{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9990917444229126, "class": 2 } ], "prob": 0.99909174, "class": 2, "oprob": 0.99886215, "models": [ { "m": "az", "prob": 0.9907088, "class": 0 }, { "m": "az/native", "prob": 0.99886215, "class": 0 }, { "m": "az/pe", "prob": 0.99644756, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T07:36:29Z" }, "path": "putty.exe", "raw": { "v": "4", "fs": [ { "f": "O₇(C₂Co₂As₂AlCaDyEr)H₉(Cm₄Cr₂Db₂DsF₂Hf₂Os₄Po₄Ti)Md₃(Bi₂Si)", "k": { "hash.imp": "c6ee16909ebeee82f97a1b67ddc3334c", "pe.checksum": "0x0017a04c", "pe.timestamp": 1738409235, "signing.time": 1738409318, "hash.authenti": "1d0c14e7ee20a0d1467ae452a28a27197336f30eaca17694657541033a65a740", "signing.catalog": "authenticode", "build.target_arch": "x86", "pe.linker_version": "14.0", "signing.cert.issuer": "Sectigo Public Code Signing CA R36", "signing.cert.serial": "be8e1d85c5d2521b6d33379e3b8501a9", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.resource_types[4]": "RT_MANIFEST", "pe.resource_types[5]": "RT_2000", "signing.cert.subject": "Simon Tatham", "pe.manifest.dpi_aware": true, "signing.countersigner": "Sectigo Public Time Stamping Root R46", "pe.manifest.description": "A network client and terminal emulator", "pe.manifest.dpi_awareness": "PerMonitorV2", "pe.data_directories[0].rva": 1061112, "pe.data_directories[1].rva": 1097728, "pe.data_directories[2].rva": 1492480, "pe.data_directories[3].rva": 1478656, "pe.data_directories[4].rva": 925256, "pe.data_directories[5].rva": 909216, "pe.data_directories[6].rva": 1062676, "signing.validity.not_after": 1822089599, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 180, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 380432, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 26216, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 39552, "pe.data_directories[4].name": "tls", "pe.data_directories[4].size": 24, "pe.data_directories[5].name": "load_config", "pe.data_directories[5].size": 192, "pe.data_directories[6].name": "iat", "pe.data_directories[6].size": 1384, "signing.validity.not_before": 1727395200, "pe.version_info.company_name": "Simon Tatham", "pe.version_info.file_version": "Release 0.83 (with embedded help)", "pe.version_info.product_name": "PuTTY suite", "signing.cert.thumbprint_sha1": "66c298d018034f29b8ea1d6e90f5497fe305d2e8", "pe.version_info.internal_name": "PuTTY", "pe.load_config.security_cookie": "0x503074", "pe.version_info.legal_copyright": "Copyright © 1997-2025 Simon Tatham.", "pe.version_info.product_version": "Release 0.83", "binary.top_complex_unnamed[0].cc": 375, "binary.top_complex_unnamed[1].cc": 233, "binary.top_complex_unnamed[2].cc": 163, "binary.top_complex_unnamed[3].cc": 109, "binary.top_complex_unnamed[4].cc": 107, "binary.top_complex_unnamed[5].cc": 95, "binary.top_complex_unnamed[6].cc": 84, "binary.top_complex_unnamed[7].cc": 65, "pe.dll_characteristics.nx_compat": true, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.version_info.file_description": "SSH, Telnet, Rlogin, and SUPDUP client", "binary.top_complex_unnamed[0].bbs": 505, "binary.top_complex_unnamed[1].bbs": 458, "binary.top_complex_unnamed[2].bbs": 316, "binary.top_complex_unnamed[3].bbs": 148, "binary.top_complex_unnamed[4].bbs": 140, "binary.top_complex_unnamed[5].bbs": 150, "binary.top_complex_unnamed[6].bbs": 85, "binary.top_complex_unnamed[7].bbs": 114, "pe.version_info.original_filename": "PuTTY", "binary.top_complex_unnamed[0].addr": "0x4a1cfd", "binary.top_complex_unnamed[0].size": 5627, "binary.top_complex_unnamed[1].addr": "0x4a948d", "binary.top_complex_unnamed[1].size": 7455, "binary.top_complex_unnamed[2].addr": "0x4c2a8a", "binary.top_complex_unnamed[2].size": 5433, "binary.top_complex_unnamed[3].addr": "0x4b1941", "binary.top_complex_unnamed[3].size": 1546, "binary.top_complex_unnamed[4].addr": "0x4a7831", "binary.top_complex_unnamed[4].size": 1487, "binary.top_complex_unnamed[5].addr": "0x4c1303", "binary.top_complex_unnamed[5].size": 2455, "binary.top_complex_unnamed[6].addr": "0x4a3380", "binary.top_complex_unnamed[6].size": 1396, "binary.top_complex_unnamed[7].addr": "0x4a679c", "binary.top_complex_unnamed[7].size": 1057, "pe.manifest.assembly_identity.name": "PuTTY", "pe.manifest.assembly_identity.type": "win32", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".00cfg", "pe.section_characteristics[4].name": ".tls", "pe.section_characteristics[5].name": ".voltbl", "pe.section_characteristics[6].name": ".rsrc", "pe.section_characteristics[7].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.manifest.dependencies[0].language": "*", "pe.manifest.assembly_identity.version": "0.0.0.0", "pe.section_characteristics[0].raw_size": 820736, "pe.section_characteristics[1].raw_size": 245248, "pe.section_characteristics[2].raw_size": 3072, "pe.section_characteristics[3].raw_size": 512, "pe.section_characteristics[4].raw_size": 512, "pe.section_characteristics[5].raw_size": 512, "pe.section_characteristics[6].raw_size": 380928, "pe.section_characteristics[7].raw_size": 39936, "pe.section_characteristics[0].virtual_size": 820698, "pe.section_characteristics[1].virtual_size": 244892, "pe.section_characteristics[2].virtual_size": 12000, "pe.section_characteristics[3].virtual_size": 8, "pe.section_characteristics[4].virtual_size": 9, "pe.section_characteristics[5].virtual_size": 146, "pe.section_characteristics[6].virtual_size": 380432, "pe.section_characteristics[7].virtual_size": 39552, "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 827392, "pe.section_characteristics[2].virtual_address": 1073152, "pe.section_characteristics[3].virtual_address": 1085440, "pe.section_characteristics[4].virtual_address": 1089536, "pe.section_characteristics[5].virtual_address": 1093632, "pe.section_characteristics[6].virtual_address": 1097728, "pe.section_characteristics[7].virtual_address": 1478656, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "c0000040", "pe.section_characteristics[5].characteristics_hex": "00000000", "pe.section_characteristics[6].characteristics_hex": "40000040", "pe.section_characteristics[7].characteristics_hex": "42000040", "pe.manifest.dependencies[0].processor_architecture": "*", "pe.manifest.assembly_identity.processor_architecture": "*" }, "x": 369, "id": 0, "is": [ "BitBlt", "CreateBitmap", "CreateCompatibleBitmap", "CreateCompatibleDC", "CreateFontA", "CreateFontIndirectA", "CreatePalette", "CreatePen", "CreateSolidBrush", "DeleteDC", "DeleteObject", "ExcludeClipRect", "ExtTextOutA", "ExtTextOutW", "GetBkMode", "GetCharABCWidthsFloatA", "GetCharWidth32A", "GetCharWidth32W", "GetCharWidthA", "GetCharWidthW", "GetCharacterPlacementW", "GetCurrentObject", "GetDIBits", "GetDeviceCaps", "GetObjectA", "GetOutlineTextMetricsA", "GetPixel", "GetStockObject", "GetTextExtentExPointA", "GetTextExtentPoint32A", "GetTextMetricsA", "IntersectClipRect", "LineTo", "MoveToEx", "Polyline", "RealizePalette", "Rectangle", "SelectObject", "SelectPalette", "SetBkColor", "SetBkMode", "SetMapMode", "SetPaletteEntries", "SetPixel", "SetTextAlign", "SetTextColor", "TextOutA", "TranslateCharsetInfo", "UnrealizeObject", "UpdateColors", "ImmGetCompositionStringW", "ImmGetContext", "ImmReleaseContext", "ImmSetCompositionFontA", "ImmSetCompositionWindow", "CoCreateInstance", "CoInitialize", "CoUninitialize", "AppendMenuA", "BeginPaint", "CheckDlgButton", "CheckMenuItem", "CheckRadioButton", "CloseClipboard", "CreateCaret", "CreateDialogParamA", "CreateMenu", "CreatePopupMenu", "CreateWindowExA", "CreateWindowExW", "DefDlgProcA", "DefWindowProcA", "DefWindowProcW", "DeleteMenu", "DestroyCaret", "DestroyIcon", "DestroyWindow", "DialogBoxParamA", "DispatchMessageA", "DispatchMessageW", "DrawEdge", "DrawIconEx", "EmptyClipboard", "EnableMenuItem", "EnableWindow", "EndDialog", "EndPaint", "FindWindowA", "FlashWindow", "GetCapture", "GetCaretBlinkTime", "GetClientRect", "GetClipboardData", "GetClipboardOwner", "GetCursorPos", "GetDC", "GetDesktopWindow", "GetDlgItem", "GetDlgItemTextA", "GetDlgItemTextW", "GetDoubleClickTime", "GetForegroundWindow", "GetKeyboardLayout", "GetKeyboardState", "GetMessageA", "GetMessageTime", "GetParent", "GetQueueStatus", "GetScrollInfo", "GetSysColor", "GetSysColorBrush", "GetSystemMenu", "GetSystemMetrics", "GetWindowLongA", "GetWindowPlacement", "GetWindowRect", "GetWindowTextA", "GetWindowTextLengthA", "HideCaret", "InsertMenuA", "InvalidateRect", "IsDialogMessageA", "IsDlgButtonChecked", "IsIconic", "IsWindow", "IsZoomed", "KillTimer", "LoadCursorA", "LoadIconA", "LoadImageA", "MapDialogRect", "MessageBeep", "MessageBoxA", "MessageBoxIndirectW", "MoveWindow", "MsgWaitForMultipleObjects", "OffsetRect", "OpenClipboard", "PeekMessageA", "PeekMessageW", "PostMessageA", "PostQuitMessage", "RegisterClassA", "RegisterClassW", "RegisterClipboardFormatA", "RegisterWindowMessageA", "ReleaseCapture", "ReleaseDC", "ScreenToClient", "SendDlgItemMessageA", "SendMessageA", "SetActiveWindow", "SetCapture", "SetCaretPos", "SetClassLongA", "SetClipboardData", "SetCursor", "SetDlgItemTextA", "SetDlgItemTextW", "SetFocus", "SetForegroundWindow", "SetKeyboardState", "SetScrollInfo", "SetTimer", "SetWindowLongA", "SetWindowPlacement", "SetWindowPos", "SetWindowTextA", "SetWindowTextW", "ShowCaret", "ShowCursor", "ShowWindow", "SystemParametersInfoA", "ToAsciiEx", "TrackPopupMenu", "TranslateMessage", "UpdateWindow", "Beep", "ClearCommBreak", "CloseHandle", "CompareStringW", "ConnectNamedPipe", "CreateEventA", "CreateFileA", "CreateFileMappingA", "CreateFileW", "CreateMutexA", "CreateNamedPipeA", "CreatePipe", "CreateProcessA", "CreateThread", "DecodePointer", "DeleteCriticalSection", "DeleteFileA", "EncodePointer", "EnterCriticalSection", "EnumSystemLocalesW", "ExitProcess", "FindClose", "FindFirstFileA", "FindFirstFileExW", "FindFirstFileW", "FindNextFileA", "FindNextFileW", "FindResourceA", "FlushFileBuffers", "