{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9414610862731934 } ], "prob": 0.9414611, "models": [ { "m": "az", "prob": 0.9414611, "class": 0 }, { "m": "az/native", "prob": 0.3349001, "class": 0 }, { "m": "az/pe", "prob": 0.9781229, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-04T20:52:01Z" }, "path": "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe", "raw": { "v": "6", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 1097519.0, "has_overlay": 1.0, "overlay_end": 1105984.0, "overlay_size": 17984.0, "checksum_valid": 0.0, "overlay_offset": 1088000.0, "overlay_padding": 17984.0, "computed_checksum": 1176680.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 1116880.0, "entropy": 2.92, "size_bytes": 1116880.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 2.65, "overlay_size": 28880.0, "string_count": 19203.0, "overlay_ratio": 0.03, "overall_entropy": 2.92, "overlay_entropy": 7.59, "entropy_variance": 1.63, "avg_string_length": 55.22, "max_string_length": 565756.0, "code_to_data_ratio": 1.0, "string_length_stddev": 4082.51, "largest_section_ratio": 0.97, "sentence_string_count": 22.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 1086976.0, "entropy_max": 2.65, "entropy_mean": 1.38, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 4493, "u8", "ToInt32" ], [ 4501, "u8", "ToUInt64" ], [ 4510, "u8", "ToInt64" ], [ 4518, "u8", "\u003cModule\u003e" ], [ 4527, "u8", "System.IO" ], [ 4537, "u8", "System.Web" ], [ 4548, "u8", "mscorlib" ], [ 4557, "u8", "Microsoft.VisualBasic" ], [ 4579, "u8", "Versioned" ], [ 4589, "u8", "CompareMethod" ], [ 4603, "u8", "Replace" ], [ 4611, "u8", "ToDouble" ], [ 4620, "u8", "RuntimeTypeHandle" ], [ 4638, "u8", "GetTypeFromHandle" ], [ 4656, "u8", "CallByName" ], [ 4671, "u8", "CallType" ], [ 4680, "u8", "WriteByte" ], [ 4690, "u8", "ToByte" ], [ 4697, "u8", "GetObjectValue" ], [ 4712, "u8", "LateBinding" ], [ 4724, "u8", "ToString" ], [ 4733, "u8", "get_Length" ], [ 4744, "u8", "ToDecimal" ], [ 4754, "u8", "AspNetHostingPermissionLevel" ], [ 4783, "u8", "DataGridCell" ], [ 4796, "u8", "MemoryStream" ], [ 4809, "u8", "System" ], [ 4816, "u8", "ToBoolean" ], [ 4826, "u8", "System.Reflection" ], [ 4884, "u8", ".zip" ], [ 4889, "u8", "Char" ], [ 4894, "u8", "ToInteger" ], [ 4904, "u8", ".ctor" ], [ 4910, "u8", ".cctor" ], [ 4917, "u8", "Microsoft.VisualBasic.CompilerServices" ], [ 4956, "u8", "System.Runtime.CompilerServices" ], [ 4988, "u8", "AnchorStyles" ], [ 5001, "u8", "Strings" ], [ 5009, "u8", "Equals" ], [ 5016, "u8", "System.Windows.Forms" ], [ 5037, "u8", "Conversions" ], [ 5049, "u8", "get_Chars" ], [ 5059, "u8", "RuntimeHelpers" ], [ 5074, "u8", "Format" ], [ 5081, "u8", "Object" ], [ 5088, "u8", "LateGet" ], [ 5096, "u8", "Split" ], [ 5102, "u8", "Convert" ], [ 5110, "u8", "ToArray" ], [ 5118, "u8", "get_Assembly" ], [ 5131, "u8", "Empty" ], [ 10571, "u8", "oTGAPkhshmfrOXCVNCbgWhuLIGbftgguyAxxyeuXkwvYbtkNFoNRiACGXuqIIByBFkrOYEViHEuYlWiO" ], [ 10733, "u8", "aWkLlECQBvvMJGqimXYHxsrRAOhpHiGKqVkxwAd" ], [ 10813, "u8", "QhvSVVYSWgDmyoOBatYDeaRNdCEPRWWegYGIytbTlYCGFtmptuheKMWoPhoSQ" ], [ 10938, "u8", "AFWjWQdhDYAeBdfrsHUwdUThJqKYIglLvOSElULehqvcfqOwheLtkOGfkoaeGFYVmnhmKaGYvpPlXqBS" ], [ 11100, "u8", "SSVxMvRwQBUkwsqCQKqnYmjitsTKa" ], [ 11160, "u8", "pcWLNdBhpuYgtxlmcFrxPqpPIEidfMGigtAlNtT" ], [ 11241, "u8", "CkdHssXauIfUcmEejeHrgZgtjPnuRhRhdHfoBhZTxuZhsXWpDUMyDsvbDiWcFcIMqxqUHOcBFntkAyAM" ], [ 11403, "u8", "dGqNNZVNrRxEpDegUEhrpvJKLfCPqEWMRfZZbvGXlZYujJJpgGchFCThvgBhX" ], [ 11528, "u8", "HgdKyJscxCRdqRBgRqsixsnkawYFdBDNlnaMBYnUegmZOheHsxpFTPROssiCjmxvyDrDpnerCXDRFNWr" ], [ 