{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9313873648643494 } ], "prob": 0.93138736, "models": [ { "m": "az", "prob": 0.93138736, "class": 0 }, { "m": "az/native", "prob": 0.22891566, "class": 0 }, { "m": "az/pe", "prob": 0.0053050397, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-03T02:26:52Z" }, "path": "46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6.dll", "raw": { "v": "6", "fs": [ { "f": "O₂(DyEr)H(Po)Md(Bi)", "x": 11, "ff": { "i": [ [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "FindResourceA" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "OpenProcess" ], [ "kernel32", "Sleep" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "GetSystemDirectoryA" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "GetVersionExA" ], [ "kernel32", "GetDateFormatA" ], [ "kernel32", "GetWindowsDirectoryA" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "VirtualProtectEx" ], [ "kernel32", "RemoveDirectoryA" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "GetSystemTime" ], [ "kernel32", "CreateSemaphoreA" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "HeapSize" ], [ "kernel32", "ReadConsoleW" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "SetLastError" ], [ "kernel32", "InitializeCriticalSectionAndSpinCount" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsFree" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "GetLocaleInfoW" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "IsProcessorFeaturePresent" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "GetStartupInfoW" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "InitializeSListHead" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "RaiseException" ], [ "kernel32", "InterlockedFlushSList" ], [ "kernel32", "GetLastError" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "GetModuleHandleExW" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "HeapFree" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetFileType" ], [ "kernel32", "IsValidLocale" ], [ "kernel32", "GetUserDefaultLCID" ], [ "kernel32", "EnumSystemLocalesW" ], [ "kernel32", "GetFileSizeEx" ], [ "kernel32", "SetFilePointerEx" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "WriteFile" ], [ "kernel32", "GetConsoleCP" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "ReadFile" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "FindClose" ], [ "kernel32", "FindFirstFileExW" ], [ "kernel32", "FindNextFileW" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "secur32", "QueryContextAttributesW" ], [ "secur32", "FreeContextBuffer" ], [ "secur32", "DeleteSecurityContext" ], [ "secur32", "InitializeSecurityContextW" ] ], "m": { "pe": { "has_cfg": 1.0, "checksum": 810465.0, "has_safe_seh": 1.0, "checksum_valid": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "computed_checksum": 810465.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 52.0, "base_relocation_entry_count": 4807.0 }, "file": { "size": 751616.0, "entropy": 6.2, "size_bytes": 751616.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.34, "data_entropy": 3.3, "string_count": 7268.0, "overall_entropy": 6.2, "entropy_variance": 2.19, "avg_string_length": 6.28, "max_string_length": 185.0, "code_to_data_ratio": 0.99, "string_length_stddev": 6.04, "largest_section_ratio": 0.74, "sentence_string_count": 108.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 3.0 }, "exports": { "count": 5.0 }, "imports": { "count": 90.0 }, "sections": { "count": 5.0, "code_size": 557568.0, "entropy_max": 6.6, "entropy_mean": 4.91, "name_entropy": 3.21, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 240, "u8", "Rich" ], [ 520, "u8", ".text" ], [ 599, "u8", "@.data" ], [ 640, "u8", ".rsrc" ], [ 679, "u8", "@.reloc" ], [ 3821, "u8", "SVWP" ], [ 4536, "u8", "YYPV" ], [ 4975, "u8", "USVWATH" ], [ 7390, "u8", "QIARp" ], [ 10626, "u8", "HVDDt" ], [ 11289, "u8", "AM0U" ], [ 13873, "u8", "HQAU" ], [ 18381, "u8", "HH6TH" ], [ 19839, "u8", "oHKHHD" ], [ 21384, "u8", "yUGDW" ], [ 22486, "u8", "gq20" ], [ 23958, "u8", "MHHL" ], [ 23969, "u8", "HHH8" ], [ 25574, "u8", "HHImc" ], [ 27797, "u8", "LEHL" ], [ 27989, "u8", "rW05Z" ], [ 29422, "u8", "HDHHu" ], [ 29585, "u8", "HIEH" ], [ 29705, "u8", "HWHE" ], [ 30916, "u8", "HpLHH" ], [ 32754, "u8", "t Hs" ], [ 33203, "u8", "Vq00ib" ], [ 33668, "u8", "E6UH" ], [ 34954, "u8", "HHPH" ], [ 