FormatMessageA", "FreeEnvironmentStringsW", "FreeLibrary", "GetACP", "GetCPInfo", "GetCommState", "GetCommandLineA", "GetCommandLineW", "GetConsoleMode", "GetConsoleOutputCP", "GetCurrentDirectoryA", "GetCurrentDirectoryW", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThread", "GetCurrentThreadId", "GetDateFormatW", "GetEnvironmentStringsW", "GetEnvironmentVariableA", "GetFileSizeEx", "GetFileType", "GetLastError", "GetLocalTime", "GetLocaleInfoA", "GetLocaleInfoW", "GetModuleFileNameA", "GetModuleFileNameW", "GetModuleHandleExW", "GetModuleHandleW", "GetOEMCP", "GetOverlappedResult", "GetProcAddress", "GetProcessHeap", "GetProcessTimes", "GetStartupInfoW", "GetStdHandle", "GetStringTypeW", "GetSystemDirectoryA", "GetSystemTimeAsFileTime", "GetTempPathA", "GetThreadTimes", "GetTickCount", "GetTimeFormatW", "GetTimeZoneInformation", "GetUserDefaultLCID", "GetWindowsDirectoryA", "GlobalAlloc", "GlobalFree", "GlobalLock", "GlobalMemoryStatus", "GlobalUnlock", "HeapAlloc", "HeapFree", "HeapReAlloc", "HeapSize", "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount", "InitializeSListHead", "IsDBCSLeadByteEx", "IsDebuggerPresent", "IsProcessorFeaturePresent", "IsValidCodePage", "IsValidLocale", "LCMapStringW", "LeaveCriticalSection", "LoadLibraryA", "LoadLibraryExA", "LoadLibraryExW", "LoadResource", "LocalAlloc", "LocalFileTimeToFileTime", "LocalFree", "LockResource", "MapViewOfFile", "MulDiv", "MultiByteToWideChar", "OpenProcess", "OutputDebugStringW", "QueryPerformanceCounter", "RaiseException", "ReadConsoleW", "ReadFile", "ReleaseMutex", "RtlUnwind", "SetCommBreak", "SetCommState", "SetCommTimeouts", "SetCurrentDirectoryA", "SetCurrentDirectoryW", "SetEndOfFile", "SetEnvironmentVariableW", "SetEvent", "SetFilePointerEx", "SetHandleInformation", "SetLastError", "SetStdHandle", "SetUnhandledExceptionFilter", "SizeofResource", "TerminateProcess", "TlsAlloc", "TlsFree", "TlsGetValue", "TlsSetValue", "UnhandledExceptionFilter", "UnmapViewOfFile", "WaitForSingleObject", "WaitNamedPipeA", "WideCharToMultiByte", "WriteConsoleW", "WriteFile", "ShellExecuteA", "ChooseColorA", "ChooseFontA", "GetOpenFileNameA", "GetOpenFileNameW", "GetSaveFileNameA", "GetSaveFileNameW", "AllocateAndInitializeSid", "CopySid", "EqualSid", "GetLengthSid", "GetUserNameA", "InitializeSecurityDescriptor", "RegCloseKey", "RegCreateKeyExA", "RegDeleteKeyA", "RegEnumKeyA", "RegOpenKeyExA", "RegQueryValueExA", "RegSetValueExA", "SetSecurityDescriptorDacl", "SetSecurityDescriptorOwner" ], "ms": { "pe": { "entry": 659590.0, "signer": "USERTrust RSA Certification Authority, Sectigo Public Code Signing Root R46, Sectigo Public Code Signing CA R36, Simon Tatham, Sectigo Public Time Stamping Root R46, Sectigo Public Time Stamping CA R36, Sectigo Public Time Stamping Signer R35", "machine": 332.0, "checksum": 1548364.0, "rsrc_size": 380928.0, "subsystem": 2.0, "timestamp": 1738409235.0, "icon_count": 2.0, "image_base": 4194304.0, "leaf_issuer": "Sectigo Public Code Signing CA R36", "leaf_serial": "be8e1d85c5d2521b6d33379e3b8501a9", "has_checksum": true, "has_manifest": true, "leaf_subject": "Simon Tatham", "rsrc_entropy": 7.84, "signing_time": 1738409318.0, "entry_section": ".text", "has_signature": true, "size_of_image": 1519616.0, "checksum_valid": true, "file_alignment": 512.0, "leaf_not_after": 1822089599.0, "primary_signer": "The USERTRUST Network", "resource_count": 6.0, "resource_types": [ "RT_ICON", "RT_DIALOG", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST", "RT_2000" ], "signature_type": "developer", "characteristics": 258.0, "leaf_not_before": 1727395200.0, "security_cookie": 5255284.0, "size_of_headers": 1024.0, "cert_chain_depth": 14.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 8.0, "se_handler_count": 5279744.0, "signature_digest": "87fab5578ec037039f23de49a097011ee427561e", "certificate_count": 1.0, "computed_checksum": 1548364.0, "section_alignment": 4096.0, "cert_validity_days": 1095.0, "nested_leaf_issuer": "Sectigo Public Code Signing CA R36", "resource_timestamp": 0.0, "signature_verified": true, "signer_info_issuer": "Sectigo Public Code Signing CA R36", "signer_info_serial": "be8e1d85c5d2521b6d33379e3b8501a9", "dll_characteristics": 33088.0, "nested_leaf_subject": "Simon Tatham", "has_export_timestamp": false, "has_nested_signature": true, "leaf_thumbprint_sha1": "66c298d018034f29b8ea1d6e90f5497fe305d2e8", "linker_major_version": 14.0, "leaf_eku_code_signing": true, "certificate_table_size": 26216.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "leaf_signature_algorithm": "sha384WithRSAEncryption", "signer_info_matches_leaf": true, "manifest_version_mismatch": true, "signature_digest_algorithm": "sha1", "api_hashing_indicator_count": 1.0, "nested_leaf_thumbprint_sha1": "66c298d018034f29b8ea1d6e90f5497fe305d2e8", "nested_leaf_eku_code_signing": true, "nested_leaf_signature_algorithm": "sha384WithRSAEncryption" }, "file": { "size": 1518696.0 }, "binary": { "code_size": 820736.0, "func_count": 838.0, "code_entropy": 6.57, "data_entropy": 3.97, "func_density": 1.05, "import_count": 338.0, "string_count": 4919.0, "avg_func_size": 239.96, "has_signature": true, "section_count": 8.0, "avg_complexity": 8.73, "import_density": 0.42, "max_complexity": 375.0, "string_density": 6.14, "overall_entropy": 3.94, "avg_basic_blocks": 13.96, "avg_section_size": 186432.0, "dependency_count": 8.0, "entropy_variance": 2.91, "avg_string_length": 26.03, "complexity_per_kb": 0.01, "max_string_length": 2050.0, "wide_string_count": 698.0, "avg_string_entropy": 3.43, "code_to_data_ratio": 1.22, "data_to_file_ratio": 0.0, "rsrc_to_file_ratio": 0.25, "text_to_file_ratio": 0.54, "total_basic_blocks": 11695.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 51.66, "largest_section_ratio": 0.54, "sentence_string_count": 1439.0, "sentence_string_ratio": 0.29, "writable_section_count": 2.0, "behavioral_import_ratio": 0.02, "executable_section_count": 1.0, "high_entropy_string_count": 6.0, "nonstandard_section_count": 2.0, "high_complexity_func_count": 16.0, "unnamed_complex_func_count": 16.0, "signed_with_individual_cert": true } }, "ss": [ [ 77, "!This program cannot be run in DOS mode.$" ], [ 368, ".text" ], [ 447, "@.data" ], [ 488, ".00cfg" ], [ 568, ".voltbl" ], [ 608, ".rsrc" ], [ 647, "@.reloc" ], [ 1328, "USWV" ], [ 3800, "VRQPS" ], [ 11249, "QUWS" ], [ 11272, "PUWS" ], [ 14896, "RVQSP" ], [ 15404, "QRPSW" ], [ 19072, "SWVP" ], [ 22544, "USWVP" ], [ 23900, "5D8P" ], [ 26310, "URQP" ], [ 32271, "QWRP" ], [ 35815, "PQRW" ], [ 36023, "PQRS" ], [ 38914, "D$()" ], [ 39884, "L$()" ], [ 40459, "T$()" ], [ 42260, "j QWRPj" ], [ 44702, "RPQS" ], [ 45826, "RQPW" ], [ 45943, "QRPW" ], [ 66643, "UWPQ" ], [ 66840, "QUWP" ], [ 87612, "USVP" ], [ 90947, "RVPQ" ], [ 91654, "PVSU" ], [ 117808, "USWV1" ], [ 119858, "5P8P" ], [ 127449, "URWPVS" ], [ 128488, "UPSW" ], [ 132914, "PQRUS" ], [ 134277, "QRUV" ], [ 136523, "PVRWS" ], [ 137649, "QRPV" ], [ 146958, "QPWV" ], [ 147232, "QPUV" ], [ 147490, "SUQPV" ], [ 150832, "SWPV" ], [ 160644, "wide", "Njjj" ], [ 167331, "UWRQV" ], [ 183991, "t.hj" ], [ 187986, "QPVU" ], [ 193717, "3RVW" ], [ 194062, "PUVW" ], [ 218900, "\\$()" ], [ 243798, "te\u003c\u003cu)" ], [ 250827, "A jdj" ], [ 251756, "WjrVUjsPSjlh\u003c/N" ], [ 251772, "RjphO/N" ], [ 256370, "Rjvh" ], [ 256386, "Qjlh" ], [ 257343, "Qjph" ], [ 257351, "Rjuh" ], [ 257672, "Qjrh" ], [ 259188, "j2jeh" ], [ 259713, "Qjuh" ], [ 266852, "Rjyh" ], [ 266860, "Sjmh" ], [ 266868, "Qjlha" ], [ 268770, "Rjbh" ], [ 273831, "PQRWS" ], [ 274335, "tr9o" ], [ 275104, "PQSW" ], [ 275441, "PQWV" ], [ 275485, "PUWV" ], [ 288473, "PQWSV" ], [ 311042, "VWSQ" ], [ 311870, "PQRV" ], [ 312283, "twQhtYN" ], [ 312538, "QRWSU" ], [ 313267, "2QPR" ], [ 315435, "u2hl" ], [ 318337, "2PQR" ], [ 320252, "6PUW" ], [ 324065, "X0US" ], [ 327948, "WURQP" ], [ 329123, "9RPQ" ], [ 330243, "F0WQP" ], [ 333589, "WSRQP" ], [ 333872, "RVWSP" ], [ 334381, "SRQP" ], [ 346601, "G0VP" ], [ 346659, "N0PQ" ], [ 348474, "UWPh/QN" ], [ 348912, "SUPhYQN" ], [ 352769, "QVRP" ], [ 363196, "WUPS" ], [ 375603, "V0PQR" ], [ 376929, "VWPQ" ], [ 381195, "PRVSW" ], [ 391130, "USWP" ], [ 411066, "PSUW" ], [ 411358, "wide", "Pjjjj" ], [ 419051, "RSWUP" ], [ 419774, "PUSW" ], [ 419909, "PVUS" ], [ 420161, "QPRV" ], [ 442984, "UUUV" ], [ 451375, "L$(9)v" ], [ 481102, "PWSQ" ], [ 484203, "t7j9" ], [ 485793, "WVPQ" ], [ 502080, "X0WS" ], [ 525570, "expa" ], [ 526488, "F0WP" ], [ 526737, "PSWQ" ], [ 577318, "PWUS" ], [ 584478, "VUSPW" ], [ 609040, "PUPPR" ], [ 617503, "UVSW" ], [ 624251, "323z" ], [ 658111, "SVW3" ], [ 658150, "Genu" ], [ 658168, "5ntel" ], [ 669685, "QSVW" ], [ 671232, "PRRRRR" ], [ 673756, "BSVW" ], [ 674937, "F88G" ], [ 680184, "QQSV" ], [ 689765, "PVWS" ], [ 690346, "SV8A" ], [ 697921, "PSRW" ], [ 700831, "QQVW" ], [ 702950, "PSSSSS" ], [ 708512, "f90t" ], [ 708545, "f97t" ], [ 708592, "QQSVW" ], [ 713247, "PVVS" ], [ 715148, "F8YY" ], [ 719843, "PRWV" ], [ 719979, "XPWV" ], [ 720432, "HPWV" ], [ 730770, "WPRQ" ], [ 732933, "PSWS" ], [ 736624, "RSPQ" ], [ 739552, "UVWS" ], [ 750004, "M$j\"^QRRRRR" ], [ 752075, "QWPV" ], [ 756810, "/PjSW" ], [ 760086, "9E WW" ], [ 763853, "f98t" ], [ 767333, "SSSQ" ], [ 769600, "WVS3" ], [ 773520, "WVU3" ], [ 773890, "SVRQ" ], [ 778545, "SVWP" ], [ 784730, "VPRQ" ], [ 785528, "PVVVVV" ], [ 785944, "_PVVVVV" ], [ 786259, "WVVVVV" ], [ 786481, "PVSRSQV" ], [ 789410, "9p t" ], [ 790893, "WQRP" ], [ 790904, "RWQRP" ], [ 792089, "PPPPPVW" ], [ 792147, "QQQP" ], [ 792244, "PPPSV" ], [ 792270, "PP9E u!PPSVP" ], [ 793300, "UQPXY]Y[" ], [ 802618, "r49z" ], [ 803089, "YYPV" ], [ 807333, "HSVW" ], [ 809193, "PPPV" ], [ 814702, "WQVS" ], [ 824080, "MNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz@[\\]^_`{" ], [ 824136, "bjnh.lyku" ], [ 852232, "%s Key File Warning" ], [ 852252, "You are loading an SSH-2 private key which has an\nold version of the file format. This means your key\nfile is not fully tamperpr" ], [ 852302, "old version of the file format. This means your key" ], [ 852354, "file is not fully tamperproof. Future versions of" ], [ 852404, "%s may stop supporting this private key format," ], [ 852452, "so we recommend you convert your key to the new" ], [ 852500, "format." ], [ 852509, "You can perform this conversion by loading the key" ], [ 852560, "into PuTTYgen and then saving it again." ], [ 852600, "The session log file \"%.