1087038, "u8", "mscoree.dll" ], [ 1088066, "u8", "N0L0" ], [ 1088495, "u8", "1604" ], [ 1088583, "u8", "201228181303Z" ], [ 1088598, "u8", "211228181303Z0" ], [ 1089157, "u8", "C0A0" ], [ 1089286, "u8", "CZ95" ], [ 1090270, "u8", "20201228181303Z" ], [ 1090318, "u8", "Greater Manchester1" ], [ 1090347, "u8", "Salford1" ], [ 1090365, "u8", "Sectigo Limited1,0*" ], [ 1090390, "u8", "#Sectigo RSA Time Stamping Signer #2" ], [ 1090550, "u8", "Sectigo Limited1%0#" ], [ 1090576, "u8", "Sectigo RSA Time Stamping CA0" ], [ 1090623, "u8", "320122235959Z0" ], [ 1090735, "u8", "#Sectigo RSA Time Stamping Signer #20" ], [ 1091254, "u8", "vIhb" ], [ 1091455, "u8", "90705" ], [ 1091490, "u8", "https://sectigo.com/CPS0D" ], [ 1091531, "u8", "3http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" ], [ 1091612, "u8", "3http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" ], [ 1091678, "u8", "http://ocsp.sectigo.com0" ], [ 1091774, "u8", "WUpKN" ], [ 1092306, "u8", "New Jersey1" ], [ 1092327, "u8", "Jersey City1" ], [ 1092349, "u8", "The USERTRUST Network1.0," ], [ 1092380, "u8", "%USERTrust RSA Certification Authority0" ], [ 1092422, "u8", "190502000000Z" ], [ 1093283, "u8", "I0G0E" ], [ 1093293, "u8", "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" ], [ 1093386, "u8", "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" ], [ 1093452, "u8", "http://ocsp.usertrust.com0" ], [ 1093655, "u8", "mAmg" ], [ 1094122, "u8", "Sectigo RSA Time Stamping CA" ], [ 1094297, "u8", "rWTZK" ], [ 1094495, "u8", "%USERTrust RSA Certification Authority" ], [ 1094890, "u8", "JiItx" ], [ 1095154, "u8", "j0h03" ], [ 1095353, "u8", "Santa Clara1" ], [ 1095375, "u8", "Intel Corporation1%0#" ], [ 1095403, "u8", "Intel External Issuing CA 7B0" ], [ 1095435, "u8", "161108101340Z" ], [ 1095450, "u8", "181108101340Z0" ], [ 1095525, "u8", "Intel Corporation1" ], [ 1095553, "u8", "EIG1907" ], [ 1095566, "u8", "0Intel(R) Embedded Subsystems and IP Blocks Group0" ], [ 1095979, "u8", ".607" ], [ 1095999, "u8", "\u0026http://pki.intel.com/crl/IntelCA7B.crl0f" ], [ 1096051, "u8", "Z0X02" ], [ 1096067, "u8", "\u0026http://pki.intel.com/crt/IntelCA7B.crt0\"" ], [ 1096120, "u8", "http://OCSP.intel.com/0" ], [ 1096724, "u8", "SMjwc" ], [ 1096905, "u8", "COMODO CA Limited1+0)" ], [ 1096932, "u8", "\"COMODO RSA Certification Authority0" ], [ 1096971, "u8", "151028000000Z" ], [ 1096986, "u8", "210617235959Z0s1" ], [ 1097882, "u8", "E0C0A" ], [ 1097892, "u8", ";http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" ], [ 1097981, "u8", "/http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" ], [ 1098043, "u8", "http://ocsp.comodoca.com05" ], [ 1098083, "u8", "intel.com0" ], [ 1098726, "u8", "AddTrust AB1\u00260$" ], [ 1098748, "u8", "AddTrust External TTP Network1\"0" ], [ 1098788, "u8", "AddTrust External CA Root0" ], [ 1098817, "u8", "000530104838Z" ], [ 1098832, "u8", "200530104838Z0" ], [ 1099671, "u8", "3http://crl.usertrust.com/AddTrustExternalCARoot.crl05" ], [ 1100129, "u8", "Washington1" ], [ 1100150, "u8", "Redmond1" ], [ 1100168, "u8", "Microsoft Corporation1)0'" ], [ 1100199, "u8", "Microsoft Code Verification Root0" ], [ 1100236, "u8", "130815202630Z" ], [ 1100251, "u8", "230815203630Z0o1" ], [ 1100803, "u8", "N0L0J" ], [ 1100813, "u8", "Dhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0" ], [ 1101045, "u8", "A07JW" ], [ 1101244, "u8", "zNjoD" ], [ 1101517, "u8", "Intel External Issuing CA 7B" ], [ 1101819, "u8", "I_KU" ], [ 1102239, "u8", "Intel Corporation1\u00260$" ], [ 1102267, "u8", "Thales TSS ESN:E892-D055-162F1\u00260$" ], [ 