{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.83227617, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T02:46:18Z" }, "path": "38905", "raw": { "v": "4", "fs": [ { "f": "KO₅(As₅Er₃PC₂I)H₂(PoDb)Md₂(Bi₅Si)Th", "x": 155, "id": 0, "is": [ "AddAtomA", "CreateDirectoryA", "CreateProcessA", "CreateSemaphoreA", "DeleteFileA", "ExitProcess", "FindAtomA", "GetAtomNameA", "GetCommandLineA", "GetLastError", "GetModuleFileNameA", "GetModuleHandleA", "GetStartupInfoA", "InterlockedDecrement", "InterlockedIncrement", "ReleaseSemaphore", "SetFileAttributesA", "SetLastError", "SetUnhandledExceptionFilter", "Sleep", "TlsAlloc", "TlsFree", "TlsGetValue", "TlsSetValue", "WaitForSingleObject", "fdopen", "read", "strdup", "write", "getmainargs", "mb_cur_max", "p__environ", "p__fmode", "set_app_type", "assert", "cexit", "ctype", "errno", "fstati64", "iob", "isctype", "lseeki64", "onexit", "pctype", "setmode", "strnicmp", "vsnprintf", "abort", "atexit", "fclose", "fflush", "fopen", "fprintf", "free", "localeconv", "malloc", "memchr", "memcpy", "memmove", "memset", "rand", "setlocale", "setvbuf", "signal", "srand", "strcat", "strcmp", "strcoll", "strcpy", "strftime", "strlen", "strtod", "strxfrm", "time", "SHGetFolderPathA", "ShellExecuteA" ], "ms": { "binary": { "code_size": 245760.0, "file_size": 740253.0, "import_count": 76.0, "string_count": 352.0, "section_count": 6.0, "avg_complexity": 5.1, "function_count": 1015.0, "import_density": 0.32, "max_complexity": 222.0, "string_density": 1.47, "overall_entropy": 7.17, "avg_basic_blocks": 7.73, "avg_section_size": 47616.0, "function_density": 4.23, "avg_function_size": 246.81, "avg_string_length": 12.87, "complexity_per_kb": 0.02, "max_string_length": 66.0, "writable_sections": 4.0, "avg_string_entropy": 2.75, "code_section_ratio": 0.17, "code_to_data_ratio": 6.15, "data_to_file_ratio": 0.0, "rsrc_to_file_ratio": 0.04, "text_to_file_ratio": 0.33, "total_basic_blocks": 7842.0, "executable_sections": 1.0, "section_name_entropy": 3.12, "string_length_stddev": 13.01, "largest_section_ratio": 0.33, "sentence_string_count": 14.0, "sentence_string_ratio": 0.04, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "has_malformed_structure": true, "normalized_import_count": 0.09, "normalized_section_count": 0.31, "high_complexity_functions": 15.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 456, ".rdata" ], [ 536, ".idata" ], [ 576, ".rsrc" ], [ 6388, "CUNG" ], [ 6607, "CUNG5" ], [ 9767, "M 9M" ], [ 12577, "B4CUNG" ], [ 31083, "5 SD" ], [ 33405, "5HSD" ], [ 57696, "UWVS" ], [ 123624, "80tp" ], [ 190213, "SL9C" ], [ 193472, "VL9F" ], [ 196504, "WL9G" ], [ 247808, ".exe" ], [ 247815, "open" ], [ 247840, "Saaaalamm" ], [ 247936, "basic_filebuf::xsgetn error reading the file" ], [ 247984, "basic_filebuf::_M_convert_to_external conversion error" ], [ 248040, "basic_filebuf::underflow codecvt::max_length() is not valid" ], [ 248100, "basic_filebuf::underflow incomplete character in file" ], [ 248156, "basic_filebuf::underflow error reading the file" ], [ 248204, "basic_filebuf::underflow invalid byte sequence in file" ], [ 248272, "basic_ios::clear" ], [ 248304, "basic_string::at" ], [ 248321, "basic_string::copy" ], [ 248340, "basic_string::compare" ], [ 248362, "basic_string::_S_create" ], [ 248386, "basic_string::reserve" ], [ 248408, "basic_string::erase" ], [ 248428, "basic_string::assign" ], [ 248449, "basic_string::append" ], [ 248470, "basic_string::_M_replace_aux" ], [ 248499, "basic_string::replace" ], [ 248521, "basic_string::insert" ], [ 248542, "basic_string::resize" ], [ 