{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00017314155, "rte": "az", "prob": 0.00017314155 }, { "cls": 0, "raw": 0.0071710944, "rte": "az/native", "prob": 0.0071710944 }, { "cls": 0, "raw": 0.16420071, "rte": "az/pe", "prob": 0.16420071 } ], "prob": 0.00017314155, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0001731415541144088, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T06:34:50Z" }, "path": "55ee934fb234b1f2a35f1a1b9acee59769415ec67b14dca3e96ad706b72a6b28.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000[bJB*4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 3, "d": "PE binary has trailing overlay data", "i": "metadata/binary/layout::has-overlay", "o": 0, "z": 25 } ], "x": true }, { "b": "9-h$snkPA*e(qVI00000ax[)E3%J=k00000LVdX:F(z^KBw@qwwk\u0026Qgr8-]0kVv^+g/KIR8Dl+r5(X]j1xkB5\u003e2hrY^O*hEbVB*B@8iT%00000uJHjTv/=TXvGDKW{w\u003enAuig", "l": 114972, "n": [ { "c": 2, "d": "Memory compare", "i": "micro-behaviors/mem/c-runtime/functions::memcmp", "o": 115040, "z": 6 }, { "c": 2, "d": "Get module handle ANSI", "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "o": 114992, "z": 16 } ], "x": true }, { "b": "mf0sr00000\u003cw=lY00000H/%\u0026WX(]dnPJRx%A-@IAu%iQipfEY0i9Dv-crZDJ7*l$v3r^Gh00000WP9weRD0V$M@Kg/J8Y]VDq$1D+2wAx*/asP)O\u003ck/zDc-rur44bl@:o*el8-K8Du?s@.@}0+2FGy00000QeRf]000", "l": 115200, "n": [ { "c": 3, "d": "Executes file or program via Windows ShellExecute API", "i": "micro-behaviors/process/create/shell/invoke::win-shellexecute", "o": 115220, "z": 13 }, { "c": 2, "d": "Check/uncheck dialog button", "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "o": 115284, "z": 14 }, { "c": 2, "d": "Get window system menu", "i": "micro-behaviors/ui/menu/popup::get-system-menu", "o": 115264, "z": 13 } ], "x": true }, { "b": "crHrHvPSWipfmL$i-(B-X(Y1l/JeaO-8^0uS-Gl4J8{5XL2}+=u@)yf+2!YB\u00268*3X{e?v@[(V1]^F", "l": 115336, "n": [ { "c": 2, "d": "Free COM memory allocation", "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "o": 115352, "z": 13 } ], "x": true }, { "b": "Ll1M)C4CYorbUYDy?rUEk$1:tp!rC#e[w^m001kznO@rmwPQsKB7ol8Acb/jzB1m5uJrVmzbU1/", "l": 151394, "n": [ { "c": 2, "d": "Reference to ADVAPI32.dll", "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "o": 151410, "z": 12 } ], "x": true }, { "b": "y^RSvxK%RIBAhT}CThrfs4MdUpdnbmwnD5Zc\u0026(?HBwls:BYiy5x(mMH001!PlUH4vyEz#KluNw", "l": 152750, "n": [ { "c": 2, "d": "WinInet DLL import name", "i": "micro-behaviors/communications/http/get::wininet-dll-import-name", "o": 152766, "z": 11 } ], "x": true }, { "b": "vp%dsvqG:?vpK7s001$Vm}D^sA=kD0B8$z%zE^Wfq/(C\u0026x(v\u003e?F=OC:lUG[GoMbb^A-Skvb(*qCvrbaOCYVjK1P.9", "l": 152886, "n": [ { "c": 2, "d": "Query process window station", "i": "micro-behaviors/ui/window/station::get-process-window-station", "o": 152902, "z": 23 } ], "x": true }, { "b": "001bwlUG[CxjT!GzGP1Xrz#s:gCQN[y?