1102307, "u8", "Thales TSS ESN:E892-D055-162F1" ], [ 1102347, "u8", "timestamp.intel.com" ], [ 1102446, "u8", "QuoVadis Limited1%0#" ], [ 1102473, "u8", "Root Certification Authority1.0," ], [ 1102511, "u8", "%QuoVadis Root Certification Authority0" ], [ 1102553, "u8", "140530163555Z" ], [ 1102568, "u8", "210317183333Z0I1" ], [ 1102607, "u8", "QuoVadis Limited1" ], [ 1102634, "u8", "QuoVadis Issuing CA G40" ], [ 1103283, "u8", "http://ocsp.quovadisglobal.com05" ], [ 1103326, "u8", ")http://trust.quovadisglobal.com/qvrca.crt0" ], [ 1103435, "u8", "'http://crl.quovadisglobal.com/qvrca.crl0" ], [ 1103748, "u8", "phDQcY" ], [ 1103911, "u8", "150424214443Z" ], [ 1103926, "u8", "180424214433Z0" ], [ 1104109, "u8", "timestamp.intel.com0" ], [ 1104460, "u8", "http://ocsp.quovadisglobal.com07" ], [ 1104503, "u8", "+http://trust.quovadisglobal.com/qvicag4.crt0O" ], [ 1104555, "u8", "H0F0D" ], [ 1104571, "u8", "X0604" ], [ 1104587, "u8", "(http://www.quovadisglobal.com/repository0" ], [ 1104719, "u8", ")http://crl.quovadisglobal.com/qvicag4.crl0" ], [ 1104882, "u8", "FZuzL" ], [ 1105390, "u8", "QuoVadis Issuing CA G4" ], [ 1105583, "u8", "K0I1" ] ], "v": { "file.stem": "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1609179183, "file.basename": "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe", "pe.image_base": 4194304, "pe.image_size": 1105920, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 1094734, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 10896, "pe.image_hash.sha1": "cd78c3c8637b7741b4529c81d982482c54dc6c14", "pe.image_hash.sha256": "f04e19f782b09ed2509dc02a8a0ecf1f776370f9cb1aa4a8ada206ecafa2e9e4", "pe.image_hash.sha384": "a567047385ed1ea9e45b8196d5a09a7aadb1827ea250dc25546d19cf3ea46c73e85ea1907d9996f5c8e1af0cadca7061", "pe.image_hash.sha512": "666e61a047bb4cce6d8f6c870d420ed4f0686546f8c932e57c6baf7af8dea3cb26b4bdb3a4b425a1102c4a8cf0ba611ba1565b22693dc8e94eaa750fb01215ab", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US", "pe.signatures[0].serial": "56000001757376cd78ad000c9a000000000175", "pe.signatures[0].subject": "CN=Intel(R) Embedded Subsystems and IP Blocks Group,OU=EIG,O=Intel Corporation,L=Santa Clara,ST=CA,C=US", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 1094656, "pe.data_directories[1].rva": 1105984, "pe.data_directories[2].rva": 1097728, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2018-11-08T10:13:40Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 10896, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2016-11-08T10:13:40Z", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "c442d3bdf3d1bf5173cdb1b0ec361ea7d684c6bd", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "8290731efc68487ba91c0b05de610675e300fb9b3c853a881860de495c179513", "pe.signatures[0].thumbprint_sha256": "534b9b1a31a38b4e0bf9a291f408337c25a2e011d460fdff495ce473fb168a8e", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 1086976, 2.65, "r-x" ], [ ".reloc", 1087488, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 1116880, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Intel(R) Embedded Subsystems and IP Blocks Group", "e": [ "Intel(R) Embedded Subsystems and IP Blocks Group" ], "i": "metadata/signed/unknown::intelr-embedded-subsystems-and-ip-blocks-group", "l": 2 }, { "c": 1.0, "d": "Signed by Intel Corporation", "e": [ "Intel Corporation" ], "i": "metadata/signed/leaf::intel-corporation", "l": 3 }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "12da" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 19203.