{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999620914459229, "class": 2 }, { "id": 1, "prob": 0.9965625405311584, "class": 1 } ], "prob": 0.9999621, "class": 2, "models": [ { "m": "az", "prob": 0.99981934, "class": 2 }, { "m": "az/native", "prob": 0.9999207, "class": 2 }, { "m": "az/pe", "prob": 0.9999621, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-02T19:10:31Z" }, "path": "126625", "raw": { "v": "4", "fs": [ { "f": "KO₈(Er₃I₂Al₂As₁₀C₄DyPS₂)H₅(Cm₃DsOs₂Po₃Db₂)Md₄(Bi₄SiPa)Th", "x": 130, "id": 0, "is": [ "AccessibleObjectFromWindow", "InterlockedIncrement", "lstrcmpiW", "LoadLibraryExW", "TlsGetValue", "LeaveCriticalSection", "InterlockedDecrement", "EnterCriticalSection", "WideCharToMultiByte", "GetCurrentProcessId", "CreateThread", "MultiByteToWideChar", "SetFileAttributesW", "GetFileAttributesW", "GetProcessId", "GetModuleFileNameW", "CreateDirectoryW", "MulDiv", "GetModuleHandleW", "FindResourceW", "ReadConsoleW", "SetEndOfFile", "WriteConsoleW", "SetFilePointerEx", "FlushFileBuffers", "SetStdHandle", "FreeLibrary", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetCommandLineW", "GetCommandLineA", "GetOEMCP", "IsValidCodePage", "FindNextFileW", "FindFirstFileExW", "FindClose", "GetConsoleMode", "GetConsoleCP", "EnumSystemLocalesW", "GetUserDefaultLCID", "LoadResource", "FindResourceExW", "LockResource", "Sleep", "SizeofResource", "GetProcessHeap", "DeleteCriticalSection", "HeapDestroy", "DecodePointer", "HeapAlloc", "RaiseException", "HeapReAlloc", "GetLastError", "HeapSize", "InitializeCriticalSectionAndSpinCount", "HeapFree", "GetProcAddress", "IsValidLocale", "GetFileType", "GetACP", "WriteFile", "GetStdHandle", "GetModuleHandleExW", "ExitProcess", "VirtualQuery", "VirtualProtect", "GetSystemInfo", "RtlUnwind", "QueryPerformanceCounter", "GetStartupInfoW", "TerminateProcess", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "WaitForSingleObjectEx", "ResetEvent", "SetEvent", "GetLocaleInfoW", "LCMapStringW", "CompareStringW", "GetCPInfo", "GetSystemTimeAsFileTime", "TlsFree", "ReadFile", "SetFilePointer", "CreateFileW", "CloseHandle", "GetFileSize", "SetLastError", "GetCurrentThreadId", "GlobalAlloc", "GlobalLock", "GlobalUnlock", "lstrcmpW", "GetCurrentProcess", "GetEnvironmentVariableW", "TlsAlloc", "FormatMessageW", "LocalFree", "IsDebuggerPresent", "OutputDebugStringW", "EncodePointer", "InitializeSListHead", "InterlockedPopEntrySList", "InterlockedPushEntrySList", "FlushInstructionCache", "IsProcessorFeaturePresent", "VirtualAlloc", "VirtualFree", "LoadLibraryExA", "GetStringTypeW", "CreateEventW", "TlsSetValue", "ReleaseDC", "UpdateWindow", "BeginPaint", "UnregisterClassW", "EndPaint", "GetDesktopWindow", "CallWindowProcW", "PostMessageW", "CharNextW", "MessageBoxW", "ShowWindow", "InvalidateRect", "GetWindowLongW", "GetWindowThreadProcessId", "GetMessageW", "DefWindowProcW", "GetWindowRect", "DestroyWindow", "GetDC", "IsWindowVisible", "SetWindowPos", "EqualRect", "EnumChildWindows", "CreateWindowExW", "GetSystemMetrics", "RegisterClassExW", "IsWindow", "DispatchMessageW", "SetTimer", "PeekMessageW", "MoveWindow", "GetWindowTextW", "GetCursorPos", "SetForegroundWindow", "ReleaseCapture", "RegisterWindowMessageW", "GetParent", "GetClassInfoExW", "GetDlgItem", "GetClientRect", "SetCapture", "SetFocus", "CreateAcceleratorTableW", "GetSysColor", "IsChild", "DestroyAcceleratorTable", "ClientToScreen", "RedrawWindow", "InvalidateRgn", "SetWindowTextW", "SendMessageW", "ScreenToClient", "FillRect", "GetFocus", "GetWindow", "GetWindowTextLengthW", "EnumWindows", "LoadBitmapW", "SetLayeredWindowAttributes", "TranslateMessage", "LoadCursorW", "GetClassNameW", "SetWindowLongW", "DrawTextW", "KillTimer", "GetObjectW", "DeleteDC", "GetStockObject", "CreateCompatibleBitmap", "CreateSolidBrush", "CreateFontIndirectW", "SetBkMode", "SetTextColor", "GetDIBits", "CreateCompatibleDC", "SelectObject", "BitBlt", "DeleteObject", "GetDeviceCaps", "CryptCreateHash", "CryptAcquireContextW", "RegQueryInfoKeyW", "RegDeleteKeyW", "RegEnumKeyExW", "RegOpenKeyExW", "RegDeleteValueW", "RegCloseKey", "RegCreateKeyExW", "RegSetValueExW", "CryptHashData", "CryptDestroyHash", "CryptGetHashParam", "CryptReleaseContext", "RegEnumKeyW", "RegQueryValueExW", "SHGetFolderPathW", "ShellExecuteW", "ShellExecuteExW", "OleLockRunning", "CoGetClassObject", "OleUninitialize", "StringFromGUID2", "CoTaskMemRealloc", "CreateStreamOnHGlobal", "OleInitialize", "CLSIDFromString", "CLSIDFromProgID", "CoCreateGuid", "CoTaskMemFree", "CoCreateInstance", "CoTaskMemAlloc", "CoUninitialize", "CoInitialize", "ORDINAL 161", "ORDINAL 420", "ORDINAL 313", "ORDINAL 7", "ORDINAL 4", "ORDINAL 162", "ORDINAL 9", "ORDINAL 314", "ORDINAL 2", "ORDINAL 6", "ORDINAL 8", "ORDINAL 277", "UrlEscapeW", "PathAppendW", "PathAddBackslashW", "UrlUnescapeW", "InternetCloseHandle", "HttpSendRequestW", "InternetCrackUrlW", "InternetOpenW", "HttpOpenRequestW", "InternetConnectW" ], "ms": { "pe": { "signer": "GlobalSign, GlobalSign CodeSigning CA - SHA256 - G3, Cloud Installer", "machine": 332.0, "checksum": 1157701.0, "rsrc_size": 749568.0, "subsystem": 2.0, "timestamp": 1511340343.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 5.39, "entry_section": ".text", "has_signature": true, "size_of_image": 1134592.0, "timestamp_day": 22.0, "file_alignment": 512.0, "primary_signer": "Cloud Installer", "resource_count": 10.0, "signature_type": "developer", "timestamp_year": 2017.0, "characteristics": 258.0, "entry_point_rva": 132748.0, "size_of_headers": 1024.0, "timestamp_month": 11.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 10.0, "manifest_present": true, "certificate_count": 1.0, "checksum_mismatch": true, "computed_checksum": 1178300.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1511340343.0, "debug_timestamp_min": 1511340343.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 14.0, "linker_minor_version": 11.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 4408.0, "debug_directory_entries": 2.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 2.0 }, "binary": { "code_size": 262144.0, "file_size": 1130296.0, "entry_point": 132748.0, "code_entropy": 6.64, "data_entropy": 4.69, "import_count": 247.0, "string_count": 1364.0, "has_signature": true, "section_count": 5.0, "avg_complexity": 7.08, "function_count": 1234.0, "import_density": 0.96, "max_complexity": 385.0, "string_density": 5.33, "overall_entropy": 5.59, "avg_basic_blocks": 10.88, "avg_section_size": 224972.8, "dependency_count": 10.0, "entropy_variance": 0.94, "function_density": 4.82, "avg_function_size": 209.67, "avg_string_length": 42.36, "complexity_per_kb": 0.03, "max_string_length": 3678.0, "wide_string_count": 443.0, "writable_sections": 1.0, "avg_string_entropy": 3.16, "code_to_data_ratio": 0.3, "data_to_file_ratio": 0.01, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.66, "text_to_file_ratio": 0.23, "total_basic_blocks": 13423.0, "embedded_file_count": 1.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 205.76, "debug_reference_count": 2.0, "embedded_binary_count": 1.0, "largest_section_ratio": 0.66, "sentence_string_count": 221.0, "sentence_string_ratio": 0.16, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0, "high_complexity_functions": 15.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 512, ".text" ], [ 591, "@.data" ], [ 632, ".rsrc" ], [ 671, "@.reloc" ], [ 2586, "QSVW" ], [ 5529, "A8V3" ], [ 8122, "RQVP" ], [ 16915, "/AQQQ" ], [ 18272, "9s4v" ], [ 22466, "6QPQS" ], [ 22984, "QSV3" ], [ 23241, "PPPPS" ], [ 23433, "PPSVP" ], [ 26736, "QQSVW" ], [ 28967, "SVWP" ], [ 30230, "QQQQQQQPQQQ" ], [ 36261, "PQQSVW" ], [ 38560, "PQVW" ], [ 41840, "PSVW" ], [ 49212, "VD9VHts" ], [ 49824, "/tK2" ], [ 64569, "SVW3" ], [ 65278, "JPRS" ], [ 67921, "PQSVW" ], [ 73316, "QQSV" ], [ 77542, "WHVR" ], [ 79246, "7SPV" ], [ 94748, "SSPPWSSSj" ], [ 97672, "Nwltf" ], [ 101094, "SVRQ" ], [ 102297, "V0SQ" ], [ 111011, "QQQQPSQj" ], [ 111039, "RRVP" ], [ 112804, "9w4v" ], [ 117368, "GWSR" ], [ 119623, "SSSSW" ], [ 119830, "PPPPW" ], [ 130925, "Genu" ], [ 130943, "5ntel" ], [ 133026, "8RCC" ], [ 133034, "8MOC" ], [ 147355, "YYPV" ], [ 147793, "r39z" ], [ 148432, "UVWS" ], [ 148960, "UQPXY]Y[" ], [ 149065, "6PWQ" ], [ 153347, "QQVW" ], [ 165114, "PVWS" ], [ 165631, "SVW8A" ], [ 172404, "w9r0" ], [ 173148, "PWRQ" ], [ 181259, "PSWSS" ], [ 185770, "PWWS" ], [ 189979, "f90t" ], [ 190012, "f97t" ], [ 196278, "v6j0" ], [ 197515, "QWPV" ], [ 210278, "f90u" ], [ 210293, "PVSQSWV" ], [ 211687, "9E WW" ], [ 212161, "PPPPPWS" ], [ 212219, "QQQP" ], [ 212377, "PP9E u:PPVWP" ], [ 219294, "WWWPWS" ], [ 222125, "f92t" ], [ 224036, "/PjSW" ], [ 231501, "f98t" ], [ 241190, "PPPV" ], [ 241225, "DSVW" ], [ 251520, "WVU3" ], [ 