248564, "basic_string::_S_construct NULL not valid" ], [ 248606, "basic_string::basic_string" ], [ 248633, "basic_string::substr" ], [ 248840, "ios_base::_M_grow_words is not valid" ], [ 248880, "ios_base::_M_grow_words allocation failed" ], [ 248968, "locale::_S_normalize_category category not found" ], [ 249044, "locale::_Impl::_M_replace_facet" ], [ 249490, "POSIX" ], [ 249511, "%m/%d/%y" ], [ 249936, "pure virtual method called" ], [ 249972, "LC_CTYPE" ], [ 249981, "LC_NUMERIC" ], [ 249992, "LC_TIME" ], [ 250000, "LC_COLLATE" ], [ 250011, "LC_MONETARY" ], [ 250023, "LC_MESSAGES" ], [ 250064, "locale::facet::_S_create_c_locale name not valid" ], [ 250161, "true" ], [ 250166, "false" ], [ 250176, "-+xX0123456789abcdef0123456789ABCDEF" ], [ 250213, "-+xX0123456789abcdefABCDEF" ], [ 250264, "AKST" ], [ 250329, "August" ], [ 250336, "September" ], [ 250346, "October" ], [ 250354, "November" ], [ 250363, "December" ], [ 250392, "Sunday" ], [ 250399, "Monday" ], [ 250406, "Tuesday" ], [ 250414, "Wednesday" ], [ 250424, "Thursday" ], [ 250433, "Friday" ], [ 250440, "Saturday" ], [ 250477, "January" ], [ 250485, "February" ], [ 250494, "March" ], [ 250500, "April" ], [ 250510, "June" ], [ 250515, "July" ], [ 250576, "c:/mnt/samo/mingw/msys/mthr_stub.c" ], [ 250624, "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32" ], [ 250660, "w32_sharedptr-\u003esize == sizeof(W32_EH_SHARED)" ], [ 250705, "%s:%u: failed assertion `%s'" ], [ 250736, "../../gcc/gcc/config/i386/w32-shared-ptr.c" ], [ 251044, "INITY" ], [ 252460, "N10__cxxabiv117__class_type_infoE" ], [ 252524, "N10__cxxabiv120__si_class_type_infoE" ], [ 252588, "N10__cxxabiv121__vmi_class_type_infoE" ], [ 252652, "NSt6locale5facetE" ], [ 252672, "NSt8ios_base7failureE" ], [ 252708, "St10bad_typeid" ], [ 252724, "St10ctype_base" ], [ 252740, "St10money_base" ], [ 252756, "St10moneypunctIcLb0EE" ], [ 252780, "St10moneypunctIcLb1EE" ], [ 252804, "St11__timepunctIcE" ], [ 252824, "St11logic_error" ], [ 252840, "St11range_error" ], [ 252856, "St12codecvt_base" ], [ 252876, "St12ctype_bynameIcE" ], [ 252896, "St12domain_error" ], [ 252916, "St12length_error" ], [ 252936, "St12out_of_range" ], [ 252956, "St13bad_exception" ], [ 252976, "St13basic_filebufIcSt11char_traitsIcEE" ], [ 253040, "St13basic_fstreamIcSt11char_traitsIcEE" ], [ 253104, "St13messages_base" ], [ 253124, "St13runtime_error" ], [ 253144, "St14basic_ifstreamIcSt11char_traitsIcEE" ], [ 253208, "St14basic_ofstreamIcSt11char_traitsIcEE" ], [ 253272, "St14codecvt_bynameIcciE" ], [ 253296, "St14collate_bynameIcE" ], [ 253320, "St14overflow_error" ], [ 253340, "St15basic_streambufIcSt11char_traitsIcEE" ], [ 253404, "St15messages_bynameIcE" ], [ 253428, "St15numpunct_bynameIcE" ], [ 253452, "St15time_get_bynameIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE" ], [ 253548, "St15time_put_bynameIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE" ], [ 253644, "St15underflow_error" ], [ 253664, "St16__numpunct_cacheIcE" ], [ 253688, "St16invalid_argument" ], [ 253712, "St17__timepunct_cacheIcE" ], [ 253740, "St17moneypunct_bynameIcLb0EE" ], [ 253772, "St17moneypunct_bynameIcLb1EE" ], [ 253804, "St18__moneypunct_cacheIcLb0EE" ], [ 253836, "St18__moneypunct_cacheIcLb1EE" ], [ 253868, "St21__ctype_abstract_baseIcE" ], [ 253900, "St23__codecvt_abstract_baseIcciE" ], [ 253976, "St7codecvtIcciE" ], [ 253992, "St7collateIcE" ], [ 254008, "St7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE" ], [ 254072, "St7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE" ], [ 254136, "St8bad_cast" ], [ 254148, "St8ios_base" ], [ 