*s\" already exists.\nYou can overwrite it with a new session log,\nappend your session log to the end of i" ], [ 852602, "The session log file \"%.*s\" already exists." ], [ 852646, "You can overwrite it with a new session log," ], [ 852691, "append your session log to the end of it," ], [ 852733, "or disable session logging for this session." ], [ 852778, "Hit Yes to wipe the file, No to append to it," ], [ 852824, "or Cancel to disable logging." ], [ 859696, "CueaaaaceeeiiiAAE**ooouuyOUc$YPsaiounNao?++**!\u003c\u003e###||||++||++++++--|-+||++--|-+----++++++++##||#aBTPEsyt******EN=+\u003e\u003c++-=... n2*" ], [ 859825, "!cL.Y|S\"Ca\u003c--R~o+23'u|.,1o\u003e///?AAAAAAACEEEEIIIIDNOOOOOxOUUUUYPBaaaaaaaceeeeiiiionooooo/ouuuuypy" ], [ 865480, "wide", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 866223, "%$%a%b%V%U%c%Q%W%]%\\%[%" ], [ 866257, "%\u003c%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%" ], [ 866556, "d2c178c49a0ae6fa9ef75ca84fb3c9d0d675ea85" ], [ 872556, "Release 0.83" ], [ 873056, "PuTTY downstream no longer available" ], [ 873116, "SSHCONNECTION@putty.projects.tartarus.org-2.0-" ], [ 883896, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], [ 906800, "INITY" ], [ 906808, "inity" ], [ 906879, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 910168, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 910552, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 911298, "wide", "PENU" ], [ 911334, "wide", "PENA" ], [ 911346, "wide", "PNLB" ], [ 911358, "wide", "PENC" ], [ 911382, "wide", "PZHI" ], [ 911394, "wide", "PCHS" ], [ 911442, "wide", "PCHT" ], [ 911490, "wide", "PENL" ], [ 911514, "wide", "PENB" ], [ 911526, "wide", "PENI" ], [ 911538, "wide", "PENJ" ], [ 911550, "wide", "PENZ" ], [ 911562, "wide", "PENS" ], [ 911574, "wide", "PENT" ], [ 911586, "wide", "PENG" ], [ 911622, "wide", "PFRB" ], [ 911634, "wide", "PFRC" ], [ 911646, "wide", "PFRL" ], [ 911658, "wide", "PFRS" ], [ 911670, "wide", "PDEA" ], [ 911682, "wide", "PDEC" ], [ 911694, "wide", "PDEL" ], [ 911706, "wide", "PDES" ], [ 911730, "wide", "PITS" ], [ 911742, "wide", "PNOR" ], [ 911766, "wide", "PNON" ], [ 911778, "wide", "PPTB" ], [ 911802, "wide", "PESB" ], [ 911814, "wide", "PESL" ], [ 911826, "wide", "PESO" ], [ 911838, "wide", "PESC" ], [ 911850, "wide", "PESD" ], [ 911862, "wide", "PESF" ], [ 911874, "wide", "PESE" ], [ 911886, "wide", "PESG" ], [ 911898, "wide", "PESH" ], [ 911910, "wide", "PESM" ], [ 911922, "wide", "PESN" ], [ 911934, "wide", "PESI" ], [ 911946, "wide", "PESA" ], [ 911958, "wide", "PESZ" ], [ 911970, "wide", "PESR" ], [ 911982, "wide", "PESU" ], [ 911994, "wide", "PESY" ], [ 912006, "wide", "PESV" ], [ 912018, "wide", "PSVF" ], [ 912082, "wide", "PUSA" ], [ 912094, "wide", "PGBR" ], [ 912106, "wide", "PCHN" ], [ 912118, "wide", "PCZE" ], [ 912154, "wide", "PNLD" ], [ 912166, "wide", "PHKG" ], [ 912178, "wide", "PNZL" ] ], "sz": 1518696, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: USERTrust RSA Certification Authority", "e": [ "USERTrust RSA Certification Authority" ], "i": "metadata/signed/developer::usertrust-rsa-certification-authority", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Sectigo Public Code Signing Root R46", "e": [ "Sectigo Public Code Signing Root R46" ], "i": "metadata/signed/developer::sectigo-public-code-signing-root-r46", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Sectigo Public Code Signing CA R36", "e": [ "Sectigo Public Code Signing CA R36" ], "i": "metadata/signed/developer::sectigo-public-code-signing-ca-r36", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Simon Tatham", "e": [ "Simon Tatham" ], "i": "metadata/signed/developer::simon-tatham", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Sectigo Public Time Stamping Root R46", "e": [ "Sectigo Public Time Stamping Root R46" ], "i": "metadata/signed/developer::sectigo-public-time-stamping-root-r46", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Sectigo Public Time Stamping CA R36", "e": [ "Sectigo Public Time Stamping CA R36" ], "i": "metadata/signed/developer::sectigo-public-time-stamping-ca-r36", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Sectigo Public Time Stamping Signer R35", "e": [ "Sectigo Public Time Stamping Signer R35" ], "i": "metadata/signed/developer::sectigo-public-time-stamping-signer-r35", "l": 2 }, { "c": 1.0, "d": "Signed by The USERTRUST Network", "e": [ "The USERTRUST Network" ], "i": "metadata/signed/leaf::the-usertrust-network", "l": 3 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.43" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "RegSetValueExA" ], "i": "objectives/command-and-control/dropper/staging/embedded::registry-powershell-byte-payload--rx-4", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-localization-l1-2-1", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-fibers-l1-1-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-synch-l1-2-0", "api-ms-" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2 }, { "c": 0.75, "d": "Clear clipboard contents", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "l": 3 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 838.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "PE Authenticode dual-signed (NestedSignature attribute)", "e": [ "pe.has_nested_signature = 1.00" ], "i": "metadata/signed/certificate::pe-cert-nested-signature", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.94" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage/control::set-window-text", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 338.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.75, "d": "Find window by class/title (ANSI)", "e": [ "FindWindowA" ], "i": "micro-behaviors/ui/window/manage/control::find-window-a-import", "l": 2 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "Downstream (connecting to the upstream PuTTY)", "upstream added want_reply flag", "Could not set up connection sharing as upstream: %s" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-14", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "Release 0.83 (with embedded help)" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "d": "HOMEPATH environment variable", "e": [ "HOMEPATH" ], "i": "micro-behaviors/os/env/vars/user-info::homepath-var", "l": 2 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "Cipher", "cipher" ], "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage/control::kill-timer", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.73" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 3 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 4919.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount", "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (Unicode)", "e": [ "PeekMessageW" ], "i": "micro-behaviors/os/message/queue::peek-message-w", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI GetDIBits pixel readback", "e": [ "GetDIBits" ], "i": "micro-behaviors/hardware/display/screen::gdi-getdibits", "l": 3, "m": "C0014" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "putty.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassW", "RegisterClassA" ], "i": "micro-behaviors/ui/window/manage/control::register-class", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "MIT-Magic-Cookie-1", "MIT-MAGIC-COOKIE-1" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-7", "l": 1, "m": "C0027" }, { "d": "X11 MIT-MAGIC-COOKIE authentication", "e": [ "MIT-MAGIC-COOKIE-1" ], "i": "micro-behaviors/dylib/library/family::x11-auth-protocol", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 3, "m": "C0014" }, { "a": "T1071.001", "c": 0.8199999928474426, "d": "Printf route placeholder segment", "e": [ "%s::/%s.html\u003emain" ], "i": "objectives/command-and-control/channel/http/stego::printf-route-placeholder", "l": 1, "m": "B0030" }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "Keyboard sends Telnet special commands", "SSH to proxy and execute a command", "Sending Telnet proxy command:", "Session sent command exit status %d", "Remote command:", "Server sent command exit status %d", "force-command", "config-command", "'Telnet' (send an ad-hoc command)", "Forced remote command", "Started a shell/command", "/config-proxy-command.html", "connection via local command", "/pageant-cmdline-command.html", "Unable to create pipes for proxy command: %s", "/config-command.html" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 338.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage/control::dispatch-message", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 338.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-word", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 1.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.699999988079071, "d": "Custom message box display", "e": [ "MessageBoxIndirectW" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-indirect", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 838.