264400, "wide", "ERROR : Unable to initialize critical section in CAtlBaseModule" ], [ 264532, "atlthunk.dll" ], [ 264548, "AtlThunk_AllocateData" ], [ 264572, "AtlThunk_InitData" ], [ 264592, "AtlThunk_DataToCode" ], [ 264612, "AtlThunk_FreeData" ], [ 264656, "bad allocation" ], [ 264720, "regex_error(error_collate): The expression contained an invalid collating element name." ], [ 264808, "regex_error(error_ctype): The expression contained an invalid character class name." ], [ 264896, "regex_error(error_escape): The expression contained an invalid escaped character, or a trailing escape." ], [ 265000, "regex_error(error_backref): The expression contained an invalid back reference." ], [ 265080, "regex_error(error_brack): The expression contained mismatched [ and ]." ], [ 265152, "regex_error(error_paren): The expression contained mismatched ( and )." ], [ 265224, "regex_error(error_brace): The expression contained mismatched { and }." ], [ 265296, "regex_error(error_badbrace): The expression contained an invalid range in a { expression }." ], [ 265392, "regex_error(error_range): The expression contained an invalid character range, such as [b-a] in most encodings." ], [ 265504, "regex_error(error_space): There was insufficient memory to convert the expression into a finite state machine." ], [ 265616, "regex_error(error_badrepeat): One of *?+{ was not preceded by a valid regular expression." ], [ 265712, "regex_error(error_complexity): The complexity of an attempted match against a regular expression exceeded a pre-set level." ], [ 265840, "regex_error(error_stack): There was insufficient memory to determine whether the regular expression could match the specified ch" ], [ 265988, "regex_error(error_parse)" ], [ 266016, "regex_error(error_syntax)" ], [ 266044, "regex_error" ], [ 267312, "address family not supported" ], [ 267344, "address in use" ], [ 267360, "address not available" ], [ 267384, "already connected" ], [ 267404, "argument list too long" ], [ 267428, "argument out of domain" ], [ 267452, "bad address" ], [ 267464, "bad file descriptor" ], [ 267484, "bad message" ], [ 267496, "broken pipe" ], [ 267508, "connection aborted" ], [ 267528, "connection already in progress" ], [ 267560, "connection refused" ], [ 267580, "connection reset" ], [ 267600, "cross device link" ], [ 267620, "destination address required" ], [ 267652, "device or resource busy" ], [ 267676, "directory not empty" ], [ 267696, "executable format error" ], [ 267720, "file exists" ], [ 267732, "file too large" ], [ 267748, "filename too long" ], [ 267768, "function not supported" ], [ 267792, "host unreachable" ], [ 267812, "identifier removed" ], [ 267832, "illegal byte sequence" ], [ 267856, "inappropriate io control operation" ], [ 267892, "interrupted" ], [ 267904, "invalid argument" ], [ 267924, "invalid seek" ], [ 267940, "io error" ], [ 267952, "is a directory" ], [ 267968, "message size" ], [ 267984, "network down" ], [ 268000, "network reset" ], [ 268016, "network unreachable" ], [ 268036, "no buffer space" ], [ 268052, "no child process" ], [ 268072, "no link" ], [ 268080, "no lock available" ], [ 268100, "no message available" ], [ 268124, "no message" ], [ 268136, "no protocol option" ], [ 268156, "no space on device" ], [ 268176, "no stream resources" ], [ 268196, "no such device or address" ], [ 268224, "no such device" ], [ 268240, "no such file or directory" ], [ 268268, "no such process" ], [ 268284, "not a directory" ], [ 268300, "not a socket" ], [ 268316, "not a stream" ], [ 268332, "not connected" ], [ 268348, "not enough memory" ], [ 268368, "not supported" ], [ 268384, "operation canceled" ], [ 268404, "operation in progress" ], [ 268428, "operation not permitted" ], [ 268452, "operation not supported" ], [ 268476, "operation would block" ], [ 268500, "owner dead" ], [ 268512, "permission denied" ], [ 268532, "protocol error" ], [ 268548, "protocol not supported" ], [ 268572, "read only file system" ], [ 268596, "resource deadlock would occur" ], [ 268628, "resource unavailable try again" ], [ 268660, "result out of range" ], [ 268680, "state not recoverable" ], [ 268704, "stream timeout" ], [ 268720, "text file busy" ], [ 268736, "timed out" ], [ 268748, "too many files open in system" ], [ 268780, "too many files open" ], [ 268800, "too many links" ], [ 268816, "too many symbolic link levels" ], [ 268848, "value too large" ], [ 268864, "wrong protocol type" ], [ 268896, "FlsAlloc" ], [ 268908, "FlsFree" ], [ 268916, "FlsGetValue" ], [ 268928, "FlsSetValue" ], [ 268940, "InitializeCriticalSectionEx" ], [ 268968, "InitOnceExecuteOnce" ], [ 268988, "CreateEventExW" ], [ 269004, "CreateSemaphoreW" ], [ 269024, "CreateSemaphoreExW" ], [ 269044, "CreateThreadpoolTimer" ], [ 269068, "SetThreadpoolTimer" ], [ 269088, "WaitForThreadpoolTimerCallbacks" ], [ 269120, "CloseThreadpoolTimer" ], [ 269144, "CreateThreadpoolWait" ], [ 269168, "SetThreadpoolWait" ], [ 269188, "CloseThreadpoolWait" ], [ 269208, "FlushProcessWriteBuffers" ], [ 269236, "FreeLibraryWhenCallbackReturns" ], [ 269268, "GetCurrentProcessorNumber" ], [ 269296, "CreateSymbolicLinkW" ], [ 269316, "GetCurrentPackageId" ], [ 269336, "GetTickCount64" ], [ 269352, "GetFileInformationByHandleEx" ], [ 269384, "SetFileInformationByHandle" ], [ 269412, "GetSystemTimePreciseAsFileTime" ], [ 269444, "InitializeConditionVariable" ], [ 269472, "WakeConditionVariable" ], [ 269496, "WakeAllConditionVariable" ], [ 269524, "SleepConditionVariableCS" ], [ 269552, "InitializeSRWLock" ], [ 269572, "AcquireSRWLockExclusive" ], [ 269596, "TryAcquireSRWLockExclusive" ], [ 269624, "ReleaseSRWLockExclusive" ], [ 269648, "SleepConditionVariableSRW" ], [ 269676, "CreateThreadpoolWork" ], [ 269700, "SubmitThreadpoolWork" ], [ 269724, "CloseThreadpoolWork" ], [ 269744, "CompareStringEx" ], [ 269760, "GetLocaleInfoEx" ], [ 269776, "LCMapStringEx" ], [ 269900, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 273712, "wide", "api-ms-win-core-synch-l1-2-0.dll" ], [ 273808, "bad array new length" ], [ 273878, "wide", "Dapi-ms-win-core-fibers-l1-1-1" ], [ 273940, "wide", "api-ms-win-core-synch-l1-2-0" ], [ 274000, "wide", "kernel32" ], [ 274020, "wide", "api-ms-" ], [ 274036, "wide", "ext-ms-" ], [ 274104, "bad exception" ], [ 274536, "__cdecl" ], [ 274544, "__pascal" ], [ 274556, "__stdcall" ], [ 274568, "__thiscall" ], [ 274580, "__fastcall" ], [ 274592, "__vectorcall" ], [ 274608, "__clrcall" ], [ 274620, "__eabi" ], [ 274636, "__restrict" ], [ 274648, "__unaligned" ], [ 274660, "restrict(" ], [ 274680, "delete" ], [ 274712, "operator" ], [ 274880, "`local static guard'" ], [ 274916, "`vbase destructor'" ], [ 274936, "`vector deleting destructor'" ], [ 274968, "`default constructor closure'" ], [ 275000, "`scalar deleting destructor'" ], [ 275032, "`vector constructor iterator'" ], [ 275064, "`vector destructor iterator'" ], [ 275096, "`vector vbase constructor iterator'" ], [ 275132, "`virtual displacement map'" ], [ 275160, "`eh vector constructor iterator'" ], [ 275196, "`eh vector destructor iterator'" ], [ 275228, "`eh vector vbase constructor iterator'" ], [ 275268, "`copy constructor closure'" ], [ 275296, "`udt returning'" ], [ 275324, "`local vftable'" ], [ 275340, "`local vftable constructor closure'" ], [ 275384, "delete[]" ], [ 275396, "`omni callsig'" ], [ 275412, "`placement delete closure'" ], [ 275440, "`placement delete[] closure'" ], [ 275472, "`managed vector constructor iterator'" ], [ 275512, "`managed vector destructor iterator'" ] ], "sz": 1130296, "ts": [ { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for (idx = 0; idx \u003c regularLinks.length; idx++) {\r\n\t\tregularLinks[idx].onclick = openRegularLinks;\r\n..." ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://", "http://", "http://", "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.9200000166893005, "d": "Stylesheet href literal remote URL", "e": [ ".href = \"http://" ], "i": "objectives/impact/ui/delivery::remote-stylesheet-literal-url", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 52.00" ], "i": "metadata/package/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "JavaScript function keyword in non-code file", "e": [ "function $(", "function debug(" ], "i": "objectives/anti-static/obfuscation/payload::js-function-in-noncode", "l": 1, "m": "B0032" }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ "\tfor (" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.85", "text.string_density = 0.00", "text.string_density = 0.67" ], "i": "objectives/anti-static/obfuscation/code-metrics::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "WebKit debug() test helper", "e": [ "debug" ], "i": "metadata/package/testing/harness::webkit-debug-call", "l": 2 }, { "c": 0.8500000238418579, "d": "Trailing IIFE closure indicating auto-execution", "e": [ "})();" ], "i": "objectives/anti-static/obfuscation/eval/dynamic::export-iife-closure", "l": 2 }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "126625##plain@0x5f8d0", "126625##plain@0x5f988", "126625##plain@0x5fe30" ], "i": "objectives/supply-chain/metadata-anomaly/markers/npm::small-file-5k", "l": 1 }, { "c": 1.0, "d": "javascript code embedded in string", "e": [ "Detected javascript at offset 0x5f8d0", "Detected javascript at offset 0x5f988", "Detected javascript at offset 0x5fe30" ], "i": "metadata/lang/embedded::javascript", "l": 2 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 1.00", "text.total_lines = 18.