{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8505154848098755, "class": 0 } ], "prob": 0.8505155, "class": 0, "models": [ { "m": "az", "prob": 0.8505155, "class": 0 }, { "m": "az/native", "prob": 0.296875, "class": 0 }, { "m": "az/pe", "prob": 0.4090909, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-12T15:02:34Z" }, "path": "505371", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "baea5e6cd68dbabc28187c4deae58342", "pe.checksum": "0x0002aaa6", "pe.timestamp": 1534251337, "hash.authenti": "e2ef2fd563f6a996f0db8546657436eb77802790285f4864fe5d133e0e99c5e9", "pe.codeview.age": 2, "hash.rich_header": "0854ad3f468e75d36bc2916bff00244e540d7d20a84f622c5bfe394cd18edea6", "pe.codeview.guid": "63DBDE0B-027C-4605-B030-DC66A2274B76", "build.target_arch": "x86", "pe.linker_version": "12.0", "pe.rich_header.xor_key": "0x3cfc8a54", "pe.debug_entries[0].size": 85, "pe.debug_entries[0].type": "codeview", "pe.data_directories[0].rva": 118072, "pe.data_directories[1].rva": 176128, "pe.data_directories[2].rva": 16608, "pe.data_directories[3].rva": 16896, "pe.data_directories[4].rva": 122880, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "base_relocation", "pe.data_directories[1].size": 1124, "pe.data_directories[2].name": "debug", "pe.data_directories[2].size": 28, "pe.data_directories[3].name": "load_config", "pe.data_directories[3].size": 64, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 68, "pe.debug_directory_types[0]": 2, "pe.debug_entries[0].timestamp": 1534251337, "pe.load_config.security_cookie": "0x42a760", "pe.rich_header_compids[0].count": 78, "pe.rich_header_compids[1].count": 7, "pe.rich_header_compids[2].count": 4, "pe.rich_header_compids[3].count": 1, "pe.rich_header_compids[4].count": 5, "pe.rich_header_compids[5].count": 11, "pe.rich_header_compids[6].count": 1, "binary.top_complex_unnamed[0].cc": 43, "binary.top_complex_unnamed[1].cc": 24, "binary.top_complex_unnamed[2].cc": 23, "binary.top_complex_unnamed[3].cc": 19, "binary.top_complex_unnamed[4].cc": 18, "binary.top_complex_unnamed[5].cc": 17, "binary.top_complex_unnamed[6].cc": 16, "binary.top_complex_unnamed[7].cc": 14, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 65536, "pe.rich_header_compids[1].compid": 9664521, "pe.rich_header_compids[2].compid": 9795593, "pe.rich_header_compids[3].compid": 8615945, "pe.rich_header_compids[4].compid": 13565917, "pe.rich_header_compids[5].compid": 14720693, "pe.rich_header_compids[6].compid": 14589621, "binary.top_complex_unnamed[0].bbs": 84, "binary.top_complex_unnamed[1].bbs": 31, "binary.top_complex_unnamed[2].bbs": 35, "binary.top_complex_unnamed[3].bbs": 28, "binary.top_complex_unnamed[4].bbs": 35, "binary.top_complex_unnamed[5].bbs": 25, "binary.top_complex_unnamed[6].bbs": 22, "binary.top_complex_unnamed[7].bbs": 31, "pe.rich_header_compids[0].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x423ccc", "binary.top_complex_unnamed[0].size": 44635, "binary.top_complex_unnamed[1].addr": "0x421c10", "binary.top_complex_unnamed[1].size": 20948, "binary.top_complex_unnamed[2].addr": "0x4272ba", "binary.top_complex_unnamed[2].size": 29108, "binary.top_complex_unnamed[3].addr": "0x4244b7", "binary.top_complex_unnamed[3].size": 514, "binary.top_complex_unnamed[4].addr": "0x41a470", "binary.top_complex_unnamed[4].size": 57184, "binary.top_complex_unnamed[5].addr": "0x402920", "binary.top_complex_unnamed[5].size": 280, "binary.top_complex_unnamed[6].addr": "0x409a94", "binary.top_complex_unnamed[6].size": 239, "binary.top_complex_unnamed[7].addr": "0x4270e1", "binary.top_complex_unnamed[7].size": 44955, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": "INIT", "pe.section_characteristics[4].name": ".dada0", "pe.section_characteristics[5].name": ".dada1", "pe.section_characteristics[6].