{ "llm": { "conf": 0.99933, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 25, "prob": 0.999, "class": "hostile" }, "outcome": "hostile", "interpretation": "Renames files to .die" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": 12, "conf": 93, "mods": [ { "cls": 0, "raw": 0.99806136, "rte": "az", "prob": 0.99806136 }, { "cls": 0, "raw": 0.99821967, "rte": "az/native", "prob": 0.99821967 }, { "cls": 0, "raw": 0.99109614, "rte": "az/pe", "prob": 0.99109614 } ], "prob": 0.999, "files": [ { "id": 0, "lvl": 12, "conf": 93, "prob": 0.9990000128746033, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-29T07:29:50Z" }, "path": "4a1adc6be03f0780689b7ff15d46fffc96ce1328b7ce24cff15fee8cc4e3455a.exe", "raw": { "v": "8", "rev": "c1ea9", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000XbVHe4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000B!wG:g5^I}g5^I}g5^I}VF\u003e", "ln": 0 }, { "b": "-h9In01Ybg0i=I801Ybg000000000000000!C]Q4e[wyjve{ocapn8G0kFTo01Ybg0kFW9000000000000000kMy/1e](2Nv/MGe{\u0026##x0mg=E0dUgL0mg=E000000000000000kMy^Hy$-8=5c8Xg00000001$Uo\u0026C7Vr.UFae\u003c@xb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 440 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000HlFxM}3A*p)RnLrf\u003e^w6JM!8pvSFn+H}YK5X=OTE.\u003eiSyk):rbC50:(i(vRhBFtEHzuuON@\u003eUpG1\u003cJ-Yi)BvsOK]L@[T(H}1{pSv1{yYw)V:F!(scJeEl\u003cMEBEO}z5x7n.y/^uK@H/x}{6EHm3D5MTN*2KbHNT@Sy0Jw(*.(\u0026bLA?[-G{[VP?::zYI3x.}X=XZF6lQ9\u003ep/\u003cxite)mRneXdxEqbA@e0M/HxxV1e5iV.ch\u003e)0^7/)wK(jxXgiS(c$iS#i#0C[GJzuDUOSR@MiQ=1xSfhwlZ*JGxkZ(\u003eEkfL)F7)E3Y?m3:P*a^/0A6hCox5-6g4($-toUB?Ie00000aPJhRUaO8Y000000000000000c\u003eOYA2MK\u002681!O9Y44/\u0026^8\u003ePB%xp?G\u003c-gGu@!$knee$=nCR\u003euuR00000cJB?X\u0026he*vb=r%e\u003e+ZVD00000xC0Gf4GDFec80T9etkxgje1$vw1=i?++EG8{m\u003c}O4X#z\u003e9I=14W4{1*r\u00265a.]qa+N3-lk\u003c8M2?3/}}7o000000000000000cJB?XYSjv00\u003c1Y*-h=i800000:n", "ln": 4000 }, { "b": "0000100ic20wKMQ0000y0001t0wTSR0000k0001-HIl.\u003e000010001$0002G02tqf001wT02tqf001wTl1B[ywGT/.z//]sxM4\u0026jlQI$KfFLKfc%7b2wn=Wkdf8aSf/.oGf/?0EatC(qg=dlGhVJ*WPAb2{0000100961PAk8@000010008*PAte%000010009K00000000060rSr70000100SA60u7}w000010003z0uh1x000010003H0vN{I0000100ic20S-o7000010003P0S", "ln": 5357 }, { "b": "h99PGiXSDxfGq9EfD}S:ze.Kgz!9M]C%(7.wJ.j)fFLNtfFLdkh=IH(iY5VOgb*Zqi65-Ea%qbEA5{ZLBywY*ByvNCBy^PVgb7ByeIF[hfGh@=ixw#NiX\u0026SAfGq9EfD}SIv(!juA=2lbjTaPSvp%d8yh^-%a%p\u0026rz//]sxM4\u0026JlVl^VA.QE.wJ.j[a%p\u0026rz//]sxM4\u0026JnKC\u003cwA=kM7y?k:NB5CH{aw20?hzEiIhz3Wpf^m-+ze-izi.sjgByx5%wL2oMb6W%ze[]3gi+g9dh-9GOiw1-Hi5\u0026GGw\u00268m{iw\u0026JHeJvr2hzWiIfGrPPgA)@^ze-iziZ^)@B.$YcBv!\u003e-b4k22vR4Phz!0G(i=F+JBz(klz/v-$h8v0DgH\u0026i)gIg5NeJvu0h7-n}vk6n[", "ln": 15887 }, { "b": "0000cA-t}7000c:000okxh?+@000c:000okvPlk)000c:000okBy/Ys00000lVl{?A+Pf1Brz#wdiHu9ixecLwP}%4BAx9hvpK7YA+3pWz/6D4zG#iZwmY*(000000000iB5CH{aw20?hzEiIhz3Wpf-RgN00000000005{3@vllF\u0026*lPcUVhA0cxe?)ta00", "ln": 19996 }, { "b": "D+6?cBbGQD/177zW]RsSS@7nKWK0OU3}xfP@@t-th#YEeAu/WqkF)rT5M!$GX7[Wu/mI#@!*!MuEvg1zkvCNkhu{[e3Ccy-lXjQGTc5+xa/Imq0oy6EE82KQ\u003c?mCKoj5zPI@\u0026wq-iaA)av\u0026@VplRY/\u003e+J!+/lu$[le*za(I*\u003eMkhgjP0Um[4\u0026t\u0026LbKEHL8C6@A}]u-%5u/Dh69cCwT:K60/0z\u0026kprF!3=bIqgCNpRpz3z5rKE=3F+vXB46E[6u\u003e:8t97/\u0026$5O)F0Cuc]xEOalkmuZAmO2cY5:C)AuR]p\u0026GIm\u003e[:lv/eu*fJW^CrK1ZtC+\u003e=:T8iSPpTVwsQP$/GmZq3)XX@)e)nxHY1K(*ufFn%f]:f?B5bY}Tjs!5kCkA0Rw]e8LgvE?