36930, "u8", "LHU tH" ], [ 38021, "u8", "HAHHL" ], [ 40295, "u8", "PHf L" ], [ 42137, "u8", "HH_VE" ], [ 43385, "u8", "HPTHH" ], [ 43521, "u8", "WHHL" ], [ 44189, "u8", "S0M7" ], [ 44540, "u8", "qdOi" ], [ 44797, "u8", "ALHZt" ], [ 46210, "u8", "HHa H" ], [ 46234, "u8", "HD75" ], [ 47098, "u8", "LHHD" ], [ 48114, "u8", "HH3Yz" ], [ 48142, "u8", "EV3H" ], [ 48184, "u8", "HDYH" ], [ 48367, "u8", "nHVHpHT" ], [ 48416, "u8", "LHHL" ], [ 52112, "u8", "GtoCO" ], [ 55488, "u8", "PHH3" ], [ 55870, "u8", "HDkHA" ], [ 56558, "u8", "sAkmS" ], [ 57031, "u8", ")t[d" ], [ 60597, "u8", "Auns" ], [ 62168, "u8", "hfFp" ], [ 64468, "u8", "CLTLH" ], [ 65531, "u8", "CHWHH" ], [ 66264, "u8", "ntTWAP" ], [ 66540, "u8", "A.I uL" ], [ 66640, "u8", "HH_H" ], [ 68008, "u8", "ELHU" ], [ 68710, "u8", "IHHC0" ], [ 68843, "u8", "XdMFk" ], [ 69386, "u8", "M3HS" ], [ 70672, "u8", "HKDM" ], [ 71645, "u8", "lKHHf" ], [ 72603, "u8", "YSFN" ], [ 74685, "u8", "LHiLH" ], [ 77102, "u8", "LGDM" ], [ 77213, "u8", "LHAH" ], [ 79604, "u8", "LAXE0" ], [ 79679, "u8", "LH5H" ], [ 80200, "u8", "HJT0" ], [ 81069, "u8", "HDEG" ], [ 81221, "u8", "W UHQ" ], [ 85133, "u8", "3HLM" ], [ 86941, "u8", "C H2" ], [ 91251, "u8", "HS0O" ], [ 92512, "u8", "LL@H%c HH@" ], [ 94648, "u8", "H8HP" ], [ 97986, "u8", "H8HE" ], [ 99223, "u8", "3MHOHPpM" ], [ 100055, "u8", "HLAL" ], [ 100273, "u8", "HXLH" ], [ 100531, "u8", "KTD1" ], [ 101459, "u8", "EHC0" ], [ 102221, "u8", "P1HEH" ], [ 104347, "u8", "/rl6" ], [ 104751, "u8", "m0k8" ], [ 105656, "u8", "LDHAH" ], [ 108623, "u8", "5RClQ" ], [ 109663, "u8", "Oe](" ], [ 110245, "u8", "XHEH" ], [ 110892, "u8", "H0UHcDH" ], [ 110981, "u8", "WHHP" ], [ 113162, "u8", "HHyLLH" ], [ 113336, "u8", "uHHDH" ], [ 116217, "u8", "ON dWp" ], [ 116433, "u8", "UHHHp" ], [ 118308, "u8", "3tHHU" ], [ 118343, "u8", "HNHL" ], [ 122993, "u8", "LXEL" ], [ 123610, "u8", "6TPcQ" ], [ 124155, "u8", "HHHP" ], [ 124694, "u8", "IHEH" ], [ 124982, "u8", "HH0E" ], [ 127111, "u8", "H L+bHu" ], [ 127948, "u8", "HAHH3" ], [ 128809, "u8", "HHVK" ], [ 129794, "u8", "HLLA" ], [ 132801, "u8", "KHAR" ], [ 134086, "u8", "MTHHu" ], [ 134108, "u8", "SAME" ], [ 135837, "u8", "O1HQ8" ], [ 136195, "u8", "EHMAL" ], [ 136284, "u8", "HHPA" ], [ 136718, "u8", "HtHHm" ], [ 136798, "u8", "ADHuHD" ], [ 138737, "u8", "Attp" ], [ 138859, "u8", "LH0E" ], [ 139689, "u8", "DHPK" ], [ 142112, "u8", "3SKHA" ], [ 143679, "u8", "gFfyP" ], [ 144382, "u8", "uHD0uHH" ], [ 144963, "u8", "bmUV @" ], [ 145538, "u8", "8NKjV" ], [ 145894, "u8", "tWHHW" ], [ 150628, "u8", "ZKFN" ], [ 155020, "u8", "HKHT" ], [ 155125, "u8", "tHHHL" ], [ 157205, "u8", "HHH9" ], [ 158702, "u8", "T2HH" ], [ 160784, "u8", "VfTxw" ], [ 161237, "u8", "HHRHH" ], [ 162288, "u8", "AHHHb" ], [ 165214, "u8", "HHQI" ], [ 165993, "u8", "R4Y7" ], [ 166488, "u8", "MHUO" ], [ 167248, "u8", "ELMH" ], [ 168103, "u8", "OHHVcH" ], [ 171037, "u8", "dXrHGf" ], [ 171558, "u8", "HDL H" ], [ 172840, "u8", "IDHzI" ], [ 178401, "u8", "6deo" ], [ 178925, "u8", "eEHHZ" ], [ 179846, "u8", "TMHle" ], [ 180292, "u8", "i5lk" ], [ 180509, "u8", "LH4H" ], [ 182232, "u8", "Hrox" ], [ 182673, "u8", "CPDDE" ], [ 184001, "u8", "LTHA" ], [ 184215, "u8", "AHHHuE" ], [ 184905, "u8", "CHHE" ], [ 188671, "u8", "MHO 0H.|" ], [ 189516, "u8", "HMH0" ], [ 189577, "u8", "HLLsH" ], [ 191812, "u8", "DM0H" ], [ 194110, "u8", "ACDHl" ], [ 194612, "u8", "SPHjy" ], [ 195183, "u8", "CtLHS" ], [ 195198, "u8", "HD1H" ], [ 197204, "u8", "HQHP" ], [ 199322, "u8", "HaXZ3" ], [ 200255, "u8", "QHHHP" ], [ 200276, "u8", "PLHE" ], [ 202060, "u8", "H3I8" ], [ 208319, "u8", "w86r" ], [ 209787, "u8", "AH3H" ], [ 211125, "u8", "HHt23" ], [ 212154, "u8", "oHuHH" ], [ 212223, "u8", "HHMH" ], [ 213630, "u8", "3DNP" ], [ 214884, "u8", "NR4KA" ], [ 215254, "u8", "HHtL2" ], [ 216216, "u8", "/HLE" ], [ 219126, "u8", "/QP6" ], [ 219496, "u8", "HHHU" ], [ 223793, "u8", "tLcLHHH" ], [ 224406, "u8", "LL3S" ], [ 224577, "u8", "fHTHH" ], [ 225599, "u8", "H E3" ], [ 227721, "u8", "vxEeZ" ], [ 231064, "u8", "80TF" ], [ 234459, "u8", "cvMHo" ], [ 235232, "u8", "HHAH" ], [ 235333, "u8", "3HCF" ], [ 236481, "u8", "5HoPH" ], [ 239551, "u8", "LSHID" ], [ 240977, "u8", "9IAI" ], [ 241759, "u8", "TMLHl" ], [ 242051, "u8", "WGLHt" ], [ 244919, "u8", "HHMC" ], [ 246698, "u8", "HHE3H" ], [ 247827, "u8", "JVJvw" ], [ 247935, "u8", "DBL0" ], [ 