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny JavaScript sidecar loader", "e": [ "text.total_lines = 1.00" ], "i": "objectives/supply-chain/hidden-payload/encoding::tiny-loader-lines", "l": 1 }, { "c": 0.800000011920929, "d": "JavaScript strings capped at five", "e": [ "strings.max_length = 0.00" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::js-max-string-length-short", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Small sidecar-sized file", "e": [ "identifiers.total = 4.00" ], "i": "metadata/package/config::small-sidecar-file", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 1.0, "d": "Authenticode chain CN: GlobalSign", "e": [ "GlobalSign" ], "i": "metadata/signed/developer::globalsign", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: GlobalSign CodeSigning CA - SHA256 - G3", "e": [ "GlobalSign CodeSigning CA - SHA256 - G3" ], "i": "metadata/signed/developer::globalsign-codesigning-ca---sha256---g3", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Cloud Installer", "e": [ "Cloud Installer" ], "i": "metadata/signed/developer::cloud-installer", "l": 2 }, { "c": 1.0, "d": "Signed by Cloud Installer", "e": [ "Cloud Installer" ], "i": "metadata/signed/leaf::cloud-installer", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "Embedded PE binary at file offset 0x6d600 (~335872 bytes)", "e": [ "kind=Pe32 estimated_size=335872" ], "i": "binary/embedded/pe", "l": 3 }, { "c": 0.8999999761581421, "d": "autogenerated rule brought to you by yara-signator", "e": [ "$sequence_0", "$sequence_0", "$sequence_0", "$sequence_0", "$sequence_0", "$sequence_0", "$sequence_1", "$sequence_1", "$sequence_2", "$sequence_3", "$sequence_4", "$sequence_4", "$sequence_5", "$sequence_6", "$sequence_6", "$sequence_7" ], "i": "third_party/Malpedia/Win/Startpage/Auto", "l": 5 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "Connect", "GetFolder" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 749568.00" ], "i": "well-known/malware/trojan/shellobject::xll-large-rsrc-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteExW)", "e": [ "ShellExecuteExW" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.59" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window (Unicode)", "e": [ "PostMessageW" ], "i": "micro-behaviors/os/message/queue::post-message-w", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.64)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-kernel32-package-current-l1-1-0", "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking::api-set-ext-cluster", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 749568.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExW" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8399999737739563, "d": "ATL ForceRemove registry directive", "e": [ "ForceRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-forceremove-directive", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.16" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": ".js extension", "e": [ "\"js/dbg.js\"" ], "i": "objectives/command-and-control/dropper/builder::js-ext", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 7680)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with many wide strings", "e": [ "binary.wide_string_count = 443.00" ], "i": "objectives/anti-static/obfuscation/payload/section::heavy-wide-string-corpus", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-file-l2-1-1", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-xstate-l2-1-0" ], "i": "metadata/binary/linking::api-set-core-cluster", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Presence of Base64 encoded content.", "e": [ "F[|BOQFBGZ|JMPWBOOFG" ], "i": "metadata/file/encoded::base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.8799999952316284, "d": "ATL module RTTI markers", "e": [ "CAtlException@ATL@@", "CComModule@ATL@@", "CAtlModule@ATL@@", "CComModule@ATL@@" ], "i": "metadata/binary/framework::atl-module-rtti", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll", "gAdvapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "QQQQQQQPQQQ", "SECURITY", "REGISTRY" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.4000000059604645, "d": "HKLM registry hive reference", "e": [ "HKLM" ], "i": "micro-behaviors/os/registry/access::hklm-hive", "l": 2 }, { "c": 1.0, "d": "PE/MZ binary embedded in resource section", "e": [ "4D 5A 90 00" ], "i": "micro-behaviors/data/embedded/payload::pe-magic-in-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "126625" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "c": 0.75, "d": "Query active window title length", "e": [ "GetWindowTextLengthW" ], "i": "micro-behaviors/ui/window/manage::get-window-text-length", "l": 2 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetOpen API name as string", "e": [ "InternetOpenW" ], "i": "micro-behaviors/communications/http/get::internet-open-str", "l": 1 }, { "c": 0.699999988079071, "d": "Move to next character", "e": [ "CharNextW" ], "i": "micro-behaviors/ui/window/manage::char-next", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.7799999713897705, "d": "Append child path via Shlwapi", "e": [ "PathAppendW" ], "i": "micro-behaviors/fs/path/construct::path-append", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesW" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1234.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.949999988079071, "d": "Connect to HTTP/FTP server via WinInet", "e": [ "InternetConnectW" ], "i": "micro-behaviors/communications/http/get::internet-connect", "l": 3 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.9800000190734863, "d": "user32 dynamic dispatch target", "e": [ "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Create cryptographic hash object", "e": [ "CryptCreateHash" ], "i": "micro-behaviors/crypto/library::crypt-create-hash", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.699999988079071, "d": "Create font object", "e": [ "CreateFontIndirectW" ], "i": "micro-behaviors/ui/graphics/draw::create-font-indirect", "l": 2 }, { "a": "T1071.001", "c": 0.949999988079071, "d": "HttpSendRequest WinInet API", "e": [ "HttpSendRequestW" ], "i": "micro-behaviors/communications/http/post::http-send-request", "l": 3, "m": "C0002" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1364.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 1130296.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1106", "c": 0.6000000238418579, "d": "EnumWindows / EnumChildWindows API", "e": [ "EnumChildWindows", "EnumWindows" ], "i": "objectives/evasion/process/injection::enum-windows-callback", "l": 3, "m": "E1106" }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage::enum-windows", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpSendRequest API name as string", "e": [ "HttpSendRequestW" ], "i": "micro-behaviors/communications/http/get::http-send-request-str", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI GetDIBits pixel readback", "e": [ "GetDIBits" ], "i": "micro-behaviors/hardware/display/screen::gdi-getdibits", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "ATL NoRemove registry directive", "e": [ "NoRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-noremove-directive", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically push entry to thread-safe list", "e": [ "InterlockedPushEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-push-entry-slist", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 13423.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales-import", "l": 2 }, { "a": "T1486", "c": 0.8999999761581421, "d": "Acquire cryptographic service provider context", "e": [ "CryptAcquireContextW" ], "i": "micro-behaviors/crypto/library::crypt-acquire-context", "l": 2, "m": "C0027" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "binary.file_size = 1130296.00" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1234.