{k/VY{JRPaI0Gdy[VARSKK{9XV)LW#s+d1t(luX%gY!JreVJZ1?9YaYP\u0026q*9u8-za/Ym*1p}F8g4gC6yB?EQr\u003cD8+k0[7vscefR)Neao7r9M\u0026nB5r^$51Qv{UD}KOV)Ncm%O]kTs=X6yivGjZhW0\u003eyD%ks\u003eGqcV[:bW\u003cO4\u0026Ys@CKj$^ePC3W{e/$C1Vv5[q+M=-.)-v)d\u003c09pO.PH)SktxbRBjD-Xcw9-Z:Xs\u003ep\u003ee\u003eqq[42Xv7lolci}RfXyvZ@o@pGbczBv=e38PS^q9C=vo}vrmO?\u003eV.+GwPT)p/Rz8Zb.d^b26)vo6*B]3$d\u003cIhoTQKmm9zmC+G$(!c[UZB#Jk$WdL(v[C-FuElJ4c*vYW+8YYt:nGuc#g!$tBdKpd/O2:M]868JmsX6^\u003ee%t[N?[5L*{Wk-DZ5b0Q)%:PUD/8BeuIA)3/s?6+B)\u003c!B?fX4\u003c{G)QZZ1o%{Uxxq.(!M{BY7YL9).dk=}(+ehE^t*p", "ln": 82880 }, { "b": "x(dB4g5}W:c)FY(2xh0\u002600[V300933aohxw0TeN6wQ5qK00iqs1jd9Z0V.pH0rs!N5=\u00261j10mHy00rA9rb3hXAXNL41gOZs00*p.000r12lj=714Js\u003e00AGaoKRywy+U[\u003c0s5Q8zFrQ0A=7\u003cW@@A601VMS!5.wA\u00261RH!n9@)O/0002i0!vlL01zU3ax8Y^B0ay)A+Pd=0T5Yc002ATli4k\u003c004Xvli4k\u003c002cIli4k\u003c008UVli6*Z000", "ln": 168146 }, { "b": "0000000000000000000000000sBykJ00000927TroAk4)rZFU!hyrPRhE*Awe[w^m00000dGxCG0000000000000ua1pa#c0000000000FrAk02kx\u003eL0rr902MK\u002680rr910rr91\u003e(pX-L-XojBDF(\u0026\u00261FuQCMmZzHx4qOMh*)+MJd0=00000000000o\u003cE-00000ojr3Mx\u003eYe0zFrQ0A=7\u003eIvrVc]x!rt5x\u003e874zu6VqvLE\u0026.]z[{({)jqE00000PQ[EIPS*-.7ZZly2/5+bmIm@^0kH]300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 168384 }, { "b": "NG8F245Y%jqTs}%2:C9TZyY)+WpI?-\u0026.DQiNp:+SW*Snp0asotraQq@f-RgNe\u003coaf}K?HkR-j}Zd(hgMlPOEGA=kPhvqNbRx(4v4asIE]hyR)9x\u003e8g4B8LVjaxAh$BZY8eq/)d)x(vlSlod2grZFX%pFs7PrZD=^0gudN000001][S62(\u003c@95sC\u0026+oQOiE^859H0000000000xMd\u003e\u0026*d[+aNp:+SW*Snp0asotoKRywy+U[\u0026i.#\u003elNp:+SW*Snp0asotmSir:00000dO)f5Np:+SW*Snp0asotrb3hXAXWQ{rb3hXAXNK]2lj-7B-RbmgCO}g8VP\u003crq!p5Avr(B8wN[\u003eRzE^Wfl3di?x\u003c#jbwPE?K+:y=$/Qk5a000c4!wsJL0000000000Q1)HK01lO:0@}g(]Qe2CXx\u003e\u003cN0rpBC?#A-S4/=Ofm}D^zx(mE1Ct8{)xf=H$+:y=$esF)9000c4\u0026kd!X0000000000Q3fuW01lO:0@}g(jEOOpXx\u003e\u003cN0rpBC?#A-S4/=Ofq!p5Lx(mE1Ct8{)xf=H$+:y=$BECI@000c4)7#6?0000000000Q4Dh*01lO:0@}g(GQLjcXx\u003e\u003cN0rpBC?#A-S3\u0026\u003c970000000000br+@4}K?HkR-j}Zd(hgMb0C\u00263}K?HkR-j}Zd(hgM0SSi2-f%0)!s5Y700000C#7K#Np:+SW*Snp0asot0SSi2tMs:72MK\u00268e=YC.CMqpP00000761sm1onA40rr91000000046v%nSc00rr91/?OU9Np:+SW*Snp0asot5=.[itMv+7zuawJv/QAEASx$SeDt+J\u0026zcHhNp:+SW*Snp0asotuTE$=vmCoGwM9X\u003eoLFM\u0026000009SMfuv/QuCwb).Lf92FZaolAZwDlPFve$cAwDi?Ma]?Py3\u0026*nce=YC.CMqpPa]\u0026.=000002MK\u00268e=YzZx-IYA00000rZG8ge\u003c@xb00000uTE$=vmt6A00000uTE$=vnY6-BAduYuTE$=vn?n*qAaTRuTE$=vmCoGwMAkWoLFM\u002600000uTE$=voc/SlT+6puTE$=vn?n*r:*2HvqC]zuTE$=vnyuEq!p4JuTE$=vmtiSz/OS%wPzy0z*8fYuTE$=vl[{Vl$HBYA=\u003e(l00000uTE$=vnI8*pJ{X/AX^W}uTE$=vmCoGwLV=I00000uTE$=vmCoGwM9X\u003e00000uTE$=voc/So(BLxuTE$=vo2(Nr:*1GuTE$=vmK)DwPzj3", "ln": 170192 }, { "b": "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000Fg0Y?0SSi2000930@@r3c\u0026:l$4GDFekMy!m5c8Xgso5tK000000000000000000310rr91z#Y(*00000Fg0Y?0SSi2000310rr91HYvB9000000000000000000310rr91PA1$x0000000000000000003100000XbVHe00000Fg0Y?0SSi2", "ln": 184256 }, { "b": "%nSc0%nSc0%nSc0%nSc0%nSc0%nJ600rrc202kFl0rskx:AvW^0rs}TgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr91000000rr91002j-00000000c400031000000000000000005k:00000qVH[tASx!NzuaqHmGvc5yYF2DnDrSdw=M-H003%s00000fAs6jfAr{ffAr{fli5Xt001LI3ig8blJz38z2!IPve$fBC(QOtve$cAwDhYg00310mf2^SnDn.