%7K7xv3lqGcbiB9RUkq!p5wvqYQ(wDkR8lSc(ue[s", "l": 153032, "n": [ { "c": 2, "d": "Reference to USER32.dll", "i": "micro-behaviors/os/module/load::user32-dll-reference", "o": 153048, "z": 10 } ], "x": true }, { "b": "vru0)rbU-AA+w%90015ulVl*Jx(mGWxkNXHzVJvtBw#*@BvyB@wO#P^z!T9hgCS2i8303uz/U", "l": 153202, "n": [ { "c": 2, "d": "Combine GDI regions", "i": "micro-behaviors/ui/window/manage/control::combine-rgn", "o": 153218, "z": 10 } ], "x": true }, { "b": "mSif^mQZdFy?WE4k(:BQlVM:DBy!uYv@$QYzue2:q!p5qA=(CppJy8pCMpIum}D^rvRPE:Bu])bm)]{8ga)9NyYFtMmS0lswk)FzA=k[}Bz1uSzdJXE6AyHsmSJ6Kk(", "l": 153370, "n": [ { "c": 2, "d": "Reference to GDI32.dll", "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "o": 153430, "z": 9 }, { "c": 2, "d": "Create rectangular GDI region", "i": "micro-behaviors/ui/window/manage/control::create-rect-rgn", "o": 153386, "z": 13 } ], "x": true }, { "b": "B]UDOwO=fKCX7xcBy!INq+ftJoFXBRwnD5ZpFshyrA7+fe[w^m001XMnO})GwLu/VBydKHBv*r", "l": 154298, "n": [ { "c": 2, "d": "Reference to SHELL32.dll", "i": "micro-behaviors/os/module/load::shell32-dll-reference", "o": 154314, "z": 11 } ], "x": true }, { "b": "nb${QoAmGY003%ugYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brr\u003c0is7C!C]N", "l": 164166, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 164182, "z": 15 } ], "x": true }, { "b": "wDlPFBo3vZ002E*6954klJz38z2!IPve$fBC(QOtve$cAwDhYg003a3wDl-Jx-ISyaoj!fwDl=", "l": 164342, "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 164358, "z": 11 } ], "x": true }, { "b": "Bo2?Ke=U\u003eK001[S2lj=8mGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up003*nwDlcsyxd]Cwb(Pf002s=5Dz?imGvc5yYF2DrSDXhASydXx-J5Kzu6Up0021VhVLxeaoja@h2]Spec3^", "l": 164414, "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 164430, "z": 15 }, { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 164486, "z": 11 } ], "x": true }, { "b": "aojn0fAq7M001$U3\u0026*qdnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE003TiwDlPFwDl-Jve$xHx-J5K", "l": 164538, "n": [ { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 164554, "z": 12 } ], "x": true }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-T6h00000c\u0026:kE0r", "l": 164624, "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 164640, "z": 9 } ], "x": true }, { "b": "ASx\u003ePA@Vgu002:]6954kpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE003ZkASyaWwDliuzVBUP", "l": 164706, "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 164722, "z": 16 } ], "x": true }, { "b": "BPuaQyYE#C001$U3\u0026*qdpYLIozVBqFBPt[KBo25ove$cAwDhYg003ZkzuaLOwDl-JB]U}JBo31PzVBUP002E*5Dz?ipYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qh#\u003eGfaoja@f-T9iec2", "l": 164818, "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 164834, "z": 11 }, { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 164890, "z": 14 } ], "x": true } ], "mol": "H(Po₂)Md(Bi)", "sha": "55ee934fb234b1f2a35f1a1b9acee59769415ec67b14dca3e96ad706b72a6b28", "fact": { "id": "pe", "imp": [ [ "advapi32", "RevertToSelf" ], [ "advapi32", "LsaQueryTrustedDomainInfoByName" ], [ "imm32", "ImmConfigureIMEW" ], [ "imm32", "ImmGetCandidateListA" ], [ "imm32", "ImmSetCompositionStringW" ], [ "imm32", "ImmGetRegisterWordStyleW" ], [ "imm32", "ImmRegisterWordW" ], [ "imm32", "ImmSetCompositionStringA" ], [ "imm32", "ImmInstallIMEA" ], [ "imm32", "ImmGetOpenStatus" ], [ "imm32", "ImmSetCompositionFontA" ], [ "imm32", "ImmGetIMEFileNameW" ], [ "imm32", "ImmSetCandidateWindow" ], [ "imm32", "ImmIsUIMessageW" ], [ "imm32", "ImmEnumRegisterWordW" ], [ "imm32", "ImmUnregisterWordA" ], [ "imm32", "ImmInstallIMEW" ], [ "imm32", "ImmEscapeA" ], [ "imm32", "ImmGetGuideLineW" ], [ "imm32", "ImmEscapeW" ], [ "imm32", "ImmSetCompositionWindow" ], [ "imm32", "ImmGetDefaultIMEWnd" ], [ "imm32", "ImmGetVirtualKey" ], [ "imm32", "ImmGetCompositionWindow" ], [ "imm32", "ImmAssociateContext" ], [ "imm32", "ImmCreateContext" ], [ "imm32", "ImmGetCandidateWindow" ], [ "imm32", "ImmGetCompositionFontA" ], [ "imm32", "ImmSetConversionStatus" ], [ "imm32", "ImmGetRegisterWordStyleA" ], [ "imm32", "ImmSetStatusWindowPos" ], [ "imm32", "ImmGetConversionListW" ], [ "imm32", "ImmGetDescriptionA" ], [ "imm32", "ImmReleaseContext" ], [ "imm32", "ImmIsUIMessageA" ], [ "imm32", "ImmGetConversionStatus" ], [ "imm32", "ImmGetStatusWindowPos" ], [ "imm32", "ImmUnregisterWordW" ], [ "imm32", "ImmGetDescriptionW" ], [ "imm32", "ImmGetIMEFileNameA" ], [ "imm32", "ImmSetCompositionFontW" ], [ "imm32", "ImmGetConversionListA" ], [ "imm32", "ImmGetGuideLineA" ], [ "imm32", "ImmConfigureIMEA" ], [ "imm32", "ImmGetCandidateListW" ], [ "imm32", "ImmSimulateHotKey" ], [ "imm32", "ImmEnumRegisterWordA" ], [ "imm32", "ImmGetCandidateListCountA" ], [ "imm32", "ImmNotifyIME" ], [ "imm32", "ImmGetContext" ], [ "imm32", "ImmGetCompositionFontW" ], [ "msvcrt", "controlfp" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "p__fmode" ], [ "msvcrt", "p__commode" ], [ "msvcrt", "adjust_fdiv" ], [ "msvcrt", "setusermatherr" ], [ "msvcrt", "initterm" ], [ "msvcrt", "acmdln" ], [ "msvcrt", "exit" ], [ "msvcrt", "XcptFilter" ], [ "msvcrt", "memcmp" ], [ "msvcrt", "except_handler3" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "exit" ], [ "wininet", "FindNextUrlCacheEntryExA" ], [ "user32", "IsDialogMessageA" ], [ "user32", "GetSystemMenu" ], [ "user32", "ChangeMenuA" ], [ "user32", "LoadMenuW" ], [ "user32", "GetDlgItemTextW" ], [ "user32", "GetMenuStringA" ], [ "user32", "CheckDlgButton" ], [ "user32", "GetKBCodePage" ], [ "user32", "CharNextA" ], [ "user32", "IsCharLowerW" ], [ "user32", "GetProcessWindowStation" ], [ "user32", "SendMessageCallbackA" ], [ "user32", "SetMessageQueue" ], [ "user32", "ChangeDisplaySettingsExW" ], [ "user32", "ChangeMenuW" ], [ "rpcrt4", "I_RpcAsyncSetHandle" ], [ "nddeapi", "ORDINAL 607" ], [ "nddeapi", "ORDINAL 611" ], [ "nddeapi", "ORDINAL 610" ], [ "nddeapi", "ORDINAL 503" ], [ "nddeapi", "ORDINAL 606" ], [ "nddeapi", "ORDINAL 511" ], [ "nddeapi", "ORDINAL 510" ], [ "nddeapi", "ORDINAL 512" ], [ "nddeapi", "ORDINAL 506" ], [ "nddeapi", "ORDINAL 500" ], [ "nddeapi", "ORDINAL 602" ], [ "nddeapi", "ORDINAL 612" ], [ "nddeapi", "ORDINAL 613" ], [ "nddeapi", "ORDINAL 603" ], [ "nddeapi", "ORDINAL 609" ], [ "gdi32", "SetTextJustification" ], [ "gdi32", "PtInRegion" ], [ "gdi32", "ColorMatchToTarget" ], [ "gdi32", "CombineRgn" ], [ "gdi32", "GetTextExtentPoint32W" ], [ "gdi32", "CloseEnhMetaFile" ], [ "gdi32", "DrawEscape" ], [ "gdi32", "GetPath" ], [ "gdi32", "GetDCOrgEx" ], [ "gdi32", "GetNearestPaletteIndex" ], [ "gdi32", "FillRgn" ], [ "gdi32", "DPtoLP" ], [ "gdi32", "EnumFontFamiliesA" ], [ "gdi32", "CreateRectRgn" ], [ "gdi32", "SetBrushOrgEx" ], [ "gdi32", "GetObjectA" ], [ "gdi32", "ExtCreateRegion" ], [ "gdi32", "CopyMetaFileA" ], [ "gdi32", "GetFontLanguageInfo" ], [ "ole32", "OleIsCurrentClipboard" ], [ "ole32", "OleDuplicateData" ], [ "ole32", "CoGetStandardMarshal" ], [ "ole32", "OleGetIconOfClass" ], [ "ole32", "CreateItemMoniker" ], [ "ole32", "CoTaskMemFree" ], [ "ole32", "CoGetInterfaceAndReleaseStream" ], [ "ole32", "RegisterDragDrop" ], [ "ole32", "CoDosDateTimeToFileTime" ], [ "ole32", "StgGetIFillLockBytesOnFile" ], [ "ole32", "CoReleaseServerProcess" ], [ "ole32", "FmtIdToPropStgName" ], [ "ole32", "CoRegisterMallocSpy" ], [ "ole32", "CoMarshalInterface" ], [ "ole32", "OleSetMenuDescriptor" ], [ "ole32", "CoGetMalloc" ], [ "ole32", "CoCreateFreeThreadedMarshaler" ], [ "ole32", "HMENU_UserSize" ], [ "ole32", "HGLOBAL_UserUnmarshal" ], [ "ole32", "FreePropVariantArray" ], [ "ole32", "CoFreeAllLibraries" ], [ "ole32", "BindMoniker" ], [ "ole32", "CoReleaseMarshalData" ], [ "ole32", "CoFileTimeToDosDateTime" ], [ "ole32", "HGLOBAL_UserFree" ], [ "ole32", "HGLOBAL_UserMarshal" ], [ "ole32", "CoRevokeMallocSpy" ], [ "ole32", "ReleaseStgMedium" ], [ "ole32", "CreateAntiMoniker" ], [ "ole32", "CoGetMarshalSizeMax" ], [ "shell32", "SHGetPathFromIDListA" ], [ "shell32", "ShellExecuteW" ], [ "shell32", "SHInvokePrinterCommandA" ], [ "shell32", "SHGetDesktopFolder" ], [ "shell32", "ShellExecuteExW" ], [ "shell32", "SHGetFileInfoA" ], [ "shell32", "SHBrowseForFolderA" ], [ "shell32", "FindExecutableA" ], [ "shell32", "ShellAboutA" ], [ "shell32", "SHGetMalloc" ], [ "oleaut32", "ORDINAL 77" ], [ "oleaut32", "ORDINAL 56" ], [ "oleaut32", "ORDINAL 175" ], [ "oleaut32", "ORDINAL 7" ], [ "oleaut32", "ORDINAL 414" ], [ "oleaut32", "ORDINAL 190" ], [ "oleaut32", "ORDINAL 183" ], [ "oleaut32", "ORDINAL 74" ], [ "oleaut32", "ORDINAL 167" ], [ "oleaut32", "ORDINAL 133" ], [ "oleaut32", "ORDINAL 71" ], [ "oleaut32", "ORDINAL 69" ], [ "comctl32", "ImageList_GetImageCount" ], [ "kernel32", "GetStartupInfoA" ], [ "kernel32", "GetModuleHandleA" ], [ "oleacc", "ObjectFromLresult" ], [ "oleacc", "AccessibleObjectFromPoint" ], [ "oleacc", "WindowFromAccessibleObject" ], [ "oleacc", "GetRoleTextW" ], [ "oleacc", "AccessibleObjectFromWindow" ], [ "oleacc", "GetStateTextA" ], [ "oleacc", "GetRoleTextA" ] ], "met": { "pe": { "checksum": 0.0, "has_overlay": 1.0, "overlay_end": 184324.0, "overlay_size": 4.0, "checksum_valid": 0.0, "overlay_offset": 184320.0, "overlay_padding": 4.0, "checksum_stripped": 1.0, "computed_checksum": 232804.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 184324.0, "entropy": 5.43, "size_bytes": 184324.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 5.85, "data_entropy": 4.09, "overlay_size": 4.0, "string_count": 723.0, "overlay_ratio": 0.0, "overall_entropy": 5.43, "overlay_entropy": 2.0, "entropy_variance": 4.65, "avg_string_length": 10.43, "max_string_length": 40.0, "code_to_data_ratio": 0.93, "string_length_stddev": 4.6, "largest_section_ratio": 0.6, "sentence_string_count": 3.