{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.5419355, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T09:43:00Z" }, "path": "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 1566205.0, "checksum_valid": 1.0, "computed_checksum": 1566205.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 1528520.0, "entropy": 4.88, "size_bytes": 1528520.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 4.87, "overlay_size": 6344.0, "string_count": 9750.0, "overlay_ratio": 0.0, "overlay_entropy": 7.51, "entropy_variance": 5.68, "avg_string_length": 4.61, "max_string_length": 90.0, "code_to_data_ratio": 1.0, "string_length_stddev": 4.95, "largest_section_ratio": 1.0, "sentence_string_count": 8.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 1521152.0, "entropy_max": 4.87, "entropy_mean": 2.48, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 266478, "u8", "% sh" ], [ 1503408, "u8", "BSJB" ], [ 1505801, "u8", "IEnumerable`1" ], [ 1505815, "u8", "IEnumerator`1" ], [ 1505829, "u8", "Int32" ], [ 1505835, "u8", "ToInt64" ], [ 1505843, "u8", "\u003cModule\u003e" ], [ 1505852, "u8", "FindSymbolByRVA" ], [ 1505868, "u8", "FindLinesByRVA" ], [ 1505883, "u8", "FILETIME" ], [ 1505892, "u8", "System.IO" ], [ 1505902, "u8", "CreateUrlCacheEntryW" ], [ 1505923, "u8", "CommitUrlCacheEntryW" ], [ 1505944, "u8", "Internal.StackGenerator.Dia" ], [ 1505972, "u8", "LoadDataFromPdb" ], [ 1505988, "u8", "Daabbfdebbaedcbdcaedbddeeeb" ], [ 1506016, "u8", "mscorlib" ], [ 1506025, "u8", "System.Collections.Generic" ], [ 1506052, "u8", "Microsoft.VisualBasic" ], [ 1506074, "u8", "Thread" ], [ 1506081, "u8", "Load" ], [ 1506086, "u8", "Guid" ], [ 1506091, "u8", "Append" ], [ 1506098, "u8", "GetDataKind" ], [ 1506110, "u8", "CoCreateInstance" ], [ 1506127, "u8", "GetReference" ], [ 1506140, "u8", "IID_IDiaDataSource" ], [ 1506159, "u8", "HttpStatusCode" ], [ 1506174, "u8", "Invoke" ], [ 1506181, "u8", "IDisposable" ], [ 1506193, "u8", "IDiaSourceFile" ], [ 1506208, "u8", "TryGetFullPathToApplicationModule" ], [ 1506242, "u8", "FileName" ], [ 1506251, "u8", "GetName" ], [ 1506259, "u8", "DateTime" ], [ 1506268, "u8", "WriteLine" ], [ 1506278, "u8", "Combine" ], [ 1506286, "u8", "BasicType" ], [ 1506296, "u8", "UnmanagedType" ], [ 1506310, "u8", "ComInterfaceType" ], [ 1506327, "u8", "ClassInterfaceType" ], [ 1506346, "u8", "GetBaseType" ], [ 1506358, "u8", "GetType" ], [ 1506366, "u8", "get_InvariantCulture" ], [ 1506387, "u8", "MethodBase" ], [ 1506398, "u8", "Dispose" ], [ 1506406, "u8", "Write" ], [ 1506412, "u8", "Byte" ], [ 1506417, "u8", "GetObjectValue" ], [ 1506432, "u8", "Remove" ], [ 1506439, "u8", "Daabbfdebbaedcbdcaedbddeeeb.exe" ], [ 1506471, "u8", "Randomize" ], [ 1506481, "u8", "LastIndexOf" ], [ 1506493, "u8", "GetSymTag" ], [ 1506503, "u8", "System.Threading" ], [ 1506520, "u8", "ToString" ], [ 1506529, "u8", "Substring" ], [ 1506539, "u8", "Debug" ], [ 1506545, "u8", "VBMath" ], [ 1506552, "u8", "Path" ], [ 1506557, "u8", "get_Length" ], [ 1506568, "u8", "GetLength" ], [ 1506578, "u8", "api-ms-win-core-com-l1-1-0.dll" ], [ 1506609, "u8", "IDiaSymbol" ], [ 1506620, "u8", "Item" ], [ 1506625, "u8", "System" ], [ 1506632, "u8", "SymTagEnum" ], [ 1506643, "u8", "TimeSpan" ], [ 1506652, "u8", "FindChildren" ], [ 1506665, "u8", "AppDomain" ], [ 1506675, "u8", "GetDomain" ], [ 1506685, "u8", "IDiaSession" ], [ 1506697, "u8", "OpenSession" ], [ 1506709, "u8", "Application" ], [ 1506721, "u8", "System.Globalization" ], [ 1506742, "u8", "System.Reflection" ], [ 1506760, "u8", "CallingConvention" ], [ 1506778, "u8", "MethodInfo" ], [ 1506789, "u8", "CultureInfo" ], [ 1506801, "u8", "Zero" ], [ 