{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998669624328613, "class": 2 } ], "prob": 0.99986696, "class": 2, "models": [ { "m": "az", "prob": 0.99986696, "class": 2 }, { "m": "az/native", "prob": 0.99960834, "class": 0 }, { "m": "az/pe", "prob": 0.99948335, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-02T23:34:51Z" }, "path": "96293", "raw": { "v": "4", "fs": [ { "f": "KO₇(As₁₃Er₄I₃AlC₄Co₂P₂)H₈(CmDb₂F₂HfOs₄Po₃DsU)Md₄(Bi₅Si)", "x": 136, "id": 0, "is": [ "GetModuleFileNameA", "GetThreadContext", "WaitForSingleObject", "CreateProcessA", "GetProcAddress", "VirtualAlloc", "LoadLibraryA", "CloseHandle", "GetTempPathA", "GetSystemTimeAsFileTime", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "GetCommandLineA", "GetStartupInfoA", "RaiseException", "RtlUnwind", "HeapAlloc", "GetLastError", "HeapFree", "GetModuleHandleW", "TlsGetValue", "TlsAlloc", "TlsSetValue", "TlsFree", "InterlockedIncrement", "SetLastError", "GetCurrentThreadId", "InterlockedDecrement", "GetCurrentThread", "Sleep", "ExitProcess", "WriteFile", "GetStdHandle", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStringsW", "SetHandleCount", "GetFileType", "DeleteCriticalSection", "HeapCreate", "HeapDestroy", "VirtualFree", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "LeaveCriticalSection", "FatalAppExitA", "EnterCriticalSection", "HeapReAlloc", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "HeapSize", "SetConsoleCtrlHandler", "FreeLibrary", "InterlockedExchange", "InitializeCriticalSectionAndSpinCount", "GetTimeFormatA", "GetDateFormatA", "GetUserDefaultLCID", "GetLocaleInfoA", "EnumSystemLocalesA", "IsValidLocale", "GetStringTypeA", "MultiByteToWideChar", "GetStringTypeW", "LCMapStringA", "LCMapStringW", "GetLocaleInfoW", "GetTimeZoneInformation", "CompareStringA", "CompareStringW", "SetEnvironmentVariableA" ], "ms": { "pe": { "signer": "VeriSign Class 3 Public Primary Certification Authority - G5, VeriSign Class 3 Code Signing 2010 CA, Premium Installer, VeriSignMPKI-2-8", "machine": 332.0, "checksum": 1105757.0, "rsrc_size": 27648.0, "subsystem": 2.0, "timestamp": 1377707542.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 5.21, "entry_section": ".text", "has_signature": true, "size_of_image": 1073152.0, "timestamp_day": 28.0, "checksum_valid": true, "file_alignment": 512.0, "primary_signer": "Premium Installer", "resource_count": 4.0, "signature_type": "developer", "timestamp_year": 2013.0, "characteristics": 259.0, "entry_point_rva": 15356.0, "size_of_headers": 1024.0, "timestamp_month": 8.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 1.0, "manifest_present": true, "certificate_count": 1.0, "computed_checksum": 1105757.0, "section_alignment": 4096.0, "number_of_sections": 4.0, "resource_timestamp": 0.0, "dll_characteristics": 33024.0, "rich_header_present": true, "linker_major_version": 9.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 6296.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 105984.0, "file_size": 1069208.0, "entry_point": 15356.0, "code_entropy": 6.6, "data_entropy": 6.06, "import_count": 79.0, "string_count": 4121.0, "has_signature": true, "section_count": 4.0, "avg_complexity": 6.76, "function_count": 570.0, "import_density": 0.76, "max_complexity": 384.0, "string_density": 39.82, "overall_entropy": 5.98, "avg_basic_blocks": 10.51, "avg_section_size": 265472.0, "dependency_count": 1.0, "entropy_variance": 0.69, "function_density": 5.51, "avg_function_size": 176.33, "avg_string_length": 34.11, "complexity_per_kb": 0.07, "max_string_length": 21512.0, "wide_string_count": 14.0, "writable_sections": 1.0, "avg_string_entropy": 2.61, "code_to_data_ratio": 0.11, "data_to_file_ratio": 0.85, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.1, "total_basic_blocks": 5991.0, "executable_sections": 1.0, "high_entropy_strings": 4.0, "string_length_stddev": 402.02, "largest_section_ratio": 0.85, "sentence_string_count": 132.0, "sentence_string_ratio": 0.03, "behavioral_import_ratio": 0.05, "function_analysis_depth": 2.0, "high_complexity_functions": 7.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 472, ".text" ], [ 551, "@.data" ], [ 592, ".rsrc" ], [ 1162, "stack", "ZSVTUPRUBRVCH9" ], [ 13026, "QSVW" ], [ 25605, "98uu" ], [ 27151, "YYPV" ], [ 45278, "tK\u003c_t\u003c\u003c$t8\u003c\u003ct4\u003c\u003et0\u003c-t,\u003ca|" ], [ 47189, "WQ8E" ], [ 49727, "Du h" ], [ 49829, "Ft,Nt\tNtFNt#NuV" ], [ 53000, "t.