{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9994513392448425, "class": 2 } ], "prob": 0.99945134, "class": 2, "oprob": 0.8111415, "oclass": 0, "version": "v16.16", "thresholds": [ 0.993587, 0.99945134 ], "analyzed_at": "2026-04-27T01:49:55Z" }, "path": "Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_357_2.vir", "raw": { "v": "4", "fs": [ { "f": "KO₅(Er₂C₃Al₃As₆S)H₄(Cm₂FPoDb)Md₄(Bi₄PaPt)", "x": 197, "id": 0, "is": [ "Sleep", "CreateProcessA", "GetTempFileNameA", "GetModuleFileNameA", "CloseHandle", "GetTempPathA", "GetSystemTimeAsFileTime", "GetCurrentProcessId", "GetCurrentThreadId", "GetTickCount", "QueryPerformanceCounter", "DecodePointer", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "EncodePointer", "InterlockedCompareExchange", "InterlockedExchange", "HeapSetInformation", "ShellExecuteA", "ORDINAL 11", "ORDINAL 111", "ORDINAL 9", "ORDINAL 115", "ORDINAL 16", "ORDINAL 23", "ORDINAL 19", "ORDINAL 4", "ORDINAL 116", "printf", "fopen", "fread", "rand", "srand", "fwrite", "ftell", "fseek", "fclose", "time64", "snprintf", "amsg_exit", "getmainargs", "cexit", "exit", "XcptFilter", "exit", "initenv", "initterm", "initterm_e", "configthreadlocale", "setusermatherr", "commode", "fmode", "set_app_type", "crt_debugger_hook", "?terminate@@YAXXZ", "unlock", "dllonexit", "lock", "onexit", "except_handler4_common", "invoke_watson", "controlfp_s", "atoi", "malloc", "memset" ], "ms": { "pe": { "machine": 332.0, "checksum": 54828.0, "pdb_path": "C:\\ping_pong\\win_client\\Release\\win_client.pdb", "rsrc_size": 512.0, "subsystem": 3.0, "timestamp": 1344615267.0, "image_base": 4194304.0, "rsrc_entropy": 5.1, "entry_section": ".text", "size_of_image": 24576.0, "timestamp_day": 10.0, "file_alignment": 512.0, "resource_count": 1.0, "timestamp_year": 2012.0, "characteristics": 258.0, "entry_point_rva": 6668.0, "size_of_headers": 1024.0, "timestamp_month": 8.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 4.0, "manifest_present": true, "checksum_mismatch": true, "computed_checksum": 75327.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1344615267.0, "debug_timestamp_min": 1344615267.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 10.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 4096.0, "file_size": 20944.0, "entry_point": 6668.0, "has_overlay": true, "code_entropy": 6.0, "data_entropy": 2.74, "import_count": 68.0, "overlay_size": 10192.0, "string_count": 112.0, "overlay_ratio": 0.49, "section_count": 5.0, "avg_complexity": 5.06, "function_count": 18.0, "import_density": 17.0, "max_complexity": 21.0, "string_density": 28.0, "overall_entropy": 4.16, "overlay_entropy": 6.07, "avg_basic_blocks": 7.44, "avg_section_size": 1945.6, "dependency_count": 4.0, "entropy_variance": 1.97, "function_density": 4.5, "avg_function_size": 194.28, "avg_string_length": 22.19, "complexity_per_kb": 1.26, "max_string_length": 89.0, "wide_string_count": 1.0, "writable_sections": 1.0, "avg_string_entropy": 3.3, "code_to_data_ratio": 0.73, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.2, "total_basic_blocks": 134.0, "executable_sections": 1.0, "string_length_stddev": 18.35, "debug_reference_count": 1.0, "largest_section_ratio": 0.2, "sentence_string_count": 35.0, "sentence_string_ratio": 0.31, "behavioral_import_ratio": 0.07, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".rsrc" ], [ 647, "@.reloc" ], [ 5476, "get_port_from_controller: socket() - Error at socket(): %ld" ], [ 5540, "get_port_from_controller: socket() is OK." ], [ 5584, "get_port_from_controller: connect() - Failed to connect and get port." ], [ 5656, "get_port_from_controller: connect() is OK." ], [ 5700, "get_port_from_controller: Getting echo port..." ], [ 5748, "get_port_from_controller: Connection Closed." ], [ 5796, "get_port_from_controller:: recv() is OK." ], [ 5840, "get_port_from_controller:: Received data is: \"%d\"" ], [ 5892, "get_port_from_controller:: Bytes received is: %ld." ], [ 5944, "echo_and_return: socket() - Error at socket(): %ld" ], [ 5996, "echo_and_return: socket() is OK." ], [ 6032, "echo_and_return: connect() - Failed to connect to