{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T11:49:20Z" }, "path": "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 2240233.0, "checksum_valid": 1.0, "computed_checksum": 2240233.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 2235296.0, "entropy": 3.33, "size_bytes": 2235296.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 3.3, "overlay_size": 5024.0, "string_count": 779.0, "overlay_ratio": 0.0, "overlay_entropy": 7.21, "entropy_variance": 2.57, "avg_string_length": 2838.34, "max_string_length": 2181200.0, "code_to_data_ratio": 1.0, "string_length_stddev": 78098.23, "largest_section_ratio": 1.0, "sentence_string_count": 6.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 2229248.0, "entropy_max": 3.3, "entropy_mean": 1.7, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 18468, "u8", "BSJB" ], [ 22545, "u8", "IEnumerable`1" ], [ 22559, "u8", "IEnumerator`1" ], [ 22581, "u8", "Int32" ], [ 22587, "u8", "Dictionary`2" ], [ 22600, "u8", "\u003cModule\u003e" ], [ 22609, "u8", "ffbceddcaddaaebabaaaa" ], [ 22631, "u8", "dbbdbaadbaa" ], [ 22643, "u8", "eddfaddacaa" ], [ 22655, "u8", "dcdecdbbdadcceabbecddcafdbcaa" ], [ 22685, "u8", "ffbbfceabbeaeeaedbadfbcaa" ], [ 22711, "u8", "bebbcdedbbdcbbdcaccaa" ], [ 22733, "u8", "baeeaadcdaa" ], [ 22745, "u8", "bdafbefaeceaeddecdaa" ], [ 22766, "u8", "fceddccbeaecbddaa" ], [ 22784, "u8", "ebedecfbcfeeacaafebfdbefdaa" ], [ 22812, "u8", "bcaabbdabfecbbeaa" ], [ 22830, "u8", "afcefbbfdeabaeddadbcefbeaa" ], [ 22857, "u8", "bebebfbfadebbaeafaa" ], [ 22877, "u8", "bcefabdeaadeabfaa" ], [ 22895, "u8", "bcacaaba" ], [ 22904, "u8", "eaabcaba" ], [ 22913, "u8", "cbcfaba" ], [ 22921, "u8", "caebeceacdeecfdbdfeabcbba" ], [ 22947, "u8", "bdbbfbfffdaacddbecba" ], [ 22968, "u8", "fddebcafabdcdbdafba" ], [ 22988, "u8", "ffafcdedbbffcfdebdbedabbfba" ], [ 23016, "u8", "cedbbbfba" ], [ 23026, "u8", "bcdbecffffacebedbadaaefffba" ], [ 23054, "u8", "fbfcbbebbedadafacaaca" ], [ 23076, "u8", "abecaca" ], [ 23084, "u8", "faedaca" ], [ 23092, "u8", "aefbbefadbcbbca" ], [ 23108, "u8", "aefefcdbca" ], [ 23119, "u8", "cfffcebca" ], [ 23129, "u8", "eafcdeadbbecbcbababddcca" ], [ 23154, "u8", "dfcaeefadada" ], [ 23167, "u8", "fdeaccfcbda" ], [ 23179, "u8", "cadcafebedda" ], [ 23192, "u8", "cbecadfbdcfdbecfccfaadbdaeda" ], [ 23221, "u8", "dacedafccbafdefafcddafda" ], [ 23246, "u8", "bbddbeafda" ], [ 23257, "u8", "dcaaebafadfdaabeacbfda" ], [ 23280, "u8", "cafdbccfda" ], [ 23291, "u8", "aaafbcbcacdabdaeaeccebaaaaea" ], [ 23320, "u8", "afcdffcaea" ], [ 23331, "u8", "bdbabbaeffaeadfffeaea" ], [ 23353, "u8", "bbbededbebdcbadebea" ], [ 23373, "u8", "feffefecebbeeffcceeebea" ], [ 23397, "u8", "bafdeafebea" ], [ 23409, "u8", "eaeedefafbcbecfbdcaeabdbdea" ], [ 23437, "u8", "bcddcadacaecacccdcdea" ], [ 23459, "u8", "cefdcfbcbacfa" ], [ 23473, "u8", "deccbcbefcebbbfdfafcfa" ], [ 23496, "u8", "bfdbefdfa" ], [ 23506, "u8", "cdfafcabbecefa" ], [ 23521, "u8", "eaaaaabbbaebfcaddedcebfcffa" ], [ 23549, "u8", "ProjectData" ], [ 23561, "u8", "bacdfcdbacbab" ], [ 23575, "u8", "bdfaccab" ], [ 23584, "u8", "cfcbdfeaccebecbbcfbbbbabb" ], [ 23610, "u8", "adfeabb" ], [ 23618, "u8", "bdbaaacdfebafdbbbabdbabfabb" ], [ 23646, "u8", "acfababedccbbb" ], [ 23661, "u8", "ebafbacedacbbeeacaeaeefaaebbb" ], [ 23691, "u8", "ebcafdeebfccecebeeababbeebbb" ], [ 23720, "u8", "eadceeebbb" ], [ 23731, "u8", "bbbaaadbb" ], [ 