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "Send HTTP request via WinInet", "e": [ "HttpSendRequestW" ], "i": "micro-behaviors/communications/http/get::http-send-request", "l": 3 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.75, "d": "FlushInstructionCache call", "e": [ "FlushInstructionCache" ], "i": "micro-behaviors/mem/sync::flush-instruction-cache", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 749568)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-pe-resource-section", "l": 1 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.8999999761581421, "d": "Release cryptographic context", "e": [ "CryptReleaseContext" ], "i": "micro-behaviors/crypto/library::crypt-release-context", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "…titute or contain trade secrets of Polarity and its li…" ], "i": "micro-behaviors/data/text/keywords::secret", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.949999988079071, "d": "Initialize WinInet session", "e": [ "InternetOpenW" ], "i": "micro-behaviors/communications/http/get::internet-open", "l": 3 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.08" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteW)", "e": [ "ShellExecuteW" ], "i": "micro-behaviors/process/create/exec::shell-execute", "l": 3 }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "download", "download", "Download", "download", "download", "download", "download", "download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.800000011920929, "d": "Enumerate child windows", "e": [ "EnumChildWindows" ], "i": "micro-behaviors/ui/window/manage::enum-child-windows-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Resolve COM class from ProgID", "e": [ "CLSIDFromProgID" ], "i": "micro-behaviors/os/com/object::clsid-from-progid", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1364.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.949999988079071, "d": "Open HTTP request via WinInet", "e": [ "HttpOpenRequestW" ], "i": "micro-behaviors/communications/http/get::http-open-request", "l": 3 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetConnect API name as string", "e": [ "InternetConnectW" ], "i": "micro-behaviors/communications/http/get::internet-connect-str", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage::get-window-thread-process-id", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1234.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "Uses internet communication API imports", "e": [ "InternetOpenW", "HttpOpenRequestW" ], "i": "micro-behaviors/communications/http::has-internet-communication-apis", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "Firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c9" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (Unicode)", "e": [ "PeekMessageW" ], "i": "micro-behaviors/os/message/queue::peek-message-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically pop entry from thread-safe list", "e": [ "InterlockedPopEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-pop-entry-slist", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1511340343.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32", "e": [ "SHGetFolderPathW" ], "i": "micro-behaviors/fs/shell-ops::shell-get-folder-path", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.949999988079071, "d": "Five section wrapper layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/layout::five-section-wrapper", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetCloseHandle API name", "e": [ "InternetCloseHandle" ], "i": "micro-behaviors/communications/http/get::internet-close-handle-str", "l": 1 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 247.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcW" ], "i": "micro-behaviors/ui/window/manage::call-window-proc", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 1130296.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.8999999761581421, "d": "Hash data using crypto provider", "e": [ "CryptHashData" ], "i": "micro-behaviors/crypto/library::crypt-hash-data", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.9700000286102295, "d": "Wrapper file size band", "e": [ "binary.file_size = 1130296.00" ], "i": "metadata/binary/layout::wrapper-file-size-band", "l": 1 }, { "d": "overflow keyword", "e": [ "…588px; overflow:scroll; overflow-x:hidden; border:1px so…", "…th:650px; height:500px; overflow:hidded; position:relati…", "…ght:230px; width:588px; overflow:scroll; overflow-x:hidd…" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.9700000286102295, "d": "Signed PE wrapper marker", "e": [ "pe.has_signature = 1.00" ], "i": "metadata/binary/layout::signed-pe-wrapper", "l": 1 }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.7599999904632568, "d": "Convert GUID to string", "e": [ "StringFromGUID2" ], "i": "micro-behaviors/os/com/invoke::string-from-guid2", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 247.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Locate PE resource entry with language", "e": [ "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 4 (connect)", "e": [ "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpOpenRequest API name as string", "e": [ "HttpOpenRequestW" ], "i": "micro-behaviors/communications/http/get::http-open-request-str", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry delete API lookup", "e": [ "RegDeleteKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-delete-key-transacted-name", "l": 3 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll mouse cursor position", "e": [ "GetCursorPos" ], "i": "micro-behaviors/hardware/input/keyboard::get-cursor-pos", "l": 2, "m": "E1056.001" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry create API lookup", "e": [ "RegCreateKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-transacted-name", "l": 3 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect", "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeCriticalSectionEx", "WaitForThreadpoolTimerCallbacks", "FlushProcessWriteBuffers", "FreeLibraryWhenCallbackReturns", "GetCurrentProcessorNumber", "GetCurrentPackageId", "GetFileInformationByHandleEx", "GetSystemTimePreciseAsFileTime", "InitializeConditionVariable", "SleepConditionVariableCS", "AcquireSRWLockExclusive", "TryAcquireSRWLockExclusive", "ReleaseSRWLockExclusive", "SleepConditionVariableSRW", "EnumSystemLocalesEx", "GetUserDefaultLocaleName" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Registry blob wipe API", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 3, "m": "F0007" }, { "c": 0.8199999928474426, "d": "Oversized PE resource section", "e": [ ".rsrc (size: 749568)" ], "i": "metadata/binary/resource::oversized-rsrc", "l": 3 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.8399999737739563, "d": "Resource-heavy PE with large .rsrc", "e": [ ".rsrc (size: 749568)" ], "i": "metadata/binary/resource::resource-heavy-rsrc", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1234.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry open API lookup", "e": [ "RegOpenKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-transacted-name", "l": 3 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1234.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1364.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1234.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 1130296.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableW" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.7200000286102295, "d": "WinInet DLL import name", "e": [ "WININET.dll" ], "i": "micro-behaviors/communications/http/get::wininet-dll-import-name", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (CryptCreateHash, CryptAcquireContextW, RegQueryInfoKeyW, RegDeleteKeyW, RegEnumKeyExW, ... +11 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 161, ORDINAL 420, ORDINAL 313, ORDINAL 7, ORDINAL 4, ... +7 more)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (ReleaseDC, UpdateWindow, BeginPaint, UnregisterClassW, EndPaint, ... +60 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (OleLockRunning, CoGetClassObject, OleUninitialize, StringFromGUID2, CoTaskMemRealloc, ... +10 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (InterlockedIncrement, lstrcmpiW, LoadLibraryExW, TlsGetValue, LeaveCriticalSection, ... +106 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetFolderPathW, ShellExecuteW, ShellExecuteExW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (UrlEscapeW, PathAppendW, PathAddBackslashW, UrlUnescapeW)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEACC.dll (AccessibleObjectFromWindow)", "e": [ "OLEACC.dll" ], "i": "metadata/dylib::oleacc/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetObjectW, DeleteDC, GetStockObject, CreateCompatibleBitmap, CreateSolidBrush, ... +9 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WININET.dll (InternetCloseHandle, HttpSendRequestW, InternetCrackUrlW, InternetOpenW, HttpOpenRequestW, ... +1 more)", "e": [ "WININET.dll" ], "i": "metadata/dylib::wininet/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 247.