248088, "u8", "MHHAPH" ], [ 248706, "u8", "WG_Z" ], [ 254680, "u8", "PTHT" ], [ 257903, "u8", "HHH3" ], [ 259962, "u8", "HVHD" ], [ 260926, "u8", "QEH7" ], [ 261206, "u8", "Ioms" ], [ 261542, "u8", "H8LLI" ], [ 261564, "u8", "XHIH" ], [ 263055, "u8", "S.wi" ], [ 264283, "u8", "HVHIMH" ], [ 267275, "u8", "V2UF" ], [ 269427, "u8", "HCCH" ], [ 269912, "u8", "8NEX" ], [ 269956, "u8", "PKDH" ], [ 270743, "u8", "AHE5" ], [ 271778, "u8", "AIHLH" ], [ 272298, "u8", "MAWR" ], [ 272798, "u8", "HMTH" ], [ 272805, "u8", "HASHH" ], [ 274504, "u8", "8CtIC" ], [ 277032, "u8", "lERUc" ], [ 278144, "u8", "DIHT" ], [ 280472, "u8", "IAMH" ], [ 281111, "u8", "/gxM" ], [ 283466, "u8", "PCGIL" ], [ 286016, "u8", "THI8" ], [ 287545, "u8", "/HDH" ], [ 290392, "u8", "jdeew" ], [ 290681, "u8", "AlHDA" ], [ 290726, "u8", "LHLI" ], [ 290751, "u8", "LLHb1" ], [ 290876, "u8", "AHHP" ], [ 291154, "u8", "9vlvM" ], [ 292508, "u8", "LHTH" ], [ 293185, "u8", "AaHIH" ], [ 294811, "u8", "yt0W0" ], [ 296345, "u8", "HHH7" ], [ 296652, "u8", "SCKZ" ], [ 298225, "u8", "HAtSPH" ], [ 298469, "u8", "LHDU" ], [ 299409, "u8", "MHEI" ], [ 301772, "u8", "9HMH" ], [ 301907, "u8", "At709L" ], [ 304228, "u8", "4AHL" ], [ 305330, "u8", "tbHx" ], [ 305361, "u8", "A8LH" ], [ 308931, "u8", "7LDI" ], [ 309428, "u8", "HUHHH" ], [ 310724, "u8", "AIAHE" ], [ 311639, "u8", "-H HHu$" ], [ 313141, "u8", "T_LW" ], [ 313364, "u8", "xHHHL" ], [ 313459, "u8", "ILtHH" ], [ 313880, "u8", "HAD9" ], [ 313910, "u8", "%pH HE" ], [ 315314, "u8", "HIHL" ], [ 315339, "u8", "HIDH0" ], [ 315521, "u8", "EYHHHL" ], [ 316523, "u8", "xEHL T" ], [ 319413, "u8", "HHSL" ], [ 320252, "u8", "3KAH" ] ], "v": { "file.stem": "46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6", "pe.imphash": "40c9a67eca61621f7fdd225020829ff7", "pe.machine": "i386", "pe.rich.key": 2971157448, "pe.rich.hash": "90f3a15e379b2449c594f40aed4a3ec4", "pe.subsystem": "windows_gui", "pe.timestamp": 1613989144, "file.basename": "46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6.dll", "pe.image_base": 4194304, "pe.image_size": 892928, "pe.machine_id": 332, "pe.os_version": "6.0", "pe.version.os": "windows_nt_windows32", "pe.entry_point": 449280, "pe.headers_size": 1024, "pe.version.type": "dll", "pe.debug.pdb.age": 1, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.debug.pdb.guid": "58da5275-eac5-465e-b39b-eb9aa3e5d28c", "pe.debug.pdb.path": "c:\\though\\guess_Dog\\Who-tie\\shop\\wife\\temperature.pdb", "pe.debug.pdb.stem": "temperature", "pe.file_alignment": 512, "pe.image_hash.sha1": "92bc1ec02aa43b7f6c067a72c65d89e98abd9607", "pe.version.company": "Trade Sell", "pe.export_timestamp": 1613989144, "pe.load_config.size": 188, "pe.image_hash.sha256": "55fe4655d2cea6bb0188a9803f7e550a7b9326d9a99ae5dde5bdb6eca65bd8c3", "pe.image_hash.sha384": "f6d876ef8decb5d9075660cf3d41fb38bf7dd02b7513e74cbd9cd8e414d5ed7698d5f833a709c6d2dd6dfc9f0a38a986", "pe.image_hash.sha512": "cc1d62c9a26c6a8c0288dedc7235c06d42fb61bbef5f319e5a40ae53a8d93052e63b670b0c2b455231e00b80fafbb2890b4a749c8513946063f935504323525b", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.version.copyright": "Copyright © 1999-2012 Trade Sell, Inc", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.debug.pdb.basename": "temperature.pdb", "pe.characteristics_raw": 8450, "pe.debug.pdb.timestamp": 1613989144, "pe.version.description": "Locate those Guessrace", "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 14, "pe.linker_minor_version": 26, "pe.version.file_version": "8.6.2.277", "pe.version.product_name": "Trade Sell", "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "codeview", "pe.debug.entries[1].type": "vc_feature", "pe.debug.entries[2].type": "pogo", "pe.version.internal_name": "Locate those Guessrace", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.data_directories[0].rva": 740368, "pe.data_directories[1].rva": 740532, "pe.data_directories[2].rva": 876544, "pe.data_directories[3].rva": 880640, "pe.data_directories[4].rva": 730376, "pe.data_directories[5].rva": 730464, "pe.data_directories[6].rva": 565248, "pe.dll_characteristics_raw": 320, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "8.6.2.277", "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 164, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 60, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 928, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 10084, "pe.data_directories[4].name": "debug", "pe.data_directories[4].size": 84, "pe.data_directories[5].name": "load_config", "pe.data_directories[5].size": 64, "pe.data_directories[6].name": "iat", "pe.data_directories[6].size": 368, "pe.debug.entries[0].type_id": 2, "pe.debug.entries[1].type_id": 12, "pe.debug.entries[2].type_id": 13, "pe.rich.entries[0].build_id": 244, "pe.rich.entries[1].build_id": 147, "pe.rich.entries[2].build_id": 257, "pe.rich.entries[3].build_id": 260, "pe.rich.entries[4].build_id": 259, "pe.rich.entries[5].build_id": 239, "pe.rich.entries[6].build_id": 1, "pe.rich.entries[7].build_id": 261, "pe.rich.entries[8].build_id": 256, "pe.rich.entries[9].build_id": 255, "pe.rich.entries[0].use_count": 3, "pe.rich.entries[10].build_id": 151, "pe.rich.entries[11].build_id": 258, "pe.rich.entries[1].use_count": 21, "pe.rich.entries[2].use_count": 4, "pe.rich.entries[3].use_count": 13, "pe.rich.entries[4].use_count": 14, "pe.rich.entries[5].use_count": 18, "pe.rich.entries[6].use_count": 391, "pe.rich.entries[7].use_count": 139, "pe.rich.entries[8].use_count": 1, "pe.rich.entries[9].use_count": 1, "pe.version.original_filename": "temperature.dll", "pe.coff.dos_header_pe_pointer": 272, "pe.load_config.guard_flags[0]": "cf_instrumented", "pe.rich.entries[0].product_id": 40116, "pe.rich.entries[10].use_count": 1, "pe.rich.entries[11].use_count": 1, "pe.rich.entries[1].product_id": 30729, "pe.rich.entries[2].product_id": 28619, "pe.rich.entries[3].product_id": 28619, "pe.rich.entries[4].product_id": 28619, "pe.rich.entries[5].product_id": 40116, "pe.rich.entries[7].product_id": 28619, "pe.rich.entries[8].product_id": 28619, "pe.rich.entries[9].product_id": 28619, "pe.debug.entries[0].size_bytes": 78, "pe.debug.entries[1].size_bytes": 20, "pe.debug.entries[2].size_bytes": 784, "pe.load_config.guard_flags_raw": 256, "pe.load_config.security_cookie": 4939796, "pe.rich.entries[11].product_id": 28619, "pe.base_relocations.block_count": 52, "pe.base_relocations.entry_count": 4807, "pe.load_config.se_handler_count": 67, "pe.load_config.se_handler_table": 4927692, "pe.base_relocations.padding_count": 27, "pe.debug.entries[0].timestamp_unix": 1613989144, "pe.debug.entries[1].timestamp_unix": 1613989144, "pe.debug.entries[2].timestamp_unix": 1613989144, "pe.load_config.guard_cf_check_function_pointer": 4759920 }, "x": [ [ "Describetone" ], [ "SuitLeast" ], [ "Trippoem" ], [ "Twentyroll" ], [ "Weatherbase" ] ], "id": "pe", "sc": [ [ ".text", 1024, 557568, 6.34, "r-x" ], [ ".rdata", 558592, 177664, 5.22, "r--" ], [ ".data", 736256, 4096, 3.3, "rw-" ], [ ".rsrc", 740352, 1024, 3.08, "r--" ], [ ".reloc", 741376, 10240, 6.6, "r--" ] ] }, "id": 0, "sz": 751616, "ts": [ { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "b3900" ] }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "b4eaa" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 7268.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "6d4b2" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.34)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 7268.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2, "el": [ "8a088" ] }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2, "el": [ "8a124" ] }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2, "el": [ "8a028" ] }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2, "el": [ "8a048" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "api-ms-win-core-string-l1-1-0", "LCMapStringW", "FreeEnvironmentStringsW", "StringFileInfo", "string", "cannot use operator[] with a string argument with", "string too long", "GetStringTypeW", "invalid string position", "CompareStringEx", "LCMapStringEx", "GetEnvironmentStringsW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "8e4b4", "b3762", "b3aa0", "b4cc2", "94b34", "94b88", "94998", "b3634", "94b70", "8995c", "8997c", "b3a86" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "8.6.2.277" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "b4ef2" ] }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "8a150", "8a154" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "8.6.2.277" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2, "el": [ "8a00c" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Locate those