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 78, "pe.rich_header.entries[1].use_count": 7, "pe.rich_header.entries[2].use_count": 4, "pe.rich_header.entries[3].use_count": 1, "pe.rich_header.entries[4].use_count": 5, "pe.rich_header.entries[5].use_count": 11, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 1, "pe.rich_header.entries[1].product_id": 147, "pe.rich_header.entries[2].product_id": 149, "pe.rich_header.entries[3].product_id": 131, "pe.rich_header.entries[4].product_id": 206, "pe.rich_header.entries[5].product_id": 224, "pe.rich_header.entries[6].product_id": 222, "pe.rich_header.entries[0].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[1].build_number": 30729, "pe.rich_header.entries[1].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[2].build_number": 30729, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 30729, "pe.rich_header.entries[3].product_name": "C_VS2008_LTCG", "pe.rich_header.entries[4].build_number": 65501, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 40629, "pe.rich_header.entries[5].product_name": "Cvtres_VS2012", "pe.rich_header.entries[6].build_number": 40629, "pe.rich_header.entries[6].product_name": "Linker_VS2012_LTCG", "pe.section_characteristics[0].raw_size": 10752, "pe.section_characteristics[1].raw_size": 1024, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[3].raw_size": 1536, "pe.section_characteristics[4].raw_size": 82432, "pe.section_characteristics[5].raw_size": 59392, "pe.section_characteristics[6].raw_size": 1536, "pe.section_characteristics[0].virtual_size": 10702, "pe.section_characteristics[1].virtual_size": 820, "pe.section_characteristics[2].virtual_size": 160, "pe.section_characteristics[3].virtual_size": 1450, "pe.section_characteristics[4].virtual_size": 82056, "pe.section_characteristics[5].virtual_size": 59240, "pe.section_characteristics[6].virtual_size": 1124, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 16384, "pe.section_characteristics[2].virtual_address": 20480, "pe.section_characteristics[3].virtual_address": 24576, "pe.section_characteristics[4].virtual_address": 28672, "pe.section_characteristics[5].virtual_address": 114688, "pe.section_characteristics[6].virtual_address": 176128, "pe.section_characteristics[0].characteristics_hex": "68000020", "pe.section_characteristics[1].characteristics_hex": "48000040", "pe.section_characteristics[2].characteristics_hex": "c8000040", "pe.section_characteristics[3].characteristics_hex": "60000020", "pe.section_characteristics[4].characteristics_hex": "e8000060", "pe.section_characteristics[5].characteristics_hex": "e0000060", "pe.section_characteristics[6].characteristics_hex": "42000040" }, "x": 5, "id": 0, "is": [ "DbgPrint", "KeRaiseIrqlToDpcLevel", "FltCreateCommunicationPort", "IoAllocateMdl", "MmProbeAndLockPages", "MmMapLockedPagesSpecifyCache", "MmUnlockPages", "IoFreeMdl", "ExAllocatePool", "ExFreePool", "NtQuerySystemInformation", "HalMakeBeep" ], "ms": { "pe": { "entry": 138304.0, "machine": 332.0, "checksum": 174758.0, "subsystem": 1.0, "timestamp": 1534251337.0, "image_base": 4194304.0, "codeview_age": 2.0, "has_checksum": true, "codeview_guid": "63DBDE0B-027C-4605-B030-DC66A2274B76", "entry_section": ".dada1", "size_of_image": 180224.0, "checksum_valid": true, "file_alignment": 512.0, "characteristics": 258.0, "has_rich_header": true, "security_cookie": 4368224.0, "size_of_headers": 1024.0, "export_timestamp": 0.0, "import_dll_count": 3.0, "se_handler_count": 4210688.0, "computed_checksum": 174758.