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 178.0 }, "sections": { "count": 4.0, "code_size": 110592.0, "entropy_max": 5.85, "entropy_mean": 3.89, "name_entropy": 2.93, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 14.0 } }, "sec": [ [ ".text", 4096, 110592, 5.85, "r-x" ], [ ".rdata", 114688, 40960, 5.3, "r--" ], [ ".data", 155648, 8192, 4.09, "rw-" ], [ ".rsrc", 163840, 20480, 0.32, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 488, "u8", ".text" ], [ 567, "u8", "@.data" ], [ 608, "u8", ".rsrc" ], [ 25252, "u8", "PXj3X" ], [ 28964, "u8", "XSVW" ], [ 33272, "u8", "j0XQYd" ], [ 92774, "u8", "PXjnX" ], [ 102471, "u8", "QYj0X" ], [ 112735, "u8", "XPVSS" ], [ 117956, "u8", "jmuNr" ], [ 122296, "u8", "IAC2" ], [ 123145, "u8", "n2D21" ], [ 126271, "u8", "XGsDYfs" ], [ 126441, "u8", "08om" ], [ 126709, "u8", "Fkki" ], [ 127652, "u8", "TgDlx" ], [ 128006, "u8", "i)Y[g" ], [ 131558, "u8", "Ykzi" ], [ 131986, "u8", "EZf7H" ], [ 151362, "u8", "LsaQueryTrustedDomainInfoByName" ], [ 151396, "u8", "RevertToSelf" ], [ 151410, "u8", "ADVAPI32.dll" ], [ 151426, "u8", "ImmGetDescriptionA" ], [ 151448, "u8", "ImmSetStatusWindowPos" ], [ 151472, "u8", "ImmGetRegisterWordStyleA" ], [ 151500, "u8", "ImmGetConversionStatus" ], [ 151526, "u8", "ImmReleaseContext" ], [ 151546, "u8", "ImmIsUIMessageA" ], [ 151564, "u8", "ImmGetStatusWindowPos" ], [ 151588, "u8", "ImmUnregisterWordW" ], [ 151610, "u8", "ImmGetDescriptionW" ], [ 151632, "u8", "ImmGetIMEFileNameA" ], [ 151654, "u8", "ImmSetCompositionFontW" ], [ 151680, "u8", "ImmGetConversionListA" ], [ 151704, "u8", "ImmGetGuideLineA" ], [ 151724, "u8", "ImmConfigureIMEA" ], [ 151744, "u8", "ImmGetCandidateListW" ], [ 151768, "u8", "ImmSimulateHotKey" ], [ 151788, "u8", "ImmEnumRegisterWordA" ], [ 151812, "u8", "ImmGetCandidateListCountA" ], [ 151840, "u8", "ImmNotifyIME" ], [ 151856, "u8", "ImmGetCompositionFontW" ], [ 151882, "u8", "ImmGetContext" ], [ 151898, "u8", "ImmGetConversionListW" ], [ 151922, "u8", "ImmConfigureIMEW" ], [ 151942, "u8", "ImmGetCandidateListA" ], [ 151966, "u8", "ImmSetCompositionStringW" ], [ 151994, "u8", "ImmGetRegisterWordStyleW" ], [ 152022, "u8", "ImmRegisterWordW" ], [ 152042, "u8", "ImmSetCompositionStringA" ], [ 152070, "u8", "ImmInstallIMEA" ], [ 152088, "u8", "ImmGetOpenStatus" ], [ 152108, "u8", "ImmSetCompositionFontA" ], [ 152134, "u8", "ImmGetIMEFileNameW" ], [ 152156, "u8", "ImmSetCandidateWindow" ], [ 152180, "u8", "ImmIsUIMessageW" ], [ 152198, "u8", "ImmEnumRegisterWordW" ], [ 152222, "u8", "ImmUnregisterWordA" ], [ 152244, "u8", "ImmInstallIMEW" ], [ 152262, "u8", "ImmEscapeA" ], [ 152276, "u8", "ImmGetGuideLineW" ], [ 152296, "u8", "ImmEscapeW" ], [ 152310, "u8", "ImmSetCompositionWindow" ], [ 152336, "u8", "ImmGetDefaultIMEWnd" ], [ 152358, "u8", "ImmGetVirtualKey" ], [ 152378, "u8", "ImmGetCompositionWindow" ], [ 152404, "u8", "ImmAssociateContext" ], [ 152426, "u8", "ImmCreateContext" ], [ 152446, "u8", "ImmGetCandidateWindow" ], [ 152470, "u8", "ImmGetCompositionFontA" ], [ 152496, "u8", "ImmSetConversionStatus" ], [ 152520, "u8", "IMM32.dll" ], [ 152532, "u8", "_except_handler3" ], [ 152552, "u8", "memcmp" ], [ 152560, "u8", "MSVCRT.dll" ], [ 152582, "u8", "_XcptFilter" ], [ 152596, "u8", "exit" ], [ 152604, "u8", "_acmdln" ], [ 152614, "u8", "__getmainargs" ], [ 152630, "u8", "_initterm" ], [ 