\u003c002m:9SMivpYLIozVBqFBPt[KBo25ove$cAwDhYg002T(ve$GKve$0wx-GZ+rrc[px-ISyzVB!Tzu6Up001LI3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9fAq7M001XM3ig8bpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9fAq7M002m:9SMivnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002T(ve$GKve$0wx-GZ+rrc[px-ISyzVB!Tzu6Up002*}cia5Dpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002T(ve$GKve$0wx-GZ+rrc[px-ISyzVB!Tzu8o?wDl@PwDhYg002y!00000rSDLdASwMex-I@HwDkp4zuanGzVx+q001nA1onA4q#*}sve$fBA@Z1Rve$xHx-J5Kzu6Up000ccUMK}a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 477082 } ], "mol": "K(Mc)O₄(As₅CIEr)H₇(F₄Db₂Ds₂OsPo₄TiU₂)Md₆(Bi₈BkPaPt₂Si)", "sha": "4a1adc6be03f0780689b7ff15d46fffc96ce1328b7ce24cff15fee8cc4e3455a", "path": "4a1adc6be03f0780689b7ff15d46fffc96ce1328b7ce24cff15fee8cc4e3455a.exe", "risk": 559, "size": 479263, "supp": [ { "by": [ { "id": "metadata/binary/framework::vb6-runtime-core-helper", "spans": [ [ 4192, 17 ], [ 4220, 18 ], [ 4236, 25 ], [ 4242, 16 ] ] }, { "id": "metadata/binary/framework::vb6-runtime-event-helper", "spans": [ [ 4192, 17 ], [ 4220, 18 ], [ 4236, 25 ], [ 4242, 16 ] ] } ], "id": "metadata/binary/section/entropy::high-entropy-writable-code-section", "crit": "suspicious", "kind": "unless" }, { "by": [ { "id": "metrics" } ], "id": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-text", "crit": "suspicious", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/data/embedded/media::photoshop-xmp-conversion-corpus", "spans": [ [ 5421, 33 ], [ 15951, 128 ] ] } ], "id": "objectives/anti-static/obfuscation/payload/encrypted::vb6-concealed-high-entropy-dispatch", "crit": "suspicious", "kind": "unless" }, { "by": [ { "id": "metadata/binary/resource/identity::pe-resource-group-icon-list", "spans": [ [ 184320, 20 ] ] }, { "id": "metadata/binary/resource/identity::pe-resource-icon-list", "spans": [ [ 184320, 20 ] ] }, { "id": "metadata/binary/resource/identity::rich-header-present", "spans": [ [ 184320, 20 ] ] }, { "id": "metadata/binary/resource/size::large-rsrc-section", "spans": [ [ 184320, 20 ] ] }, { "id": "metadata/binary/resource/size::pe-few-resource-entries", "spans": [ [ 184320, 20 ] ] } ], "id": "metadata/binary/section/ratio::few-sections", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "basename" } ], "id": "metadata/file/naming::opaque-identifier-pe-basename", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/fs/write/file/handle::vb6-put-owner3", "spans": [ [ 4202, 12 ] ] } ], "id": "micro-behaviors/fs/write/file/handle::vb6-put-owner3-text", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/resource/identity::pe-resource-group-icon-list", "spans": [ [ 184320, 20 ] ] }, { "id": "metadata/binary/resource/identity::pe-resource-icon-list", "spans": [ [ 184320, 20 ] ] }, { "id": "metadata/binary/resource/identity::rich-header-present", "spans": [ [ 184320, 20 ] ] }, { "id": "metadata/binary/resource/size::large-rsrc-section", "spans": [ [ 184320, 20 ] ] }, { "id": "metadata/binary/resource/size::pe-few-resource-entries", "spans": [ [ 184320, 20 ] ] } ], "id": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/framework::vb6-runtime-core-helper", "spans": [ [ 568, 12 ], [ 4192, 17 ], [ 4220, 18 ], [ 4224, 11 ], [ 4236, 25 ], [ 4242, 16 ] ] }, { "id": "metadata/binary/framework::vb6-runtime-event-helper", "spans": [ [ 568, 12 ], [ 4192, 17 ], [ 4220, 18 ], [ 4224, 11 ], [ 4236, 25 ], [ 4242, 16 ] ] }, { "id": "metadata/binary/framework::vb6-application-framework", "spans": [ [ 568, 12 ], [ 4192, 17 ], [ 4220, 18 ], [ 4224, 11 ], [ 4236, 25 ], [ 4242, 16 ] ] } ], "id": "objectives/anti-static/obfuscation/payload/resource::large-icon-resource", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "section", "spans": [ [ 184320, 20 ] ] } ], "id": "objectives/anti-static/obfuscation/payload/section::low-code-to-data-ratio-pe", "crit": "notable", "kind": "unless" } ], "type": "pe", "facts": { "imp": [ [ "msvbvm60", "CIcos" ], [ "msvbvm60", "adj_fptan" ], [ "msvbvm60", "vbaVarMove" ], [ "msvbvm60", "vbaFreeVar" ], [ "msvbvm60", "ORDINAL 588" ], [ "msvbvm60", "vbaFreeVarList" ], [ "msvbvm60", "vbaEnd" ], [ "msvbvm60", "adj_fdiv_m64" ], [ "msvbvm60", "vbaFreeObjList" ], [ "msvbvm60", "adj_fprem1" ], [ "msvbvm60", "vbaStrCat" ], [ "msvbvm60", "vbaSetSystemError" ], [ "msvbvm60", "vbaHresultCheckObj" ], [ "msvbvm60", "adj_fdiv_m32" ], [ "msvbvm60", "vbaAryDestruct" ], [ "msvbvm60", "ORDINAL 593" ], [ "msvbvm60", "ORDINAL 594" ], [ "msvbvm60", "vbaOnError" ], [ "msvbvm60", "vbaObjSet" ], [ "msvbvm60", "adj_fdiv_m16i" ], [ "msvbvm60", "adj_fdivr_m16i" ], [ "msvbvm60", "CIsin" ], [ "msvbvm60", "vbaChkstk" ], [ "msvbvm60", "vbaFileClose" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "vbaGenerateBoundsError" ], [ "msvbvm60", "vbaPutOwner3" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "adj_fpatan" ], [ "msvbvm60", "vbaRedim" ], [ "msvbvm60", "vbaStrR8" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "ORDINAL 600" ], [ "msvbvm60", "vbaUI1I2" ], [ "msvbvm60", "CIsqrt" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "adj_fprem" ], [ "msvbvm60", "adj_fdivr_m64" ], [ "msvbvm60", "vbaFPException" ], [ "msvbvm60", "vbaGetOwner3" ], [ "msvbvm60", "vbaUbound" ], [ "msvbvm60", "vbaStrVarVal" ], [ "msvbvm60", "vbaVarCat" ], [ "msvbvm60", "CIlog" ], [ "msvbvm60", "vbaErrorOverflow" ], [ "msvbvm60", "vbaFileOpen" ], [ "msvbvm60", "vbaNew2" ], [ "msvbvm60", "ORDINAL 570" ], [ "msvbvm60", "vbaR8Str" ], [ "msvbvm60", "adj_fdiv_m32i" ], [ "msvbvm60", "adj_fdivr_m32i" ], [ "msvbvm60", "vbaFreeStrList" ], [ "msvbvm60", "adj_fdivr_m32" ], [ "msvbvm60", "adj_fdiv_r" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "vbaI4Var" ], [ "msvbvm60", "vbaVarMod" ], [ "msvbvm60", "CIatan" ], [ "msvbvm60", "vbaStrMove" ], [ "msvbvm60", "allmul" ], [ "msvbvm60", "CItan" ], [ "msvbvm60", "vbaFPInt" ], [ "msvbvm60", "vbaUI1Var" ], [ "msvbvm60", "CIexp" ], [ "msvbvm60", "vbaFreeStr" ], [ "msvbvm60", "vbaFreeObj" ] ], "sec": [ [ ".text", 4096, 176128, 7.57, "rw-" ], [ ".data", 4026712064, 4096, 0.0, "rw-" ], [ ".rsrc", 184320, 294912, 2.46, "r--" ] ], "metrics": { "pe": { "checksum": 513757, "timestamp": 1547904896, "icon_count": 2, "image_size": 479232, "headers_size": 4096, "checksum_valid": 0, "file_alignment": 4096, "resource_count": 3, "has_version_info": 1, "computed_checksum": 516148, "bound_import_count": 1, "headers_size_ratio": 0.01, "prose_section_count": 0, "bss_like_section_count": 0, "section_overflow_count": 1, "misaligned_section_count": 0, "bound_imports_fingerprint": 1243922264, "entry_in_writable_section": 1, "declared_data_directory_count": 4, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 479263, "entropy": 4.86 }, "binary": { "is_pie": 0, "data_entropy": 7.4, "string_count": 315, "entropy_variance": 9.94, "avg_string_length": 15.88, "max_string_length": 1994, "peak_region_bytes": 114688, "code_to_data_ratio": 0, "peak_region_entropy": 7.77, "string_length_stddev": 111.87, "largest_section_ratio": 0.62, "sentence_string_count": 11, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0 }, "imports": { "count": 67 }, "strings": { "truncated": 0, "retained_count": 315, "extracted_count": 315 }, "sections": { "count": 