{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9434438943862915 } ], "prob": 0.9434439, "models": [ { "m": "az", "prob": 0.9434439, "class": 0 }, { "m": "az/native", "prob": 0.8245243, "class": 0 }, { "m": "az/pe", "prob": 0.8844697, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-02T10:06:41Z" }, "path": "61e167f9e1703baf78d68b40e7cecd90b2899c0f79f15ab3e870e9f75f30f758.dll", "raw": { "v": "6", "fs": [ { "f": "O₂(DyEr)H(Po)Md(Bi)", "x": 9, "ff": { "i": [ [ "kernel32", "ExitProcess" ], [ "kernel32", "GetComputerNameA" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "IsBadReadPtr" ], [ "kernel32", "Sleep" ], [ "kernel32", "IsBadWritePtr" ], [ "kernel32", "FlushInstructionCache" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "VirtualProtect" ], [ "kernel32", "GetVersionExA" ], [ "kernel32", "GetSystemTime" ], [ "kernel32", "CreateThread" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "InterlockedCompareExchange" ], [ "kernel32", "InterlockedExchange" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "IsProcessorFeaturePresent" ], [ "user32", "SetRect" ], [ "user32", "MessageBoxA" ], [ "msvcr100", "??2@YAPAXI@Z" ], [ "msvcr100", "stricmp" ], [ "msvcr100", "malloc_crt" ], [ "msvcr100", "encoded_null" ], [ "msvcr100", "initterm" ], [ "msvcr100", "initterm_e" ], [ "msvcr100", "amsg_exit" ], [ "msvcr100", "CppXcptFilter" ], [ "msvcr100", "crt_debugger_hook" ], [ "msvcr100", "clean_type_info_names_internal" ], [ "msvcr100", "unlock" ], [ "msvcr100", "dllonexit" ], [ "msvcr100", "lock" ], [ "msvcr100", "onexit" ], [ "msvcr100", "except_handler4_common" ], [ "msvcr100", "localtime64" ], [ "msvcr100", "vsnprintf" ], [ "msvcr100", "free" ], [ "msvcr100", "memmove" ], [ "msvcr100", "sprintf" ], [ "msvcr100", "CxxFrameHandler3" ], [ "msvcr100", "CIsqrt" ], [ "msvcr100", "memset" ], [ "msvcr100", "time64" ] ], "m": { "pe": { "checksum": 80217.0, "has_manifest": 1.0, "has_safe_seh": 1.0, "checksum_valid": 0.0, "resource_count": 1.0, "computed_checksum": 80473.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 9.0, "base_relocation_entry_count": 1343.0 }, "file": { "size": 37376.0, "entropy": 6.41, "size_bytes": 37376.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.46, "data_entropy": 2.13, "string_count": 345.0, "overall_entropy": 6.41, "entropy_variance": 2.24, "avg_string_length": 12.25, "max_string_length": 424.0, "code_to_data_ratio": 0.98, "string_length_stddev": 24.42, "largest_section_ratio": 0.7, "sentence_string_count": 8.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 54.0 }, "sections": { "count": 5.0, "code_size": 26112.0, "entropy_max": 6.46, "entropy_mean": 4.94, "name_entropy": 3.21, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 215, "u8", "RRich" ], [ 480, "u8", ".text" ], [ 559, "u8", "@.data" ], [ 600, "u8", ".rsrc" ], [ 639, "u8", "@.reloc" ], [ 3427, "u8", "QSVW" ], [ 5574, "u8", "SVWP" ], [ 15501, "u8", "90te95X" ], [ 16605, "u8", "VPVPhd" ], [ 16686, "u8", "VPVPh" ], [ 21091, "u8", "SVW3" ], [ 24599, "u8", "QQS3" ], [ 24604, "u8", "VW9E" ], [ 25248, "u8", "u WPS" ], [ 25289, "u8", "uCWVS" ], [ 27468, "u8", "Shift" ], [ 27476, "u8", "Ctrl" ], [ 27484, "u8", "R-Click" ], [ 27492, "u8", "L-Click" ], [ 27500, "u8", "Auto" ], [ 27520, "u8", "Fast" ], [ 27528, "u8", "Slow" ], [ 27556, "u8", "Enemy" ], [ 27564, "u8", "Body" ], [ 27596, "u8", "Close" ], [ 27604, "u8", "Open" ], [ 27624, "u8", "xx????xxxxxx" ], [ 27656, "u8", "xx????xxxx????" ], [ 27688, "u8", "xx????xx????xxx" ], [ 27720, "u8", "xx????x?xx????xxx??xx????" ], [ 27824, "u8", "xx????xxx?????xx" ], [ 27864, "u8", "xxxxxxxxx????xxx" ], [ 27904, "u8", "xxxxxx?x?xxx????" ], [ 27944, "u8", "xxxx??xxxxxx?" ], [ 28000, "u8", "xx?xxxxxx?xxxxxx?" ], [ 28040, "u8", "xxxxx????xx" ], [ 28064, "u8", "x????xxxx????xxx" ], [ 28104, "u8", "xx????x????xxxx??" ], [ 