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/rsa import", "e": [ "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/rsa.c" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-rsa", "l": 1 }, { "c": 0.75, "d": "Open clipboard access", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard", "l": 3 }, { "c": 1.0, "d": "GUI binary declares DPI awareness", "e": [ "true" ], "i": "metadata/build/manifest::pe-dpi-aware", "l": 2 }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "loop finished" ], "i": "micro-behaviors/crypto/symmetric/xor/loop::asm-loop-control-transfer", "l": 2 }, { "c": 0.6499999761581421, "d": "Get text from dialog control", "e": [ "GetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item-text", "l": 2 }, { "d": "certificate string reference", "e": [ "certificate", "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1021.004", "c": 0.6000000238418579, "d": "SSH keyboard-interactive auth method", "e": [ "Attempt \"keyboard-interactive\" auth (SSH-2)", "keyboard-interactive authentication prompt", "Authentication plugin agreed to help with keyboard-interactive", "End of keyboard-interactive prompts from server", "Server refused keyboard-interactive authentication", "Authentication plugin declined to help with keyboard-interactive", "Authentication plugin failed to set up keyboard-interactive authentication:", "Attempting keyboard-interactive authentication", "Authentication plugin declined to help with keyboard-interactive: %.*s", "End of keyboard-interactive prompts from plugin" ], "i": "micro-behaviors/communications/ssh/client::keyboard-interactive", "l": 3 }, { "c": 0.7799999713897705, "d": "SetClipboardData string reference", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data-text", "l": 3 }, { "c": 1.0, "d": "Large PE resource section with high entropy", "e": [ ".rsrc (size: 380928, entropy: 7.84)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-high-entropy-rsrc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "public_y", "Full text of host's public key", "Bad SSH-1 public key packet", "Key file contains public key only", "public_exponent", "Offered public key", "Public key of certification authority", "SSH-1 public key", "not a public key or a PuTTY SSH-2 private key", "PublicKey", "public_affine_x", "public_affine_y", "publickey", "Select public key file of certification authority", "Received public keys", "Unable to parse RSA public key packet" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8500000238418579, "d": "Get message (ANSI)", "e": [ "GetMessageA" ], "i": "micro-behaviors/os/message/queue::get-message-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage/control::set-timer", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Bun loader AES CBC marker", "e": [ "aes256-cbc" ], "i": "objectives/command-and-control/dropper/delivery/http::bun-loader-aes-cbc", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Write data to clipboard", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "l": 3 }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage/control::get-window-rect", "l": 2 }, { "a": "T1612", "c": 0.8500000238418579, "d": "Large PE resource section", "e": [ ".rsrc (size: 380928)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-rsrc-section", "l": 1, "m": "B0023" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 338.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 380928)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage/control::screen-to-client", "l": 2 }, { "a": "T1115", "c": 0.8199999928474426, "d": "Clipboard command fragment", "e": [ "/config-clipboards.html", "Control pasting of text from clipboard to terminal", "Auto-copy selected text to system clipboard", "Copy to clipboard in RTF as well as plain text", "System clipboard", "term-\u003emouse_select_clipboards[0] == CLIP_LOCAL", "Options controlling copying from terminal to clipboard", "Assign copy/paste actions to clipboards", "clipboard == CLIP_SYSTEM", "clipboards[i] != CLIP_LOCAL" ], "i": "objectives/collection/clipboard/capture::clipboard-fragment", "l": 3 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA", "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "SSH2_MSG_KEXRSA_SECRET" ], "i": "micro-behaviors/data/text/keywords/lexicon::secret", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "Noninteractive SSH proxy cannot confirm weak crypto primitive", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/aes-ni.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/sha512.h", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/arcfour.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/sha256.h", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/diffie-hellman.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/sha1-select.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/openssh-certs.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/mlkem.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/aes-select.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/aesgcm-select.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/sha512-select.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/aes-sw.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/sha256-select.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/ntru.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/sha1.h" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr", "l": 1 }, { "c": 1.0, "d": "Uses named pipe IPC APIs", "e": [ "ConnectNamedPipe", "CreateNamedPipeA", "WaitNamedPipeA" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage", "l": 3 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/aes import", "e": [ "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/aes-ni.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/aes-sw.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/aes-select.c", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/crypto/aesgcm-select.c" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-aes", "l": 1 }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2 }, { "c": 0.7400000095367432, "d": "EmptyClipboard string reference", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard-text", "l": 3 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "KUSER_SHARED_DATA structure access (uptime)", "e": [ "00 00 FE 7F" ], "i": "micro-behaviors/time/timing/check::kuser-shared-data", "l": 3, "m": "B0003.003" }, { "a": "T1071.001", "c": 0.8799999952316284, "d": "Command endpoint path marker", "e": [ "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/cmdline.c" ], "i": "objectives/command-and-control/beacon/network/json::c2-command-result-endpoints", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage/control::is-window", "l": 2 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "c": 0.75, "d": "argon2 key derivation", "e": [ "Argon2-Parallelism", "Argon2-Memory", "Argon2-Passes" ], "i": "micro-behaviors/crypto/kdf/algorithm::argon2", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Location string", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/ssh/verstring.c", "Unable to decode terminal mode string", "unfinished multibyte encoding at end of string", "Version string did not have expected prefix", "consumed_from_main_string \u003c= len", "false \u0026\u0026 \"Should never try to send packets during SSH version \" \"string exchange\"", "Version string far too long", "'' occurred at end of string (expected another character)", "WSAAddressToStringA", "Empty string", "Certificate ID string is \"%s\"", "Terminal-type string", "!cs-\u003esent_verstring", "Downstream version string: %.*s", "Certificate ID string" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1021.004", "c": 0.4000000059604645, "d": "ssh string", "e": [ "ssh" ], "i": "micro-behaviors/communications/ssh/connect::ssh-string", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Query timezone configuration", "e": [ "GetTimeZoneInformation" ], "i": "micro-behaviors/time/query::get-timezone-information", "l": 2 }, { "c": 0.30000001192092896, "d": "zlib compression reference", "e": [ "zlib", "Zlib" ], "i": "micro-behaviors/dylib/library/family::zlib-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "a": "T1552.004", "c": 0.75, "d": "PuTTY private key (.ppk) extension", "e": [ ".ppk" ], "i": "objectives/collection/file-targeting/filter::ppk-extension", "l": 3, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Demo screenshot failure" ], "i": "objectives/command-and-control/channel/websocket::rat-command-media-capture--rx-6", "l": 1, "m": "B0030" }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0x7fffffff", "0x3617de4a", "0x4f1970c6", "0x10000000", "0x216936d3", "0xb3312fa7", "0x5ac635d8", "0xFFFFFFFF", "0x01ffffff", "0xffffffff" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "c": 0.699999988079071, "d": "gethostbyname import string", "e": [ "gethostbyname" ], "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import", "l": 2 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied", "Network error: Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\S" ], "i": "objectives/anti-static/obfuscation/payload/registry::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 1738409235.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "PE has an Authenticode signature", "e": [ "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-is-authenticode-signed", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 338.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.6000000238418579, "d": "Hex byte format string", "e": [ "type %d / 0x%02x (%s)" ], "i": "micro-behaviors/data/encode/payload::hex-byte-format", "l": 2 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST, RT_2000]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingA" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "a": "T1210", "c": 0.8600000143051147, "d": "Redis KEYS command", "e": [ "keys" ], "i": "objectives/lateral-movement/exploit/container::redis-keys-command", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "putty.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.57" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage/control::set-foreground-window", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.29" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage/control::send-message-a", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with many wide strings", "e": [ "binary.wide_string_count = 698.