3, "entropy_max": 7.57, "entropy_mean": 3.34, "name_entropy": 3.01, "writable_count": 2, "executable_count": 0, "nonstandard_count": 0, "executable_writable_count": 0 }, "dependencies": { "count": 1 } } }, "ident": { "trust": "unsigned", "organization": { "value": "UEFI", "source": "pe.version.company", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::vb6-runtime-core-helper", "conf": 0.94, "crit": 3, "desc": "VB6 runtime helper import symbol", "spans": [ [ 4242, 16 ] ] }, { "id": "metadata/binary/framework::vb6-runtime-event-helper", "conf": 0.92, "crit": 3, "desc": "VB6 event sink import symbol", "spans": [ [ 4192, 17 ], [ 4220, 18 ], [ 4236, 25 ] ] }, { "id": "metadata/binary/layout/checksum::pe-checksum-populated", "conf": 1.0, "crit": 2, "desc": "PE checksum field holds a non-zero value" }, { "id": "metadata/binary/layout/entropy::high-entropy-64k-region", "conf": 1.0, "crit": 3, "desc": "Binary has a high-entropy 64 KiB region" }, { "id": "metadata/binary/layout/entropy::low-overall-entropy-binary", "conf": 0.9, "crit": 2, "desc": "Binary has low overall entropy" }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/symbols/imports::ordinal-import-600", "conf": 0.9, "crit": 3, "desc": "PE imports ordinal 600 by number", "spans": [ [ 4224, 11 ] ] }, { "id": "metadata/build/artifact::pe-bound-imports-present", "conf": 0.9, "crit": 3, "desc": "PE carries bound import descriptors" }, { "id": "metadata/file/data-blob::concealed-payload-mass-8k", "conf": 0.85, "crit": 2, "desc": "High-entropy region mass over 8KB" }, { "id": "metadata/file/data-blob::peak-region-cipher-entropy", "conf": 0.85, "crit": 2, "desc": "1KB region has high entropy", "spans": [ [ 82944, 73728 ] ] }, { "id": "metadata/file/extension/executable::exe", "conf": 1.0, "crit": 2, "desc": "Windows executable extension" }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/string/identity::jfif-or-jpeg-media-marker", "conf": 0.82, "crit": 3, "desc": "References JFIF or the JPEG media type", "spans": [ [ 16001, 10 ] ] }, { "id": "metadata/lang/compiler/native::ms-visual", "conf": 0.9, "crit": 3, "desc": "Microsoft Visual string", "spans": [ [ 170256, 59 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 477282, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 477390, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 477482, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 477434, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 477130, 0 ] ] }, { "id": "micro-behaviors/data/embedded/media::photoshop-cc-2018-metadata", "conf": 0.9, "crit": 2, "desc": "Embedded Photoshop CC 2018 image metadata", "spans": [ [ 5421, 0 ], [ 15951, 0 ] ] }, { "id": "micro-behaviors/data/embedded/media::photoshop-xmp-history-agent", "conf": 0.9, "crit": 2, "desc": "Embedded XMP history names Photoshop CC 2018", "spans": [ [ 15951, 0 ] ] }, { "id": "micro-behaviors/data/embedded/media::xmp-png-jpeg-derivation", "conf": 0.9, "crit": 2, "desc": "Embedded XMP records PNG to JPEG conversion", "spans": [ [ 15951, 0 ] ] }, { "id": "micro-behaviors/data/string/runtime::vb6-string-construction-cat", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "VB6 __vbaVarCat string concatenation", "spans": [ [ 4270, 9 ] ] }, { "id": "micro-behaviors/dylib/load/runtime::vb6-runtime-dll-reference", "conf": 0.98, "crit": 3, "desc": "MSVBVM60.DLL runtime reference", "spans": [ [ 568, 12 ] ] }, { "id": "micro-behaviors/dylib/lookup::vb6-dll-function-call-symbol", "conf": 0.94, "crit": 