\u003c@t5V" ], [ 55325, "u8ht" ], [ 62610, "UVWS" ], [ 65060, "QWVP" ], [ 67393, "UQPXY]Y[" ], [ 73871, "98tl" ], [ 96335, "PVVRV" ], [ 96491, "VVVVVQRSSj" ], [ 97131, "u09u" ], [ 98252, "u99u" ], [ 99391, "WWWWV" ], [ 101536, "QVW3" ], [ 102090, "8VVVVV" ], [ 103294, "QQSV3" ], [ 103681, "SVW3" ], [ 107384, "bad allocation" ], [ 107460, "string too long" ], [ 107476, "invalid string position" ], [ 107500, "invalid string argument" ], [ 107536, "Unknown exception" ], [ 107644, "EncodePointer" ], [ 107660, "wide", "KERNEL32.DLL" ], [ 107688, "DecodePointer" ], [ 107704, "FlsFree" ], [ 107712, "FlsSetValue" ], [ 107724, "FlsGetValue" ], [ 107736, "FlsAlloc" ], [ 107748, "CorExitProcess" ], [ 107764, "wide", "mscoree.dll" ], [ 107788, "runtime error" ], [ 107808, "TLOSS error" ], [ 107824, "SING error" ], [ 107840, "DOMAIN error" ], [ 107856, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 107863, "An application has made an attempt to load the C runtime library incorrectly." ], [ 107941, "Please contact the application's support team for more information." ], [ 108016, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 108023, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 108103, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 108264, "R6032\r\n- not enough space for locale information" ], [ 108271, "- not enough space for locale information" ], [ 108320, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 108327, "- Attempt to initialize the CRT more than once." ], [ 108375, "This indicates a bug in your application." ], [ 108420, "R6030\r\n- CRT not initialized" ], [ 108427, "- CRT not initialized" ], [ 108452, "R6028\r\n- unable to initialize heap" ], [ 108459, "- unable to initialize heap" ], [ 108492, "R6027\r\n- not enough space for lowio initialization" ], [ 108499, "- not enough space for lowio initialization" ], [ 108548, "R6026\r\n- not enough space for stdio initialization" ], [ 108555, "- not enough space for stdio initialization" ], [ 108604, "R6025\r\n- pure virtual function call" ], [ 108611, "- pure virtual function call" ], [ 108644, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 108651, "- not enough space for _onexit/atexit table" ], [ 108700, "R6019\r\n- unable to open console device" ], [ 108707, "- unable to open console device" ], [ 108744, "R6018\r\n- unexpected heap error" ], [ 108751, "- unexpected heap error" ], [ 108780, "R6017\r\n- unexpected multithread lock error" ], [ 108787, "- unexpected multithread lock error" ], [ 108828, "R6016\r\n- not enough space for thread data" ], [ 108835, "- not enough space for thread data" ], [ 108872, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 108874, "This application has requested the Runtime to terminate it in an unusual way." ], [ 109024, "R6009\r\n- not enough space for environment" ], [ 109031, "- not enough space for environment" ], [ 109068, "R6008\r\n- not enough space for arguments" ], [ 109075, "- not enough space for arguments" ], [ 109112, "R6002\r\n- floating point support not loaded" ], [ 109119, "- floating point support not loaded" ], [ 109160, "Microsoft Visual C++ Runtime Library" ], [ 109208, "\u003cprogram name unknown\u003e" ], [ 109232, "Runtime Error!\n\nProgram:" ], [ 109404, "bad exception" ], [ 109420, "LC_TIME" ], [ 109428, "LC_NUMERIC" ], [ 109440, "LC_MONETARY" ], [ 109452, "LC_CTYPE" ], [ 109464, "LC_COLLATE" ], [ 109476, "LC_ALL" ], [ 109591, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 109716, "Complete Object Locator'" ], [ 109744, "Class Hierarchy Descriptor'" ], [ 109776, "Base Class Array'" ], [ 109796, "Base Class Descriptor at (" ], [ 109824, "Type Descriptor'" ], [ 109844, "`local static thread guard'" ], [ 109872, "`managed vector copy constructor iterator'" ], [ 109916, "`vector vbase copy constructor iterator'" ], [ 109960, "`vector copy constructor iterator'" ], [ 109996, "`dynamic atexit destructor for '" ], [ 110032, "`dynamic initializer for '" ], [ 110060, "`eh vector vbase copy constructor iterator'" ], [ 110104, "`eh vector copy constructor iterator'" ], [ 110144, "`managed vector destructor iterator'" ], [ 110184, "`managed