Guessrace" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "b4c66" ] }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 6.20" ], "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "895f0" ] }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2, "el": [ "b3462" ] }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "8a150" ] }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2, "el": [ "8a09c" ] }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2, "el": [ "8a128" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "8a02c" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "8a070" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "8a12c" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "8a084" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Trade Sell" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1, "el": [ "8a00c" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6.dll" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "8a068" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "48", "46", "41" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "6c873", "8239b", "870b0" ] }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2, "el": [ "8a0d4" ] }, { "c": 0.9800000190734863, "d": "GetFileSizeEx import symbol", "e": [ "GetFileSizeEx" ], "i": "metadata/binary/symbols/imports::getfilesizeex-import", "l": 1, "el": [ "8a10c" ] }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2, "el": [ "b4d8e" ] }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "8a0f8" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "8a0e8" ] }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2, "el": [ "8a0c0" ] }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 90.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2, "el": [ "8a0d8" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "88f68" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "b4d36" ] }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2, "el": [ "b4c66" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "167e6" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 7268.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2, "el": [ "8a0ec" ] }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2, "el": [ "8a018" ] }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2, "el": [ "8a0c4" ] }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-string-l1-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-xstate-l2-1-0" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1, "el": [ "8e4b4", "8c558", "8e33a", "8e468", "8e3c0", "8e408", "8e4f0", "8e388", "8e530", "8c51a", "8e56c" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "8a008" ] }, { "c": 0.8199999928474426, "d": "Opaque generated DLL original filename", "e": [ "temperature.dll" ], "i": "metadata/lang/compiler/generated::dotnet-generated-dll-original-filename", "l": 1, "el": [ "value:pe.version.original_filename" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 7268.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2, "el": [ "8a118" ] }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2, "el": [ "b3772" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "8a11c" ] }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2, "el": [ "8a130" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "8a000", "8a0f0" ] }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2, "el": [ "8a034" ] }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "8a094" ] }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2, "el": [ "b3966", "8e794" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "b3750" ] }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "8a080" ] }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2, "el": [ "b4f2a" ] }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004", "el": [ "76488" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "8a010" ] }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "8a0a8" ] }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 1999-2012 Trade Sell, Inc" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2, "el": [ "8a074" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2, "el": [ "b34c0" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "8a038" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "8a0f4" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "b39a0" ] }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2, "el": [ "b3504" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "8a0dc" ] }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "10 a1 48 00", "e4 a0 48 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1, "el": [ "7bf1f", "70e92" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "893f4" ] }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2, "el": [ "8a03c" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2, "el": [ "b34e2" ] }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2, "el": [ "8a060" ] }, { "c": 0.8500000238418579, "d": "Inline MZ header validation constant", "e": [ "B8 4D 5A 00 00" ], "i": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "l": 1, "el": [ "6ca7b" ] }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "HüIĈIŐIapi-ms-win-core-datetime-l1-1-1", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-file-l1-2-2", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-localization-l1-2-1", "api-ms-", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-rtcore-ntuser-window-l1-1-0", "Hapi-ms-win-core-fibers-l1-1-1", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-sysinfo-l1-2-1" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1, "el": [ "8e33a", "8e708", "8e468", "8e388", "8e5f8", "8e4b4", "8e3c0", "8c5a8", "8e408", "8e56c", "8e5a8", "8c51a", "8e530", "8c558", "8e4f0" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2, "el": [ "8a01c" ] }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "sections.count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "b4dc2" ] }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "exports.count = 5.00" ], "i": "metadata/binary/symbols/exports::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2, "el": [ "8a0c8" ] }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2, "el": [ "8a058" ] }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2, "el": [ "8d9d4" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.34" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Minimal resource section footprint", "e": [ ".rsrc (size: 1024)" ], "i": "well-known/malware/virus/virlock::tiny-rsrc-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2, "el": [ "8a07c" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "8.6.2.277" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2, "el": [ "8a08c" ] }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "8a0b0" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "b4cfe" ] }, { "a": "T1574.002", "c": 0.8799999952316284, "d": "LoadLibraryExW API string", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w-string", "l": 2, "el": [ "b38ca" ] }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2, "el": [ "8d9bc" ] }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreA" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042", "el": [ "8a040" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014", "el": [ "6c8ba" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "8a0ac" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-a", "l": 2, "el": [ "8a004" ] }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2, "el": [ "8e650", "8e698" ] }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2, "el": [ "8a0a0" ] }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2, "el": [ "8a0e0" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 90.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2, "el": [ "8a138" ] }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2, "el": [ "8a110" ] }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtectEx" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1, "el": [ "8a030" ] }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "8a000", "8a0f0" ] }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2, "el": [ "896a0" ] }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2, "el": [ "8a0fc" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "41", "48", "46" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014", "el": [ "870b0", "6c873", "8239b" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2, "el": [ "8a134" ] }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2, "el": [ "8a0cc" ] }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "l": 2, "el": [ "8a108" ] }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "c:\\though\\guess_Dog\\Who-tie\\shop\\wife\\temperature.