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::heavy-wide-string-corpus", "l": 1, "m": "B0032" }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SUPDUPOUTPUT", "COMBOBOX", "STARTTLS", "HOMEDRIVE", "LINEMODE", "XDISPLOC", "HOMEPATH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 1.0, "d": "PE Authenticode signature cryptographically valid", "e": [ "pe.signature_verified = 1.00" ], "i": "metadata/signed/certificate::pe-signature-verified", "l": 2 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "CONNECT %s HTTP/1.1\r\nHost: %s" ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "c": 0.699999988079071, "d": "BSD license reference", "e": [ "BSD" ], "i": "metadata/package/license::bsd-word", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 338.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage/control::get-dc", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_valid = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 338.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextA" ], "i": "micro-behaviors/ui/window/manage/control::get-window-text", "l": 2 }, { "c": 0.6000000238418579, "d": "Clipboard keyword", "e": [ "OpenClipboard", "term-\u003emouse_select_clipboards[0] == CLIP_LOCAL", "/config-clipboards.html", "Assign copy/paste actions to clipboards", "clipboards[i] != CLIP_LOCAL", "SetClipboardData", "GetClipboardData", "Auto-copy selected text to system clipboard", "EmptyClipboard", "C\u0026opy All to Clipboard", "CloseClipboard", "clipboard == CLIP_SYSTEM", "Control pasting of text from clipboard to terminal", "Options controlling copying from terminal to clipboard", "RegisterClipboardFormatA", "GetClipboardOwner" ], "i": "micro-behaviors/data/text/keywords/clipboard::clipboard-token", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 1.0, "d": "signatures word", "e": [ "signatures" ], "i": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1195", "c": 0.699999988079071, "d": "Regex component marker", "e": [ "ppl" ], "i": "well-known/malware/dropper/dragonbreath::dragonbreath-ppl-edr-neutralization-text--rx-1", "l": 1 }, { "a": "T1021.004", "c": 0.6000000238418579, "d": "libssh library reference", "e": [ "curve25519-sha256@libssh.org" ], "i": "micro-behaviors/communications/ssh/client::libssh", "l": 3 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage/control::def-window-proc", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.800000011920929, "d": "Query current foreground window", "e": [ "GetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage/control::get-foreground-window", "l": 2 }, { "a": "T1071.001", "d": "Basic authentication", "e": [ "Authorization: Basic" ], "i": "micro-behaviors/communications/http/headers::basic-auth", "l": 3, "m": "C0002" }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 1.0, "d": "Issued by Sectigo Code Signing CA", "e": [ "Sectigo Public Code Signing CA R36" ], "i": "metadata/signed/certificate::pe-cert-issuer-sectigo", "l": 2 }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"public_key_token\":\"6595b64144ccf1df\",\"language\"" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "token" ], "i": "micro-behaviors/data/text/keywords/lexicon::token", "l": 1 }, { "c": 0.7400000095367432, "d": "OpenClipboard string reference", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard-text", "l": 3 }, { "d": "IRC QUIT command in binary", "e": [ "QUIT" ], "i": "objectives/command-and-control/channel/irc/bot::pe-irc-quit", "l": 1 }, { "c": 0.699999988079071, "d": "PEM begin marker", "e": [ "-----BEGIN", "-----BEGIN OPENSSH PRIVATE KEY" ], "i": "micro-behaviors/crypto/certificate/usage::pem-begin", "l": 2 }, { "a": "T1071.001", "d": "HTTP header syntax marker", "e": [ "HTTP/1.1\r\nHost: " ], "i": "objectives/command-and-control/channel/http/protocol::http-delimiter", "l": 1 }, { "d": "OpenSSH string", "e": [ "OpenSSH_2.[235]*", "OpenSSH_7.[2-7]*", "…ified key (forbidden by OpenSSH certificate specificati…", "a CBC-mode cipher in OpenSSH ETM mode", "OpenSSH SSH-2 private key (old PEM format)", "key algorithms do not match in OpenSSH public key file", "OpenSSH SSH-2 private key (new format)", "OpenSSH_2.5.[0-3]*", "SSH-2 public key (OpenSSH format)", "OpenSSH_3.[0-2]*", "OpenSSH_2.[0-2]*", "OpenSSH_6.[0-6]*", "OpenSSH_2.[0-4]*", "OpenSSH_[2-5].*", "invalid length for base64 data in OpenSSH public key file", "no key blob in OpenSSH public key file" ], "i": "micro-behaviors/communications/ssh/connect::openssh", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 3, "m": "C0014" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::lock-resource", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 380928.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Printable output", "%s expects an output filename", "Input/output error", "%s expects input and output filenames", "PuTTY remote printer output", "!hs-\u003eoutput_eof_pending", "All session output", "Printer to send ANSI printer output to:" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.8799999952316284, "d": "High entropy resource section (encrypted payload)", "e": [ "pe.rsrc_entropy = 7.84" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-high-rsrc-entropy", "l": 1 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-file-l1-2-2", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-fibers-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-localization-obsolete-l1-2-0" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code IN token", "e": [ " IN " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-in", "l": 1, "m": "B0007.003" }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.1" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "a": "T1543.003", "c": 0.9399999976158142, "d": "WSAEventSelect referenced as text", "e": [ "WSAEventSelect" ], "i": "objectives/command-and-control/backdoor/binary::wsa-event-select-text", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage/control::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "d": "password keyword", "e": [ "Confirm new password:", "Server requested password change", "SSHLogOmitPasswords", "Sent new password", "Sent password", "SSH1_CMSG_AUTH_PASSWORD", "Received unexpected packet in response to password authentication, type %d (%s)", "/faq-password-remember.html", "Current password (blank for previously entered password):", "SOCKS 5 authentication cannot support passwords longer than 255 chars", "unable to read a password from file '%s'", "Server rejected new password", "SOCKS 5 password reply had version number %d (expected %d)", "password-change prompt", "unable to open password file '%s'", "/faq-password-fails.html" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 3072)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 3, "m": "E1106" }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "LocalFileTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.949999988079071, "d": "Windows path join format string", "e": [ "HKEY_CURRENT_USER\\%s\\%s", "Unable to create registry key\nHKEY_CURRENT_USER\\%s\\%s" ], "i": "micro-behaviors/fs/path/construct::windows-system-path-join-format", "l": 1 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 380928, entropy: 7.84)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 0.75, "d": "Read data from clipboard", "e": [ "GetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::get-clipboard-data", "l": 3 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 3 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 3 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 3 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "7FC28940-9D31-11D0-9B27-00A0C91E9C7C" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "config-serial-speed", "Speed (baud)", "TerminalSpeed", "client subnegotiation: SB TSPEED IS %s", "SerialSpeed", "TSPEED", "server subnegotiation: SB TSPEED \u003csomething weird\u003e", "/config-serial-speed.html", "/config-termspeed.html", "config-termspeed", "Terminal speeds", "server subnegotiation: SB TSPEED SEND" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-77", "l": 1 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "14 37 50 00", "b8 39 50 00", "cc 3b 50 00", "68 3b 50 00", "00 39 50 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 3, "m": "C0014" }, { "a": "T1110.001", "c": 0.8999999761581421, "d": "Weak password master", "e": [ "master" ], "i": "objectives/lateral-movement/brute-force/password::weak-pass-master", "l": 1, "m": "E1110" }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols/exports::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.6499999761581421, "d": "Set text in dialog control", "e": [ "SetDlgItemTextW" ], "i": "micro-behaviors/ui/dialog/prompt::set-dialog-item-text", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST, RT_2000]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage/control::enable-window", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "a": "T1559", "c": 0.699999988079071, "d": "Wait for named pipe server", "e": [ "WaitNamedPipeA" ], "i": "micro-behaviors/communications/ipc/named-pipe::wait-named-pipe", "l": 3 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"assembly_identity\":{\"version\":\"0.0.0.0\",\"processor_architecture\":\"*\",\"name\":\"PuTTY\",\"type\":\"win32\"},\"description\":\"A network c" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "MoveToEx" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.6499999761581421, "d": "Close clipboard", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard", "l": 3 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "putty.