vector constructor iterator'" ], [ 110224, "`placement delete[] closure'" ], [ 110256, "`placement delete closure'" ], [ 110284, "`omni callsig'" ], [ 110300, "delete[]" ], [ 110320, "`local vftable constructor closure'" ], [ 110356, "`local vftable'" ], [ 110384, "`udt returning'" ], [ 110400, "`copy constructor closure'" ], [ 110428, "`eh vector vbase constructor iterator'" ], [ 110468, "`eh vector destructor iterator'" ], [ 110500, "`eh vector constructor iterator'" ], [ 110536, "`virtual displacement map'" ], [ 110564, "`vector vbase constructor iterator'" ], [ 110600, "`vector destructor iterator'" ], [ 110632, "`vector constructor iterator'" ], [ 110664, "`scalar deleting destructor'" ], [ 110696, "`default constructor closure'" ], [ 110728, "`vector deleting destructor'" ], [ 110760, "`vbase destructor'" ], [ 110792, "`local static guard'" ], [ 110984, "operator" ], [ 111020, "delete" ], [ 111036, "__unaligned" ], [ 111048, "__restrict" ], [ 111068, "__clrcall" ], [ 111080, "__fastcall" ], [ 111092, "__thiscall" ], [ 111104, "__stdcall" ], [ 111116, "__pascal" ], [ 111128, "__cdecl" ], [ 111616, "{flat}" ], [ 111632, "`non-type-template-parameter" ], [ 111664, "unsigned" ], [ 111700, "char" ], [ 111708, "void" ], [ 111716, "\u003cellipsis\u003e" ], [ 111764, "`template-parameter" ], [ 111796, "cli::pin_ptr\u003c" ], [ 111812, "cli::array\u003c" ], [ 111836, "`anonymous namespace'" ], [ 111864, "generic-type-" ], [ 111880, "template-parameter-" ], [ 111904, "`unknown ecsu'" ], [ 111920, "union" ], [ 111928, "struct" ], [ 111944, "enum" ], [ 111952, "coclass" ], [ 111964, "cointerface" ], [ 111984, "extern \"C\"" ], [ 112044, "virtual" ], [ 112056, "static" ], [ 112064, "`template static data member destructor helper'" ], [ 112112, "`template static data member constructor helper'" ], [ 112164, "`local static destructor helper'" ], [ 112224, "`vtordispex{" ], [ 112260, "volatile" ], [ 112312, "signed" ], [ 112320, "double" ], [ 112328, "UNKNOWN" ], [ 112336, "__int128" ], [ 112348, "bool" ], [ 112356, "wchar_t" ], [ 112364, "__int64" ], [ 112372, "__int16" ], [ 112380, "__int32" ], [ 112404, "float" ], [ 112440, "SystemFunction036" ], [ 112460, "ADVAPI32.DLL" ], [ 112476, "GetProcessWindowStation" ], [ 112500, "GetUserObjectInformationA" ], [ 112528, "GetLastActivePopup" ], [ 112548, "GetActiveWindow" ], [ 112564, "MessageBoxA" ], [ 112576, "USER32.DLL" ], [ 113362, "wide", "h(((( H" ], [ 114040, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 114424, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 114660, "dddd, MMMM dd, yyyy" ], [ 114680, "MM/dd/yy" ], [ 114700, "December" ], [ 114712, "November" ], [ 114724, "October" ], [ 114732, "September" ], [ 114744, "August" ], [ 114752, "July" ], [ 114760, "June" ], [ 114768, "April" ], [ 114776, "March" ], [ 114784, "February" ], [ 114796, "January" ], [ 114852, "Saturday" ], [ 114864, "Friday" ], [ 114872, "Thursday" ], [ 114884, "Wednesday" ], [ 114896, "Tuesday" ], [ 114904, "Monday" ], [ 114912, "Sunday" ], [ 114960, "united-states" ], [ 114976, "united-kingdom" ], [ 114992, "trinidad \u0026 tobago" ], [ 115012, "south-korea" ], [ 115024, "south-africa" ], [ 115040, "south korea" ], [ 115052, "south africa" ], [ 115068, "slovak" ], [ 115076, "puerto-rico" ], [ 115088, "pr-china" ], [ 115100, "pr china" ], [ 115116, "new-zealand" ], [ 115128, "hong-kong" ], [ 115140, "holland" ], [ 115148, "great britain" ], [ 115164, "england" ], [ 115180, "china" ], [ 115188, "britain" ], [ 115196, "america" ], [ 115224, "swedish-finland" ], [ 115240, "spanish-venezuela" ], [ 115260, "spanish-uruguay" ], [ 115276, "spanish-puerto rico" ], [ 115296, "spanish-peru" ], [ 115312, "spanish-paraguay" ], [ 115332, "spanish-panama" ], [ 115348, "spanish-nicaragua" ], [ 115368, "spanish-modern" ], [ 115384, "spanish-mexican" ], [ 115400, "spanish-honduras" ], [ 115420, "spanish-guatemala" ], [ 115440, "spanish-el salvador" ], [ 115460, "spanish-ecuador" ], [ 115476, "spanish-dominican republic" ], [ 115504, "spanish-costa rica" ], [ 115524, "spanish-colombia" ], [ 115544, "spanish-chile" ], [ 115560, "spanish-bolivia" ], [ 115576, "spanish-argentina" ], [ 115596, "portuguese-brazilian" ], [ 115620, "norwegian-nynorsk" ], [ 115640, "norwegian-bokmal" ], [ 115660, "norwegian" ], [ 