{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.96293104, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T15:16:18Z" }, "path": "626a065b29e1e8dfdc7a7c11e89b55696c09f11a0dfbdec077207f46b04d4072.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 20, "ff": { "i": [ [ "msvbvm60", "ORDINAL 187" ], [ "msvbvm60", "MethCallEngine" ], [ "msvbvm60", "ORDINAL 516" ], [ "msvbvm60", "ORDINAL 518" ], [ "msvbvm60", "ORDINAL 519" ], [ "msvbvm60", "ORDINAL 669" ], [ "msvbvm60", "ORDINAL 520" ], [ "msvbvm60", "ORDINAL 709" ], [ "msvbvm60", "ORDINAL 631" ], [ "msvbvm60", "ORDINAL 632" ], [ "msvbvm60", "ORDINAL 526" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "ORDINAL 527" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 711" ], [ "msvbvm60", "ORDINAL 712" ], [ "msvbvm60", "ORDINAL 607" ], [ "msvbvm60", "ORDINAL 608" ], [ "msvbvm60", "ORDINAL 717" ], [ "msvbvm60", "ProcCallEngine" ], [ "msvbvm60", "ORDINAL 535" ], [ "msvbvm60", "ORDINAL 537" ], [ "msvbvm60", "ORDINAL 644" ], [ "msvbvm60", "ORDINAL 645" ], [ "msvbvm60", "ORDINAL 648" ], [ "msvbvm60", "ORDINAL 681" ], [ "msvbvm60", "ORDINAL 578" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "ORDINAL 616" ], [ "msvbvm60", "ORDINAL 617" ], [ "msvbvm60", "ORDINAL 618" ], [ "msvbvm60", "ORDINAL 619" ] ], "m": { "pe": { "checksum": 148056.0, "checksum_valid": 0.0, "computed_checksum": 160379.0, "bound_import_count": 1.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 1243922264.0 }, "file": { "size": 102400.0, "entropy": 5.06, "size_bytes": 102400.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.0, "string_count": 503.0, "entropy_variance": 0.07, "avg_string_length": 8.25, "max_string_length": 476.0, "code_to_data_ratio": 1.0, "string_length_stddev": 22.23, "largest_section_ratio": 0.8, "sentence_string_count": 4.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 35.0 }, "sections": { "count": 3.0, "code_size": 81920.0, "entropy_max": 5.54, "entropy_mean": 5.27, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 152, "u8", "Rich" ], [ 424, "u8", ".text" ], [ 504, "u8", ".rsrc" ], [ 560, "u8", "MSVBVM60.DLL" ], [ 4512, "u8", "bffyvik" ], [ 4724, "u8", "edPzdubd" ], [ 4733, "u8", "KuDytyiHlFhN" ], [ 4812, "u8", "qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq]" ], [ 5156, "u8", "CHARTWIZ.OCX" ], [ 5169, "u8", "MSChartWiz.SubWizard" ], [ 5190, "u8", "SubWizard" ], [ 10984, "wide", "roun" ], [ 11008, "u8", "jrmlgOwKgaF1" ], [ 11024, "u8", "frmFlags" ], [ 11036, "u8", "basFoxCBmp3" ], [ 11060, "wide", "WKpdZM" ], [ 11080, "wide", "edPzdubd" ], [ 11104, "wide", "bffyvik" ], [ 11124, "wide", "jrmlgOwKgaF" ], [ 11452, "u8", "user32" ], [ 11464, "u8", "CallWindowProcW" ], [ 11536, "u8", "gdi32" ], [ 11548, "u8", "GdiGetBatchLimit" ], [ 12504, "wide", "uf0p" ], [ 12536, "u8", "VBA6.DLL" ], [ 12628, "wide", "awq52" ], [ 12744, "wide", "u0u7" ], [ 12924, "wide", "o14ogxb" ], [ 13088, "wide", "d7p2" ], [ 13104, "wide", "gmue" ], [ 13120, "wide", "8yfilf" ], [ 13152, "wide", "9qko" ], [ 13260, "wide", "5e3t" ], [ 13400, "wide", "ajxw4jauc" ], [ 13652, "wide", "4orx" ], [ 13680, "wide", "b22ce" ], [ 14100, "wide", "y35i" ], [ 14832, "wide", "4wqe" ], [ 15056, "wide", "v4i75" ], [ 15072, "wide", "z5ec7" ], [ 15300, "wide", "ayer" ], [ 15376, "wide", "8e9in" ], [ 15508, "wide", "5sr7u" ], [ 