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.7799999713897705, "d": "Register custom clipboard format", "e": [ "RegisterClipboardFormatA" ], "i": "micro-behaviors/os/clipboard/access::register-clipboard-format-a", "l": 3 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 380928.00" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-large-rsrc-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "ToUnicodeEx P/Invoke string reference", "e": [ "ToUnicodeEx" ], "i": "micro-behaviors/hardware/input/keyboard/hook::to-unicode-ex-str", "l": 3, "m": "E1056.001" }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage/control::destroy-window", "l": 2 }, { "c": 0.30000001192092896, "d": "xterm terminal reference", "e": [ "Disable xterm-style mouse reporting", "xterm (Right extends, Middle pastes)", "Allow terminal to use xterm 256-colour mode", "/config-xtermcolour.html", "xterm-style bitmap", "config-xtermcolour" ], "i": "micro-behaviors/process/tty/terminal::xterm-ref", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token", "e": [ " ID ", "-ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003" }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.9900000095367432, "d": "MSVC C++ runtime strerror diagnostic string", "e": [ "Visual C++ CRT: Not enough memory to complete call to strerror." ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-strerror-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.94" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8500000238418579, "d": "Signed binary with personal-name leaf cert", "e": [ "binary.signed_with_individual_cert = 1.00" ], "i": "metadata/binary/anomaly/format::binary-signed-with-individual-cert", "l": 3 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "a": "T1543.003", "c": 0.9399999976158142, "d": "WSAEnumNetworkEvents referenced as text", "e": [ "WSAEnumNetworkEvents" ], "i": "objectives/command-and-control/backdoor/binary::wsa-enum-network-events-text", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 338.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 838.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.57)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Tool identity claims PuTTY", "e": [ "PuTTY" ], "i": "metadata/package/tooling::tool-identity-putty", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "d": "overflow keyword", "e": [ "!bs-\u003eoverflowed" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Long hex M strings in rdata", "e": [ "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437", "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437", "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437", "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437", "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437", "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437" ], "i": "objectives/anti-static/obfuscation/payload/section::long-hexm-string-cluster", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage/control::post-quit-message", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 4919.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "putty.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 338.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-over-120", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.8600000143051147, "d": "RAT screen capture command", "e": [ "screenshot" ], "i": "objectives/command-and-control/remote-command/tasking::rat-screen-capture-command", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Using 3DES encryption", "The %s selected for this session is %s, which, with this server, is vulnerable to the 'Terrapin' attack CVE-2023-48795, potentia", "Using single-DES encryption", "Trying to enable encryption...", "Successfully started encryption", "Initialised %s outbound encryption", "Miscomputes SSH-2 encryption keys", "SSH-1 public key encryptions failed due to bad formatting", "Server violates SSH-1 protocol by not supporting 3DES encryption", "Initialised %s encryption", "/config-ssh-encryption.html", "Using Blowfish encryption", "Initialised %s inbound encryption", "/sshnames-encrypt.html", "Options controlling SSH encryption", "config-ssh-encryption" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-4", "l": 1, "m": "B0040" }, { "c": 0.8999999761581421, "d": "PE certificate table entry populated", "e": [ "pe.certificate_table_size = 26216.00" ], "i": "metadata/binary/layout::cert-table-present", "l": 1 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 3, "m": "C0014" }, { "c": 0.75, "d": "Query active window title length", "e": [ "GetWindowTextLengthA" ], "i": "micro-behaviors/ui/window/manage/control::get-window-text-length", "l": 2 }, { "c": 0.8500000238418579, "d": "PuTTY identity string", "e": [ "…thing to do with SSH!)\n\nPuTTY Master Key as of 2023 (…", "not a PuTTY SSH-2 private key", "PuTTY: information about the server's host key", "PuTTY Licence", "PuTTY key format too new", "Software\\SimonTatham\\PuTTY\\Sessions", "PuTTY-User-Key-File-1", "…the fingerprints of the PuTTY PGP Master Keys. They c…", "not a public key or a PuTTY SSH-2 private key", "PuTTYHostKeyDialog", "…by loading the key\ninto PuTTYgen and then saving it a…", "SimonTatham.PuTTY", "name=\"PuTTY\"", "into PuTTYgen and then saving it again.", "PuTTY downstream no longer available", "PuTTY Private Key Files (*.ppk)" ], "i": "objectives/supply-chain/trojanized/app/monitor::putty-identity-string", "l": 1 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "putty.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "CloseClipboard string reference", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard-text", "l": 3 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-a", "l": 2 }, { "c": 0.9399999976158142, "d": "AES-256-CTR cipher marker", "e": [ "aes256-ctr" ], "i": "micro-behaviors/crypto/symmetric/aes/ctr::aes-256-ctr-term", "l": 3, "m": "C0021.001" }, { "c": 0.8500000238418579, "d": "COM Both threading model", "e": [ "Both" ], "i": "objectives/persistence/system/registry/com::threadingmodel-both-word", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll", "ADVAPI32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 338.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Connection/SSH/Auth/Credentials", "Connection closed by remote host", "Connected to %s", "Connection/SSH/Cipher", "Connection/SSH/Tunnels", "Connecting to %s", "Connection/Proxy", "Connection sharing: %s", "Connection/SSH/Host keys", "Connection/Telnet", "Connection/SSH/Bugs", "Connection/SSH/Kex", "Network error: Connection timed out", "Connection/SSH/More bugs", "Network error: Connection reset by peer", "Connection sharing downstream #%u: %s" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e", "\u003c\u003c\u003cObsolete\u003e\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "a": "T1021.004", "c": 0.6000000238418579, "d": "SSH user authentication protocol string", "e": [ "ssh-userauth" ], "i": "micro-behaviors/communications/ssh/client::ssh-userauth", "l": 3 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "binary.import_count = 338.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "c": 0.4000000059604645, "d": "Blowfish keyword", "e": [ "Blowfish" ], "i": "micro-behaviors/crypto/library/keyword::blowfish-keyword", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 11695.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 3 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "d": "HOMEDRIVE environment variable", "e": [ "HOMEDRIVE" ], "i": "micro-behaviors/os/env/vars/user-info::homedrive-var", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "No credentials are available in the security package.", "GSSAPI authentication failed to get credentials", "FreeCredentialsHandle", "Connection/SSH/Auth/Credentials", "GSS credentials updated", "AcquireCredentialsHandleA", "Credentials to authenticate with" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-2", "l": 1 }, { "c": 0.7599999904632568, "d": "GetClipboardData string reference", "e": [ "GetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::get-clipboard-data-text", "l": 3 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.7599999904632568, "d": "Winsock startup API string", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage/control::release-dc", "l": 2 }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage/control::invalidate-rect", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 4919.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "HTTP CONNECT proxy tunneling", "e": [ "HTTP CONNECT" ], "i": "micro-behaviors/communications/http/request/client::http-connect-proxy", "l": 4 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Clipboard class or symbol reference", "e": [ "Clipboard" ], "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "l": 3 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::module-stomping-target", "l": 1 }, { "a": "T1559", "c": 0.6499999761581421, "d": "ConnectNamedPipe API call", "e": [ "ConnectNamedPipe" ], "i": "micro-behaviors/communications/ipc/named-pipe::connect-named-pipe", "l": 3 }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableA" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "putty.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.6000000238418579, "d": "High maximum function complexity", "e": [ "binary.max_complexity = 375.00" ], "i": "metadata/binary/metrics/structural::high-max-complexity", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 838.