115672, "italian-swiss" ], [ 115688, "irish-english" ], [ 115704, "german-swiss" ], [ 115720, "german-luxembourg" ], [ 115740, "german-lichtenstein" ] ], "sz": 1069208, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Public Primary Certification Authority - G5", "e": [ "VeriSign Class 3 Public Primary Certification Authority - G5" ], "i": "metadata/signed/developer::verisign-class-3-public-primary-certification-authority---g5", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Code Signing 2010 CA", "e": [ "VeriSign Class 3 Code Signing 2010 CA" ], "i": "metadata/signed/developer::verisign-class-3-code-signing-2010-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Premium Installer", "e": [ "Premium Installer" ], "i": "metadata/signed/developer::premium-installer", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSignMPKI-2-8", "e": [ "VeriSignMPKI-2-8" ], "i": "metadata/signed/developer::verisignmpki-2-8", "l": 2 }, { "c": 1.0, "d": "Signed by Premium Installer", "e": [ "Premium Installer" ], "i": "metadata/signed/leaf::premium-installer", "l": 3 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "urlmon library reference", "e": [ "urlmon.dll" ], "i": "micro-behaviors/communications/http/get::urlmon-dll-reference", "l": 1 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "EEEHHHJJJ" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.60)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesA" ], "i": "objectives/evasion/process/injection::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetConnect API name as string", "e": [ "InternetConnectA" ], "i": "micro-behaviors/communications/http/get::internet-connect-str", "l": 1 }, { "c": 0.9399999976158142, "d": "Dominant largest PE section", "e": [ "binary.largest_section_ratio = 0.85" ], "i": "metadata/binary/layout::large-dominant-section", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpSendRequest API name as string", "e": [ "HttpSendRequestA" ], "i": "micro-behaviors/communications/http/get::http-send-request-str", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 79.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 79.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 570.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8399999737739563, "d": "ATL ForceRemove registry directive", "e": [ "ForceRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-forceremove-directive", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 4121.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA", "GetLocaleInfoW", "GetLocaleInfoA", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1499", "c": 0.8999999761581421, "d": "Shutdown prank markers", "e": [ "Shutdown" ], "i": "objectives/impact/ui/manipulation::shutdown-prank-markers", "l": 3 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.9700000286102295, "d": "Signed PE wrapper marker", "e": [ "pe.has_signature = 1.00" ], "i": "metadata/binary/layout::signed-pe-wrapper", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 570.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetCloseHandle API name", "e": [ "InternetCloseHandle" ], "i": "micro-behaviors/communications/http/get::internet-close-handle-str", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.9700000286102295, "d": "VirLock GUI noise import pair", "e": [ "UnpackDDElParam" ], "i": "well-known/malware/virus/virlock::gui-noise-imports", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "96293" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "URLDownloadToFile API name as string", "e": [ "URLDownloadToFileA" ], "i": "micro-behaviors/communications/http/get::url-download-to-file-str", "l": 3 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "RegisterClipboardFormatA", "OleIsCurrentClipboard", "OleFlushClipboard" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 1069208.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetReadFile API name as string", "e": [ "InternetReadFile" ], "i": "micro-behaviors/communications/http/get::internet-read-file-str", "l": 1 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.03" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 1069208.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "LocalServer32 registry word", "e": [ "LocalServer32" ], "i": "objectives/persistence/system/registry/com::localserver32-word", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 570.