23741, "u8", "cdabbfecaadcadecaaabebaebbebb" ], [ 23771, "u8", "ecbaaacbbbcedefbbafbacb" ], [ 23795, "u8", "ebbfdacb" ], [ 23804, "u8", "ffbeaadaeaddefabfacb" ], [ 23825, "u8", "dadebbcb" ], [ 23834, "u8", "dbccffeabfffbfacdeccccbcb" ], [ 23860, "u8", "fbfacbdfaaafbfbcccb" ], [ 23880, "u8", "bfacabeddefabdcb" ], [ 23897, "u8", "cbbebdbcecb" ], [ 23909, "u8", "adfbfbbffdedbdeadafdfbebfcb" ], [ 23937, "u8", "dcbccaccaeeaceadadebcceadb" ], [ 23964, "u8", "bdffeecebdb" ], [ 23976, "u8", "bafebdb" ], [ 23984, "u8", "cedeebcdb" ], [ 23994, "u8", "cbbbbcfccbabdebbedbaabedb" ], [ 24020, "u8", "effbbaeedfedb" ], [ 24034, "u8", "cfffcedbaaffbfdb" ], [ 24051, "u8", "bfeedabeb" ], [ 24061, "u8", "fcdcbbacfbbddbeddbeb" ], [ 24082, "u8", "bfaebeb" ], [ 24090, "u8", "bebfdceb" ], [ 24099, "u8", "febfceffcaaacddfffedadfbdeb" ], [ 24127, "u8", "beeecbfecdbfdacceeb" ], [ 24147, "u8", "ccceecfeeb" ], [ 24158, "u8", "bdcdffababdefeeecbcbfbebeefeb" ], [ 24188, "u8", "bcfbbfcfebddffeb" ], [ 24205, "u8", "bddaedebafb" ], [ 24217, "u8", "daabebcfdffbffcacafb" ], [ 24238, "u8", "cecbacbbbbfabcbfedfcafb" ], [ 24262, "u8", "dedbfdbffaedefddcbdcfb" ], [ 24285, "u8", "acdeedfafeffbddeedaaeecdfb" ], [ 24312, "u8", "bbbfcfbcabebfcadeaafcfbbbeefb" ], [ 24342, "u8", "dbfbcafdebaffb" ], [ 24357, "u8", "dafcfdbccabfbacffb" ], [ 24376, "u8", "mscorlib" ], [ 24385, "u8", "ccbeabeaaabaeaaac" ], [ 24403, "u8", "ffebeaabaffeaac" ], [ 24419, "u8", "ccfddfdecabac" ], [ 24433, "u8", "aedcabbac" ], [ 24443, "u8", "ddcfaeffadfffcfcabcedbac" ], [ 24468, "u8", "ecfaddccabaabbbaeeafbac" ], [ 24492, "u8", "edaaefbac" ], [ 24502, "u8", "dfaabfdcac" ], [ 24513, "u8", "ffeaaabeeeaceaefdac" ], [ 24533, "u8", "eafaeaceffcbbfecbfbeffceac" ], [ 24560, "u8", "aadeccfaefdfcdeceefac" ], [ 24582, "u8", "fdddbbefccefabfaecdbbbc" ], [ 24606, "u8", "aceabdcaafcfefeebdffddcbbc" ], [ 24633, "u8", "babbfbdbccabcbc" ], [ 24649, "u8", "edeaffcceadedebdfbedbc" ], [ 24672, "u8", "feafecdecabcbeebc" ], [ 24690, "u8", "dbecaaaddcdbbadbffbc" ], [ 24711, "u8", "ddaedcabaaacc" ], [ 24725, "u8", "ccabcbdacaddbdcefbbeadebefacc" ], [ 24755, "u8", "ecabcdbcaceedbcc" ], [ 24772, "u8", "bffeccdfbedcbccc" ], [ 24789, "u8", "eabbedacefdfeffdcc" ], [ 24808, "u8", "edaacfbffececc" ], [ 24823, "u8", "bfefbfbcbeefcaebefbfecdaeafcc" ], [ 24853, "u8", "abaedfbaadaedbdc" ], [ 24870, "u8", "aebeafeedbdaeddccabcdc" ], [ 24893, "u8", "acecaacfebddc" ], [ 24907, "u8", "ccfaeddc" ], [ 24916, "u8", "bfabdeddedc" ], [ 24928, "u8", "ceafaecbfdc" ], [ 24940, "u8", "adefaffcebbbdbcefeadfcec" ], [ 24965, "u8", "eaccddfccedaeddacadaabdaddec" ], [ 24994, "u8", "deeedacadeaebabefbaacefafdec" ], [ 25023, "u8", "aeafcbeeacddfbafaedfdfeaafec" ], [ 25052, "u8", "eeafecbfbdebcffecabfbcaabdafc" ], [ 25082, "u8", "bcdcdfbaeabaefcdacfc" ], [ 25103, "u8", "abeeaacdffdbabfbccfefdebbccfc" ], [ 25133, "u8", "fccabdeccaadfc" ], [ 25148, "u8", "cffefcebadeefddfcbecdcddaefc" ], [ 25177, "u8", "fdddaefc" ], [ 25186, "u8", "bccbfeceefc" ], [ 25198, "u8", "cfaabaefafefc" ], [ 25212, "u8", "bcfefaddbbccfbfdbbacdadaffc" ], [ 25240, "u8", "System.Collections.Generic" ], [ 25267, "u8", "Microsoft.VisualBasic" ], [ 25289, "u8", "dcacccdcaacddacacaabad" ], [ 25312, "u8", "daccbebcbdebeeeefbad" ], [ 25333, "u8", "dddbcddad" ], [ 25343, "u8", "abcfdadaecdedabead" ], [ 25362, "u8", "dfaadfead" ], [ 25372, "u8", "dcdafdbfadebfbfeeaddbbd" ], [ 