{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.89994407, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T19:40:11Z" }, "path": "22266", "raw": { "v": "4", "fs": [ { "f": "KO₄(As₅C₄Er₂I)H₂(CmOs)Md₂(Bi₅He)", "x": 81, "id": 0, "is": [ "p__commode", "p__fmode", "set_app_type", "controlfp", "cexit", "adjust_fdiv", "except_handler3", "XcptFilter", "exit", "c_exit", "setusermatherr", "initterm", "getmainargs", "initenv", "write", "strchr", "puts", "exit", "FormatMessageA", "LocalFree", "GetModuleHandleA", "GetLastError", "CharToOemBuffA", "gethostname", "WSAStartup", "s_perror" ], "ms": { "binary": { "code_size": 33792.0, "file_size": 35328.0, "wx_sections": 1.0, "import_count": 26.0, "string_count": 91.0, "section_count": 4.0, "avg_complexity": 4.33, "function_count": 6.0, "import_density": 0.79, "max_complexity": 9.0, "string_density": 2.76, "overall_entropy": 7.48, "avg_basic_blocks": 7.83, "avg_section_size": 8576.0, "function_density": 0.18, "avg_function_size": 135.17, "avg_string_length": 21.01, "complexity_per_kb": 0.13, "max_string_length": 97.0, "wide_string_count": 54.0, "writable_sections": 3.0, "avg_string_entropy": 3.31, "code_section_ratio": 0.5, "code_to_data_ratio": 66.0, "data_to_file_ratio": 0.01, "rsrc_to_file_ratio": 0.9, "text_to_file_ratio": 0.06, "total_basic_blocks": 47.0, "executable_sections": 2.0, "section_name_entropy": 3.3, "string_length_stddev": 15.74, "largest_section_ratio": 0.9, "sentence_string_count": 34.0, "sentence_string_ratio": 0.37, "function_analysis_depth": 2.0, "has_malformed_structure": true, "normalized_import_count": 0.14, "normalized_section_count": 0.26, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 424, ".text" ], [ 504, ".rsrc" ], [ 544, "tsheszc" ], [ 640, "msvcrt.dll" ], [ 651, "KERNEL32.dll" ], [ 664, "NTDLL.DLL" ], [ 674, "USER32.dll" ], [ 685, "WS2_32.dll" ], [ 696, "MSWSOCK.dll" ], [ 1212, "NB10" ], [ 1228, "hostname.pdb" ], [ 1355, "89.106.1.235:89" ], [ 1400, "211.133.219.116:235" ], [ 2658, "exit" ], [ 2684, "_c_exit" ], [ 2702, "_XcptFilter" ], [ 2716, "_cexit" ], [ 2726, "__initenv" ], [ 2738, "__getmainargs" ], [ 2754, "_initterm" ], [ 2766, "__setusermatherr" ], [ 2786, "_adjust_fdiv" ], [ 2802, "__p__commode" ], [ 2818, "__p__fmode" ], [ 2832, "__set_app_type" ], [ 2862, "_controlfp" ], [ 2876, "_except_handler3" ], [ 2896, "GetLastError" ], [ 2912, "GetModuleHandleA" ], [ 2946, "CharToOemBuffA" ], [ 2988, "_write" ], [ 2998, "LocalFree" ], [ 3010, "FormatMessageA" ], [ 3028, "s_perror" ], [ 3750, "wide", "VS_VERSION_INFO" ], [ 3842, "wide", "StringFileInfo" ], [ 3902, "wide", "CompanyName" ], [ 3928, "wide", "Microsoft Corporation" ], [ 3978, "wide", "FileDescription" ], [ 4012, "wide", "Hostname APP" ], [ 4046, "wide", "FileVersion" ], [ 4072, "wide", "5.1.2600.0 (xpclient.010817-1148)" ], [ 4146, "wide", "InternalName" ], [ 4172, "wide", "hostname.exe" ], [ 4206, "wide", "LegalCopyright" ], [ 4236, "wide", "© Microsoft Corporation. All rights reserved." ], [ 4334, "wide", "OriginalFilename" ], [ 4402, "wide", "ProductName" ], [ 4428, "wide", "Microsoft® Windows® Operating System" ], [ 4510, "wide", "ProductVersion" ], [ 4570, "wide", "VarFileInfo" ], [ 4602, "wide", "Translation" ], [ 4784, "wide", "poll failed%0" ], [ 4820, "wide", "Timeout occurred" ], [ 4864, "wide", "t_look returned %1!d!" ], [ 4916, "wide", "The network is down" ], [ 4964, "wide", "Not super user" ], [ 5004, "wide", "GATE Table alloc error%0" ], [ 5064, "wide", "GATE Table read error%0" ], [ 5120, "wide", "Smart Gateway: %1%0" ], [ 5176, "wide", "Network Address Gateway Address Redirect Life" ], [ 5384, "wide", "Unable to alloc conn block" ], [ 5448, "wide", "Server port %1!d! in use!" ], [ 5508, "wide", "Unable to allocate packet" ], [ 5568, "wide", "%1 packet, foreign host %2, foreign port %3!d!:" ], [ 5676, "wide", "Contents in hex bytes and characters:" ], [ 5764, "wide", "Unable to open connection" ], [ 5824, "wide", "Unable to fork daemon" ], [ 5876, "wide", "Received bad packet. Length = %1!d!" ], [ 5956, "wide", "Received bad opcode. Opcode = %1!d!" ], [ 6036, "wide", "Error on server : %1" ], [ 6088, "wide", "Received packet with unexpected block number. Block number = %1!d!" ], [ 6232, "wide", "Received bad initial opcode. Opcode = %1!d!" ], [ 6328, "wide", "Bad transfer mode '%1' specified" ], [ 6404, "wide", "Option %1!c! is not valid" ], [ 6464, "wide", "Option %1!c! requires an additional argument" ], [ 6564, "wide", "error getting console input handle, code %1!d!" ], [ 6672, "wide", "error getting console output handle, code %1!d!" ], [ 6780, "wide", "error getting console mode, code %1!d!" ], [ 6872, "wide", "error setting console mode, code %1!d!" ], [ 6964, "wide", "Write to ConsoleOut error == %1!ld!" ], [ 7044, "wide", "Read from ConsoleIn error == %1!ld!" ], [ 7124, "wide", "error restoring console mode, code %1!d!" ], [ 7216, "wide", "Prints the name of the current host.\r\n\r\nhostname" ], [ 7332, "wide", "sethostname%0" ], [ 7368, "wide", "gethostname%0" ], [ 7404, "wide", "hostname: WSAStartup:%0" ], [ 7460, "wide", "sethostname: Use the Network Control Panel Applet to set hostname.