28144, "u8", "xxxxxxxx??x" ], [ 28188, "xor", "user32.dll" ], [ 28238, "u8", "lFgwBpjkXh~cBlcjOD" ], [ 28288, "u8", "hawhbd:8%hab" ], [ 28360, "u8", "zYCGKLD" ], [ 28380, "u8", "xx????xx????xx" ], [ 28412, "u8", "Neck" ], [ 28420, "u8", "Head" ], [ 28428, "u8", "R UpperArm" ], [ 28440, "u8", "L UpperArm" ], [ 28452, "u8", "R Forearm" ], [ 28464, "u8", "R Hand" ], [ 28472, "u8", "L Forearm" ], [ 28484, "u8", "L Hand" ], [ 28492, "u8", "Spine3" ], [ 28500, "u8", "Root" ], [ 28508, "u8", "L Thigh" ], [ 28516, "u8", "L Calf" ], [ 28524, "u8", "L Foot" ], [ 28532, "u8", "R Thigh" ], [ 28540, "u8", "R Calf" ], [ 28548, "u8", "R Foot" ], [ 28580, "u8", "TARGET" ], [ 28588, "u8", "%d-%d-%d" ], [ 28600, "u8", "Win XP" ], [ 28608, "u8", "Win Vista" ], [ 28817, "u8", "Crosshair" ], [ 28829, "u8", "Esp Bone" ], [ 28841, "u8", "Esp HP" ], [ 28853, "u8", "Esp Name" ], [ 28865, "u8", "Esp Dist" ], [ 28877, "u8", "Esp Line" ], [ 28889, "u8", "Esp Box" ], [ 28901, "u8", "Esp Team" ], [ 28925, "u8", "Macro Awp" ], [ 28937, "u8", "No Recoil 80%" ], [ 28953, "u8", "Aim Bullet Bredet" ], [ 28973, "u8", "Aim Bot" ], [ 28985, "u8", "Show Target" ], [ 29001, "u8", "Show FOV" ], [ 29013, "u8", "Set FOV" ], [ 29025, "u8", "Keys" ], [ 29033, "u8", "Sensitive" ], [ 29045, "u8", "Target Pos" ], [ 29061, "u8", "Target Lock" ], [ 29076, "u8", "Player_Hack" ], [ 29089, "u8", "No AFK" ], [ 29101, "u8", "Hide Nick" ], [ 29113, "u8", "Quick Change" ], [ 29129, "u8", "Quick Reload" ], [ 29144, "u8", "Hide/Show Menu [DELETE]" ], [ 29176, "u8", "Tahoma" ], [ 29184, "u8", "Consolas" ], [ 29196, "u8", "Arial" ], [ 29212, "url", "\u0002i:\u0002i:\u0002i" ], [ 29228, "u8", "kernel32.dll" ], [ 29244, "u8", "EnterCriticalSection" ], [ 29276, "u8", "Exception hit parsing imports" ], [ 29308, "u8", "xxx????xx??xxxxxxx????xxxx??xx" ], [ 29372, "u8", "xxx????x????xxxxxxxx????x????xxxxxx????xxxxxxxxxxxxx??" ], [ 29484, "u8", "xxx????xxxxxxxxxx????xx" ], [ 29556, "u8", "xxx????xxx????x????" ], [ 29612, "u8", "PhysxCore.2.8.1.dll" ], [ 29640, "u8", "_CIsqrt" ], [ 29648, "u8", "api-ms-win-crt-math-l1-1-0.dll" ], [ 29688, "u8", "2021" ], [ 29696, "u8", "NOTICE" ], [ 29704, "u8", "EXPIRED" ], [ 30176, "u8", "RSDS" ], [ 30200, "u8", "C:\\Users\\AFI\\documents\\Visual Studio 2010\\Projects\\Free\\Release\\NEW GEN V3\\Teh.pdb" ], [ 31458, "u8", "ExitProcess" ], [ 31472, "u8", "GetComputerNameA" ], [ 31492, "u8", "VirtualQuery" ], [ 31508, "u8", "GetCurrentProcess" ], [ 31528, "u8", "GetTickCount" ], [ 31544, "u8", "IsBadReadPtr" ], [ 31560, "u8", "Sleep" ], [ 31568, "u8", "IsBadWritePtr" ], [ 31584, "u8", "FlushInstructionCache" ], [ 31608, "u8", "GetProcAddress" ], [ 31626, "u8", "GetModuleHandleA" ], [ 31646, "u8", "VirtualProtect" ], [ 31664, "u8", "GetVersionExA" ], [ 31680, "u8", "GetSystemTime" ], [ 31696, "u8", "CreateThread" ], [ 31710, "u8", "KERNEL32.dll" ], [ 31726, "u8", "MessageBoxA" ], [ 31740, "u8", "SetRect" ], [ 31748, "u8", "USER32.dll" ], [ 31762, "u8", "sprintf" ], [ 31772, "u8", "memmove" ], [ 31782, "u8", "free" ], [ 31790, "u8", "_vsnprintf" ], [ 31804, "u8", "_localtime64" ], [ 31820, "u8", "_time64" ], [ 31830, "u8", "??2@YAPAXI@Z" ], [ 31844, "u8", "MSVCR100.dll" ], [ 31860, "u8", "_stricmp" ], [ 31872, "u8", "_malloc_crt" ], [ 31886, "u8", "_encoded_null" ], [ 31902, "u8", "_initterm" ], [ 31914, "u8", "_initterm_e" ], [ 31928, "u8", "_amsg_exit" ], [ 31942, "u8", "__CppXcptFilter" ], [ 31960, "u8", "_crt_debugger_hook" ], [ 31982, "u8", "__clean_type_info_names_internal" ], [ 32018, "u8", "_unlock" ], [ 32028, "u8", "__dllonexit" ], [ 32050, "u8", "_onexit" ], [ 32060, "u8", "_except_handler4_common" ], [ 32086, "u8", "EncodePointer" ], [ 32102, "u8", "DecodePointer" ], [ 32118, "u8", "InterlockedExchange" ], [ 32140, "u8", "InterlockedCompareExchange" ], [ 