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/", "0123456789abcdefABCDEF:", "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/=" ], "i": "objectives/anti-static/obfuscation/encoding/stream::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "a": "T1559", "c": 0.699999988079071, "d": "CreateNamedPipe API call", "e": [ "CreateNamedPipeA" ], "i": "micro-behaviors/communications/ipc/named-pipe::create-named-pipe", "l": 3 }, { "a": "T1033", "c": 0.8999999761581421, "d": "Query current username", "e": [ "GetUserNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-user-name", "l": 3 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image/pixel::pixel-access-getpixel", "l": 2 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.800000011920929, "d": "winmm library import", "e": [ "winmm.dll" ], "i": "objectives/evasion/anti-av/import-pollution::winmm-library", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Delete registry key via import", "e": [ "RegDeleteKeyA" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-key-a-symbol", "l": 3 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "GetKeyboardState P/Invoke string reference", "e": [ "GetKeyboardState" ], "i": "micro-behaviors/hardware/input/keyboard/hook::get-keyboard-state-str", "l": 3, "m": "E1056.001" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "(Storing this certified key in the cache will NOT cause its certification authority to be trusted for any other key or host.)", "If you want to carry on connecting but without updating the cache, %s.", "Noninteractive SSH proxy cannot confirm weak cached host key", "Store key in cache?", "which does not match the certified key %s had previously cached for this server.", "If you want to carry on connecting just once, without adding the key to the cache, %s.", "populating transient host key cache", "ALSO, that key does not match the key %s had previously cached for this server.", "The host key is not cached for this server:", "Cache new host key type", "If you were expecting this change and trust the new key, %s to update %s's cache and carry on connecting.", "Accepting certified host key anyway based on cache", "If you trust this host, %s to add the key to %s's cache and carry on connecting.", "/home/simon/mem/.build/workdirs/bob-ko_aa4bt/putty/ssh/transient-hostkey-cache.c", "The host key does not match the one %s has cached for this server:", "Update cached key?" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 838.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextA" ], "i": "objectives/command-and-control/backdoor/shell/com::get-window-text-import", "l": 1, "m": "B0025" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "putty.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1486", "c": 0.8999999761581421, "d": "Generate cryptographic random bytes", "e": [ "CryptGenRandom" ], "i": "micro-behaviors/os/random/generator::crypt-gen-random", "l": 2, "m": "C0027" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 4919.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.84)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 3, "m": "C0027" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "SetPixel" ], "i": "micro-behaviors/data/encode/image/pixel::pixel-access-setpixel", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "ApplicationCursorKeys", "ConnectionSharingUpstream", "LocalPortAcceptAll", "SetDefaultDllDirectories", "FullScreenOnAltEnter", "RemotePortAcceptAll", "GetNamedPipeClientProcessId", "InitializeSecurityDescriptor", "ConnectionSharingDownstream", "GetSystemMetricsForDpi", "SetSecurityDescriptorOwner", "UserNameFromEnvironment", "AdjustWindowRectExForDpi", "ScrollBarFullScreen", "DwmGetWindowAttribute", "SetCurrentProcessExplicitAppUserModelID" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1033", "c": 0.8500000238418579, "d": "Allocate and initialize SID", "e": [ "AllocateAndInitializeSid" ], "i": "micro-behaviors/os/privilege/check::allocate-initialize-sid", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryW", "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.import_count = 338.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-3--inline-29165", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "OpenSSL ChaCha20-Poly1305", "e": [ "ChaCha20-Poly1305" ], "i": "micro-behaviors/crypto/symmetric/stream::openssl-chacha-poly", "l": 3 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{7FC28940-9D31-11D0-9B27-00A0C91E9C7C}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 3, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA", "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "l": 2 }, { "a": "T1071.001", "d": "Authorization header", "e": [ "Proxy-Authorization: Digest", "Proxy-Authorization: Basic" ], "i": "micro-behaviors/communications/http/headers::auth-header", "l": 3, "m": "C0002" }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/shell/com::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariableA" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001" }, { "a": "T1559", "c": 0.800000011920929, "d": "Named pipe path prefix", "e": [ "\\\\.\\pipe\\" ], "i": "micro-behaviors/communications/ipc/named-pipe::pipe-path-prefix", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.import_count = 338.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-9--inline-29171", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1552.004", "c": 0.800000011920929, "d": "PuTTY sessions registry reference", "e": [ "Software\\SimonTatham\\PuTTY\\Sessions" ], "i": "objectives/credential-access/ssh/key::putty-sessions", "l": 3 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 1738409235.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll mouse cursor position", "e": [ "GetCursorPos" ], "i": "micro-behaviors/hardware/input/keyboard/hook::get-cursor-pos", "l": 2, "m": "E1056.001" }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-a", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 338.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "ENCRYPT", "encrypt" ], "i": "micro-behaviors/crypto/library/keyword::encrypt-fn", "l": 3 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "Software\\SimonTatham\\PuTTY64\\CHMPath", "GetTempPathA", "Software\\SimonTatham\\PuTTY\\CHMPath", "SHGetFolderPathA" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032" }, { "a": "T1027.002", "c": 0.699999988079071, "d": "High maximum function complexity (obfuscation)", "e": [ "binary.max_complexity = 375.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-max-complexity", "l": 3, "m": "B0032" }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMDLG32.dll (ChooseColorA, ChooseFontA, GetOpenFileNameA, GetOpenFileNameW, GetSaveFileNameA, ... +1 more)", "e": [ "COMDLG32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (BitBlt, CreateBitmap, CreateCompatibleBitmap, CreateCompatibleDC, CreateFontA, ... +45 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links IMM32.dll (ImmGetCompositionStringW, ImmGetContext, ImmReleaseContext, ImmSetCompositionFontA, ImmSetCompositionWindow)", "e": [ "IMM32.dll" ], "i": "metadata/dylib::imm32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (AppendMenuA, BeginPaint, CheckDlgButton, CheckMenuItem, CheckRadioButton, ... +114 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, CoInitialize, CoUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (Beep, ClearCommBreak, CloseHandle, CompareStringW, ConnectNamedPipe, ... +134 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (AllocateAndInitializeSid, CopySid, EqualSid, GetLengthSid, GetUserNameA, ... +10 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.800000011920929, "d": "X.509 certificate handling (legitimate)", "e": [ "Certificate", "certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-handling", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetLocaleInfoW", "EnumSystemLocalesW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-fingerprinting-imports", "l": 2 }, { "a": "T1115", "c": 0.949999988079071, "d": "Win32 cryptocurrency clipboard hijacker (clipper)", "e": [ "OpenClipboard", "SetClipboardData", "EnumSystemLocalesW", "EnumSystemLocalesEx", "GetClipboardData", "CreateThread" ], "i": "objectives/collection/clipboard/capture::win32-crypto-clipper", "l": 5 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesEx", "GetLocaleInfoW", "GetUserDefaultLCID", "GetLocaleInfoA", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2 }, { "c": 0.8999999761581421, "d": "Pipe creation with handle redirect", "e": [ "SetStdHandle", "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::pipe-io-redirect", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "ReadFile", "CreateFileA", "CreateFileW", "GetModuleFileNameA", "SetFilePointerEx" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetProcessWindowStation", "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "c": 0.8199999928474426, "d": "Win32 clipboard read and write access", "e": [ "OpenClipboard", "SetClipboardData", "EmptyClipboard", "GetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::win32-clipboard-read-write", "l": 3 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindNextFileA", "FindFirstFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "a": "T1113", "c": 0.9399999976158142, "d": "Windows GDI active window capture primitives", "e": [ "CreateCompatibleDC", "BitBlt", "GetDC", "CreateCompatibleBitmap", "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::gdi-window-capture-primitives", "l": 3, "m": "C0014" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 wide APIs", "e": [ "FindClose", "FindNextFileW", "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker-wide", "l": 2 }, { "a": "T1115", "c": 0.800000011920929, "d": "Clipboard read and write APIs", "e": [ "SetClipboardData", "GetClipboardData" ], "i": "objectives/credential-access/clipboard/crypto::clipboard-rw", "l": 1, "m": "E1510" }, { "a": "T1021.004", "c": 0.75, "d": "SSH client/auth library", "e": [ "curve25519-sha256@libssh.org", "Authentication plugin failed to set up keyboard-interactive authentication:", "Authentication plugin declined to help with keyboard-interactive: %.