 10 ], [ 8460, 10 ], [ 8464, 10 ], [ 8468, 9 ] ] }, { "id": "metadata/binary/layout/checksum::pe-checksum-mismatch", "conf": 0.95, "crit": 3, "desc": "PE checksum differs from computed content", "uses": [ 3, 44 ], "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "conf": 0.8, "crit": 3, "desc": "Temp directory staging primitives", "uses": [ 24, 52 ], "spans": [ [ 7620, 16 ], [ 7676, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution capability", "uses": [ 33 ], "spans": [ [ 6392, 10 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 35 ], "spans": [ [ 8196, 14 ] ] } ] } ] } }