3, "desc": "VB6 named DLL call thunk import", "spans": [ [ 4204, 15 ] ] }, { "id": "micro-behaviors/fs/file/open::vb6-file-open", "conf": 0.93, "crit": 2, "desc": "VB6 runtime file open helper", "spans": [ [ 4282, 0 ] ] }, { "id": "micro-behaviors/fs/file/rename::cmd-rename-quoted-target", "conf": 0.97, "crit": 3, "desc": "Embedded cmd rename with quoted source", "spans": [ [ 170888, 15 ] ] }, { "id": "micro-behaviors/fs/file/rename::utf16-cmd-rename-quoted-target", "conf": 0.97, "crit": 3, "desc": "UTF-16 cmd rename with quoted source", "spans": [ [ 170888, 44 ] ] }, { "id": "micro-behaviors/fs/path/extension::die-extension-marker", "conf": 0.98, "crit": 1, "desc": "References a .die filename extension", "spans": [ [ 170944, 0 ] ] }, { "id": "micro-behaviors/fs/path/extension::utf16-exe-suffix-token", "conf": 0.84, "crit": 3, "desc": "UTF-16 exe filename suffix token", "spans": [ [ 170770, 17 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::vb6-get-owner3", "conf": 0.95, "crit": 2, "desc": "VB6 runtime binary file read", "spans": [ [ 4258, 0 ] ] }, { "id": "micro-behaviors/fs/write/file/handle::vb6-put-owner3", "conf": 0.95, "crit": 3, "desc": "VB6 runtime binary file write", "spans": [ [ 4202, 12 ] ] }, { "id": "micro-behaviors/os/random/generator::vb6-ordinal-random-next", "conf": 0.9, "crit": 3, "desc": "VB6 ordinal random-number helper", "spans": [ [ 4156, 11 ] ] }, { "id": "micro-behaviors/os/random/generator::vb6-ordinal-randomize", "conf": 0.9, "crit": 3, "desc": "VB6 ordinal randomize helper", "spans": [ [ 4160, 11 ] ] }, { "id": "micro-behaviors/process/create/shell/command-mode::windows-command-shell-invocation", "atk": "T1059.001,T1059.003", "conf": 0.94, "crit": 3, "desc": "Windows shell command-mode invocation syntax", "spans": [ [ 170888, 6 ] ] }, { "id": "micro-behaviors/process/create/shell/script-host::cmd-exe-c-command", "conf": 0.85, "crit": 3, "desc": "Runs commands through cmd.exe /c", "spans": [ [ 170888, 6 ] ] }, { "id": "micro-behaviors/time/schedule/interval::timer1-control-marker", "conf": 0.82, "crit": 1, "desc": "Timer1 control identifier in PE resources", "spans": [ [ 168210, 0 ] ] }, { "id": "micro-behaviors/ui/window/control::get-window-long-ansi", "conf": 0.9, "crit": 3, "desc": "GetWindowLongA ANSI window-style query API", "spans": [ [ 170540, 14 ] ] }, { "id": "micro-behaviors/ui/window/region::set-layered-window-attributes", "conf": 0.9, "crit": 3, "desc": "set layered window attributes", "spans": [ [ 170456, 26 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "conf": 0.8, "crit": 3, "desc": "Large PE resource section (\u003e150KB)", "spans": [ [ 184320, 20 ] ] }, { "id": "objectives/evasion/anti-av/code-padding::small-code-section-in-large-pe", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Small code section in large PE", "spans": [ [ 4096, 20 ] ] }, { "id": "well-known/malware/virus/kawaii-unicorn::kawaii-unicorn-executable-name", "conf": 0.995, "crit": 3, "desc": "Kawaii-Unicorn executable filename marker", "spans": [ [ 477580, 35 ] ] }, { "id": "well-known/malware/virus/kawaii-unicorn::kawaii-unicorn-product", "conf": 0.995, "crit": 3, "desc": "Kawaii-Unicorn embedded product marker", "spans": [ [ 168540, 14 ] ] }, { "id": "well-known/malware/virus/kawaii-unicorn::kawaii-unicorn-replica-prefix", "conf": 0.995, "crit": 3, "desc": "Kawaii-Unicorn replica filename prefix", "spans": [ [ 170828, 53 ] ] }, { "id": "metadata/binary/layout/checksum::pe-checksum-content-invalid", "conf": 