25396, "u8", "feffdecccaddcaafdcbd" ], [ 25417, "u8", "deadfcceccbcffdcfafeebbfdbd" ], [ 25445, "u8", "febdbbccebadebd" ], [ 25461, "u8", "afadfdbfcccccfacbabcdccfbd" ], [ 25488, "u8", "cffebadafbfbbeafbdcbacd" ], [ 25512, "u8", "dceabfecabfbaabfcfcefefccd" ], [ 25539, "u8", "aceeacaafaaebdaafdfcd" ], [ 25565, "u8", "fdfcbadd" ], [ 25574, "u8", "ffadfbfcdcbcbcfaecdbadd" ], [ 25598, "u8", "dbcaaffeceadbbcdfccbbdcfbedd" ], [ 25627, "u8", "bdfecededd" ], [ 25638, "u8", "cffbbabcbaedfbdfaecbded" ], [ 25662, "u8", "ceebedabcdded" ], [ 25676, "u8", "fecfeaedaddedeeeabaaabcdfeeed" ], [ 25706, "u8", "eeabeaccacdfccbfed" ], [ 25725, "u8", "ffdbefed" ], [ 25734, "u8", "baaebeaaabcaeaafefbdfdaafd" ], [ 25761, "u8", "bcecdadebfd" ], [ 25773, "u8", "afdaeeeaaaeadfadfbbddcbcfd" ], [ 25800, "u8", "beebcdceddfd" ], [ 25813, "u8", "eaffffd" ], [ 25821, "u8", "TrimEnd" ], [ 25829, "u8", "GetCurrentMethod" ], [ 25846, "u8", "abfecbffffaeadffdfbdbdbae" ], [ 25872, "u8", "bdffdbae" ], [ 25881, "u8", "cebeecccbfaeaabcaadafbbacae" ], [ 25909, "u8", "bacbbceebdeebbbaadbbbcae" ], [ 25934, "u8", "cdebeeaeae" ], [ 25945, "u8", "bdcdcebceae" ], [ 25957, "u8", "aadffdbbcdeae" ], [ 25971, "u8", "babbfdadccedfebccedfbeccfeae" ], [ 26000, "u8", "bacfadfae" ], [ 26010, "u8", "cfacdadcbcdefdedbdabe" ], [ 26032, "u8", "ecedfaeedbfbcfabbe" ], [ 26051, "u8", "feffacaddbe" ], [ 26063, "u8", "bdabafabdafddbe" ], [ 26079, "u8", "fadbabcedcfaebbcbededbe" ], [ 26103, "u8", "badcebe" ], [ 26111, "u8", "aedbbbcdadbfabccfaeeebe" ], [ 26135, "u8", "edbbfaabace" ], [ 26147, "u8", "cfedfbcbcdbdecefbbace" ], [ 26169, "u8", "cfbdcddcbcfbaedccedabaeadcace" ], [ 26199, "u8", "ecaeecbbcdeeeccbcadadebdace" ], [ 26227, "u8", "Replace" ], [ 26235, "u8", "defcbeeddcfcfccbddbece" ], [ 26258, "u8", "feeeaddedbdbefdece" ], [ 26277, "u8", "bdbbbaeeefdfbbbfcbafce" ], [ 26300, "u8", "IUIService" ], [ 26311, "u8", "GetService" ], [ 26322, "u8", "ITypeReference" ], [ 26337, "u8", "INamedTypeReference" ], [ 26357, "u8", "CreateTypeReference" ], [ 26377, "u8", "IUnitReference" ], [ 26392, "u8", "GetDefiningUnitReference" ], [ 26417, "u8", "IAssemblyReference" ], [ 26436, "u8", "afcbabecfdeeabadde" ], [ 26455, "u8", "eeeaededeacaaede" ], [ 26472, "u8", "ebeffccfede" ], [ 26484, "u8", "faabbcbcabefeddfcabdcbdfdcfde" ], [ 26514, "u8", "fbafccdaecdcfedfabfedfffde" ], [ 26541, "u8", "cfbebbadbcdabbeaecdabee" ], [ 26565, "u8", "abfdebcfdefbdcdee" ], [ 26583, "u8", "ecdacbfcbdaddadeffcdadddee" ], [ 26610, "u8", "fbdadafcecfbedee" ], [ 26627, "u8", "ffaebebcbcdaddcbaabdfdeee" ], [ 26653, "u8", "ebaefcaacafbecceafcbdafeee" ], [ 26680, "u8", "adfbdaccabeeffaacbaceefee" ], [ 26706, "u8", "fefeccdccbeecbaddfddffee" ], [ 26731, "u8", "bacbbdaadecafe" ], [ 26746, "u8", "cdedfcafe" ], [ 26756, "u8", "aaaebffbdfcaacdecceacbbfe" ], [ 26782, "u8", "aebcdfbdfdafdfdaddeedebcfe" ], [ 26809, "u8", "cdfcbbbaefadcccfe" ], [ 26827, "u8", "cebbfafacbadadbaebabbefe" ], [ 26852, "u8", "eadbadbcbacafaefdefe" ], [ 26873, "u8", "afeafcaffeafffeeeffabffe" ], [ 26898, "u8", "feeffaaebfdbadcddfebdacdfffe" ], [ 26927, "u8", "INameTable" ], [ 26938, "u8", "get_NameTable" ], [ 26952, "u8", "IDisposable" ], [ 26964, "u8", "RuntimeTypeHandle" ], [ 26982, "u8", "GetTypeFromHandle" ], [ 27000, "u8", "IModule" ], [ 27008, "u8", "IName" ], [ 27014, "u8", "get_Name" ], [ 27023, "u8", "GetTypeName" ], [ 