1506806, "u8", "Char" ], [ 1506811, "u8", "IDiaLineNumber" ], [ 1506826, "u8", "ColumnNumber" ], [ 1506839, "u8", "IsNumber" ], [ 1506848, "u8", "IFormatProvider" ], [ 1506864, "u8", "StringBuilder" ], [ 1506878, "u8", "IMessageFilter" ], [ 1506893, "u8", "AddMessageFilter" ], [ 1506910, "u8", "GetModuleFromPointer" ], [ 1506931, "u8", "IEnumerator" ], [ 1506943, "u8", "GetEnumerator" ], [ 1506957, "u8", "System.Private.StackTraceGenerator" ], [ 1506992, "u8", ".ctor" ], [ 1506998, "u8", ".cctor" ], [ 1507005, "u8", "IntPtr" ], [ 1507012, "u8", "DiaSource_CLSIDs" ], [ 1507029, "u8", "System.Diagnostics" ], [ 1507048, "u8", "Guids" ], [ 1507054, "u8", "System.Runtime.InteropServices" ], [ 1507085, "u8", "System.Runtime.CompilerServices" ], [ 1507117, "u8", "GetLoadedModules" ], [ 1507134, "u8", "System.Runtime.InteropServices.ComTypes" ], [ 1507174, "u8", "TypeAttributes" ], [ 1507189, "u8", "get_Ticks" ], [ 1507199, "u8", "IDiaEnumSymbols" ], [ 1507215, "u8", "System.Windows.Forms" ], [ 1507236, "u8", "System.Collections" ], [ 1507255, "u8", "NameSearchOptions" ], [ 1507273, "u8", "get_Chars" ], [ 1507283, "u8", "IDiaEnumLineNumbers" ], [ 1507303, "u8", "RuntimeHelpers" ], [ 1507318, "u8", "Internal.Runtime.Augments" ], [ 1507344, "u8", "RuntimeAugments" ], [ 1507360, "u8", "DoEvents" ], [ 1507369, "u8", "Concat" ], [ 1507376, "u8", "Format" ], [ 1507383, "u8", "Object" ], [ 1507390, "u8", "System.Net" ], [ 1507401, "u8", "CharSet" ], [ 1507409, "u8", "wininet" ], [ 1507417, "u8", "op_Explicit" ], [ 1507429, "u8", "IsLetterOrDigit" ], [ 1507445, "u8", "get_Current" ], [ 1507457, "u8", "get_EntryPoint" ], [ 1507472, "u8", "Count" ], [ 1507478, "u8", "MoveNext" ], [ 1507487, "u8", "System.Text" ], [ 1507499, "u8", "get_Now" ], [ 1507507, "u8", "ToByteArray" ], [ 1507519, "u8", "Assembly" ], [ 1507528, "u8", "set_Capacity" ], [ 1507541, "u8", "op_Equality" ], [ 1507553, "u8", "op_Inequality" ], [ 1507567, "u8", "IsNullOrEmpty" ], [ 1517462, "u8", "a248ddd5-3f5f-465e-b727-dd4a8e96db8d" ], [ 1517536, "u8", "a696ba64-729a-4fc8-9490-ab151af2fc8e" ], [ 1517610, "u8", "0a86c963-7e6d-493d-9ff3-00e98db1638b" ], [ 1517684, "u8", "b5f40d6b-0834-44b2-81da-02af60c5f213" ], [ 1517758, "u8", "9b64d22d-da2e-4575-9014-f8cc0fbffc4e" ], [ 1517832, "u8", "8d962a6e-7b68-4b49-90e5-7853c58cb378" ], [ 1517906, "u8", "55cd2082-8002-4fa7-9ce0-12d2a22ab50e" ], [ 1521534, "u8", "mscoree.dll" ], [ 1522242, "u8", "N0L0" ], [ 1522385, "u8", "Aebebbcaadeacedddccbdbdda1" ], [ 1522421, "u8", "Bbedbdbdceeefabbd1$0\"" ], [ 1522449, "u8", "Dbdfaafffdbbaaabbbaeddcfebf1" ], [ 1522512, "u8", "201215005614Z" ], [ 1522527, "u8", "211215005614Z0" ], [ 1522709, "u8", "E1tkq" ], [ 1522840, "u8", "C0A0" ], [ 1523396, "u8", "YTAVJ" ], [ 1523706, "u8", "20201215005615Z" ], [ 1523754, "u8", "Greater Manchester1" ], [ 1523783, "u8", "Salford1" ], [ 1523801, "u8", "Sectigo Limited1,0*" ], [ 1523826, "u8", "#Sectigo RSA Time Stamping Signer #2" ], [ 1523986, "u8", "Sectigo Limited1%0#" ], [ 1524012, "u8", "Sectigo RSA Time Stamping CA0" ], [ 1524059, "u8", "320122235959Z0" ], [ 1524171, "u8", "#Sectigo RSA Time Stamping Signer #20" ], [ 1524690, "u8", "vIhb" ], [ 1524891, "u8", "90705" ], [ 1524926, "u8", "https://sectigo.com/CPS0D" ], [ 1524967, "u8", "3http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" ], [ 1525048, "u8", "3http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" ], [ 1525114, "u8", "http://ocsp.sectigo.com0" ], [ 1525210, "u8", "WUpKN" ], [ 1525742, "u8", "New Jersey1" ], [ 1525763, "u8", "Jersey City1" ], [ 1525785, "u8", "The USERTRUST Network1.0," ], [ 1525816, "u8", "%USERTrust RSA Certification