15848, "wide", "a2f2a" ], [ 15876, "wide", "e4fg" ], [ 15892, "wide", "3hee" ], [ 16116, "wide", "y2fu" ], [ 16156, "wide", "fmubwns83" ], [ 16280, "wide", "efud" ], [ 16452, "wide", "eryslm" ], [ 16568, "wide", "r4eb" ], [ 16740, "wide", "lici" ], [ 16952, "wide", "v6wya" ], [ 17080, "wide", "v9uydwq" ], [ 17100, "wide", "a6ji" ], [ 17140, "wide", "f067y" ], [ 17188, "wide", "uh2ps9" ], [ 17436, "wide", "yemd8zj" ], [ 17704, "wide", "u9177" ], [ 17768, "wide", "msdl9o6" ], [ 17836, "wide", "sute" ], [ 18044, "wide", "h9kba" ], [ 18228, "wide", "ds8ta" ], [ 18280, "wide", "81pr" ], [ 18332, "wide", "bh02" ], [ 18348, "wide", "or7s" ], [ 18388, "wide", "o3ptwk" ], [ 18496, "wide", "f0q1" ], [ 18808, "wide", "8zsyo" ], [ 19036, "wide", "u4to" ], [ 19172, "wide", "ad2l" ], [ 19192, "wide", "8oyk" ], [ 19332, "wide", "aizaq" ], [ 19496, "wide", "wiphh0" ], [ 19528, "wide", "43b9d" ], [ 19592, "wide", "x30o" ], [ 19872, "wide", "9uevjb" ], [ 19924, "wide", "Modu" ], [ 19940, "wide", "FileName" ], [ 20108, "u8", "Form" ], [ 20132, "u8", "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 20242, "u8", "5_SubWizard1" ], [ 20270, "u8", "EyC:\\Program Files\\Microsoft Visual Studio\\VB98\\Wizards\\CHARTWIZ.oca" ], [ 20340, "u8", "MSChartWiz" ], [ 20408, "u8", "chkFlag" ], [ 20432, "u8", "chkCls" ], [ 20440, "u8", "GetCls" ], [ 20448, "u8", "Flags" ], [ 20456, "u8", "AllowFlags" ], [ 20480, "wide", "Update" ], [ 20512, "wide", "mnuFlag" ], [ 20528, "wide", "Checked" ], [ 20560, "wide", "Enabled" ], [ 20576, "wide", "Visible" ], [ 20596, "u8", "FoxCBmp3.dl" ], [ 20612, "u8", "FoxDrawPreview" ], [ 20684, "u8", "FoxTime" ], [ 20752, "u8", "FoxCounter" ], [ 20820, "u8", "FoxTimer" ], [ 20888, "u8", "FoxMosaic" ], [ 20956, "u8", "FoxBrightness" ], [ 21028, "u8", "FoxBlur" ], [ 21092, "u8", "FoxInvert" ], [ 21160, "u8", "FoxGreyScale" ], [ 21232, "u8", "FoxAlphaBlend" ], [ 21304, "u8", "FoxAlphaMask" ], [ 21376, "u8", "FoxRotate" ], [ 21444, "u8", "FoxOutline" ], [ 21512, "u8", "FoxFlip" ], [ 21576, "u8", "FoxBumpMap" ], [ 21592, "u8", "FoxWave" ], [ 21656, "u8", "FoxHSL" ], [ 21720, "u8", "FoxHSLRGB" ], [ 21788, "u8", "FoxChrome" ], [ 21856, "u8", "FoxMonochrome" ], [ 21928, "u8", "FoxShift" ], [ 21996, "u8", "FoxPsycho" ], [ 22116, "u8", "FoxCreateFastMask" ], [ 22192, "u8", "FoxCreateFastData" ], [ 22268, "u8", "FoxFastMask" ], [ 22336, "u8", "FoxxCreatePicture" ], [ 22412, "u8", "FoxxDeletePicture" ], [ 22488, "u8", "FoxxBlendPicture" ], [ 22564, "u8", "FoxxBlendPictures" ], [ 22640, "u8", "FoxxCreateFastMask" ], [ 22716, "u8", "FoxxDeleteMask" ], [ 22788, "u8", "FoxxFastMask" ], [ 22860, "u8", "BitBlt" ], [ 22924, "u8", "GetDC" ], [ 23109, "u8", "WKpdZM" ], [ 23210, "u8", "r/2\u003eS" ], [ 24761, "u8", "(undefined)" ], [ 24911, "u8", "Linear Chrome" ], [ 24963, "u8", "Anti-Aliasing" ], [ 25017, "u8", "Use Mask Color" ], [ 40922, "u8", "XYYYYT" ], [ 81916, "u8", "MethCallEngine" ], [ 81934, "u8", "EVENT_SINK_AddRef" ], [ 81954, "u8", "DllFunctionCall" ], [ 81972, "u8", "EVENT_SINK_Release" ], [ 81994, "u8", "EVENT_SINK_QueryInterface" ], [ 82022, "u8", "__vbaExceptHandler" ], [ 82044, "u8", "ProcCallEngine" ], [ 87910, "u8", "qqpiiiiV5" ], [ 87958, "u8", "pppyyuyyyyhR5#" ], [ 91810, "u8", "zvuuuuuuy" ], [ 92157, "u8", "``S`" ], [ 92198, "u8", "/,PPQQQgg" ], [ 92293, "u8", ".1OOOOO[dl" ], [ 92334, "u8", "SOcc0" ], [ 92352, "u8", "phbdecc" ], [ 92430, "u8", "eUed" ], [ 92435, "u8", "-3Oi]]XXW\\^kh]\\\\]kee" ], [ 92483, "u8", "-K:;587888\u003c\u003e\u003e\u003cA=A=?