32170, "u8", "TerminateProcess" ], [ 32190, "u8", "UnhandledExceptionFilter" ], [ 32218, "u8", "SetUnhandledExceptionFilter" ], [ 32248, "u8", "IsDebuggerPresent" ], [ 32268, "u8", "QueryPerformanceCounter" ], [ 32294, "u8", "GetCurrentThreadId" ], [ 32316, "u8", "GetCurrentProcessId" ], [ 32338, "u8", "GetSystemTimeAsFileTime" ], [ 32364, "u8", "memset" ], [ 32384, "u8", "__CxxFrameHandler3" ], [ 32406, "u8", "IsProcessorFeaturePresent" ], [ 33368, "u8", "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 33443, "u8", "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 33499, "u8", "\u003csecurity\u003e" ], [ 33515, "u8", "\u003crequestedPrivileges\u003e" ], [ 33544, "u8", "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 33640, "u8", "\u003c/requestedPrivileges\u003e" ], [ 33670, "u8", "\u003c/security\u003e" ], [ 33687, "u8", "\u003c/trustInfo\u003e" ], [ 33703, "u8", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD" ], [ 34185, "u8", "22262\u003e2}2" ], [ 34449, "u8", "5%5.5@5I5" ], [ 34797, "u8", "797G7a7g7q7y7" ], [ 34937, "u8", "\u003c \u003c$\u003c(\u003c,\u003c0\u003c4\u003c8\u003c\u003c\u003c@\u003cD\u003cH\u003cL\u003cP\u003cT\u003cX\u003c\\\u003c`\u003cd\u003ch\u003cl\u003cp\u003ct\u003c" ], [ 35031, "u8", "\u003e2\u003eS\u003ef\u003ev\u003e" ], [ 35765, "u8", "020J0O0U0h0y0" ], [ 36504, "u8", "h0l0p0t0x0|0" ] ], "v": { "file.stem": "61e167f9e1703baf78d68b40e7cecd90b2899c0f79f15ab3e870e9f75f30f758", "pe.imphash": "9a3884b5b8da0579bb9b8a31186211b6", "pe.machine": "i386", "pe.rich.key": 1387355353, "pe.rich.hash": "1d702d76d60dd2012a97cd40ce4cba90", "pe.subsystem": "windows_gui", "pe.timestamp": 1613563940, "file.basename": "61e167f9e1703baf78d68b40e7cecd90b2899c0f79f15ab3e870e9f75f30f758.dll", "pe.image_base": 268435456, "pe.image_size": 73728, "pe.machine_id": 332, "pe.os_version": "5.1", "build.username": "AFI", "pe.entry_point": 28466, "build.user_home": "C:\\Users\\AFI", "pe.headers_size": 1024, "build.build_root": "C:\\Users\\AFI\\documents", "pe.debug.pdb.age": 2, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.debug.pdb.guid": "876065c5-45cf-4cda-8d57-c4f42d432c45", "pe.debug.pdb.path": "C:\\Users\\AFI\\documents\\Visual Studio 2010\\Projects\\Free\\Release\\NEW GEN V3\\Teh.pdb", "pe.debug.pdb.stem": "Teh", "pe.file_alignment": 512, "pe.image_hash.sha1": "9d6c9794080e73762cf2ecb5b4cebaa4281cf7f1", "build.username_from": "pdb_path", "pe.load_config.size": 72, "pe.image_hash.sha256": "1615cd1d9f897f5aff7e18d6be3454be1620772d4ac15410a66ac13dac009d72", "pe.image_hash.sha384": "2cca7a793d80eea66bcbe594ceb5fd5e22017ac013c68e4e4fe5b18194e71bd4559139d0edde53e867fbab1f361ccf1f", "pe.image_hash.sha512": "cf6066bca07f05b191c351b0602801c2e728fd13349dc16f7b769d91e0b031f9a0971246698d098d46df3207f97623c8193576850acff3e1824b0f84e27b5a27", "pe.resource_types[0]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "5.1", "build.source_paths[0]": "C:\\Users\\AFI\\documents\\Visual", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.debug.pdb.basename": "Teh.pdb", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 8450, "pe.debug.pdb.timestamp": 1613563940, "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 10, "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "codeview", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.data_directories[0].rva": 36780, "pe.data_directories[1].rva": 65536, "pe.data_directories[2].rva": 69632, "pe.data_directories[3].rva": 33056, "pe.data_directories[4].rva": 35736, "pe.data_directories[5].rva": 32768, "pe.dll_characteristics_raw": 320, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 436, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 2768, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "load_config", "pe.data_directories[4].size": 64, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 228, "pe.debug.entries[0].type_id": 2, "pe.rich.entries[0].build_id": 156, "pe.rich.entries[1].build_id": 152, "pe.rich.entries[2].build_id": 158, "pe.rich.entries[3].build_id": 170, "pe.rich.entries[4].build_id": 171, "pe.rich.entries[5].build_id": 147, "pe.rich.entries[6].build_id": 1, "pe.rich.entries[7].build_id": 175, "pe.rich.entries[8].build_id": 157, "pe.rich.entries[0].use_count": 2, "pe.rich.entries[1].use_count": 1, "pe.rich.entries[2].use_count": 3, "pe.rich.entries[3].use_count": 12, "pe.rich.entries[4].use_count": 3, "pe.rich.entries[5].use_count": 5, "pe.rich.entries[6].use_count": 63, "pe.rich.entries[7].use_count": 1, "pe.rich.entries[8].use_count": 1, "pe.coff.dos_header_pe_pointer": 232, "pe.rich.entries[0].product_id": 30319, "pe.rich.entries[1].product_id": 20115, "pe.rich.entries[2].product_id": 30319, "pe.rich.entries[3].product_id": 30319, "pe.rich.entries[4].product_id": 30319, "pe.rich.entries[5].product_id": 30729, "pe.rich.entries[7].product_id": 30319, "pe.rich.entries[8].product_id": 30319, "pe.debug.entries[0].size_bytes": 107, "pe.load_config.security_cookie": 268476416, "pe.base_relocations.block_count": 9, "pe.base_relocations.entry_count": 1343, "pe.load_config.se_handler_count": 2, "pe.load_config.se_handler_table": 268471376, "pe.base_relocations.padding_count": 5, "pe.debug.entries[0].timestamp_unix": 1613563940, "pe.manifest.requested_execution_level": "asInvoker" }, "id": "pe", "sc": [ [ ".text", 1024, 26112, 6.46, "r-x" ], [ ".rdata", 27136, 5632, 5.09, "r--" ], [ ".data", 32768, 512, 2.13, "rw-" ], [ ".rsrc", 33280, 512, 5.1, "r--" ], [ ".reloc", 33792, 3584, 5.91, "r--" ] ] }, "id": 0, "sz": 37376, "ts": [ { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2, "el": [ "7bd0" ] }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "8054" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query computer/host name", "e": [ "GetComputerNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "l": 2, "el": [ "7af0" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "6e1c" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021", "el": [ "802c" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2, "el": [ "8068" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "61e167f9e1703baf78d68b40e7cecd90b2899c0f79f15ab3e870e9f75f30f758.dll" ], "i": "objectives/evasion/masquerade/dll/name::dll-basename", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2, "el": [ "8038" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004", "el": [ "d70" ] }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2, "el": [ "80b8" ] }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "8308" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "7c04" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2, "el": [ "7bb0" ] }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "sections.count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.20000000298023224, "d": "localtime function (symbol)", "e": [ "localtime64" ], "i": "micro-behaviors/time/query::localtime-symbol", "l": 2, "el": [ "80b0" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "8000" ] }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 6.41" ], "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.75, "d": "FlushInstructionCache call", "e": [ "FlushInstructionCache" ], "i": "micro-behaviors/mem/sync/cache::flush-instruction-cache", "l": 2, "el": [ "7b60" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PDB with very short project name", "e": [ "C:\\Users\\AFI\\documents\\Visual Studio 2010\\Projects\\Free\\Release\\NEW GEN V3\\Teh.pdb" ], "i": "metadata/binary/debug::pdb-short-project-name", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2, "el": [ "value:pe.manifest.requested_execution_level" ] }, { "c": 