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1113", "c": 0.9399999976158142, "d": "Windows GDI active window capture primitives", "e": [ "GetDC", "CreateCompatibleBitmap", "BitBlt", "GetDesktopWindow", "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-window-capture-primitives", "l": 2, "m": "C0014" }, { "a": "T1027", "c": 0.8999999761581421, "d": "WinInet APIs resolved dynamically", "e": [ "InternetOpenW", "HttpSendRequestW", "InternetCloseHandle", "InternetConnectW", "HttpOpenRequestW" ], "i": "micro-behaviors/communications/http/get::wininet-dynamic-load", "l": 2 }, { "c": 0.8600000143051147, "d": "PNG and manifest in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e", "IHDR" ], "i": "metadata/binary/resource::png-and-manifest-rsrc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "FileVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetUserDefaultLCID", "EnumSystemLocalesW", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::locale-fingerprinting-imports", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Full Win32 GUI message-pump import cluster", "e": [ "RegisterClassExW", "GetMessageW", "DispatchMessageW", "DefWindowProcW", "CreateWindowExW" ], "i": "objectives/evasion/anti-av/heuristic::gui-message-pump-cluster", "l": 1 }, { "a": "T1113", "c": 0.9300000071525574, "d": "Windows GDI screenshot primitives", "e": [ "CreateCompatibleBitmap", "GetDesktopWindow", "CreateCompatibleDC", "GetDIBits", "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-screen-capture-primitives", "l": 2, "m": "C0014" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx", "GetUserDefaultLCID", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "c": 0.800000011920929, "d": "Signed versioned temp handoff context", "e": [ "GlobalSign", "VS_VERSION_INFO", "GlobalSign CodeSigning CA - SHA256 - G3", "Cloud Installer", "binary.import_count = 247.00" ], "i": "objectives/command-and-control/dropper/execution/loader::signed-versioned-temp-handoff-profile", "l": 1 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "ATL COM registration directives", "e": [ "ForceRemove", "NoRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-registration-directives", "l": 1 }, { "c": 0.8999999761581421, "d": "WinInet request and response workflow", "e": [ "InternetOpenW", "HttpOpenRequestW", "HttpSendRequestW", "InternetConnectW" ], "i": "micro-behaviors/communications/http/get::wininet-http-flow", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceW", "LoadResource", "LockResource", "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource extraction API chain", "e": [ "LoadLibraryExA", "FindResourceExW", "LoadResource", "FindResourceW", "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-loader-api-chain", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExW", "RegCreateKeyExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InterlockedPopEntrySList", "InitializeSListHead", "InterlockedPushEntrySList" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "SizeofResource", "LoadResource", "FindResourceW", "LockResource", "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 1 }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI window capture with screen context", "e": [ "GetDC", "CreateCompatibleBitmap", "GetDesktopWindow", "GetWindowTextW", "CreateCompatibleDC", "GetWindowTextLengthW", "BitBlt" ], "i": "objectives/collection/screenshot/capture::gdi-window-capture", "l": 2, "m": "C0014" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Transacted registry API fallback chain", "e": [ "RegOpenKeyTransactedW", "RegCreateKeyTransactedW", "RegDeleteKeyTransactedW" ], "i": "micro-behaviors/os/registry/access::registry-transacted-api-chain", "l": 3 }, { "c": 0.9200000166893005, "d": "Resource-heavy PE with PNG UI bundle", "e": [ ".rsrc (size: 749568)", "VS_VERSION_INFO", "FileVersion", "IHDR", "ProductVersion" ], "i": "metadata/binary/resource::resource-heavy-png-ui-wrapper", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetEnvironmentStringsW", "GetLocaleInfoW", "GetUserDefaultLCID", "EnumSystemLocalesW", "FreeEnvironmentStringsW", "EnumSystemLocalesEx" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 2, "m": "E1082" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with low average complexity", "e": [ "binary.avg_complexity = 7.08", "binary.file_size = 1130296.00", "binary.function_count = 1234.00", "binary.overall_entropy = 5.59", "binary.string_count = 1364.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-binary-low-average-complexity", "l": 2, "m": "B0032" }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "GetCurrentThreadId", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetUserDefaultLCID", "GetCommandLineA", "GetLocaleInfoW", "EnumSystemLocalesW", "GetCommandLineW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "a": "T1010", "c": 0.8500000238418579, "d": "Process discovery via window enumeration", "e": [ "GetWindowThreadProcessId", "EnumWindows", "EnumChildWindows", "GetWindowTextW" ], "i": "objectives/discovery/process/window::window-process-discovery", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetCommandLineA", "FreeEnvironmentStringsW", "GetUserDefaultLCID", "GetEnvironmentStringsW", "GetLocaleInfoW", "EnumSystemLocalesW", "EnumSystemLocalesEx", "GetSystemTimeAsFileTime", "GetCommandLineW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 2, "m": "E1082" } ], "sha": "62a2b59f00a9441064d09ad3f7cbc3e7e1965a3b6ef74e29789077e0a8c3ca78", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/126625", "type": "pe" }, { "f": "KO₄(C₃Er₃Al₂As₈)H₅(Cm₄Db₂DsPo₂Os)Md₂(Bi₃Si)", "x": 16, "dp": 1, "id": 1, "is": [ "GlobalHandle", "GlobalFree", "MultiByteToWideChar", "LoadResource", "FindResourceExW", "RaiseException", "HeapReAlloc", "GlobalAlloc", "LockResource", "GetLastError", "HeapSize", "GetCurrentThreadId", "LeaveCriticalSection", "InitializeCriticalSectionAndSpinCount", "GetModuleFileNameW", "CreateFileW", "WriteConsoleW", "FlushFileBuffers", "SetFilePointerEx", "GetConsoleMode", "InterlockedDecrement", "SetStdHandle", "MulDiv", "GetEnvironmentStringsW", "GetCommandLineW", "GetCommandLineA", "GetOEMCP", "IsValidCodePage", "FindNextFileW", "FindFirstFileExW", "FindClose", "EnumSystemLocalesW", "GetUserDefaultLCID", "IsValidLocale", "GetFileType", "GetACP", "WriteFile", "GetStdHandle", "GetModuleHandleExW", "ExitProcess", "lstrcmpW", "GlobalUnlock", "InterlockedIncrement", "GetProcessHeap", "DeleteCriticalSection", "GlobalLock", "HeapDestroy", "DecodePointer", "HeapAlloc", "FreeEnvironmentStringsW", "FindResourceW", "EnterCriticalSection", "SetLastError", "HeapFree", "GetConsoleCP", "SizeofResource", "LoadLibraryExW", "FreeLibrary", "RtlUnwind", "QueryPerformanceCounter", "GetStartupInfoW", "TerminateProcess", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "WaitForSingleObjectEx", "ResetEvent", "SetEvent", "OutputDebugStringW", "IsDebuggerPresent", "LoadLibraryExA", "VirtualFree", "VirtualAlloc", "IsProcessorFeaturePresent", "FlushInstructionCache", "InterlockedPushEntrySList", "InterlockedPopEntrySList", "InitializeSListHead", "EncodePointer", "GetSystemTimeAsFileTime", "TlsFree", "TlsSetValue", "TlsGetValue", "TlsAlloc", "CreateEventW", "GetLocaleInfoW", "LCMapStringW", "CompareStringW", "GetCPInfo", "WideCharToMultiByte", "GetCurrentProcess", "GetEnvironmentVariableW", "FormatMessageW", "CloseHandle", "GetProcAddress", "LocalFree", "GetCurrentProcessId", "GetModuleHandleW", "GetStringTypeW", "MapDialogRect", "SetWindowLongW", "GetClientRect", "GetDlgItem", "GetDesktopWindow", "EndDialog", "SetCapture", "GetWindowTextW", "EndPaint", "BeginPaint", "ReleaseDC", "InvalidateRect", "ReleaseCapture", "RegisterWindowMessageW", "GetParent", "GetClassNameW", "MessageBoxW", "GetActiveWindow", "DialogBoxIndirectParamW", "GetWindowLongW", "GetWindowTextLengthW", "DefWindowProcW", "CallWindowProcW", "GetWindow", "GetFocus", "DestroyWindow", "GetDC", "SetWindowPos", "FillRect", "CreateWindowExW", "ScreenToClient", "SendMessageW", "LoadCursorW", "UnregisterClassW", "SetWindowTextW", "RegisterClassExW", "IsWindow", "InvalidateRgn", "RedrawWindow", "ClientToScreen", "DestroyAcceleratorTable", "IsChild", "GetSysColor", "MoveWindow", "CreateAcceleratorTableW", "SetFocus", "CharNextW", "SetWindowContextHelpId", "GetClassInfoExW", "BitBlt", "CreateCompatibleBitmap", "SelectObject", "CreateCompatibleDC", "GetStockObject", "GetDeviceCaps", "DeleteDC", "GetObjectW", "DeleteObject", "CreateSolidBrush", "RegCloseKey", "RegDeleteKeyW", "RegOpenKeyExW", "RegQueryValueExW", "RegDeleteValueW", "RegSetValueExW", "RegCreateKeyExW", "RegEnumKeyW", "CoGetClassObject", "OleUninitialize", "CoTaskMemAlloc", "StringFromGUID2", "CoCreateInstance", "CLSIDFromProgID", "CoTaskMemFree", "CreateStreamOnHGlobal", "OleInitialize", "CLSIDFromString", "OleLockRunning", "CoCreateGuid", "CoInitialize", "CoUninitialize", "ORDINAL 9", "ORDINAL 162", "ORDINAL 8", "ORDINAL 161", "ORDINAL 6", "ORDINAL 420", "ORDINAL 2", "ORDINAL 7", "ORDINAL 4", "UrlEscapeW", "PathRemoveFileSpecW", "UrlUnescapeW", "HttpOpenRequestW", "InternetOpenW", "InternetCrackUrlW", "HttpSendRequestW", "InternetCloseHandle", "InternetConnectW", "ShellExecuteW" ], "ms": { "pe": { "signer": "GlobalSign, GlobalSign CodeSigning CA - SHA256 - G3, Cloud Installer", "machine": 332.0, "checksum": 339290.0, "rsrc_size": 51712.0, "subsystem": 2.0, "timestamp": 1511340304.