*s", "ssh-userauth", "Attempt \"keyboard-interactive\" auth (SSH-2)", "Server refused keyboard-interactive authentication", "End of keyboard-interactive prompts from server", "Attempting keyboard-interactive authentication", "Authentication plugin agreed to help with keyboard-interactive", "keyboard-interactive authentication prompt", "Authentication plugin declined to help with keyboard-interactive", "End of keyboard-interactive prompts from plugin" ], "i": "micro-behaviors/communications/ssh/client::library-comp", "l": 3 }, { "a": "T1113", "c": 0.9300000071525574, "d": "Windows GDI screenshot primitives", "e": [ "GetDIBits", "CreateCompatibleDC", "CreateCompatibleBitmap", "GetDesktopWindow", "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-screen-capture-primitives", "l": 3, "m": "C0014" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.800000011920929, "d": "Thread synchronization via message queue", "e": [ "CreateThread", "PeekMessageA" ], "i": "micro-behaviors/process/threading/async::thread-message-sync", "l": 2 }, { "a": "T1559", "c": 0.8199999928474426, "d": "Named pipe server and client wait", "e": [ "ConnectNamedPipe", "WaitNamedPipeA", "CreateNamedPipeA" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-client-server", "l": 3 }, { "a": "T1021.004", "c": 0.6600000262260437, "d": "SSH connection", "e": [ "ssh" ], "i": "micro-behaviors/communications/ssh/connect::connect-comp", "l": 3 }, { "a": "T1021.004", "c": 0.8500000238418579, "d": "SSH authentication implementation", "e": [ "End of keyboard-interactive prompts from server", "ssh-userauth", "Permission denied", "Attempting keyboard-interactive authentication", "Server refused keyboard-interactive authentication", "Authentication plugin declined to help with keyboard-interactive", "Network error: Permission denied", "Authentication plugin declined to help with keyboard-interactive: %.*s", "Attempt \"keyboard-interactive\" auth (SSH-2)", "keyboard-interactive authentication prompt", "curve25519-sha256@libssh.org", "Authentication plugin agreed to help with keyboard-interactive", "End of keyboard-interactive prompts from plugin", "Authentication plugin failed to set up keyboard-interactive authentication:" ], "i": "micro-behaviors/communications/ssh/client::full-implementation", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceA", "LockResource", "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource extraction API chain", "e": [ "LoadResource", "FindResourceA", "SizeofResource", "LoadLibraryExA" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-loader-api-chain", "l": 3 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "SizeofResource", "FindResourceA", "LockResource", "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-full-extraction", "l": 3 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file/script::module-path-delete", "l": 2, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyExA", "RegSetValueExA", "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "c": 0.800000011920929, "d": "Clipboard read/write API context", "e": [ "clipboard == CLIP_SYSTEM", "/config-clipboards.html", "Options controlling copying from terminal to clipboard", "OpenClipboard", "SetClipboardData", "Auto-copy selected text to system clipboard", "term-\u003emouse_select_clipboards[0] == CLIP_LOCAL", "GetClipboardData", "clipboards[i] != CLIP_LOCAL", "GetClipboardOwner", "Control pasting of text from clipboard to terminal", "C\u0026opy All to Clipboard", "Assign copy/paste actions to clipboards", "SetClipboardData", "EmptyClipboard", "RegisterClipboardFormatA" ], "i": "objectives/collection/clipboard/capture::ethereum-address", "l": 3 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "ExitProcess", "CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "c": 1.0, "d": "SSH protocol with authentication methods", "e": [ "curve25519-sha256@libssh.org", "Authentication plugin agreed to help with keyboard-interactive", "Authentication plugin failed to set up keyboard-interactive authentication:", "End of keyboard-interactive prompts from plugin", "Attempting keyboard-interactive authentication", "keyboard-interactive authentication prompt", "Attempt \"keyboard-interactive\" auth (SSH-2)", "ssh-userauth", "Authentication plugin declined to help with keyboard-interactive", "End of keyboard-interactive prompts from server", "Server refused keyboard-interactive authentication", "Authentication plugin declined to help with keyboard-interactive: %.*s" ], "i": "objectives/lateral-movement/brute-force/ssh::ssh-with-auth", "l": 1 }, { "a": "T1497.001", "c": 0.8799999952316284, "d": "User-interaction trigger APIs (mouse/keyboard/window monitoring)", "e": [ "GetForegroundWindow", "GetCursorPos" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::user-interaction-trigger-cluster", "l": 3 }, { "c": 0.8500000238418579, "d": "Resource extraction to temp directory", "e": [ "LockResource", "GetTempPathA", "FindResourceA", "LoadResource", "SizeofResource" ], "i": "objectives/command-and-control/dropper/staging/embedded::pe-resource-temp-stager-persistence-chain", "l": 1 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.func_count = 838.00", "binary.overall_entropy = 3.94" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "/config-clipboards.html", "Assign copy/paste actions to clipboards", "Options controlling copying from terminal to clipboard", "Auto-copy selected text to system clipboard", "EmptyClipboard", "CloseClipboard", "clipboard == CLIP_SYSTEM", "RegisterClipboardFormatA", "GetClipboardData", "OpenClipboard", "GetClipboardOwner", "C\u0026opy All to Clipboard", "Control pasting of text from clipboard to terminal", "SetClipboardData", "term-\u003emouse_select_clipboards[0] == CLIP_LOCAL", "SetClipboardData" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 }, { "a": "T1559", "c": 0.800000011920929, "d": "Named pipe server creation", "e": [ "CreateNamedPipeA", "ConnectNamedPipe" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-server", "l": 3 }, { "a": "T1553.002", "c": 0.949999988079071, "d": "Signed PE with abuse-pattern cluster", "e": [ "Sectigo Public Time Stamping CA R36", "USERTrust RSA Certification Authority", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-localization-l1-2-1", "Sectigo Public Code Signing CA R36", "api-ms-win-core-fibers-l1-1-0", "pe.has_nested_signature = 1.00", "Sectigo Public Code Signing Root R46", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-processthreads-l1-1-2", "Sectigo Public Code Signing CA R36", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "Sectigo Public Time Stamping Root R46" ], "i": "objectives/command-and-control/dropper/execution/loader::signed-pe-with-anomaly-cluster", "l": 5, "m": "B0009" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegCreateKeyExA", "RegOpenKeyExA", "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "CreateMutexA", "STARTTLS", "HOMEPATH", "SUPDUPOUTPUT", "HOMEDRIVE", "XDISPLOC", "LINEMODE", "COMBOBOX" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetEnvironmentStringsW", "EnumSystemLocalesEx", "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetLocaleInfoA", "GetUserDefaultLCID", "EnumSystemLocalesW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "a": "T1083", "c": 0.8500000238418579, "d": "File system enumeration pattern", "e": [ "FindFirstFileW", "FindNextFileW" ], "i": "objectives/collection/file-targeting/enumeration::file-enumeration-targeting", "l": 1, "m": "C0000" }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "EnumSystemLocalesW", "GetUserDefaultLCID", "GetLocaleInfoW", "GetCurrentThreadId", "GetEnvironmentStringsW", "GetCommandLineA", "FreeEnvironmentStringsW", "GetCommandLineW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "a": "T1612", "c": 0.8500000238418579, "d": "Disproportionately large icon resources (payload carrier)", "e": [ "pe.icon_count = 2.00", ".rsrc (size: 380928)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-icon-resource", "l": 4, "m": "B0023" }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI window capture with screen context", "e": [ "GetDesktopWindow", "CreateCompatibleDC", "GetWindowTextLengthA", "CreateCompatibleBitmap", "GetWindowTextA", "GetDC", "GetForegroundWindow", "BitBlt" ], "i": "objectives/collection/screenshot/capture::gdi-window-capture", "l": 2, "m": "C0014" }, { "a": "B0030", "c": 0.9300000071525574, "d": "GUID mutex with crypto and network", "e": [ "Version string far too long", "unfinished multibyte encoding at end of string", "Certificate ID string is \"%s\"", "'' occurred at end of string (expected another character)", "consumed_from_main_string \u003c= len", "Certificate ID string", "ChaCha20-Poly1305", "Downstream version string: %.*s", "{7FC28940-9D31-11D0-9B27-00A0C91E9C7C}", "Unable to decode terminal mode string", "Version string did not have expected prefix", "WSAAddressToStringA", "Empty string", "aes256-ctr", "Terminal-type string", "Location string" ], "i": "objectives/command-and-control/beacon/mutex::mutex-guid-crypto-http-coordination", "l": 4 }, { "a": "T1115", "c": 0.9700000286102295, "d": "Clipboard stealer with C2 endpoints", "e": [ "GetWindowTextLengthA", "GetDC", "OpenClipboard", "GetForegroundWindow", "CreateCompatibleDC", "GetWindowTextA", "SetClipboardData", "BitBlt", "GetDesktopWindow", "CreateCompatibleBitmap" ], "i": "objectives/collection/clipboard/capture::clipboard-stealer-with-c2", "l": 5, "m": "B0047" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetCommandLineW", "GetLocaleInfoW", "GetUserDefaultLCID", "EnumSystemLocalesEx", "GetEnvironmentStringsW", "GetCommandLineA", "GetSystemTimeAsFileTime", "GetLocaleInfoA", "EnumSystemLocalesW", "FreeEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "://QtatFetvp:Fazgtrp:XFVzxegpffpq:Agt{fs \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "60f715bf82b9edb35e54d95b02e2960666d5872c61c2cd0fc02f7da81f7d2e2c", "path": "/data/samples/good/datasets/Malware-ai-project/putty.exe", "type": "pe" } ], "tv": "d376d" } }