0.8500000238418579, "d": "Inline MZ header validation constant", "e": [ "B8 4D 5A 00 00" ], "i": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "l": 1, "el": [ "6588" ] }, { "c": 0.8500000238418579, "d": "Inline PE signature validation constant", "e": [ "3c 38" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-signature-check", "l": 1, "el": [ "5310" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "47", "41", "48" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "530d", "6596", "4b2" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014", "el": [ "6588" ] }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2, "el": [ "8034" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "61e167f9e1703baf78d68b40e7cecd90b2899c0f79f15ab3e870e9f75f30f758.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014", "el": [ "602b" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.46" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "8028" ] }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2, "el": [ "803c" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2, "el": [ "8008" ] }, { "c": 0.8199999928474426, "d": "sprintf string formatting API", "e": [ "sprintf" ], "i": "micro-behaviors/fs/path/construct::sprintf-format-api", "l": 2, "el": [ "80c0" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "Teh.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "75f8" ] }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "800c" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "8018" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "7b78" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 345.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2, "el": [ "8044" ] }, { "d": "COMPUTERNAME environment variable", "e": [ "GetComputerNameA" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2, "el": [ "7af0" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "41", "48", "47" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014", "el": [ "6596", "4b2", "530d" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "8050" ] }, { "d": "Visual Studio build path", "e": [ "C:\\Users\\AFI\\documents\\Visual Studio 2010\\Projects\\Free\\Release\\NEW GEN V3\\Teh.pdb" ], "i": "metadata/binary/debug::pdb-visual-studio", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadReadPtr anti-debug style probe", "e": [ "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-read-ptr", "l": 1, "m": "B0001", "el": [ "8014" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.46)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "80cc" ] }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2, "el": [ "8010" ] }, { "c": 0.699999988079071, "d": "PDB path with user profile", "e": [ "C:\\Users\\AFI\\documents\\Visual Studio 2010\\Projects\\Free\\Release\\NEW GEN V3\\Teh.pdb" ], "i": "metadata/binary/debug::pdb-users-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1, "el": [ "802c" ] }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1, "el": [ "83a7", "83a7", "83a7", "83a7" ] }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "C:\\Users\\AFI\\documents\\Visual Studio 2010\\Projects\\Free\\Release\\NEW GEN V3\\Teh.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "GetComputerName P/Invoke string for hostname recon", "e": [ "GetComputerNameA" ], "i": "objectives/discovery/host/fingerprint::getcomputername-text", "l": 3, "el": [ "7af0" ] }, { "c": 0.20000000298023224, "d": "localtime function (string)", "e": [ "_localtime64", "localtime64" ], "i": "micro-behaviors/time/query::localtime-string", "l": 2, "el": [ "7c3c", "" ] }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2, "el": [ "8040" ] }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadWritePtr anti-debug style probe", "e": [ "IsBadWritePtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-write-ptr", "l": 