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.37, "entry_section": ".text", "has_signature": true, "size_of_image": 335872.0, "timestamp_day": 22.0, "file_alignment": 512.0, "primary_signer": "Cloud Installer", "resource_count": 5.0, "signature_type": "developer", "timestamp_year": 2017.0, "characteristics": 258.0, "entry_point_rva": 77628.0, "size_of_headers": 1024.0, "timestamp_month": 11.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 9.0, "manifest_present": true, "certificate_count": 1.0, "checksum_mismatch": true, "computed_checksum": 395313.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1511340304.0, "debug_timestamp_min": 1511340304.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 14.0, "linker_minor_version": 11.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 3128.0, "debug_directory_entries": 2.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 2.0 }, "binary": { "code_size": 174080.0, "file_size": 335872.0, "entry_point": 77628.0, "code_entropy": 6.64, "data_entropy": 4.82, "import_count": 198.0, "string_count": 929.0, "has_signature": true, "section_count": 5.0, "avg_complexity": 6.23, "function_count": 935.0, "import_density": 1.16, "max_complexity": 385.0, "string_density": 5.46, "overall_entropy": 5.43, "avg_basic_blocks": 9.67, "avg_section_size": 64102.4, "dependency_count": 9.0, "entropy_variance": 1.01, "function_density": 5.5, "avg_function_size": 250.03, "avg_string_length": 19.03, "complexity_per_kb": 0.04, "max_string_length": 762.0, "wide_string_count": 140.0, "writable_sections": 1.0, "avg_string_entropy": 3.03, "code_to_data_ratio": 1.19, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.15, "text_to_file_ratio": 0.52, "total_basic_blocks": 9042.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 31.57, "debug_reference_count": 2.0, "largest_section_ratio": 0.52, "sentence_string_count": 67.0, "sentence_string_ratio": 0.07, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0, "high_complexity_functions": 9.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 248, "Rich" ], [ 512, ".text" ], [ 591, "@.data" ], [ 632, ".rsrc" ], [ 671, "@.reloc" ], [ 1711, "QSVW" ], [ 3726, "f91u" ], [ 13967, "SSPPWSSSj" ], [ 14117, "QQSV" ], [ 16918, "Nwltf" ], [ 23374, "RQVP" ], [ 28943, "SVWP" ], [ 29889, "6QPQS" ], [ 30347, "QQSVW" ], [ 31498, "QSV3" ], [ 33574, "PPPPS" ], [ 33825, "QQQQPSQj" ], [ 33853, "RRVP" ], [ 34999, "PSVW" ], [ 35860, "9w4v" ], [ 37024, "SVW3" ], [ 40112, "GWSR" ], [ 42382, "SSSSW" ], [ 42585, "PPPPW" ], [ 46508, "JPRS" ], [ 49372, "PQSVW" ], [ 59024, "WHVR" ], [ 60728, "7SPV" ], [ 76169, "Genu" ], [ 76187, "5ntel" ], [ 79577, "8RCC" ], [ 79585, "8MOC" ], [ 92491, "YYPV" ], [ 92929, "r39z" ], [ 93552, "UVWS" ], [ 94080, "UQPXY]Y[" ], [ 94180, "6PWQ" ], [ 98462, "QQVW" ], [ 105812, "PSWSS" ], [ 110485, "PWWS" ], [ 114242, "f90t" ], [ 114275, "f97t" ], [ 120667, "v6j0" ], [ 121904, "QWPV" ], [ 124875, "9E WW" ], [ 125349, "PPPPPWS" ], [ 125407, "QQQP" ], [ 125565, "PP9E u:PPVWP" ], [ 128543, "f90u" ], [ 128558, "PVSQSWV" ], [ 138350, "WWWPWS" ], [ 141310, "f92t" ], [ 143015, "/PjSW" ], [ 150480, "f98t" ], [ 168560, "WVU3" ], [ 176080, "atlthunk.dll" ], [ 176096, "AtlThunk_AllocateData" ], [ 176120, "AtlThunk_InitData" ], [ 176140, "AtlThunk_DataToCode" ], [ 176160, "AtlThunk_FreeData" ], [ 176200, "ERROR : Unable to initialize critical section in CAtlBaseModule\n" ], [ 176356, "bad allocation" ], [ 176424, "regex_error(error_collate): The expression contained an invalid collating element name." ], [ 176512, "regex_error(error_ctype): The expression contained an invalid character class name." ], [ 176600, "regex_error(error_escape): The expression contained an invalid escaped character, or a trailing escape." ], [ 176704, "regex_error(error_backref): The expression contained an invalid back reference." ], [ 176784, "regex_error(error_brack): The expression contained mismatched [ and ]." ], [ 176856, "regex_error(error_paren): The expression contained mismatched ( and )." ], [ 176928, "regex_error(error_brace): The expression contained mismatched { and }." ], [ 177000, "regex_error(error_badbrace): The expression contained an invalid range in a { expression }." ], [ 177096, "regex_error(error_range): The expression contained an invalid character range, such as [b-a] in most encodings." ], [ 177208, "regex_error(error_space): There was insufficient memory to convert the expression into a finite state machine." ], [ 177320, "regex_error(error_badrepeat): One of *?+{ was not preceded by a valid regular expression." ], [ 177416, "regex_error(error_complexity): The complexity of an attempted match against a regular expression exceeded a pre-set level." ], [ 177544, "regex_error(error_stack): There was insufficient memory to determine whether the regular expression could match the specified ch" ], [ 177692, "regex_error(error_parse)" ], [ 177720, "regex_error(error_syntax)" ], [ 177748, "regex_error" ], [ 181464, "wide", "kernel32.dll" ], [ 181492, "FlsAlloc" ], [ 181504, "FlsFree" ], [ 181512, "FlsGetValue" ], [ 181524, "FlsSetValue" ], [ 181536, "InitializeCriticalSectionEx" ], [ 181564, "InitOnceExecuteOnce" ], [ 181584, "CreateEventExW" ], [ 181600, "CreateSemaphoreW" ], [ 181620, "CreateSemaphoreExW" ], [ 181640, "CreateThreadpoolTimer" ], [ 181664, "SetThreadpoolTimer" ], [ 181684, "WaitForThreadpoolTimerCallbacks" ], [ 181716, "CloseThreadpoolTimer" ], [ 181740, "CreateThreadpoolWait" ], [ 181764, "SetThreadpoolWait" ], [ 181784, "CloseThreadpoolWait" ], [ 181804, "FlushProcessWriteBuffers" ], [ 181832, "FreeLibraryWhenCallbackReturns" ], [ 181864, "GetCurrentProcessorNumber" ], [ 181892, "CreateSymbolicLinkW" ], [ 181912, "GetCurrentPackageId" ], [ 181932, "GetTickCount64" ], [ 181948, "GetFileInformationByHandleEx" ], [ 181980, "SetFileInformationByHandle" ], [ 182008, "GetSystemTimePreciseAsFileTime" ], [ 182040, "InitializeConditionVariable" ], [ 182068, "WakeConditionVariable" ], [ 182092, "WakeAllConditionVariable" ], [ 182120, "SleepConditionVariableCS" ], [ 182148, "InitializeSRWLock" ], [ 182168, "AcquireSRWLockExclusive" ], [ 182192, "TryAcquireSRWLockExclusive" ], [ 182220, "ReleaseSRWLockExclusive" ], [ 182244, "SleepConditionVariableSRW" ], [ 182272, "CreateThreadpoolWork" ], [ 182296, "SubmitThreadpoolWork" ], [ 182320, "CloseThreadpoolWork" ], [ 182340, "CompareStringEx" ], [ 182356, "GetLocaleInfoEx" ], [ 182372, "LCMapStringEx" ], [ 182484, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 182564, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 182648, "wide", "api-ms-win-core-synch-l1-2-0.dll" ], [ 182744, "bad array new length" ], [ 182814, "Bapi-ms-win-core-fibers-l1-1-1" ], [ 182876, "wide", "api-ms-win-core-synch-l1-2-0" ], [ 182936, "kernel32" ], [ 182956, "wide", "api-ms-" ], [ 182972, "wide", "ext-ms-" ], [ 183040, "bad exception" ], [ 183472, "__cdecl" ], [ 183480, "__pascal" ], [ 183492, "__stdcall" ], [ 183504, "__thiscall" ], [ 183516, "__fastcall" ], [ 183528, "__vectorcall" ], [ 183544, "__clrcall" ], [ 183556, "__eabi" ], [ 183572, "__restrict" ], [ 183584, "__unaligned" ], [ 183596, "restrict(" ], [ 183616, "delete" ], [ 183652, "operator" ], [ 183824, "`local static guard'" ], [ 183860, "`vbase destructor'" ], [ 183880, "`vector deleting destructor'" ], [ 183912, "`default constructor closure'" ], [ 183944, "`scalar deleting destructor'" ], [ 183976, "`vector constructor iterator'" ], [ 184008, "`vector destructor iterator'" ], [ 184040, "`vector vbase constructor iterator'" ], [ 184076, "`virtual displacement map'" ], [ 184104, "`eh vector constructor iterator'" ], [ 184140, "`eh vector destructor iterator'" ], [ 184172, "`eh vector vbase constructor iterator'" ], [ 