1.0, "crit": 2, "desc": "PE checksum does not match content" }, { "id": "metadata/binary/section/header::pe-entry-in-writable-section", "conf": 0.95, "crit": 3, "desc": "PE entry point in writable section" }, { "id": "metadata/binary/section/permission::writable-text-section", "conf": 0.92, "crit": 4, "desc": "Writable .text section", "spans": [ [ 4096, 47 ] ] }, { "id": "metadata/binary/section/ratio::pe-no-executable-sections", "conf": 0.95, "crit": 3, "desc": "PE has no executable sections" }, { "id": "metadata/binary/section/ratio::pe-section-overflow-present", "conf": 0.9, "crit": 3, "desc": "PE section extends beyond file" }, { "id": "metadata/lang/encoded/wide::shell-interpreter-cmd", "conf": 0.95, "crit": 1, "desc": "cmd interpreter marker encoded", "spans": [ [ 170888, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 477326, 11 ] ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 3, "desc": "PE lacks signature record" }, { "id": "micro-behaviors/fs/path/extension::exe-name-or-extension", "conf": 0.5, "crit": 1, "desc": "References a Windows .exe filename or extension", "spans": [ [ 477594, 0 ] ] }, { "id": "micro-behaviors/ui/window/control::set-window-long-ansi", "conf": 0.9, "crit": 3, "desc": "SetWindowLongA ANSI window-style update API", "spans": [ [ 170612, 14 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::code-data-ratio-below-008", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "PE code-to-data ratio below 0.08" }, { "id": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "atk": "T1055", "conf": 0.85, "crit": 3, "desc": "Large null run in executable (64+ bytes)", "spans": [ [ 168611, 191 ] ] }, { "id": "metadata/binary/framework::vb6-application-framework", "conf": 0.95, "crit": 2, "desc": "Visual Basic 6 application framework", "uses": [ 0, 1, 6, 23 ], "spans": [ [ 568, 0 ], [ 4192, 0 ], [ 4220, 0 ], [ 4224, 0 ], [ 4236, 0 ], [ 4242, 0 ] ] }, { "id": "micro-behaviors/data/embedded/media::photoshop-xmp-conversion-corpus", "conf": 0.92, "crit": 3, "desc": "Embedded Photoshop XMP conversion metadata", "uses": [ 19, 20, 21 ], "spans": [ [ 5421, 33 ], [ 15951, 128 ] ] }, { "id": "micro-behaviors/fs/file/rename::cmd-target-die-extension-rename", "conf": 0.995, "crit": 4, "desc": "Embedded cmd rename changes a target to the .die extension", "uses": [ 26, 27, 28 ], "spans": [ [ 170888, 44 ], [ 170944, 4 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::vb6-record-file-read", "conf": 0.96, "crit": 3, "desc": "VB6 opens and reads file records", "uses": [ 25, 30 ], "spans": [ [ 4258, 12 ], [ 4282, 11 ] ] }, { "id": "micro-behaviors/fs/write/file/handle::vb6-binary-file-write", "conf": 0.95, "crit": 3, "desc": "VB6 runtime opens and writes file", "uses": [ 25, 31 ], "spans": [ [ 4202, 12 ], [ 4282, 11 ] ] }, { "id": "micro-behaviors/process/create/macro/office::vb6-shell-execution", "conf": 0.95, "crit": 3, "desc": "VB6 shell execution primitive", "uses": [ 6, 23 ], "spans": [ [ 568, 12 ], [ 4224, 11 ] ] }, { "id": "well-known/malware/virus/kawaii-unicorn::kawaii-unicorn-identity", "conf": 0.998, "crit": 3, "desc": "Kawaii-Unicorn family identity", "uses": [ 41, 42, 43 ], "spans": [ [ 168540, 14 ], [ 170828, 53 ], [ 477580, 35 ] ] }, { "id": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "conf": 0.96, "crit": 3, "desc": "VB6 DLL function call thunk", "uses": [ 24, 56 ], "spans": [ [ 568, 12 ], [ 4192, 17 ], [ 4204, 15 ], [ 4220, 18 ], [ 4224, 11 ], [ 4236, 25 ], [ 