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1, "el": [ "8a04c" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 90.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "8d9bc" ] }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1, "el": [ "8cb70" ] }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2, "el": [ "8a104" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "temperature.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "b17f0" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "8a154" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "8a014", "8a04c" ] }, { "c": 1.0, "d": "VirtualProtectEx/NtProtectVirtualMemory symbol", "e": [ "VirtualProtectEx" ], "i": "objectives/evasion/fileless/memory::protect-memory-sym", "l": 1, "el": [ "8a030" ] }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2, "el": [ "8a0d0" ] }, { "c": 0.699999988079071, "d": "Windows Temp directory path", "e": [ "\\temp" ], "i": "micro-behaviors/fs/path/temp::win-temp-path", "l": 2, "el": [ "b17f0" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2, "el": [ "8a090" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "TlsSetValue", "value too large", "FlsGetValue", "FlsSetValue", "TlsGetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "b370a", "894b0", "89620", "8962c", "b36fc" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014", "el": [ "76488" ] }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Extended memory protection modification", "e": [ "VirtualProtectEx" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect-ex", "l": 2, "el": [ "8a030" ] }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "8a06c" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "8a148", "8a14c" ] }, { "a": "T1106", "c": 0.8999999761581421, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process-string", "l": 2, "el": [ "b349c" ] }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1, "el": [ "899ec" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "b4e58" ] }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6.dll" ], "i": "objectives/evasion/masquerade/dll/name::dll-basename", "l": 2 }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1, "el": [ "8d9bc" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "88565" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "8a0b4" ] }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2, "el": [ "8a018" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "895f0" ] }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009", "el": [ "8a0b8" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 7268.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001", "el": [ "b380e" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "b34b2" ] }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "dc a0 48 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1, "el": [ "70e6e" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "WaitForThreadpoolTimerCallbacks", "GetCurrentProcessorNumber", "FreeLibraryWhenCallbackReturns", "GetFileInformationByHandleEx", "AcquireSRWLockExclusive", "SleepConditionVariableCS", "FlushProcessWriteBuffers", "EnumSystemLocalesEx", "InitializeCriticalSectionEx", "InitializeConditionVariable", "SleepConditionVariableSRW", "GetCurrentPackageId", "ReleaseSRWLockExclusive", "GetUserDefaultLocaleName", "TryAcquireSRWLockExclusive", "GetSystemTimePreciseAsFileTime" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "896cc", "89780", "89760", "897d4", "898b0", "89880", "89744", "8e794", "89638", "89830", "898fc", "897b0", "898e4", "8e808", "898c8", "89810" ] }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1, "el": [ "b4c66" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 90.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 2.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "8a098" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cKeyword Index=\"", "entry\u003e\r \u003c/row\u003e\r \u003crow", "d.