1, "m": "B0001", "el": [ "801c" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.70" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\"}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2, "el": [ "80bc" ] }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2, "el": [ "80dc" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PE signature validation in code", "e": [ "3c 38" ], "i": "objectives/anti-static/obfuscation/imports::pe-signature-check", "l": 1, "m": "B0032.014", "el": [ "5310" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014", "el": [ "d70" ] }, { "a": "T1036.005", "c": 0.8500000238418579, "d": "PE stem disagrees with embedded PDB stem", "e": [ "file.stem != pe.debug.pdb.stem (\"61e167f9e1703baf78d68b40e7cecd90b2899c0f79f15ab3e870e9f75f30f758\" != \"teh\")" ], "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "l": 3, "el": [ "value:file.stem" ] }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "FlushInstructionCache" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "7b60" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "722c" ] }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "8058" ] }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001", "el": [ "7df8" ] }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2, "el": [ "8048" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 54.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "8024" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009", "el": [ "806c" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InterlockedCompareExchange", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "7d8c", "7e3c", "7e52", "7dda", "7dbe" ] }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "8058" ] }, { "c": 0.949999988079071, "d": "links user32 (SetRect, MessageBoxA)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcr100 (??2@YAPAXI@Z, stricmp, malloc_crt, encoded_null, initterm, ... +19 more)", "e": [ "msvcr100" ], "i": "metadata/dylib::msvcr100", "l": 2, "el": [ "24 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (ExitProcess, GetComputerNameA, VirtualQuery, GetCurrentProcess, GetTickCount, ... +23 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "28 symbols" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "8024", "8028" ] }, { "c": 0.8999999761581421, "d": "Inline PE header validation sequence", "e": [ "48", "B8 4D 5A 00 00", "3c 38", "47", "41" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-validation-sequence", "l": 1, "el": [ "4b2", "6588", "5310", "530d", "6596" ] }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "IsDebuggerPresent", "TerminateProcess" ], "i": "objectives/anti-analysis/environment-detect/check::anti-analysis-core", "l": 1, "el": [ "7df8", "8058" ] }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "GetTickCount", "QueryPerformanceCounter" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003", "el": [ "8010", "8048" ] }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Timing-based sandbox evasion", "e": [ "IsProcessorFeaturePresent", "QueryPerformanceCounter", "GetTickCount" ], "i": "objectives/anti-analysis/timing/evasion::timing-sandbox-evasion", "l": 2, "m": "B0003.003", "el": [ "806c", "8048", "8010" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2, "el": [ "8054", "8050" ] }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Timing-based anti-debugging pattern", "e": [ "QueryPerformanceCounter", "IsDebuggerPresent", "GetTickCount", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug", "l": 2, "m": "B0003.003", "el": [ "8048", "804c", "8010", "7df8" ] } ], "sha": "61e167f9e1703baf78d68b40e7cecd90b2899c0f79f15ab3e870e9f75f30f758", "path": "61e167f9e1703baf78d68b40e7cecd90b2899c0f79f15ab3e870e9f75f30f758.dll", "type": "pe" } ], "tv": "ed903" } }