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "1230" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "a": "T1140", "c": 0.8999999761581421, "d": "VB LateGet dispatch token", "e": [ "LateGet" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token", "l": 1, "m": "B0030", "el": [ "13e0" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "1398" ] }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 19203.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.92" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "10963e" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1.0," ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "10aafd" ] }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic", "Microsoft.VisualBasic.CompilerServices" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "11cd", "1335" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "GetObjectValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "1259" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 19203.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "COMODO certificate string in overlay", "e": [ "COMODO CA Limited1+0)" ], "i": "objectives/evasion/masquerade/binary::overlay-comodo-string", "l": 1, "el": [ "10bcc9" ] }, { "c": 0.949999988079071, "d": "PE has exactly two sections", "e": [ "sections.count = 2.00" ], "i": "well-known/malware/virus/virlock::two-section-layout", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Strings", "ToString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "1389", "1274" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "10963e" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 19203.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.7799999713897705, "d": "Assembly accessor token (get_Assembly)", "e": [ "get_Assembly" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token", "l": 1, "el": [ "13fe" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "1398" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.9700000286102295, "d": "Wrapper file size band", "e": [ "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe" ], "i": "metadata/binary/layout::wrapper-file-size-band", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.92" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.9399999976158142, "d": "Dominant largest PE section", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "metadata/binary/layout::large-dominant-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "11c4" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "11af" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 19203.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "MicrosoftCodeVerifRoot", "SectigoRSATimeStampingCA", "AspNetHostingPermissionLevel", "CkdHssXauIfUcmEejeHrgZgtjPnuRhRhdHfoBhZTxuZhsXWpDUMyDsvbDiWcFcIMqxqUHOcBFntkAyAM", "QhvSVVYSWgDmyoOBatYDeaRNdCEPRWWegYGIytbTlYCGFtmptuheKMWoPhoSQ", "HgdKyJscxCRdqRBgRqsixsnkawYFdBDNlnaMBYnUegmZOheHsxpFTPROssiCjmxvyDrDpnerCXDRFNWr" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "10cc0d", "10a7cb", "1292", "2be9", "2a3d", "2d08" ] }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Giant embedded string blob metric", "e": [ "binary.max_string_length = 565756.00" ], "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 19203.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 7.59" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 19203.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 19203.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.97" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2021-01/4822c7636f2dcdfd1dcac8af813496dbe4d1cb4e5d88fec4e175d87bbdbaafbf.exe", "type": "pe" } ], "tv": "84adb" } }