4242, 16 ] ] }, { "id": "micro-behaviors/dylib/lookup::vb6-runtime-api-dispatch", "conf": 0.95, "crit": 3, "desc": "VB6 runtime API dispatch", "uses": [ 0, 56 ], "spans": [ [ 568, 12 ], [ 4192, 17 ], [ 4220, 18 ], [ 4224, 11 ], [ 4236, 25 ], [ 4242, 16 ] ] }, { "id": "micro-behaviors/time/schedule/interval::vb6-timer-control", "conf": 0.82, "crit": 3, "desc": "VB6 Timer1 control marker", "uses": [ 36, 56 ], "spans": [ [ 568, 12 ], [ 4192, 17 ], [ 4220, 18 ], [ 4224, 11 ], [ 4236, 25 ], [ 4242, 16 ], [ 168210, 6 ] ] }, { "id": "objectives/impact/destroy/file-rename::shell-rename-to-die-extension", "atk": "T1565.001", "conf": 0.97, "crit": 5, "desc": "Executes shell commands renaming files to .die", "uses": [ 34, 35, 58 ], "spans": [ [ 170888, 44 ], [ 170944, 4 ] ] }, { "id": "well-known/malware/virus/kawaii-unicorn::vb6-kawaii-polymorphic-self-replication", "atk": "T1027", "conf": 0.999, "crit": 5, "desc": "Kawaii-Unicorn writes randomized executable replicas", "uses": [ 25, 30, 31, 32, 41, 42, 43, 66 ], "spans": [ [ 4156, 11 ], [ 4202, 12 ], [ 4258, 12 ], [ 4282, 11 ], [ 168540, 14 ], [ 170828, 53 ], [ 170888, 6 ], [ 170944, 4 ] ] }, { "id": "metadata/binary/layout/checksum::pe-checksum-mismatch", "conf": 0.95, "crit": 3, "desc": "PE checksum differs from computed content", "uses": [ 2, 44 ] }, { "id": "metadata/file/data-blob::low-entropy-binary-with-dense-region", "conf": 0.9, "crit": 3, "desc": "Low-entropy binary contains dense data region", "uses": [ 4, 8, 9 ], "spans": [ [ 82944, 73728 ] ] }, { "id": "metadata/lang/encoded/wide::shell-interpreter-encoded", "conf": 0.9, "crit": 3, "desc": "Encoded shell interpreter (wide strings)", "uses": [ 49 ], "spans": [ [ 170888, 15 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution capability", "uses": [ 35 ], "spans": [ [ 170888, 6 ] ] }, { "id": "objectives/anti-static/pack/overlay::writable-ep-bound-imports", "atk": "T1027.002", "mbc": "B0032", "conf": 0.92, "crit": 5, "desc": "Writable entry point with bound imports", "uses": [ 7, 45 ] }, { "id": "objectives/anti-static/pack/overlay::writable-ep-vb6-shell", "atk": "T1027.002,T1059", "mbc": "B0032", "conf": 0.94, "crit": 5, "desc": "Writable-entry VB6 stub shells a payload", "uses": [ 45, 61 ], "spans": [ [ 568, 12 ], [ 4224, 11 ] ] }, { "id": "objectives/anti-static/pack/runtime::writable-ep-no-exec-sections", "conf": 0.94, "crit": 5, "desc": "Writable entry in a PE with no executable sections", "uses": [ 45, 47 ] }, { "id": "objectives/command-and-control/dropper/execution/loader::vb6-shell-exe-drop", "atk": "T1059", "conf": 0.93, "crit": 5, "desc": "VB6 shell dropper stages an exe payload", "uses": [ 29, 61 ], "spans": [ [ 568, 12 ], [ 4224, 11 ], [ 170770, 17 ] ] }, { "id": "objectives/command-and-control/dropper/execution/loader::vb6-shell-file-write", "atk": "T1059,T1105", "conf": 0.93, "crit": 5, "desc": "VB6 shell dropper writes a binary file", "uses": [ 60, 61 ], "spans": [ [ 568, 12 ], [ 4202, 12 ], [ 4224, 11 ], [ 4282, 11 ] ] }, { "id": "objectives/command-and-control/dropper/execution/loader::vb6-write-exe-drop", "atk": "T1105", "conf": 0.93, "crit": 5, "desc": "VB6 file writer stages an exe payload", "uses": [ 29, 60 ], "spans": [ [ 4202, 12 ], [ 4282, 11 ], [ 170770, 17 ] ] }, { "id": "objectives/anti-static/pack/overlay::writable-ep-checksum-mismatch", "atk": "T1027.002", "mbc": "B0032", "conf": 0.93, "crit": 5, "desc": "Writable entry point with invalid PE checksum", "uses": [ 45, 68 ] } ] } ] } }