184212, "`copy constructor closure'" ], [ 184240, "`udt returning'" ], [ 184268, "`local vftable'" ], [ 184284, "`local vftable constructor closure'" ], [ 184328, "delete[]" ], [ 184340, "`omni callsig'" ], [ 184356, "`placement delete closure'" ], [ 184384, "`placement delete[] closure'" ], [ 184416, "`managed vector constructor iterator'" ], [ 184456, "`managed vector destructor iterator'" ], [ 184496, "`eh vector copy constructor iterator'" ], [ 184536, "`eh vector vbase copy constructor iterator'" ], [ 184580, "`dynamic initializer for '" ], [ 184608, "`dynamic atexit destructor for '" ], [ 184644, "`vector copy constructor iterator'" ], [ 184680, "`vector vbase copy constructor iterator'" ], [ 184724, "`managed vector copy constructor iterator'" ], [ 184768, "`local static thread guard'" ], [ 184812, "operator co_await" ], [ 184832, " Type Descriptor'" ], [ 184852, " Base Class Descriptor at (" ], [ 184880, " Base Class Array'" ], [ 184900, " Class Hierarchy Descriptor'" ], [ 184932, " Complete Object Locator'" ], [ 185001, "700WP" ], [ 185017, "`h````" ], [ 185102, "700PP" ], [ 185148, "(null)" ], [ 185156, "wide", "(null)" ], [ 186984, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 187368, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 190284, "mscoree.dll" ], [ 190308, "CorExitProcess" ], [ 190518, "BLC_ALL" ], [ 190536, "LC_COLLATE" ], [ 190560, "LC_CTYPE" ], [ 190580, "LC_MONETARY" ], [ 190604, "LC_NUMERIC" ], [ 190628, "wide", "LC_TIME" ], [ 190679, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 190824, "NAN(SNAN)" ], [ 190836, "nan(snan)" ], [ 190848, "NAN(IND)" ], [ 190860, "nan(ind)" ], [ 190908, "Sunday" ], [ 190916, "Monday" ], [ 190924, "Tuesday" ], [ 190932, "Wednesday" ], [ 190944, "Thursday" ], [ 190956, "Friday" ], [ 190964, "Saturday" ], [ 191024, "January" ], [ 191032, "February" ], [ 191044, "March" ], [ 191052, "April" ], [ 191060, "June" ], [ 191068, "July" ], [ 191076, "August" ], [ 191084, "September" ], [ 191096, "October" ], [ 191104, "November" ], [ 191116, "December" ], [ 191136, "MM/dd/yy" ], [ 191148, "dddd, MMMM dd, yyyy" ], [ 191236, "wide", "Sunday" ], [ 191252, "Monday" ], [ 191268, "wide", "Tuesday" ], [ 191284, "wide", "Wednesday" ], [ 191304, "wide", "Thursday" ], [ 191324, "wide", "Friday" ], [ 191340, "Saturday" ], [ 191456, "wide", "January" ], [ 191472, "February" ], [ 191492, "March" ], [ 191504, "April" ], [ 191516, "June" ], [ 191528, "wide", "July" ], [ 191540, "August" ], [ 191556, "September" ], [ 191576, "October" ], [ 191592, "November" ], [ 191612, "December" ], [ 191648, "MM/dd/yy" ], [ 191668, "wide", "dddd, MMMM dd, yyyy" ], [ 192034, "C(C4CDCXChC|C" ], [ 192166, "wide", "Capi-ms-win-appmodel-runtime-l1-1-1" ], [ 192240, "api-ms-win-core-datetime-l1-1-1" ], [ 192304, "api-ms-win-core-file-l2-1-1" ], [ 192360, "api-ms-win-core-localization-l1-2-1" ], [ 192432, "api-ms-win-core-localization-obsolete-l1-2-0" ], [ 192528, "api-ms-win-core-processthreads-l1-1-2" ], [ 192604, "api-ms-win-core-string-l1-1-0" ], [ 192664, "wide", "api-ms-win-core-sysinfo-l1-2-1" ], [ 192728, "api-ms-win-core-winrt-l1-1-0" ], [ 192788, "wide", "api-ms-win-core-xstate-l2-1-0" ], [ 192848, "wide", "api-ms-win-rtcore-ntuser-window-l1-1-0" ], [ 192928, "wide", "api-ms-win-security-systemfunctions-l1-1-0" ], [ 193016, "wide", "ext-ms-win-kernel32-package-current-l1-1-0" ], [ 193104, "ext-ms-win-ntuser-dialogbox-l1-1-0" ], [ 193176, "wide", "ext-ms-win-ntuser-windowstation-l1-1-0" ], [ 193256, "advapi32" ] ], "sz": 335872, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: GlobalSign", "e": [ "GlobalSign" ], "i": "metadata/signed/developer::globalsign", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: GlobalSign CodeSigning CA - SHA256 - G3", "e": [ "GlobalSign CodeSigning CA - SHA256 - G3" ], "i": "metadata/signed/developer::globalsign-codesigning-ca---sha256---g3", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Cloud Installer", "e": [ "Cloud Installer" ], "i": "metadata/signed/developer::cloud-installer", "l": 2 }, { "c": 1.0, "d": "Signed by Cloud Installer", "e": [ "Cloud Installer" ], "i": "metadata/signed/leaf::cloud-installer", "l": 3 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.43" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.64)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-kernel32-package-current-l1-1-0", "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking::api-set-ext-cluster", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExW" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.03" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6656)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 198.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-file-l2-1-1", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-xstate-l2-1-0" ], "i": "metadata/binary/linking::api-set-core-cluster", "l": 1 }, { "c": 0.8500000238418579, "d": "DarkGate C2 record with embedded key anchor", "e": [ "8bunz8" ], "i": "well-known/malware/trojan/darkgate::c2-record-key-anchor", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 198.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.8799999952316284, "d": "ATL module RTTI markers", "e": [ "CAtlException@ATL@@" ], "i": "metadata/binary/framework::atl-module-rtti", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4e", "47", "4f", "4f", "47", "4f", "4f", "46", "4e", "48", "41", "46", "48", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 198.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 198.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "c": 0.75, "d": "Query active window title length", "e": [ "GetWindowTextLengthW" ], "i": "micro-behaviors/ui/window/manage::get-window-text-length", "l": 2 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::set-window-long", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetOpen API name as string", "e": [ "InternetOpenW" ], "i": "micro-behaviors/communications/http/get::internet-open-str", "l": 1 }, { "c": 0.699999988079071, "d": "Move to next character", "e": [ "CharNextW" ], "i": "micro-behaviors/ui/window/manage::char-next", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster GetActiveWindow", "e": [ "GetActiveWindow" ], "i": "metadata/binary/symbols::gui-import-cluster-getactivewindow", "l": 1 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 935.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.949999988079071, "d": "Connect to HTTP/FTP server via WinInet", "e": [ "InternetConnectW" ], "i": "micro-behaviors/communications/http/get::internet-connect", "l": 3 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.9800000190734863, "d": "user32 dynamic dispatch target", "e": [ "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target", "l": 1 }, { "a": "T1071.001", "c": 0.949999988079071, "d": "HttpSendRequest WinInet API", "e": [ "HttpSendRequestW" ], "i": "micro-behaviors/communications/http/post::http-send-request", "l": 3, "m": "C0002" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00", "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 335872.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpSendRequest API name as string", "e": [ "HttpSendRequestW" ], "i": "micro-behaviors/communications/http/get::http-send-request-str", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically push entry to thread-safe list", "e": [ "InterlockedPushEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-push-entry-slist", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 198.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": "GetEnvironmentVariableW import", "e": [ "GetEnvironmentVariableW" ], "i": "well-known/malware/trojan/hijack-gen::get-environment-variable-w-import", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 9042.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Strip filename from path", "e": [ "PathRemoveFileSpecW" ], "i": "micro-behaviors/fs/path/check::path-remove-file-spec", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 935.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 198.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.949999988079071, "d": "Send HTTP request via WinInet", "e": [ "HttpSendRequestW" ], "i": "micro-behaviors/communications/http/get::http-send-request", "l": 3 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.75, "d": "FlushInstructionCache call", "e": [ "FlushInstructionCache" ], "i": "micro-behaviors/mem/sync::flush-instruction-cache", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.949999988079071, "d": "Initialize WinInet session", "e": [ "InternetOpenW" ], "i": "micro-behaviors/communications/http/get::internet-open", "l": 3 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.23" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteW)", "e": [ "ShellExecuteW" ], "i": "micro-behaviors/process/create/exec::shell-execute", "l": 3 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8500000238418579, "d": "Resolve COM class from ProgID", "e": [ "CLSIDFromProgID" ], "i": "micro-behaviors/os/com/object::clsid-from-progid", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 929.