=" ], [ 92531, "u8", "-O965554788\u003c\u003c\u003c\u003e\u003c=B=8" ], [ 92574, "u8", "D')+/-RVF857488\u003c\u003c\u003c\u003c\u003c=BA==" ], [ 92627, "u8", "J]^d]GF\u003c?AVWWWVABB=?" ], [ 92675, "u8", "LWXYX^^dhdkj" ], [ 92723, "u8", "@WVXW^]ddhkp" ], [ 92771, "u8", "BGVVW]]dhdkj" ], [ 92814, "u8", "cBBA*BABVWX^dddhjhhh^i]^]" ], [ 92863, "u8", "BBBABABVW]]]ddh^^^^^d]\\\\" ], [ 92911, "u8", "GBAAAABMVWX]^dd^^deele" ], [ 95078, "u8", "EJJIJJGJHGDHHJHJH,,G%%%DGGHHJHHH,,%" ], [ 95125, "u8", "FLNNNNiLLFF\u003eFNLLFL\u003e\u003e;::;;;\u003eFL\u003eF;FF;," ], [ 95415, "u8", "1pyyVU" ], [ 95838, "u8", "395Q" ], [ 95886, "u8", "935x" ], [ 95944, "u8", "t241R" ], [ 96042, "u8", "--0006R" ], [ 96140, "u8", "----03--z" ], [ 96184, "u8", "R024000.0-06" ], [ 96199, "u8", "vXvYZZ" ], [ 96232, "u8", "sP9PPA436A" ], [ 96296, "u8", "XsYZZ" ], [ 96439, "u8", "ztaaa" ], [ 96929, "u8", "efd778%" ], [ 98982, "u8", "}aa\"[[[YW22" ], [ 101438, "wide", "VS_VERSION_INFO" ], [ 101530, "wide", "VarFileInfo" ], [ 101562, "wide", "Translation" ], [ 101598, "wide", "StringFileInfo" ], [ 101634, "wide", "040904B0" ], [ 101658, "wide", "ProductName" ], [ 101684, "wide", "KuDytyiHlFhN" ], [ 101718, "wide", "FileVersion" ], [ 101744, "wide", "1.00" ], [ 101762, "wide", "ProductVersion" ], [ 101810, "wide", "InternalName" ], [ 101862, "wide", "OriginalFilename" ], [ 101896, "wide", "edPzdubd.exe" ], [ 101924, "u8", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ] ], "v": { "file.stem": "626a065b29e1e8dfdc7a7c11e89b55696c09f11a0dfbdec077207f46b04d4072", "pe.imphash": "086114859f6fda69cf3499a02423ead8", "pe.machine": "i386", "pe.rich.key": 2288615565, "pe.rich.hash": "cfa14d932599a86407a6162cc2d261fa", "pe.subsystem": "windows_gui", "pe.timestamp": 1333603206, "file.basename": "626a065b29e1e8dfdc7a7c11e89b55696c09f11a0dfbdec077207f46b04d4072.exe", "pe.image_base": 4194304, "pe.image_size": 106496, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4452, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "3c456a53f1ec10266dbba6db6155ccfeae1f5582", "pe.image_hash.sha256": "b93238cbf1a468d091d3382b613cbb22a2b457c02cb865add1663430e65d57ac", "pe.image_hash.sha384": "1b0febd21a6a1f642b7cdff89f1de5f158052f8c6685747508626039697ef7f6dcd31d126bc4c1cefcd051221b835d5f", "pe.image_hash.sha512": "2ce554fa4177a6ffd5e4088745d9e3f840ce412a78571cfdd53f8e1fa1dcc909ad7b62b3948b3ae1b99b767af7fc99e79f4d518d6568b5b9701975ab5c35d291", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 81716, "pe.data_directories[1].rva": 90112, "pe.data_directories[2].rva": 544, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 15908, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 144, "pe.rich.entries[0].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.coff.dos_header_pe_pointer": 176, "pe.rich.entries[0].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1247533676 }, "id": "pe", "sc": [ [ ".text", 4096, 81920, 5.0, "r-x" ], [ ".data", 0, 0, 0.0, "rw-" ], [ ".rsrc", 86016, 16384, 5.54, "r--" ] ] }, "id": 0, "sz": 102400, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "626a065b29e1e8dfdc7a7c11e89b55696c09f11a0dfbdec077207f46b04d4072.