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.9300000071525574, "d": "Network policies registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network" ], "i": "metadata/file/text::policies-network-path", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requests highest available privileges", "e": [ "\u003crequestedExecutionLevel level=\"highestAvailable" ], "i": "micro-behaviors/os/privilege/manifest::highest-available", "l": 3 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.85" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027.002", "c": 0.949999988079071, "d": "XOR-decoded ShellExecute API", "e": [ "ShellExecuteA" ], "i": "objectives/anti-static/obfuscation/decoders::xor-decoded-shellexec-api", "l": 4 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.DLL", "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpQueryInfo API name as string", "e": [ "HttpQueryInfoA" ], "i": "micro-behaviors/communications/http/get::http-query-info-str", "l": 1 }, { "c": 0.8999999761581421, "d": "RtlGenRandom export-ordinal alias (SystemFunction036)", "e": [ "SystemFunction036" ], "i": "micro-behaviors/os/random/generator::system-function-036", "l": 3 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Call to GetDriveTypeA by raw bytes", "e": [ "GetDriveTypeA" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type-raw", "l": 1 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027.002", "c": 0.949999988079071, "d": "XOR-decoded VirtualProtect and process memory write APIs", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/decoders::xor-decoded-virtual-protect-api", "l": 4 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with dense string corpus", "e": [ "binary.string_density = 39.82" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-string-density-large-pe", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform", "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "Download", "Download", "Download", "Download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 79.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening::pe-dep", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpOpenRequest API name as string", "e": [ "HttpOpenRequestA" ], "i": "micro-behaviors/communications/http/get::http-open-request-str", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.61" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1377707542.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "Bitcoin address pattern", "e": [ "3sssssssssssssssssssssssss5", "1sssssssssssssssssssssssss5", "1sssssssssssssssssssssssss5", "1yyyyyyyyyyyyyyyyyyyyyyyyy" ], "i": "objectives/impact/ransom/encrypt::bitcoin-address", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 4121.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.76" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.98" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 5991.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1027.002", "c": 0.949999988079071, "d": "XOR-decoded VirtualAlloc memory allocation API", "e": [ "VirtualAlloc" ], "i": "objectives/anti-static/obfuscation/decoders::xor-decoded-virtual-alloc-api", "l": 4 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesA", "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 79.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…ompatibility\u003e\u003c/assembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX", "…ssembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetOpen API name as string", "e": [ "InternetOpenA" ], "i": "micro-behaviors/communications/http/get::internet-open-str", "l": 1 }, { "c": 0.75, "d": "Get window device context", "e": [ "GetWindowDC" ], "i": "micro-behaviors/ui/window/manage::get-window-dc", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense short mixed-case data tokens", "e": [ "Vzsss", "Vzssr", "Nsrss", "Nswss", "Wrsss", "Ersss", "Frsss", "Frssr", "Nqqss", "Kpssr", "ssNbrss", "Nkrss", "Nzrss", "Ngrss", "Fssss", "Nssss" ], "i": "objectives/anti-static/obfuscation/string::dense-short-mixedcase-data-tokens", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "binary.file_size = 1069208.00" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.949999988079071, "d": "Explorer policies registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" ], "i": "metadata/file/text::policies-explorer-path", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 79.