254160, "St8messagesIcE" ], [ 254176, "St8numpunctIcE" ], [ 254192, "St8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE" ], [ 254256, "St8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE" ], [ 254320, "St9bad_alloc" ], [ 254336, "St9basic_iosIcSt11char_traitsIcEE" ], [ 254400, "St9exception" ], [ 254416, "St9money_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE" ], [ 254480, "St9money_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE" ], [ 254544, "St9time_base" ], [ 254560, "St9type_info" ], [ 258322, "CreateDirectoryA" ], [ 258342, "CreateProcessA" ], [ 258362, "CreateSemaphoreA" ], [ 258382, "DeleteFileA" ], [ 258398, "ExitProcess" ], [ 258426, "GetAtomNameA" ], [ 258442, "GetCommandLineA" ], [ 258462, "GetLastError" ], [ 258478, "GetModuleFileNameA" ], [ 258502, "GetModuleHandleA" ], [ 258522, "GetStartupInfoA" ], [ 258542, "InterlockedDecrement" ], [ 258566, "InterlockedIncrement" ], [ 258590, "ReleaseSemaphore" ], [ 258610, "SetFileAttributesA" ], [ 258634, "SetLastError" ], [ 258650, "SetUnhandledExceptionFilter" ], [ 258682, "Sleep" ], [ 258690, "TlsAlloc" ], [ 258702, "TlsFree" ], [ 258714, "TlsGetValue" ], [ 258730, "TlsSetValue" ], [ 258746, "WaitForSingleObject" ], [ 258770, "_fdopen" ], [ 258790, "_strdup" ], [ 258802, "_write" ], [ 258814, "__getmainargs" ], [ 258830, "__mb_cur_max" ], [ 258846, "__p__environ" ], [ 258862, "__p__fmode" ], [ 258878, "__set_app_type" ], [ 258898, "_assert" ], [ 258910, "_cexit" ], [ 258922, "_ctype" ], [ 258934, "_errno" ], [ 258946, "_fstati64" ], [ 258966, "_isctype" ], [ 258978, "_lseeki64" ], [ 258990, "_onexit" ], [ 259002, "_pctype" ], [ 259014, "_setmode" ], [ 259026, "_strnicmp" ], [ 259038, "_vsnprintf" ], [ 259054, "abort" ], [ 259062, "atexit" ], [ 259074, "fclose" ], [ 259086, "fflush" ], [ 259098, "fopen" ], [ 259106, "fprintf" ], [ 259118, "free" ], [ 259126, "localeconv" ], [ 259142, "malloc" ], [ 259154, "memchr" ], [ 259166, "memcpy" ], [ 259178, "memmove" ], [ 259190, "memset" ], [ 259210, "setlocale" ], [ 259222, "setvbuf" ], [ 259234, "signal" ], [ 259254, "strcat" ], [ 259278, "strcoll" ], [ 259302, "strftime" ], [ 259314, "strlen" ], [ 259326, "strtod" ], [ 259338, "strxfrm" ], [ 259350, "time" ], [ 259358, "SHGetFolderPathA" ], [ 259378, "ShellExecuteA" ], [ 259492, "KERNEL32.dll" ], [ 259524, "msvcrt.dll" ], [ 259736, "SHELL32.DLL" ], [ 261905, "3330" ], [ 264863, "RTVVjrqmjr}" ], [ 264907, "!/9?NGGaaq^^^m" ], [ 264956, "+388\u003c\u003ca^^^^]^" ], [ 265004, "#%88\u003cCa[]]]]]" ], [ 265244, "##''\u003c_am^m^^m" ], [ 265388, "\"#%89addammmr" ], [ 265437, "$-8\u003cGdnmmmj" ], [ 265485, "$-8GIdnnjrr" ], [ 265533, "$-8GGhnsrr}" ], [ 268349, "uwxz.4DC\\JJMU" ], [ 270509, "AYRNF" ], [ 270589, "Tccbk" ], [ 270637, "Vccll7,bheb:" ], [ 270653, "Vcj[S/dhhhbH" ], [ 270669, "_VTTTPJJJBH" ], [ 271608, "Lhh(QjT/SiB3Sh'5Ti" ], [ 271801, "Lit%Qla-TkM3Ti\u003e5Sf85Qd(6Rf" ], [ 271993, "Liz$Qli,UmU2VlD5Ti:5Rf55Qd1Y" ], [ 272185, "Li|#Qmo+Un\\Fs" ], [ 276409, "H9TS" ], [ 276653, "H9LS" ], [ 276870, "/86I" ], [ 280335, "LUY1" ], [ 280363, "TSX9" ], [ 280919, "LSO9" ], [ 283753, "H7OM" ], [ 284027, "SUK9TU" ], [ 284424, "GD78" ], [ 284752, "UI7P" ], [ 285815, "LSK1" ], [ 286301, "H7BM" ], [ 286719, "LS 9" ], [ 287375, "LUH7" ], [ 288813, "G7BSL" ], [ 297679, "LUX9" ], [ 299135, "KUH7" ], [ 299359, "TUH7" ], [ 300253, "H7NU" ], [ 301957, "T9PZ" ], [ 302394, "9MST" ] ], "sz": 740253, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE header too corrupted to parse: Malformed entity: ResourceString value_len (23609) exceeds available bytes (0)", "e": [ "Malformed entity: ResourceString value_len (23609) exceeds available bytes (0)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)", "e": [ "SIGNATURE_BASE_SUSP_Imphash_Mar23_2" ], "i": "third_party/SigBase/SUSP/Imphash/Mar23", "l": 3 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 0.9900000095367432, "d": "Mira operator magic greeting string", "e": [ "Saaaalamm" ], "i": "well-known/malware/dropper/mira::saaaalamm-magic-banner", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 7.17" ], "i": "objectives/command-and-control/dropper/staging::high-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 0.00)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "String comparison", "e": [ "strcmp" ], "i": "micro-behaviors/data/string/operations::strcmp", "l": 2 }, { "c": 0.8999999761581421, "d": "String copy (unsafe)", "e": [ "strcpy" ], "i": "micro-behaviors/data/string/operations::strcpy", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 740253.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 1024)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.20000000298023224, "d": "Format time as string", "e": [ "strftime" ], "i": "micro-behaviors/time/query::strftime", "l": 2 }, { "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "GNU libstdc++ stdlib", "e": [ "__cxxabiv1", "__cxxabiv1", "__cxxabiv1" ], "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "l": 2 }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".rdata (size: 9728, entropy: 0.00, perms: -r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "AddAtomA API atom table access", "e": [ "AddAtomA" ], "i": "objectives/evasion/process/injection/atom-bombing::addatoma-api", "l": 1, "m": "C0041" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1015.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.75" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32 ANSI", "e": [ "SHGetFolderPathA" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-folder-path-a", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.9800000190734863, "d": "Mira MinGW build path with operator handle", "e": [ "c:/mnt/samo/mingw/msys/mthr_stub.c" ], "i": "well-known/malware/dropper/mira::mira-build-path", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current calendar time (seconds)", "e": [ "time" ], "i": "micro-behaviors/time/query::time", "l": 2, "m": "T1124" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8999999761581421, "d": "String length", "e": [ "strlen" ], "i": "micro-behaviors/data/string/operations::strlen", "l": 2 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1015.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Close stdio file", "e": [ "fclose" ], "i": "micro-behaviors/os/stdio::fclose", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 76.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 0.00" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.10" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 740253.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.800000011920929, "d": "GetAtomNameA API for atom retrieval", "e": [ "GetAtomNameA" ], "i": "objectives/evasion/process/injection/atom-bombing::getatomnama-api", "l": 1, "m": "C0041" }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreA" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "d": "overflow keyword", "e": [ "St14overflow_error" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Formatted file output", "e": [ "fprintf" ], "i": "micro-behaviors/os/stdio::fprintf", "l": 2 }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 7842.