\u003c/para\u003e\r \u003c/listItem\u003e\r \u003clistItem\u003e\r \u003cpara\u003eTo prevent a spec...", "ition could not start\" /\u003e\r \u003cKeyword Index=\"BestBet\" Term=\"voicecontrol\" /\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1, "el": [ "956c8", "95704", "97a64", "9561e" ] }, { "a": "T1036.005", "c": 0.8500000238418579, "d": "PE stem disagrees with embedded PDB stem", "e": [ "file.stem != pe.debug.pdb.stem (\"46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6\" != \"temperature\")" ], "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "l": 3, "el": [ "value:file.stem" ] }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales callback API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 1, "m": "E1106", "el": [ "8a108" ] }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "8a0b4" ] }, { "c": 0.949999988079071, "d": "links kernel32 (GetModuleFileNameA, FindResourceA, GetModuleHandleA, OpenProcess, Sleep, ... +81 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "86 symbols" ] }, { "c": 0.949999988079071, "d": "links secur32 (QueryContextAttributesW, FreeContextBuffer, DeleteSecurityContext, InitializeSecurityContextW)", "e": [ "secur32" ], "i": "metadata/dylib::secur32", "l": 2, "el": [ "4 symbols" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2, "el": [ "8a150", "8a154" ] }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetModuleFileNameA", "CreateFileW", "CreateFileA", "ReadFile", "SetFilePointerEx" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032", "el": [ "b3462", "8a04c", "8a014", "8a128", "8a110" ] }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetLocaleInfoW", "GetUserDefaultLCID", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-fingerprinting-imports", "l": 2, "el": [ "8a0a0", "8a104", "8a108" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesW", "GetUserDefaultLCID", "GetLocaleInfoW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2, "el": [ "b3966", "8a104", "b3772", "8e794" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW", "GetModuleHandleExW", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "8a098", "8a094", "8a0ec", "8a008" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "8.6.2.277" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "FileVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2, "el": [ "b4f2a", "b4d8e", "b4c66" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "8.6.2.277" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "Copyright © 1999-2012 Trade Sell, Inc", "Trade Sell", "Locate those Guessrace", "imports.count = 90.00" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2, "el": [ "value:pe.version.copyright", "value:pe.version.product_name", "value:pe.version.description", "" ] }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InitializeSListHead", "InterlockedFlushSList" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2, "el": [ "8a0cc", "8a0d8" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetEnvironmentStringsW", "GetUserDefaultLCID", "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082", "el": [ "8a154", "b3772", "8a150", "8a104", "b3966", "8e794" ] }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "GetEnvironmentStringsW", "EnumSystemLocalesW", "FreeEnvironmentStringsW", "GetCurrentThreadId", "GetUserDefaultLCID", "GetCommandLineA", "GetLocaleInfoW", "GetCommandLineW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082", "el": [ "8a150", "8a108", "8a154", "8a0c8", "8a104", "8a148", "8a0a0", "8a14c" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2, "el": [ "8a0ac", "8a0a8" ] }, { "a": "T1497", "c": 0.8500000238418579, "d": "Adaptive behavior based on environment", "e": [ "IsProcessorFeaturePresent", "IsDebuggerPresent", "VS_VERSION_INFO", "GetEnvironmentStringsW", "imports.count = 90.00", "IsDebuggerPresent", "FreeEnvironmentStringsW", "c:\\though\\guess_Dog\\Who-tie\\shop\\wife\\temperature.pdb" ], "i": "objectives/anti-analysis/environment-detect/runtime::environment-adaptive-behavior", "l": 2, "m": "B0001", "el": [ "8a0b8", "8a0bc", "b4c66", "8a150", "", "b380e", "8a154", "value:pe.debug.pdb.path" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "EnumSystemLocalesW", "GetUserDefaultLCID", "GetCommandLineW", "GetCommandLineA", "GetSystemTimeAsFileTime", "EnumSystemLocalesEx", "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082", "el": [ "b3966", "8a104", "8a14c", "8a148", "8a090", "8e794", "8a154", "b3772", "8a150" ] } ], "sha": "46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-04/46e22d42410a59d1aa9efca5444c6d08123c725d9bf4b75ec22b02330e7576d6.dll", "type": "pe" } ], "tv": "126f8" } }