Authority0" ], [ 1525858, "u8", "190502000000Z" ], [ 1526719, "u8", "I0G0E" ], [ 1526729, "u8", "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" ], [ 1526822, "u8", "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" ], [ 1526888, "u8", "http://ocsp.usertrust.com0" ], [ 1527091, "u8", "mAmg" ], [ 1527558, "u8", "Sectigo RSA Time Stamping CA" ], [ 1527931, "u8", "%USERTrust RSA Certification Authority" ] ], "v": { "file.stem": "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1607993774, "file.basename": "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe", "pe.image_base": 4194304, "pe.image_size": 1540096, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 1529230, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 6344, "pe.image_hash.sha1": "d6c6e9fd321cfcbafccb307e2bcd02fdbe86d7e7", "pe.image_hash.sha256": "73b0332af252767b8c5716f5e46d9dcab17bfd3f5bb802c4d2c9c73c928c7da3", "pe.image_hash.sha384": "385a70f64921d1a131db1cca53f7915c0c32e10c3a791fcee7792c9a4fea1ffcd281a4db10494c571f932c4e32574531", "pe.image_hash.sha512": "d2f58a90ee70d35843da150ab14b5b72224c6c1a9fcde053bada5ae2efaaa974887fdf0bafee4f213441a41a3153ef1c0b235d34e57a58b6f936f670133e5746", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=Dbdfaafffdbbaaabbbaeddcfebf,O=Bbedbdbdceeefabbd,CN=Aebebbcaadeacedddccbdbdda", "pe.signatures[0].serial": "27a782c29faa5c8dfeea0b1114177b15", "pe.signatures[0].subject": "C=US,L=New York,OU=Dbdfaafffdbbaaabbbaeddcfebf,O=Bbedbdbdceeefabbd,CN=Aebebbcaadeacedddccbdbdda", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 1529152, "pe.data_directories[1].rva": 1522176, "pe.data_directories[2].rva": 1531904, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-12-15T00:56:14Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 6344, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-12-15T00:56:14Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "cb32c904e369e344e45af1153ca113805264ae62", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "73b0332af252767b8c5716f5e46d9dcab17bfd3f5bb802c4d2c9c73c928c7da3", "pe.signatures[0].thumbprint_sha256": "a5615d4079ca76c31f774f88dc021fe818f4a8d310166a5866943d8f0680b244", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 1521152, 4.87, "r-x" ], [ ".reloc", 1521664, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 1528520, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x16f0b0" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x16f0b0" ] }, { "c": 1.0, "d": "Authenticode chain CN: Aebebbcaadeacedddccbdbdda", "e": [ "Aebebbcaadeacedddccbdbdda" ], "i": "metadata/signed/unknown::aebebbcaadeacedddccbdbdda", "l": 2 }, { "c": 1.0, "d": "Signed by Bbedbdbdceeefabbd", "e": [ "Bbedbdbdceeefabbd" ], "i": "metadata/signed/leaf::bbedbdbdceeefabbd", "l": 3 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices.ComTypes", "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x16ff3e", "0x16feee" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x16fdb6" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025", "el": [ "0x16fe30" ] }, { "c": 0.7200000286102295, "d": "Path combination helper token", "e": [ "Combine" ], "i": "micro-behaviors/fs/temp/directory::path-combine-token", "l": 1, "el": [ "0x16fbe6" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x16fd12" ] }, { "c": 0.699999988079071, "d": "Assembly entry point resolution", "e": [ "get_EntryPoint" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-entrypoint", "l": 1, "el": [ "0x170081" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1, "el": [ "0x16fd69" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 9750.