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "urlmon DLL name in data", "e": [ "urlmon.dll" ], "i": "well-known/malware/trojan/elex/storm::wininet-urlmon-data-strings", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 4121.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 1.0, "d": "Overrides WndProc method", "e": [ "AfxOldWndProc423" ], "i": "objectives/collection/clipboard/monitor::wndproc-override", "l": 1 }, { "c": 0.9300000071525574, "d": "Common dialog policies registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" ], "i": "metadata/file/text::policies-comdlg32-path", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 79.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "Connect", "Connect", "Connect", "GetFolder", "Connect", "Connect" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M", "Software\\M", "Software\\M", "Software\\C" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "a": "T1027.002", "c": 0.949999988079071, "d": "XOR-decoded WinINet HTTP APIs", "e": [ "InternetOpenA", "HttpSendRequestA" ], "i": "objectives/anti-static/obfuscation/decoders::xor-decoded-http-api", "l": 4 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA", "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1027", "c": 0.75, "d": "Large .data section (\u003e70% of", "e": [ "binary.data_to_file_ratio = 0.85" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::large-data-section", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.8999999761581421, "d": "SuspendThread API reference", "e": [ "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime::suspend-thread", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.05" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 570.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "GetKeyboardState P/Invoke string reference", "e": [ "GetKeyboardState" ], "i": "micro-behaviors/hardware/input/keyboard::get-keyboard-state-str", "l": 3, "m": "E1056.001" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 1069208.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 570.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "binary.import_count = 79.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-80-imports", "l": 1 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetModuleFileNameA", "GetSystemTimeAsFileTime", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "InterlockedIncrement", "InterlockedDecrement", "WideCharToMultiByte", "GetCurrentProcessId", "SetConsoleCtrlHandler", "InitializeCriticalSectionAndSpinCount", "MultiByteToWideChar", "GetTimeZoneInformation" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 79.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1056.001", "c": 0.800000011920929, "d": "Synthesize keyboard input events", "e": [ "keybd_event" ], "i": "micro-behaviors/hardware/input/keyboard::keybd-event", "l": 3, "m": "E1056.001" }, { "c": 0.7200000286102295, "d": "WinInet DLL import name", "e": [ "WININET.dll" ], "i": "micro-behaviors/communications/http/get::wininet-dll-import-name", "l": 2 }, { "a": "T1140", "c": 0.800000011920929, "d": "Large base64 encoded payload", "e": [ "FTs9BhU1IQMLNQcRED89HhoBPWMzKiUGGzghCB07BD8VBmprHDo5ABBgAwQUOAdiHCUfMDM6NRQbBgsIFxBrIxcoPR4aODETGAETBxQ1NjsUFj1gGxAffRQWIQsTFgdr", "CChmZRsKGzsCAQdhGxYxYDE4EyAxOmI7GDghfRgoaysVKCU6GDgfeQI4MTUxOwdkHSgXZDE7B2UCOGcrAigfah8oB2ExOwtkHGEbYAIBB2oCOGIoHDwbKAIWCCsdKCU6", "FBE9GhA6Fz4cAR8xED8LGREqHzQaOj0QECg9GxMVPTgVKDVjGRA5fRVgITQZFgdkGioTFgg6ADUTJQMLEysUORorIRofEB8DEygfHh0QH2AVBj0+HAADFhEoPREZEx8F", "FTsHBh01ISMcAAcRED89HhoBPWMzKiUGGzghHhcRBD8VEwg/GjpiBQs/BzMYADFkFSoTPhAANRQRYBsHHTgIPBcoBwoZNSEDGAMTCgsRFwAUJR9kGyofZBErPREZEx8G", "FToXGhU1GyMLNQsEGTUxKBUGPTQZEDEjGigDAxcWFxUUKzUWETo5YxphOQAUOAcFGhY9ZxMqahQaJQsxExYXCBorIWsCOh8DFCsfHh0QahkUFj0qFCo9PhFgIQcdOwcG", "FygHBhE6YgMCAwcRED89HhoBPWMzKiUGGzghHhcqIQMXFRNrFwBiBBUoYjMUOwd5HBMQOwIAAz0QKhcGExYLNRU6EwoVKB9kMzoHHgIVGDsXFgc/GxAHBhEoZmETKiEE", "FCoLOwIqIQMXKgcRED89HhoBPWMzKiUGGzghHhcqIQMXFRNrFwBiBBUoYjMUOwd5HBMQOwIAAz0QKhcGExYLNRU6EwoVKB9kMzoHHgIVGDsXFgc/GxAHBhEoZmETKiEE", "ESULBggqYmURKGowAigiIBwTCwoLExszGAUHERcAMX0aKzo/NwYDABBgBzAQOBQ1EzUXGjM1G2YLOzUxHSoAIxolCDs0BgMVGwU9MBMDIT0TODo/CwAhABUrNTQQODk9", "GiUfHh06YmURKGowAigiIBwTCwoLExszGAUHERcAMX0aKzo/NwYDABBgBzAQOBQ1EzUXGjM1G2YLOzUxHSoAIxolCDs0BgMVGwU9MBMDIT0TODo/CwAhABUrNTQQODk9" ], "i": "micro-behaviors/data/encode/payload::large-base64-payload", "l": 3, "m": "C0043" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 4121.