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 35.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x230" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "626a065b29e1e8dfdc7a7c11e89b55696c09f11a0dfbdec077207f46b04d4072.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x14022" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x18c3e" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 35.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 503.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "MethCallEngine", "__vbaExceptHandler", "ProcCallEngine" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x13ffc", "0x14066", "0x1407c" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1247533676,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.80" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x18db2" ] }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1, "el": [ "0x18e24", "0x18e24", "0x18e24" ] }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x1034" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB", "EyC:\\Program Files\\Microsoft Visual Studio\\VB98\\Wizards\\CHARTWIZ.oca" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0x4ea4", "0x4f2e" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x18de6" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 35.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x18e08" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x2eca" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x18d1a" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x18cde" ] }, { "a": "T1027", "c": 0.4000000059604645, "d": "Low entropy variance (uniform packing)", "e": [ "binary.entropy_variance = 0.07" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::entropy-variance-low", "l": 4, "m": "B0032" }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcW" ], "i": "micro-behaviors/ui/window/manage/control::call-window-proc", "l": 2, "el": [ "0x2cc8" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 35.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.80" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 35.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x159b" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 81920, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x159b" ] }, { "c": 1.0, "d": "Android Pictures folder", "e": [ "FoxxBlendPictures" ], "i": "objectives/impact/wipe/disk/mass-delete::android-pictures", "l": 1, "el": [ "0x5824" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 35.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "626a065b29e1e8dfdc7a7c11e89b55696c09f11a0dfbdec077207f46b04d4072.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x18e08" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.80" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (ORDINAL 187, MethCallEngine, ORDINAL 516, ORDINAL 518, ORDINAL 519, ... +30 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "35 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "DllFunctionCall", "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x14022", "0x230" ] } ], "sha": "626a065b29e1e8dfdc7a7c11e89b55696c09f11a0dfbdec077207f46b04d4072", "path": "626a065b29e1e8dfdc7a7c11e89b55696c09f11a0dfbdec077207f46b04d4072.exe", "type": "pe" } ], "tv": "52045" } }