server(%s) port:%d" ], [ 6104, "echo_and_return: connect() is OK." ], [ 6140, "echo_and_return: Sending echo token..." ], [ 6180, "echo_and_return: send() error %ld." ], [ 6216, "echo_and_return: send() is OK - Bytes sent: %ld" ], [ 6268, "echo_and_return: The test string sent: \"%s\"" ], [ 6316, "get_port_from_controller:: Received data is: \"%s\"" ], [ 6368, "file_size is: %d" ], [ 6392, "wide", "cmd.exe /C ping -w 50 -n 1 1.1.1.1 \u003e Nul \u0026 Del" ], [ 6496, "Got my filename: %s" ], [ 6524, "Unable to open: %s" ], [ 6544, "DEMO" ], [ 6556, "Wrote %d bytes to %s" ], [ 6580, "Client: Error at WSAStartup()." ], [ 6612, "Client: WSAStartup() is OK." ], [ 6644, "10.180.0.115" ], [ 6660, "[!]Failed to get echo port from server." ], [ 6704, "Got controller port: %d" ], [ 6732, "ADAMANDPRASHANTAREAWESOME" ], [ 6760, "%s:%d DATA CORRUPT." ], [ 6784, "%s:%d DATA OK." ], [ 6800, "Attempting to execute: %s" ], [ 6828, "open" ], [ 6836, "%s: option requires an argument -- %.*s" ], [ 6880, "%s: option does not take an argument -- %.*s" ], [ 7032, "C:\\ping_pong\\win_client\\Release\\win_client.pdb" ], [ 7594, "Sleep" ], [ 7602, "CreateProcessA" ], [ 7620, "GetTempFileNameA" ], [ 7640, "GetModuleFileNameA" ], [ 7662, "CloseHandle" ], [ 7676, "GetTempPathA" ], [ 7690, "KERNEL32.dll" ], [ 7706, "ShellExecuteA" ], [ 7720, "SHELL32.dll" ], [ 7732, "WS2_32.dll" ], [ 7746, "malloc" ], [ 7756, "atoi" ], [ 7764, "_snprintf" ], [ 7776, "printf" ], [ 7786, "fopen" ], [ 7794, "fread" ], [ 7818, "fwrite" ], [ 7836, "fseek" ], [ 7844, "fclose" ], [ 7854, "_time64" ], [ 7862, "MSVCR100.dll" ], [ 7878, "_amsg_exit" ], [ 7892, "__getmainargs" ], [ 7908, "_cexit" ], [ 7926, "_XcptFilter" ], [ 7940, "exit" ], [ 7948, "__initenv" ], [ 7960, "_initterm" ], [ 7972, "_initterm_e" ], [ 7986, "_configthreadlocale" ], [ 8008, "__setusermatherr" ], [ 8028, "_commode" ], [ 8040, "_fmode" ], [ 8050, "__set_app_type" ], [ 8068, "_crt_debugger_hook" ], [ 8090, "?terminate@@YAXXZ" ], [ 8110, "_unlock" ], [ 8120, "__dllonexit" ], [ 8142, "_onexit" ], [ 8152, "_except_handler4_common" ], [ 8178, "_invoke_watson" ], [ 8196, "_controlfp_s" ], [ 8212, "InterlockedExchange" ], [ 8234, "InterlockedCompareExchange" ], [ 8264, "HeapSetInformation" ], [ 8286, "EncodePointer" ], [ 8302, "TerminateProcess" ], [ 8322, "GetCurrentProcess" ], [ 8342, "UnhandledExceptionFilter" ], [ 8370, "SetUnhandledExceptionFilter" ], [ 8400, "IsDebuggerPresent" ], [ 8420, "DecodePointer" ], [ 8436, "QueryPerformanceCounter" ], [ 8462, "GetTickCount" ], [ 8478, "GetCurrentThreadId" ], [ 8500, "GetCurrentProcessId" ], [ 8522, "GetSystemTimeAsFileTime" ], [ 8548, "memset" ], [ 9304, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 9379, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 9435, "\u003csecurity\u003e" ], [ 9451, "\u003crequestedPrivileges\u003e" ], [ 9480, "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 9576, "\u003c/requestedPrivileges\u003e" ], [ 9606, "\u003c/security\u003e" ], [ 9623, "\u003c/trustInfo\u003e" ], [ 9639, "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD" ], [ 12872, "U.pvt" ], [ 15717, "B6DN" ] ], "sz": 20944, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.800000011920929, "d": "Text-based beaconing string (echo_return)", "e": [ "echo_and_return: The test string sent: \"%s\" (contains: echo_and_return)", "echo_and_return: send() error %ld. (contains: echo_and_return)", "echo_and_return: send() is OK - Bytes sent: %ld (contains: echo_and_return)", "echo_and_return: socket() is OK. (contains: echo_and_return)", "echo_and_return: connect() is OK. (contains: echo_and_return)", "echo_and_return: socket() - Error at socket(): %ld (contains: echo_and_return)", "echo_and_return: Sending echo token... (contains: echo_and_return)", "echo_and_return: connect() - Failed to connect to server(%s) port:%d (contains: echo_and_return)" ], "i": "micro-behaviors/communications/socket::pingpong-echo-return", "l": 4 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.31" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.800000011920929, "d": "Text-based beaconing string (get_port)", "e": [ "get_port_from_controller:: Received data is: \"%d\" (contains: get_port_from_controller)", "get_port_from_controller: connect() is OK. (contains: get_port_from_controller)", "get_port_from_controller:: Received data is: \"%s\" (contains: get_port_from_controller)", "get_port_from_controller: socket() - Error at socket(): %ld (contains: get_port_from_controller)", "get_port_from_controller: Connection Closed. (contains: get_port_from_controller)", "get_port_from_controller: connect() - Failed to connect and get port. (contains: get_port_from_controller)", "get_port_from_controller: Getting echo port... (contains: get_port_from_controller)", "get_port_from_controller:: recv() is OK. (contains: get_port_from_controller)", "get_port_from_controller:: Bytes received is: %ld. (contains: get_port_from_controller)", "get_port_from_controller: socket() is OK. (contains: get_port_from_controller)" ], "i": "micro-behaviors/communications/socket::pingpong-get-port", "l": 4 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.06" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "fseek" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 68.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.949999988079071, "d": "cmd interpreter marker encoded", "e": [ "cmd.exe /C ping -w 50 -n 1 1.1.1.1 \u003e Nul \u0026 Del" ], "i": "metadata/lang/encoded/wide::shell-interpreter-cmd", "l": 1 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.16" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1071", "c": 0.7799999713897705, "d": "Winsock library string marker", "e": [ "WS2_32.dll" ], "i": "objectives/command-and-control/backdoor/binary::winsock-library-reference", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 116 (WSACleanup)", "e": [ "ORDINAL 116" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-116", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Read stream (fread)", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1344615267.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1105", "c": 0.8600000143051147, "d": "Demo temp payload prefix", "e": [ "DEMO" ], "i": "well-known/malware/dropper/ping-pong::demo-temp-prefix", "l": 1, "m": "B0024" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 16 (recv)", "e": [ "ORDINAL 16" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-16", "l": 1 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 115 (WSAStartup)", "e": [ "ORDINAL 115" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-115", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPAD (contains: PADDINGXXPADDING)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 18.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.16" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.75, "d": "String to integer conversion (atoi)", "e": [ "atoi" ], "i": "micro-behaviors/data/string/conversion::atoi", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.30" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Formatted console output", "e": [ "printf" ], "i": "micro-behaviors/os/stdio::printf", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1105", "c": 0.9599999785423279, "d": "Ping-pong controller port banner", "e": [ "get_port_from_controller: Getting echo port..." ], "i": "well-known/malware/dropper/ping-pong::controller-port-banner", "l": 4, "m": "B0024" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "a": "T1105", "c": 0.9800000190734863, "d": "Ping-pong client PDB path", "e": [ "C:\\ping_pong\\win_client\\Release\\win_client.pdb" ], "i": "well-known/malware/dropper/ping-pong::ping-pong-pdb-path", "l": 4, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Close stdio file", "e": [ "fclose" ], "i": "micro-behaviors/os/stdio::fclose", "l": 2 }, { "a": "T1105", "c": 0.9900000095367432, "d": "Hardcoded ping-pong echo token", "e": [ "ADAMANDPRASHANTAREAWESOME" ], "i": "well-known/malware/dropper/ping-pong::echo-token-string", "l": 4, "m": "B0024" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA (contains: CreateProcess)" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.49" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00", "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 512.