152642, "u8", "__setusermatherr" ], [ 152662, "u8", "_adjust_fdiv" ], [ 152678, "u8", "__p__commode" ], [ 152694, "u8", "__p__fmode" ], [ 152708, "u8", "__set_app_type" ], [ 152726, "u8", "_controlfp" ], [ 152740, "u8", "FindNextUrlCacheEntryExA" ], [ 152766, "u8", "WININET.dll" ], [ 152780, "u8", "GetMenuStringA" ], [ 152798, "u8", "CheckDlgButton" ], [ 152816, "u8", "GetKBCodePage" ], [ 152832, "u8", "ChangeDisplaySettingsExW" ], [ 152860, "u8", "SetMessageQueue" ], [ 152878, "u8", "SendMessageCallbackA" ], [ 152902, "u8", "GetProcessWindowStation" ], [ 152928, "u8", "IsCharLowerW" ], [ 152944, "u8", "CharNextA" ], [ 152956, "u8", "GetDlgItemTextW" ], [ 152974, "u8", "LoadMenuW" ], [ 152986, "u8", "ChangeMenuA" ], [ 153000, "u8", "GetSystemMenu" ], [ 153016, "u8", "IsDialogMessageA" ], [ 153036, "u8", "ChangeMenuW" ], [ 153048, "u8", "USER32.dll" ], [ 153062, "u8", "I_RpcAsyncSetHandle" ], [ 153082, "u8", "RPCRT4.dll" ], [ 153094, "u8", "NDdeApi.dll" ], [ 153108, "u8", "PtInRegion" ], [ 153122, "u8", "SetTextJustification" ], [ 153146, "u8", "GetPath" ], [ 153156, "u8", "ExtCreateRegion" ], [ 153174, "u8", "GetFontLanguageInfo" ], [ 153196, "u8", "ColorMatchToTarget" ], [ 153218, "u8", "CombineRgn" ], [ 153232, "u8", "GetTextExtentPoint32W" ], [ 153256, "u8", "CloseEnhMetaFile" ], [ 153276, "u8", "DrawEscape" ], [ 153290, "u8", "CopyMetaFileA" ], [ 153306, "u8", "GetDCOrgEx" ], [ 153320, "u8", "GetNearestPaletteIndex" ], [ 153346, "u8", "FillRgn" ], [ 153356, "u8", "DPtoLP" ], [ 153366, "u8", "EnumFontFamiliesA" ], [ 153386, "u8", "CreateRectRgn" ], [ 153402, "u8", "SetBrushOrgEx" ], [ 153418, "u8", "GetObjectA" ], [ 153430, "u8", "GDI32.dll" ], [ 153442, "u8", "FmtIdToPropStgName" ], [ 153464, "u8", "CoFreeAllLibraries" ], [ 153486, "u8", "StgGetIFillLockBytesOnFile" ], [ 153516, "u8", "CoDosDateTimeToFileTime" ], [ 153542, "u8", "RegisterDragDrop" ], [ 153562, "u8", "CoGetInterfaceAndReleaseStream" ], [ 153596, "u8", "ReleaseStgMedium" ], [ 153616, "u8", "HGLOBAL_UserUnmarshal" ], [ 153640, "u8", "OleDuplicateData" ], [ 153660, "u8", "CreateItemMoniker" ], [ 153680, "u8", "OleGetIconOfClass" ], [ 153700, "u8", "CoGetStandardMarshal" ], [ 153724, "u8", "OleIsCurrentClipboard" ], [ 153748, "u8", "CoReleaseServerProcess" ], [ 153774, "u8", "BindMoniker" ], [ 153788, "u8", "CoTaskMemFree" ], [ 153804, "u8", "CoRegisterMallocSpy" ], [ 153826, "u8", "CoMarshalInterface" ], [ 153848, "u8", "OleSetMenuDescriptor" ], [ 153872, "u8", "CreateAntiMoniker" ], [ 153892, "u8", "CoRevokeMallocSpy" ], [ 153912, "u8", "HGLOBAL_UserMarshal" ], [ 153934, "u8", "HGLOBAL_UserFree" ], [ 153954, "u8", "CoFileTimeToDosDateTime" ], [ 153980, "u8", "CoReleaseMarshalData" ], [ 154004, "u8", "FreePropVariantArray" ], [ 154028, "u8", "CoGetMarshalSizeMax" ], [ 154050, "u8", "HMENU_UserSize" ], [ 154068, "u8", "CoCreateFreeThreadedMarshaler" ], [ 154100, "u8", "CoGetMalloc" ], [ 154112, "u8", "ole32.dll" ], [ 154124, "u8", "SHGetMalloc" ], [ 154138, "u8", "ShellAboutA" ], [ 154152, "u8", "FindExecutableA" ], [ 154170, "u8", "SHBrowseForFolderA" ], [ 154192, "u8", "SHGetFileInfoA" ], [ 154210, "u8", "ShellExecuteExW" ], [ 