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1534251337.0, "debug_timestamp_min": 1534251337.0, "dll_characteristics": 320.0, "has_export_timestamp": false, "linker_major_version": 12.0, "debug_directory_types": [ 2.0 ], "has_resource_timestamp": false, "debug_directory_entries": 1.0, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "entry_in_nonstandard_section": true, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 158208.0 }, "binary": { "code_size": 154112.0, "func_count": 300.0, "code_entropy": 7.29, "data_entropy": 2.0, "func_density": 1.99, "import_count": 12.0, "string_count": 86.0, "avg_func_size": 13371.45, "section_count": 7.0, "avg_complexity": 2.47, "import_density": 0.08, "max_complexity": 43.0, "string_density": 0.57, "overall_entropy": 5.43, "avg_basic_blocks": 5.14, "avg_section_size": 22454.86, "dependency_count": 3.0, "entropy_variance": 2.48, "wx_section_count": 2.0, "avg_string_length": 10.4, "complexity_per_kb": 0.02, "max_string_length": 76.0, "wide_string_count": 5.0, "avg_string_entropy": 2.6, "code_to_data_ratio": 50.17, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.07, "total_basic_blocks": 1543.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 11.12, "debug_reference_count": 1.0, "largest_section_ratio": 0.52, "sentence_string_count": 1.0, "sentence_string_ratio": 0.01, "writable_section_count": 3.0, "entry_in_writable_region": true, "executable_section_count": 4.0, "nonstandard_section_count": 3.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 480, ".text" ], [ 519, "h.rdata" ], [ 559, "H.data" ], [ 600, "INIT" ], [ 680, ".dada1" ], [ 720, ".reloc" ], [ 1794, "UVWS" ], [ 1921, "UQPXY]Y[" ], [ 11298, "MiniFilter Unload" ], [ 11318, "[mini-filter] NPMiniConnect" ], [ 11346, "[mini-filter] NPMiniDisconnect" ], [ 11378, "[mini-filter] NPMiniMessage" ], [ 11406, "[DirAccess-filter] default" ], [ 11434, "url", "\bx\bx\bx\bx" ], [ 11452, "wide", "321029" ], [ 11480, "PrsProt" ], [ 11494, "NPUnicodeStringToChar EXCEPTION_EXECUTE_HANDLER" ], [ 11546, "wide", "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName" ], [ 11700, "wide", "ComputerName" ], [ 12056, "wide", "\\Device\\FileProt" ], [ 12092, "wide", "\\DosDevices\\FileProt" ], [ 12280, "Unknown" ], [ 12380, "RSDS" ], [ 25793, "BGtXqc^fkclu" ], [ 27531, "/hha" ], [ 29130, "/LdD" ], [ 30082, "odPTdsR" ], [ 34107, "Olda}8KvXomL" ], [ 36293, "Wdhi" ], [ 38741, "Xmef" ], [ 40877, "Snad" ], [ 41009, "Xbeal" ], [ 43058, "Nucb" ], [ 47303, "MVAN" ], [ 50415, "b838" ], [ 58553, "cUtR}YfbkqH|UwR" ], [ 58865, "Niebjg" ], [ 59857, "Ilbe" ], [ 62564, "`ke`" ], [ 69220, "Foal" ], [ 70489, "Rgal" ], [ 72546, "ZXwz/oxU" ], [ 73377, "/Tmc" ], [ 76626, "Xdah" ], [ 76930, "r59t" ], [ 83112, "MHW0" ], [ 85902, "hega" ], [ 91120, "Mpfa" ], [ 91293, "CrbgeltI" ], [ 95631, "/FzuC\tC" ], [ 99471, "XPgchpM" ], [ 99566, "r85l" ], [ 107482, "3ide" ], [ 108714, "[2\u003eu" ], [ 108958, "GSPC" ], [ 112669, "FLTMGR.SYS" ], [ 112719, "MmUnlockPages" ], [ 113229, "Niajhc" ], [ 113335, "Ujgj" ], [ 113727, "ntoskrnl.exe" ], [ 115629, "40mwi" ], [ 118559, "kntoskrnl.exe" ], [ 119647, "Veld" ], [ 120063, "MmProbeAndLockPages" ], [ 120666, "FltCreateCommunicationPort" ], [ 122533, "hal.dll" ], [ 124072, "Oapu" ], [ 126482, "tCo_ldao" ], [ 127806, "/omP" ], [ 130646, "fe_rbg" ], [ 131694, "/Orf" ], [ 132220, "HalMakeBeep" ], [ 132319, "NtQuerySystemInformation" ], [ 132433, "Lieb" ], [ 132492, "XWMD" ], [ 133251, "Luafx" ], [ 135121, "m\\rUq^fkw:A" ], [ 135358, "CK77" ], [ 135436, "ExAllocatePool" ], [ 