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Packed loader code-to-data ratio below 0.2", "e": [ "binary.code_to_data_ratio = 0.11" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-packed-loader-code-to-data-ratio", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.85" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "GetThreadContext API reference", "e": [ "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime::get-thread-context-dup", "l": 3 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "a": "T1055.012", "c": 0.6000000238418579, "d": "ResumeThread call", "e": [ "ResumeThread" ], "i": "objectives/evasion/process/injection/hollowing::resume-thread", "l": 1, "m": "E1055.012" }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 79.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1055.012", "c": 0.699999988079071, "d": "GetThreadContext call", "e": [ "GetThreadContext" ], "i": "objectives/evasion/process/injection/hollowing::get-thread-context", "l": 1, "m": "E1055.012" }, { "a": "T1055", "c": 0.8999999761581421, "d": "ResumeThread API reference", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime::resume-thread-dup", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 79.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE data section with base64-like blobs", "e": [ "FToHCggqEwUfAAceHREXHhoAFwczKgcAHTsfGxMqIRMUETojHBA5BBEVMTMXARcVHxEEJDAlb28=", "GishGhQ6JRMXJQsbHRMfYhUBOjs3AD0AHAMLNh07B2sVOzUaHBATZgs4CzMTBgd5GgY9Ywg6IjodABc2FDoDYxoQEx4RNSFkGAALJQsVIiQ=", "FxEhax06YmURKGowAigiIBwTCwozJRsFE2AHMRE7BCAaBRQjGTUbFRgFGzYZEwNjHBALCjMlGz4wYGpv", "FCUTNBwQF2QTKx8LEypqFRElBzALOgcQHTg1KBk4YhMaExA/FSofBAIKOTQUABM4HxEEJDAlb28=", "FAYhaxMqISMTKh8eHRULFhUBByoYAAMFMzgTYRMTMXkXASFrHwAfABQlAwQYAzYgGiUTFjQABwATYGpv", "FCUXaxo6A2QfAx8REyUfJRcWIRoYAD0TGig9ERMTMRQaExdrERAlExsDAzQZFSE4HxEEJDAlb28=", "FBATNBMqIQMLPwMxEABqJRcTHyoUEDE+GihqNh06az4VJR86GRBiZhAWajMYARtlGioTPhQWHyATYGpv", "FCoXGh06AyMQJR8HCwY5YBUAE2ACEGoVGAA9BhcVPWsVExdrHwA5BBw4NTQQOxc3Hys1Cgg6ahAaKAsIGAYHNRQAC2MzJSEVFGALMBAGYiUXJR86AgAfZh04ah4TERco", "FCs1YxU6B2QXKx8LEAMfExUTEzQTED0TFCU9MBk4YgUTNR86Gjo5Zgs1AwYdFT1iFQYiOwI6NWUXKAMDHRM2ORorNWsdOjEDFCsTMRMQMWAUEwsKHANvbw==", "FBE9HggQYj4bAx8DFDUxYhcTFwoZOgMFECgXNh01MTgVOgs6ERBifQIFIQQXKjYgGiUTZxAQFz0UKB8LEygEaxcAHwMbKgMTCzoDBxkQMSoXEwc6HQNvbw==", "FBE9NBo6OWMVJQc0ExBqHhcTHyoTEAM+Fys9YhMWYjUaBjojCwAfBhsDAwcXARQ4FCUTFggQJWYCAws2FyUfZxoqFxcYFhM+MGBqbw==", "GhEHCggTG2QQJR8wEAAhIxoBIQcbEAcEFCgTNhcWB2sVJQgjGTpiABAREwQXKGIlFSofMBcQahUQKz02GTgLNRU6EwoaNRtkMzsTCgsQMSMaAQdgGxAfZAIAPREZEDY/", "FToXGhE6YmMbAx8eHAMxYBcWah4ZOgcTECpmMBk6azgXABc0GjofABQlAwcXBgczGiUTZxAAAwAaYGpv", "FBAfBhwQMSMLPwMREAMxKhcWOjsaOjEFGwM9YhMWYnkXBRM6HyoxABQWZgcLEB8ZGioQOxAAAwAaKB8HHAMcPhU1C2sdNTVkAgETERA6MR4XEwc6HQNvbw==", "FBE9BhwQPWQUKx82EAMxExEqEzQVKgcTFCo9ERMQaz4aEwtrERBiZhAWajMYADFiFwE9PhQWHyATYGpv", "FBEhOgslISMTKgczCxMhYBcTEzQTEDE+GmATMBk6az8aBjU6ERAxABAWNQAZFj04GiUTZwIDIWoLOB8IGSoxBBcBBwMbJRtjGwpiBxkQHxkXKhM+HAADEAIGFwsUOh95" ], "i": "metadata/file/encoded::pe-dense-data-base64-like-blobs", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetModuleFileNameA, GetThreadContext, WaitForSingleObject, CreateProcessA, GetProcAddress, ... +74 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "a": "T1027.002", "c": 0.9800000190734863, "d": "Binary contains XOR-encoded critical API table", "e": [ "VirtualProtect", "InternetOpenA", "VirtualAlloc", "HttpSendRequestA", "ShellExecuteA" ], "i": "objectives/anti-static/obfuscation/decoders::xor-encoded-api-table", "l": 5 }, { "c": 0.8199999928474426, "d": "Large PE with four standard sections", "e": [ "96293", "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::large-four-section-pe", "l": 3 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "ProductVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "WinInet APIs resolved dynamically", "e": [ "HttpSendRequestA", "InternetCloseHandle", "InternetConnectA", "InternetOpenA", "HttpOpenRequestA", "InternetReadFile", "HttpQueryInfoA" ], "i": "micro-behaviors/communications/http/get::wininet-dynamic-load", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetLocaleInfoW", "GetLocaleInfoA", "GetUserDefaultLCID", "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathA", "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegCreateKeyExA", "RegSetValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "FreeEnvironmentStringsW", "GetLocaleInfoW", "EnumSystemLocalesA", "GetLocaleInfoA", "GetUserDefaultLCID", "GetEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 2, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetLocaleInfoA", "EnumSystemLocalesA", "GetCommandLineA", "FreeEnvironmentStringsW", "GetSystemTimeAsFileTime", "GetUserDefaultLCID", "GetEnvironmentStringsW", "GetLocaleInfoW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 2, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "!This program cannot be run in DOS mode. \u003cxor\u003e", "E:\\Program Files (x86)\\Microsoft Visual \u003cxor\u003e", " suggests free popular software in which \u003cxor\u003e", "Software\\Microsoft\\Windows\\CurrentVersio \u003cxor\u003e", "f:\\dd\\vctools\\vc7libs\\ship\\atlmfc\\src\\mf \u003cxor\u003e", "f:\\dd\\vctools\\vc7libs\\ship\\atlmfc\\includ \u003cxor\u003e", "%2\\protocol\\StdFileEditing\\verb\\0 \u003cxor\u003e", "%2\\protocol\\StdFileEditing\\server \u003cxor\u003e", "An application has made an attempt to lo \u003cxor\u003e", "Please contact the application's support \u003cxor\u003e", "- Attempt to use MSIL code from this a \u003cxor\u003e", "This indicates a bug in your application \u003cxor\u003e", "- not enough space for locale informatio \u003cxor\u003e", "- Attempt to initialize the CRT more tha \u003cxor\u003e", "- not enough space for lowio initializat \u003cxor\u003e", "- not enough space for stdio initializat \u003cxor\u003e", "- not enough space for _onexit/atexit ta \u003cxor\u003e", "- unexpected multithread lock error \u003cxor\u003e", "- not enough space for thread data \u003cxor\u003e", "This application has requested the Runti \u003cxor\u003e", "- not enough space for environment \u003cxor\u003e", "- not enough space for arguments \u003cxor\u003e", "- floating point support not loaded \u003cxor\u003e", "Microsoft Visual C++ Runtime Library \u003cxor\u003e", "InitializeCriticalSectionAndSpinCount \u003cxor\u003e", ".?AV?$basic_streambuf@DU?$char_traits@D@ \u003cxor\u003e", ".?AV?$basic_ofstream@DU?$char_traits@D@s \u003cxor\u003e", ".?AV?$basic_iostream@DU?$char_traits@D@s \u003cxor\u003e", ".?AV?$basic_stringstream@DU?$char_traits \u003cxor\u003e", ".?AV?$basic_ostringstream@DU?$char_trait \u003cxor\u003e", ".?AV?$basic_istringstream@DU?$char_trait \u003cxor\u003e", ".?AV?$basic_ifstream@DU?$char_traits@D@s \u003cxor\u003e", ".?AV?$CList@PAVIControlSiteFactory@@PAV1 \u003cxor\u003e", ".?AV?$CComObjectRootEx@VCComSingleThread \u003cxor\u003e", ".?AV?$_CTypedPtrList@VCPtrList@@PAUCOleC \u003cxor\u003e", ".?AV?$CTypedPtrList@VCPtrList@@PAUCOleCo \u003cxor\u003e", ".?AVXOleContainer@COleControlContainer@@ \u003cxor\u003e", ".?AVXOleIPFrame@COleControlContainer@@ \u003cxor\u003e", ".?AV?$CTypedPtrArray@VCObArray@@PAVCBitm \u003cxor\u003e", ".?AVXOleClientSite@COleControlSite@@ \u003cxor\u003e", ".?AVXOleControlSite@COleControlSite@@ \u003cxor\u003e", ".?AVXAmbientProps@COleControlSite@@ \u003cxor\u003e", ".?AVXPropertyNotifySink@COleControlSite@ \u003cxor\u003e", ".?AVXEventSink@COleControlSite@@ \u003cxor\u003e", ".?AVXBoundObjectSite@COleControlSite@@ \u003cxor\u003e", ".?AVXNotifyDBEvents@COleControlSite@@ \u003cxor\u003e", ".?AVXRowsetNotify@COleControlSite@@ \u003cxor\u003e", ".?AVXOleIPSite@COleControlSite@@ \u003cxor\u003e", ".?AV?$CArray@W4LoadArrayObjType@CArchive \u003cxor\u003e", ".?AV?$CArray@VCVariantBoolPair@@ABV1@@@ \u003cxor\u003e", "Copyright (c) 1992-2004 by P.J. Plauger, \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor → base64", "e": [ "\u003cbinary data\u003e \u003cxor+base64\u003e" ], "i": "metadata/encoded-payload/xor-base64", "l": 3 } ], "sha": "5e30a084e42cd249f52da248b89b42a01a5726cee017dfe4ee2d19bdc1ae1571", "path": "96293", "type": "pe" } ], "tv": "b2c18" } }