154228, "u8", "SHGetDesktopFolder" ], [ 154250, "u8", "SHGetPathFromIDListA" ], [ 154274, "u8", "SHInvokePrinterCommandA" ], [ 154300, "u8", "ShellExecuteW" ], [ 154314, "u8", "SHELL32.dll" ], [ 154326, "u8", "OLEAUT32.dll" ], [ 154342, "u8", "ImageList_GetImageCount" ], [ 154366, "u8", "COMCTL32.dll" ], [ 154382, "u8", "GetModuleHandleA" ], [ 154402, "u8", "GetStartupInfoA" ], [ 154418, "u8", "KERNEL32.dll" ], [ 154434, "u8", "GetRoleTextA" ], [ 154450, "u8", "ObjectFromLresult" ], [ 154470, "u8", "GetStateTextA" ], [ 154486, "u8", "AccessibleObjectFromWindow" ], [ 154516, "u8", "GetRoleTextW" ], [ 154532, "u8", "WindowFromAccessibleObject" ], [ 154562, "u8", "AccessibleObjectFromPoint" ], [ 154588, "u8", "OLEACC.dll" ], [ 155756, "u8", "BBynmE" ], [ 155764, "u8", "xlJVRUywa" ], [ 155776, "u8", "sClCJJRkEFb" ], [ 155788, "u8", "JTRpTJu" ], [ 155796, "u8", "ksAdBcTWCIM" ], [ 155808, "u8", "XsIywXFU" ], [ 155820, "u8", "YqQbFrTGpcv" ], [ 155832, "u8", "VTRFVUekcg" ], [ 155844, "u8", "tbGXEmle" ], [ 155856, "u8", "XAcylba" ], [ 155864, "u8", "JflsDXTrS" ], [ 155876, "u8", "SGmGmcNVbOS" ], [ 155888, "u8", "RLaYsp" ], [ 155896, "u8", "ylEsPlVVSb" ], [ 155908, "u8", "LGXhIV" ], [ 155916, "u8", "bcCfMCYthR" ], [ 155928, "u8", "StKIDvHd" ], [ 155940, "u8", "PxORGPUIUHr" ], [ 155952, "u8", "kcPeOOUIugP" ], [ 155964, "u8", "awJTxiPl" ], [ 155976, "u8", "UOHLVbrFoHy" ], [ 155988, "u8", "QDsRagIgDya" ], [ 156000, "u8", "lYjjTWL" ], [ 156008, "u8", "LjKXBWNHP" ], [ 156020, "u8", "KjrAvs" ], [ 156028, "u8", "HBrdaWBLVKK" ], [ 156040, "u8", "siSdSlC" ], [ 156048, "u8", "YuyLmlPLL" ], [ 156060, "u8", "MGNRLmv" ], [ 156068, "u8", "tDrACBUsDa" ], [ 156080, "u8", "bEBtHTTrCR" ], [ 156092, "u8", "WVKBKNWVRXB" ], [ 156104, "u8", "ovFpGaHIbl" ], [ 156116, "u8", "NHdNMk" ], [ 156124, "u8", "UyLyKyUtlbw" ], [ 156136, "u8", "aYfQgTQWrds" ], [ 156148, "u8", "FBoPVDMnEn" ], [ 156160, "u8", "xbspQs" ], [ 156168, "u8", "tbNVwTfAhl" ], [ 156180, "u8", "NyLhJbopdiI" ], [ 156192, "u8", "hfmlIrQ" ], [ 156200, "u8", "iNSKbg" ], [ 156208, "u8", "PLuiPh" ], [ 156216, "u8", "eYmbPP" ], [ 156224, "u8", "vuYeKgPXFTS" ], [ 156236, "u8", "DvSCvM" ], [ 156244, "u8", "tIwVCmkuF" ], [ 156256, "u8", "WxIqygAjVI" ], [ 156268, "u8", "ulKNPd" ], [ 156276, "u8", "FHnWARg" ], [ 156284, "u8", "VXCtrKAnLC" ], [ 156296, "u8", "VMXTnSgEgHj" ], [ 156308, "u8", "fqyoYRbtboB" ], [ 156320, "u8", "CsdICQv" ], [ 156328, "u8", "OAbsjc" ], [ 156336, "u8", "tTEfYn" ], [ 156344, "u8", "qoBdgVQyKq" ], [ 156356, "u8", "UrOslmNSHYF" ], [ 156368, "u8", "yxhkNmrRJjR" ], [ 156380, "u8", "nrLeQNAh" ], [ 156392, "u8", "JqDuPGwLeMP" ], [ 156404, "u8", "kMKuIJgYW" ], [ 156416, "u8", "NNOyJxjv" ], [ 156428, "u8", "PtXxWR" ], [ 156436, "u8", "BeELQpiUvLA" ], [ 156448, "u8", "bcOgSl" ], [ 156456, "u8", "xLyfGkggHn" ], [ 156468, "u8", "BmgNjVe" ], [ 156476, "u8", "wlruUf" ], [ 156484, "u8", "TFXkGPUq" ], [ 156496, "u8", "icbxTHjujYk" ], [ 156508, "u8", "TQNvNcArTPe" ] ], "val": { "file.stem": "55ee934fb234b1f2a35f1a1b9acee59769415ec67b14dca3e96ad706b72a6b28", "pe.imphash": "7d25b7bb3dc9ea72fa2a455daf2484d2", "pe.machine": "i386", "pe.rich.key": 571995571, "pe.rich.hash": "1ae86a190138865c32d574d533de2c1b", "pe.subsystem": "windows_gui", "pe.timestamp": 