27035, "u8", "Microsoft.Build.ILTasks.ReducerEngine" ], [ 27073, "u8", "get_AliasedType" ], [ 27089, "u8", "get_ResolvedType" ], [ 27106, "u8", "get_Error_CouldNotFindWellKnownType" ], [ 27142, "u8", "IAliasForType" ], [ 27156, "u8", "MethodBase" ], [ 27167, "u8", "Dispose" ], [ 27175, "u8", "ISite" ], [ 27181, "u8", "ComVisibleAttribute" ], [ 27201, "u8", "AssemblyTitleAttribute" ], [ 27224, "u8", "AssemblyTrademarkAttribute" ], [ 27251, "u8", "TargetFrameworkAttribute" ], [ 27276, "u8", "AssemblyFileVersionAttribute" ], [ 27305, "u8", "AssemblyDescriptionAttribute" ] ], "v": { "file.stem": "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1604488288, "file.basename": "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe", "pe.image_base": 4194304, "pe.image_size": 2252800, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 2237214, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 5024, "pe.image_hash.sha1": "b018bc35aa5395f99b2a8b37d59bc115e7090e2d", "pe.image_hash.sha256": "ce146350debdf3ed61b0e3b9b23525e9995040b426f3b5e828e65a1e9967b41a", "pe.image_hash.sha384": "38cc3e4d343a79ca09866ccecd55762d5273b898e72682c52feaaf8ec24b7670d7c54c7a02e6a33a3cbf7f3a00210196", "pe.image_hash.sha512": "e9568cd798bac0878dd4635c6f373ff5a41ea3ae52ed26e73fdf210775b5659216fc9f6747d949d1b6ecc003240c787cd43ffee76aaaee8e97dc577c33cfacf9", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=RE 999,O=Bill Gates,CN=Microsoft Windows", "pe.signatures[0].serial": "1fdd0995b684758da235bf2e022582df", "pe.signatures[0].subject": "C=US,L=New York,OU=RE 999,O=Bill Gates,CN=Microsoft Windows", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 2237132, "pe.data_directories[1].rva": 2230272, "pe.data_directories[2].rva": 2244608, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-11-04T11:11:29Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 79, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 5024, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-11-04T11:11:29Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "84273a060bb28531c92e6a8220a7685d4dd3612b", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "ce146350debdf3ed61b0e3b9b23525e9995040b426f3b5e828e65a1e9967b41a", "pe.signatures[0].thumbprint_sha256": "92ffe23e7fd100d788cc49dab66055930827650041f4c9aad707b28d2c1c5d06", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 2229248, 3.3, "r-x" ], [ ".reloc", 2229760, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 2235296, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x4824" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x4824" ] }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Windows", "e": [ "Microsoft Windows" ], "i": "metadata/signed/unknown::microsoft-windows", "l": 2 }, { "c": 1.0, "d": "Signed by Bill Gates", "e": [ "Bill Gates" ], "i": "metadata/signed/leaf::bill-gates", "l": 3 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x7132" ] }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x22106a" ] }, { "c": 0.949999988079071, "d": "DigiCert timestamp certificate chain", "e": [ "DigiCert SHA2 Assured ID Timestamping CA" ], "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain", "l": 2, "el": [ "0x220e0c" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x22050e" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x22050e" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 779.