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 24576.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 19 (send)", "e": [ "ORDINAL 19" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-19", "l": 1 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "C:\\ping_pong\\win_client\\Release\\win_client.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "High import density (\u003e3 imports/KB)", "e": [ "binary.import_density = 17.00" ], "i": "metadata/binary/metrics::high-import-density", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 11 (inet_addr)", "e": [ "ORDINAL 11" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-11", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 4 (connect)", "e": [ "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-4", "l": 1 }, { "a": "T1027.009", "c": 1.0, "d": "ftell import", "e": [ "ftell" ], "i": "objectives/anti-static/obfuscation/payload/self-read::ftell-import", "l": 1, "m": "B0032" }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Batch with ping delay before deletion", "e": [ "ping -w 50 -n 1 1.1.1.1 \u003e Nul \u0026 Del" ], "i": "objectives/evasion/self-delete/file::batch-ping-delay-delete", "l": 4, "m": "F0007" }, { "a": "T1105", "c": 0.9200000166893005, "d": "Hardcoded controller private IP", "e": [ "10.180.0.115" ], "i": "well-known/malware/dropper/ping-pong::controller-private-ip", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Text-based beaconing string (data corrupt)", "e": [ "%s:%d DATA CORRUPT. (contains: DATA CORRUPT.)" ], "i": "micro-behaviors/communications/socket::pingpong-data-corrupt", "l": 4 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 112.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 20944.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1105", "c": 0.9800000190734863, "d": "Delayed ping-and-del self-delete", "e": [ "cmd.exe /C ping -w 50 -n 1 1.1.1.1 \u003e Nul \u0026 Del" ], "i": "well-known/malware/dropper/ping-pong::ping-del-self-delete", "l": 4, "m": "B0024" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 23 (socket)", "e": [ "ORDINAL 23" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-23", "l": 1 }, { "c": 0.550000011920929, "d": "Stdout redirected to NUL", "e": [ "\u003e Nul" ], "i": "micro-behaviors/os/console/io::windows-stdout-to-nul", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "a": "T1105", "c": 0.9599999785423279, "d": "Ping-pong echo token banner", "e": [ "echo_and_return: Sending echo token..." ], "i": "well-known/malware/dropper/ping-pong::echo-token-banner", "l": 4, "m": "B0024" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.49" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script::cmd-exe-dup", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 3 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetModuleFileNameA", "InterlockedCompareExchange", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcessId", "GetSystemTimeAsFileTime" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links MSVCR100.dll (printf, fopen, fread, rand, srand, ... +32 more)", "e": [ "MSVCR100.dll" ], "i": "metadata/dylib::msvcr100/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (ORDINAL 11, ORDINAL 111, ORDINAL 9, ORDINAL 115, ORDINAL 16, ... +4 more)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (Sleep, CreateProcessA, GetTempFileNameA, GetModuleFileNameA, CloseHandle, ... +16 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8399999737739563, "d": "IPv4 string conversion import", "e": [ "ORDINAL 11", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::inet-addr-api-ordinal", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "GetTickCount", "QueryPerformanceCounter" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "c": 0.8600000143051147, "d": "Initialize Winsock library", "e": [ "WS2_32.dll", "ORDINAL 115" ], "i": "micro-behaviors/communications/socket/init::winsock-startup-ordinal", "l": 3 }, { "c": 0.800000011920929, "d": "Writes file to Temp directory and executes it", "e": [ "ShellExecuteA", "CreateProcessA", "fopen", "GetTempPathA" ], "i": "objectives/command-and-control/dropper/staging::temp-dropper", "l": 3 }, { "a": "T1105", "c": 0.9700000286102295, "d": "Ping-pong controller beacon workflow", "e": [ "echo_and_return: Sending echo token...", "get_port_from_controller: Getting echo port...", "10.180.0.115", "ADAMANDPRASHANTAREAWESOME" ], "i": "well-known/malware/dropper/ping-pong::ping-pong-controller-beacon", "l": 4, "m": "B0024" }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempFileNameA", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.8399999737739563, "d": "Cleanup Winsock library", "e": [ "ORDINAL 116", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::winsock-cleanup-ordinal", "l": 2 }, { "a": "T1027.009", "c": 0.8199999928474426, "d": "CRT self-open via module path", "e": [ "fseek", "ftell", "fopen", "fread", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-crt-chain", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Winsock send import", "e": [ "ORDINAL 19", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::send-api-ordinal", "l": 2 }, { "c": 0.8399999737739563, "d": "Network byte order conversion", "e": [ "WS2_32.dll", "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::htons-api-ordinal", "l": 2 }, { "c": 0.8799999952316284, "d": "Winsock outbound connect import", "e": [ "ORDINAL 4", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::connect-api-ordinal", "l": 3 }, { "c": 0.8600000143051147, "d": "Winsock receive import", "e": [ "ORDINAL 16", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::recv-api-ordinal", "l": 2 }, { "c": 0.8799999952316284, "d": "Winsock socket creation import", "e": [ "WS2_32.dll", "ORDINAL 23" ], "i": "micro-behaviors/communications/socket/init::socket-api-ordinal", "l": 3 }, { "a": "T1562.001", "c": 0.8500000238418579, "d": "Debugger detection + process termination", "e": [ "TerminateProcess", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/environment-detect::anti-analysis-core", "l": 1 }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Timing-based anti-debugging pattern", "e": [ "IsDebuggerPresent", "QueryPerformanceCounter", "GetTickCount", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug", "l": 1, "m": "B0003.003" }, { "a": "T1105", "c": 0.9850000143051147, "d": "Overlay temp payload dropper", "e": [ "C:\\ping_pong\\win_client\\Release\\win_client.pdb", "ftell", "binary.overlay_ratio = 0.49", "fseek", "DEMO", "fopen", "ShellExecuteA", "fread", "GetTempFileNameA", "GetTempPathA", "GetModuleFileNameA" ], "i": "well-known/malware/dropper/ping-pong::overlay-temp-payload-dropper", "l": 5, "m": "B0024" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "IsDebuggerPresent", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "a": "T1622", "c": 0.8999999761581421, "d": "Windows debugger/VM detection (multiple signals)", "e": [ "IsDebuggerPresent", "QueryPerformanceCounter" ], "i": "objectives/anti-analysis/debugger-detect/check::win-comprehensive", "l": 2, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1105", "c": 0.9950000047683716, "d": "Ping-pong overlay dropper with self-delete", "e": [ "GetTempPathA", "binary.overlay_ratio = 0.49", "10.180.0.115", "fread", "GetModuleFileNameA", "ADAMANDPRASHANTAREAWESOME", "GetTempFileNameA", "get_port_from_controller: Getting echo port...", "DEMO", "fopen", "cmd.exe /C ping -w 50 -n 1 1.1.1.1 \u003e Nul \u0026 Del", "IsDebuggerPresent", "ftell", "echo_and_return: Sending echo token...", "C:\\ping_pong\\win_client\\Release\\win_client.pdb", "fseek" ], "i": "well-known/malware/dropper/ping-pong::ping-pong-overlay-dropper", "l": 5, "m": "B0024" }, { "a": "T1497", "c": 0.8500000238418579, "d": "Malware with multiple anti-analysis awareness checks", "e": [ "IsDebuggerPresent", "QueryPerformanceCounter" ], "i": "objectives/anti-analysis/debugger-detect/heuristics::evasion-aware-malware", "l": 1, "m": "B0001" } ], "sha": "635019da57ef7bfcbdcc65f3315f7697e34225e2700a225fe2a46bafc8b428cc", "path": "Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_357_2.vir", "type": "pe" } ], "tv": "1a4dd" } }