135834, "IoAllocateMdl" ], [ 136732, "DbgPrint" ], [ 138987, "MmMapLockedPagesSpecifyCache" ], [ 140143, "HAL.dll" ], [ 140419, "Wdfc" ], [ 143069, "KeRaiseIrqlToDpcLevel" ] ], "sz": 158208, "ts": [ { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "NPUnicodeStringToChar EXCEPTION_EXECUTE_HANDLER" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.43" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_func_size = 13371.45" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "505371" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.29" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 2.47" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "d": "COMPUTERNAME environment variable", "e": [ "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\ComputerName\\ComputerName", "ComputerName" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 300.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 300.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 180224.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query system information", "e": [ "NtQuerySystemInformation" ], "i": "micro-behaviors/os/exception/handler::query-system-information", "l": 2, "m": "C0046" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1534251337.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.52)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.60" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.77)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1055", "c": 1.0, "d": "Windows kernel driver marker (ntoskrnl/storport)", "e": [ "ntoskrnl" ], "i": "objectives/anti-static/obfuscation/binary-structure::kernel-driver-string", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1543.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 300.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.60" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 2.47" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 12.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 300.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 12.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "FltCreateCommunicationPort" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1195.002", "c": 0.8500000238418579, "d": "Extremely large average function size", "e": [ "binary.avg_func_size = 13371.45" ], "i": "objectives/supply-chain/trojanized/backdoor::massive-code-blob", "l": 1, "m": "B0025" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.29" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".dada0 (size: 82432, perms: rwx)", ".dada1 (size: 59392, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 12.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "MmMapLockedPagesSpecifyCache" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1562.001", "c": 0.6000000238418579, "d": "STATUS_NOT_SUPPORTED constant", "e": [ "bb 01 00 00 c0" ], "i": "objectives/evasion/anti-av/ntdll-unhook::status-not-supported", "l": 3 }, { "c": 0.949999988079071, "d": "links ntoskrnl.exe (DbgPrint, IoAllocateMdl, MmProbeAndLockPages, MmMapLockedPagesSpecifyCache, MmUnlockPages, ... +4 more)", "e": [ "ntoskrnl.exe" ], "i": "metadata/dylib::ntoskrnl/exe", "l": 2 }, { "c": 0.949999988079071, "d": "links HAL.dll (KeRaiseIrqlToDpcLevel, HalMakeBeep)", "e": [ "HAL.dll" ], "i": "metadata/dylib::hal/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links FLTMGR.SYS (FltCreateCommunicationPort)", "e": [ "FLTMGR.SYS" ], "i": "metadata/dylib::fltmgr/sys", "l": 2 } ], "sha": "5682fadd7e8559fe2673d02838fa8a95689d5769739d535557ee0b518ac7869f", "path": "505371", "type": "pe" } ], "tv": "c1637" } }