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x5f38" ] }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x7084" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.6000000238418579, "d": "MethodBase class reference", "e": [ "MethodBase" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-methodbase-token", "l": 1, "el": [ "0x6a14" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 1.0, "d": "Modification of HTTP context items", "e": [ "set_Item" ], "i": "micro-behaviors/communications/http/server/managed::http-item-setter", "l": 1, "el": [ "0x6fa4" ] }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0x220124" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic", "Microsoft.VisualBasic.CompilerServices" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x62b3", "0x7151" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x6fe4" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.949999988079071, "d": "PE has exactly two sections", "e": [ "sections.count = 2.00" ], "i": "well-known/malware/virus/virlock::two-section-layout", "l": 1 }, { "a": "T1140", "c": 0.9200000166893005, "d": "VB NewLateBinding dispatch helper", "e": [ "NewLateBinding" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-newlatebinding", "l": 1, "m": "B0030", "el": [ "0x6f23" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms", "System.Windows.Forms.Design" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x71eb", "0x6fc3" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Substring", "StringComparison", "GetString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x6f56", "0x703c", "0x6f4c" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0x220e0c" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x6b55" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "TryGetValue", "GetObjectValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x6b49", "0x6b3a" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x6fc3" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1140", "c": 0.8999999761581421, "d": "VB LateGet dispatch token", "e": [ "LateGet" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token", "l": 1, "m": "B0030", "el": [ "0x72a3" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x2202a3" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.01" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyCompanyAttribute", "CreateTypeReference", "MissingManifestResourceException", "GetDefiningUnitReference", "AssemblyTrademarkAttribute", "AssemblyProductAttribute", "AssemblyCopyrightAttribute", "ComVisibleAttribute", "AssemblyTitleAttribute", "TargetFrameworkAttribute", "AssemblyDescriptionAttribute", "AssemblyFileVersionAttribute", "CompilationRelaxationsAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x6b1a", "0x66f5", "0x701b", "0x6718", "0x6a58", "0x6ae6", "0x6aff", "0x6a2d", "0x6a41", "0x6a73", "0x6aa9", "0x6a8c", "0x6ac6" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 2229248, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Giant embedded string blob metric", "e": [ "binary.max_string_length = 2181200.00" ], "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x6b55" ] }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "0x7084" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-11/61f8d11bd98b3fca7ab5239e2fd784d5126617813f7f2c358d32c73eb1686417.exe", "type": "pe" } ], "tv": "52045" } }