\r\nhostname -s is not supported." ], [ 28837, "8.557" ], [ 32712, "WYLB" ] ], "sz": 35328, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE header too corrupted to parse: Malformed entity: Resource directory offset (0xe00) out of bounds", "e": [ "Malformed entity: Resource directory offset (0xe00) out of bounds" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 0.949999988079071, "d": "Random low-entropy RWX cavity section", "e": [ ".rsrc (size: 31744, entropy: 0.00, perms: -rwx)" ], "i": "metadata/binary/section/metrics::random-rwx-cavity-section", "l": 4 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.function_count = 6.00" ], "i": "metadata/binary/metrics::few-functions", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Uses internet communication API imports", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/http::has-internet-communication-apis", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "© Microsoft Corporation. All rights reserved.", "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/dll/task-scheduler::microsoft-company-string", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.33" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.31" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "hostname.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 0.00" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 7.48" ], "i": "objectives/command-and-control/dropper/staging::high-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 1.0, "d": "String claiming to be Microsoft Corporation", "e": [ "Microsoft Corporation", "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/identity/vendor::microsoft-corporation-string", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 35328.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 1.0, "d": "WSAStartup import", "e": [ "WSAStartup" ], "i": "well-known/malware/trojan/hijack-gen::padodor-wsa-startup-import", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1082", "c": 0.6499999761581421, "d": "Hostname in binary", "e": [ "Hostname" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-string-raw", "l": 1, "m": "E1082" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 26.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "error getting console output handle, code %1!d!" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.37" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1620", "c": 0.8199999928474426, "d": "RegPhantom compact driver size", "e": [ "22266" ], "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size", "l": 1, "m": "B0032" }, { "c": 0.7599999904632568, "d": "Winsock startup API string", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Find character in string", "e": [ "strchr" ], "i": "micro-behaviors/data/string/operations::strchr", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 26.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "a": "T1140", "c": 0.8999999761581421, "d": "Microsoft company string", "e": [ "Microsoft Corporation", "© Microsoft Corporation. All rights reserved." ], "i": "objectives/command-and-control/dropper/staging::microsoft-company-string", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "Initialize Winsock library", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::wsa-startup", "l": 3 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 6.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".rsrc (size: 31744, perms: -rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::wx-sections", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High overall file entropy (likely", "e": [ "binary.overall_entropy = 7.48" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-overall-entropy", "l": 3, "m": "B0032" }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Zero-entropy executable section (carved/packed PE)", "e": [ ".rsrc (size: 31744, entropy: 0.00, perms: -rwx)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::zero-entropy-executable-section", "l": 4, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 26.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "binary.has_malformed_structure = 1.00" ], "i": "metadata/binary/metrics::malformed-pe-structure", "l": 3 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.90" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 35328 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027.002", "c": 0.75, "d": "Small high-entropy section (encrypted stub)", "e": [ ".text (size: 2048, perms: -r-x)" ], "i": "objectives/anti-static/pack/polymorphic::small-encrypted-section", "l": 3, "m": "F0001" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 26.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "links msvcrt.dll (p__commode, p__fmode, set_app_type, controlfp, cexit, ... +13 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (FormatMessageA, LocalFree, GetModuleHandleA, GetLastError)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CharToOemBuffA)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (gethostname, WSAStartup)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSWSOCK.dll (s_perror)", "e": [ "MSWSOCK.dll" ], "i": "metadata/dylib::mswsock/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "ProductVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 } ], "sha": "4b7f19b0ab9e27b2a4ec0461c22ddf564d4c4c9b57e4c57d20dfad9ebe2bc310", "path": "22266", "type": "pe" } ], "tv": "feb13" } }