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.949999988079071, "d": "Open HTTP request via WinInet", "e": [ "HttpOpenRequestW" ], "i": "micro-behaviors/communications/http/get::http-open-request", "l": 3 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 198.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetConnect API name as string", "e": [ "InternetConnectW" ], "i": "micro-behaviors/communications/http/get::internet-connect-str", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage::def-window-proc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 935.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "Uses internet communication API imports", "e": [ "HttpOpenRequestW", "InternetOpenW" ], "i": "micro-behaviors/communications/http::has-internet-communication-apis", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c9" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Atomically pop entry from thread-safe list", "e": [ "InterlockedPopEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-pop-entry-slist", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1511340304.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 335872.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage::get-window-long", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetCloseHandle API name", "e": [ "InternetCloseHandle" ], "i": "micro-behaviors/communications/http/get::internet-close-handle-str", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 198.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcW" ], "i": "micro-behaviors/ui/window/manage::call-window-proc", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window", "e": [ "SendMessageW" ], "i": "micro-behaviors/ui/window/manage::send-message", "l": 2 }, { "c": 0.7599999904632568, "d": "Convert GUID to string", "e": [ "StringFromGUID2" ], "i": "micro-behaviors/os/com/invoke::string-from-guid2", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 198.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Locate PE resource entry with language", "e": [ "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 4 (connect)", "e": [ "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-4", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpOpenRequest API name as string", "e": [ "HttpOpenRequestW" ], "i": "micro-behaviors/communications/http/get::http-open-request-str", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindow" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeCriticalSectionEx", "WaitForThreadpoolTimerCallbacks", "FlushProcessWriteBuffers", "FreeLibraryWhenCallbackReturns", "GetCurrentProcessorNumber", "GetCurrentPackageId", "GetFileInformationByHandleEx", "GetSystemTimePreciseAsFileTime", "InitializeConditionVariable", "SleepConditionVariableCS", "AcquireSRWLockExclusive", "TryAcquireSRWLockExclusive", "ReleaseSRWLockExclusive", "SleepConditionVariableSRW", "EnumSystemLocalesEx", "GetUserDefaultLocaleName" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Registry blob wipe API", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 3, "m": "F0007" }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "160.134.63.204:5352", "184.85.116.130:16269", "21.191.18.231:55615" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "160.134.63.204:5352", "184.85.116.130:16269", "21.191.18.231:55615" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 935.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextW" ], "i": "objectives/command-and-control/backdoor/binary::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "74 c0 42 00", "74 c0 42 00", "74 c0 42 00", "74 c0 42 00", "74 c0 42 00", "74 c0 42 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 935.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableW" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.7200000286102295, "d": "WinInet DLL import name", "e": [ "WININET.dll" ], "i": "micro-behaviors/communications/http/get::wininet-dll-import-name", "l": 3 }, { "c": 0.949999988079071, "d": "links WININET.dll (HttpOpenRequestW, InternetOpenW, InternetCrackUrlW, HttpSendRequestW, InternetCloseHandle, ... +1 more)", "e": [ "WININET.dll" ], "i": "metadata/dylib::wininet/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey, RegDeleteKeyW, RegOpenKeyExW, RegQueryValueExW, RegDeleteValueW, ... +3 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (BitBlt, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetStockObject, ... +5 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (MapDialogRect, SetWindowLongW, GetClientRect, GetDlgItem, GetDesktopWindow, ... +44 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GlobalHandle, GlobalFree, MultiByteToWideChar, LoadResource, FindResourceExW, ... +93 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (UrlEscapeW, PathRemoveFileSpecW, UrlUnescapeW)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 9, ORDINAL 162, ORDINAL 8, ORDINAL 161, ORDINAL 6, ... +4 more)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoGetClassObject, OleUninitialize, CoTaskMemAlloc, StringFromGUID2, CoCreateInstance, ... +9 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 198.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "a": "T1113", "c": 0.9399999976158142, "d": "Windows GDI active window capture primitives", "e": [ "GetDC", "GetDesktopWindow", "BitBlt", "CreateCompatibleBitmap", "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-window-capture-primitives", "l": 2, "m": "C0014" }, { "a": "T1027", "c": 0.8999999761581421, "d": "WinInet APIs resolved dynamically", "e": [ "InternetOpenW", "HttpOpenRequestW", "InternetCloseHandle", "HttpSendRequestW", "InternetConnectW" ], "i": "micro-behaviors/communications/http/get::wininet-dynamic-load", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "EnumSystemLocalesW", "GetLocaleInfoW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::locale-fingerprinting-imports", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesEx", "GetLocaleInfoW", "GetUserDefaultLCID", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW", "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "WinInet request and response workflow", "e": [ "HttpSendRequestW", "InternetConnectW", "HttpOpenRequestW", "InternetOpenW" ], "i": "micro-behaviors/communications/http/get::wininet-http-flow", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceExW", "FindResourceW", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExW", "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource extraction API chain", "e": [ "FindResourceExW", "LoadResource", "LoadLibraryExA", "SizeofResource", "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-loader-api-chain", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExW", "RegOpenKeyExW", "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InitializeSListHead", "InterlockedPopEntrySList", "InterlockedPushEntrySList" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "FindResourceExW", "LockResource", "SizeofResource", "FindResourceW", "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 3 }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI window capture with screen context", "e": [ "GetWindowTextW", "GetDC", "BitBlt", "CreateCompatibleBitmap", "GetDesktopWindow", "CreateCompatibleDC", "GetWindowTextLengthW" ], "i": "objectives/collection/screenshot/capture::gdi-window-capture", "l": 2, "m": "C0014" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "EnumSystemLocalesW", "GetEnvironmentStringsW", "GetUserDefaultLCID", "FreeEnvironmentStringsW", "EnumSystemLocalesEx", "GetLocaleInfoW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 2, "m": "E1082" }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "FreeEnvironmentStringsW", "EnumSystemLocalesW", "GetUserDefaultLCID", "GetCurrentThreadId", "GetCommandLineW", "GetLocaleInfoW", "GetEnvironmentStringsW", "GetCommandLineA" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetUserDefaultLCID", "EnumSystemLocalesEx", "GetSystemTimeAsFileTime", "EnumSystemLocalesW", "GetCommandLineW", "GetCommandLineA", "GetLocaleInfoW", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 2, "m": "E1082" } ], "sha": "3fb61f7aea6d5e6f0a510b433e7d853f1e7a4dffcb4fbcd8a25fd403366ff928", "path": "126625!!embedded:pe@0x6d600", "type": "pe" } ], "tv": "96b0e" } }