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x16fae0" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 9750.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8199999928474426, "d": "AppDomain GetDomain token", "e": [ "GetDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-getdomain-token", "l": 1, "el": [ "0x16fd73" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x1389" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1.0," ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "0x174819" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x17377e" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x16ff8f" ] }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1, "el": [ "0x16fb7e" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x16ff8f" ] }, { "c": 0.6000000238418579, "d": "MethodBase class reference", "e": [ "MethodBase" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-methodbase-token", "l": 1, "el": [ "0x16fc53" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x16fc87" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x1c1e" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "0x16fed5" ] }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 9750.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xb54" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 9750.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO", "System.Net" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x16fa64", "0x17003e" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "GetObjectValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x16fc71" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "55cd2082-8002-4fa7-9ce0-12d2a22ab50e", "b5f40d6b-0834-44b2-81da-02af60c5f213", "9b64d22d-da2e-4575-9014-f8cc0fbffc4e", "a248ddd5-3f5f-465e-b727-dd4a8e96db8d", "8d962a6e-7b68-4b49-90e5-7853c58cb378", "0a86c963-7e6d-493d-9ff3-00e98db1638b", "a696ba64-729a-4fc8-9490-ab151af2fc8e" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030", "el": [ "0x172952", "0x172874", "0x1728be", "0x172796", "0x172908", "0x17282a", "0x1727e0" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringBuilder", "Substring", "ToString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x16fe30", "0x16fce1", "0x16fcd8" ] }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "0x16fb21" ] }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x16fb04" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.949999988079071, "d": "PE has exactly two sections", "e": [ "sections.count = 2.00" ], "i": "well-known/malware/virus/virlock::two-section-layout", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 9750.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 1521152, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027.007", "c": 0.75, "d": "DJB2 hash algorithm constant (5381)", "e": [ "05 15 00 00" ], "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "l": 1, "m": "B0032.014", "el": [ "0xb993" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x16fc87" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "TryGetFullPathToApplicationModule", "StackTraceGenerator", "GetModuleFromPointer", "SectigoRSATimeStampingCA", "CommitUrlCacheEntryW", "CreateUrlCacheEntryW" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x16fba0", "0x16fe8d", "0x16fe5e", "0x1744e7", "0x16fa83", "0x16fa6e" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "CreateUrlCacheEntryW", "CommitUrlCacheEntryW" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "0x16fa6e", "0x16fa83" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc", "path": "54fc260d5b0b1258f3b6fdd43f30e1976a763f45c7f6b3c62406a1355c101bbc.exe", "type": "pe" } ], "tv": "52045" } }