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Install signal handler", "e": [ "signal" ], "i": "micro-behaviors/os/signal/handler::signal", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1015.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.800000011920929, "d": "FindAtomA API atom table lookup", "e": [ "FindAtomA" ], "i": "objectives/evasion/process/injection/atom-bombing::findatoma-api", "l": 1, "m": "C0041" }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 352.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1015.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1015.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High overall file entropy (likely", "e": [ "binary.overall_entropy = 7.17" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-overall-entropy", "l": 3, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 76.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 76.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-under-80", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "-+xX0123456789abcdef0123456789ABCDEF", "-+xX0123456789abcdefABCDEF" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1015.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "binary.import_count = 76.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-80-imports", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetModuleFileNameA", "InterlockedDecrement", "InterlockedIncrement", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Zero-entropy executable section (carved/packed PE)", "e": [ ".text (size: 245760, entropy: 0.00, perms: -r-x)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::zero-entropy-executable-section", "l": 4, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "binary.has_malformed_structure = 1.00" ], "i": "metadata/binary/metrics::malformed-pe-structure", "l": 3 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (fdopen, read, strdup, write, getmainargs, ... +44 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.DLL (SHGetFolderPathA, ShellExecuteA)", "e": [ "SHELL32.DLL" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (AddAtomA, CreateDirectoryA, CreateProcessA, CreateSemaphoreA, DeleteFileA, ... +20 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "a": "T1547.001", "c": 0.8999999761581421, "d": "Startup folder persistence via shell API chain", "e": [ "ShellExecuteA", "CreateDirectoryA", "SetFileAttributesA", "SHGetFolderPathA", "CreateProcessA" ], "i": "objectives/persistence/login/startup/folder::startup-folder-dropper-chain", "l": 4 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 3, "m": "F0007" }, { "a": "T1055.001", "c": 0.8500000238418579, "d": "Atom bombing injection capability", "e": [ "FindAtomA", "AddAtomA", "GetAtomNameA" ], "i": "objectives/evasion/process/injection/atom-bombing::atom-bombing-capable", "l": 4, "m": "C0041" }, { "a": "T1546.015", "c": 0.9399999976158142, "d": "Shell object installer import cluster", "e": [ "DeleteFileA", "GetAtomNameA", "SetFileAttributesA", "ShellExecuteA", "SHGetFolderPathA", "AddAtomA", "CreateProcessA" ], "i": "objectives/anti-static/pack::shellobject-installer-import-cluster", "l": 4, "m": "F0012" }, { "a": "T1055.001", "c": 0.8999999761581421, "d": "Full atom-table API triad (Add/Find/GetAtomName)", "e": [ "AddAtomA", "FindAtomA", "GetAtomNameA" ], "i": "objectives/evasion/process/injection/atom-bombing::atom-bombing-triple", "l": 4, "m": "C0041" } ], "sha": "56fdbe661c72bc763a117dcd2ddcbd3adc433220f2f7f8864db28a78568fbb53", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/38905", "type": "pe" } ], "tv": "2a0fe" } }