1089903273, "file.basename": "55ee934fb234b1f2a35f1a1b9acee59769415ec67b14dca3e96ad706b72a6b28.exe", "pe.image_base": 4194304, "pe.image_size": 839680, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 112444, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "8cfe279ebc6718a6e3b39397cd9982f52084e825", "pe.image_hash.sha256": "e538c7d08ba02d1229ba9f464e6da9b47c040f4a584e4adcef847101d3d3c200", "pe.image_hash.sha384": "61b1d2869c0e1723cb18ad08e597fa5df0ed4b93786e8afe667d8ddea260871e2e94d051baa1c4aac8b59b92ac854876", "pe.image_hash.sha512": "93a32644a650cbaea6452772f7bd28af5b458be88cfe804645b0e16cda72b49fab041292cab4b017d57f72adee3ff28f24dd2308dbfb4e4b817f6761db9546f0", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 270, "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.data_directories[0].rva": 150292, "pe.data_directories[1].rva": 819200, "pe.data_directories[2].rva": 114688, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 300, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 16800, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 768, "pe.rich.entries[0].build_id": 1, "pe.rich.entries[1].build_id": 1, "pe.rich.entries[2].build_id": 19, "pe.rich.entries[3].build_id": 11, "pe.rich.entries[4].build_id": 6, "pe.rich.entries[5].build_id": 14, "pe.rich.entries[6].build_id": 11, "pe.rich.entries[7].build_id": 14, "pe.rich.entries[8].build_id": 10, "pe.rich.entries[0].use_count": 171, "pe.rich.entries[1].use_count": 217, "pe.rich.entries[2].use_count": 205, "pe.rich.entries[3].use_count": 171, "pe.rich.entries[4].use_count": 17, "pe.rich.entries[5].use_count": 184, "pe.rich.entries[6].use_count": 2, "pe.rich.entries[7].use_count": 92, "pe.rich.entries[8].use_count": 105, "pe.coff.dos_header_pe_pointer": 240, "pe.rich.entries[2].product_id": 8034, "pe.rich.entries[3].product_id": 8168, "pe.rich.entries[4].product_id": 1720, "pe.rich.entries[5].product_id": 7299, "pe.rich.entries[6].product_id": 8168, "pe.rich.entries[7].product_id": 7299, "pe.rich.entries[8].product_id": 8168 } }, "find": [ { "id": "micro-behaviors/process/create/exec::shell-execute-ex", "atk": "T1059.001", "conf": 0.75, "crit": 3, "desc": "Execute shell command (ShellExecuteExW)" }, { "id": "micro-behaviors/process/create/exec::shell-execute", "atk": "T1059.001", "conf": 0.75, "crit": 3, "desc": "Execute shell command (ShellExecuteW)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "metadata/binary/layout::low-overlay-entropy", "conf": 0.8999999761581421, "crit": 3, "desc": "Low entropy overlay payload" }, { "id": "metadata/binary/layout::has-overlay", "conf": 1.0, "crit": 3, "desc": "PE binary has trailing overlay data" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" }, { "id": "micro-behaviors/process/create/shell/invoke::win-shellexecute", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.8999999761581421, "crit": 3, "desc": "Executes file or program via Windows ShellExecute API" }, { "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability detected" } ], "path": "55ee934fb234b1f2a35f1a1b9acee59769415ec67b14dca3e96ad706b72a6b28.exe", "risk": 3, "size": 184324, "type": "pe" } ] } }