{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.33898306, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T19:31:19Z" }, "path": "63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be.exe", "raw": { "v": "5", "fs": [ { "f": "O(As)H(Cm)Md", "x": 40, "ff": { "i": [ [ "msvcrt", "memset" ], [ "msvcrt", "printf" ], [ "msvcrt", "memcpy" ], [ "msvcrt", "memmove" ], [ "msvcrt", "rand" ], [ "msvcrt", "wcslen" ], [ "msvcrt", "strcmp" ], [ "msvcrt", "srand" ], [ "msvcrt", "strtol" ], [ "msvcrt", "wsystem" ], [ "msvcrt", "vsnprintf" ], [ "msvcrt", "vsnwprintf" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "controlfp" ], [ "msvcrt", "argc" ], [ "msvcrt", "argv" ], [ "msvcrt", "environ" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "exit" ], [ "kernel32", "FileTimeToSystemTime" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapSize" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "GetLastError" ], [ "kernel32", "Sleep" ], [ "kernel32", "WriteFile" ], [ "kernel32", "HeapFree" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "SleepEx" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "ExpandEnvironmentStringsW" ], [ "ntdll", "NtQuerySystemInformation" ], [ "ntdll", "RtlGetNtVersionNumbers" ], [ "winhttp", "WinHttpOpen" ], [ "winhttp", "WinHttpConnect" ], [ "winhttp", "WinHttpOpenRequest" ], [ "winhttp", "WinHttpSendRequest" ], [ "winhttp", "WinHttpReceiveResponse" ], [ "winhttp", "WinHttpQueryHeaders" ], [ "winhttp", "WinHttpQueryDataAvailable" ], [ "winhttp", "WinHttpReadData" ], [ "winhttp", "WinHttpCloseHandle" ], [ "bcrypt", "BCryptEnumProviders" ], [ "bcrypt", "BCryptEnumRegisteredProviders" ], [ "bcrypt", "BCryptFinalizeKeyPair" ], [ "bcrypt", "BCryptGenerateKeyPair" ], [ "bcrypt", "BCryptGenRandom" ], [ "bcrypt", "BCryptRemoveContextFunction" ] ], "m": { "pe": { "checksum": 57276.0, "checksum_valid": 1.0, "computed_checksum": 57276.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 12800.0, "entropy": 5.15, "size_bytes": 12800.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.13, "data_entropy": 4.3, "string_count": 106.0, "entropy_variance": 2.29, "avg_string_length": 12.99, "max_string_length": 77.0, "code_to_data_ratio": 0.74, "string_length_stddev": 10.41, "largest_section_ratio": 0.68, "sentence_string_count": 4.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 50.0 }, "sections": { "count": 3.0, "code_size": 8704.0, "entropy_max": 5.13, "entropy_mean": 3.67, "name_entropy": 2.58, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 5.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 392, "u8", ".text" ], [ 472, "u8", ".pdata" ], [ 7709, "u8", "M H9" ], [ 9282, "url", "\u0002i\u0002i\u0002i\u0002i\u0002i\u0002i\u0003i" ], [ 9320, "wide", "%c%c%c%c" ], [ 9362, "u8", "v5.mrmpzjjhn3sgtq5w.pro" ], [ 9414, "url", "t/v5/%hs/%hs/%hs/\u0006llx\u0006llx/\u0006x/%ls.bin" ], [ 9500, "u8", "ERROR %lu in #%i" ], [ 9546, "u8", "/~isapi/isapiv5.dll/v5/ucph/yzxt/242603055318698/0018dd001fff/000007/kacl.bin" ], [ 9696, "u8", "TrollAV/5.0" ], [ 9963, "u8", "Retrying %ls" ], [ 9976, "wide", "%%tmp%%\\%hs.exe" ], [ 10010, "u8", "http://%ls%ls --\u003e %ls" ], [ 10032, "wide", "%s %06x" ], [ 10065, "u8", "Grupa Sendbajt, User Id: %s" ], [ 10095, "u8", "3524113223" ], [ 10106, "u8", "d1=%s, executing..." ], [ 10137, "u8", "d2=%s, executing..." ], [ 10168, "u8", "d3=%s, executing..." ], [ 10199, "u8", "d6=%s, executing..." ], [ 10230, "u8", "d9=%s, executing..." ], [ 10261, "u8", "de=%s, executing..." ], [ 11304, "u8", "msvcrt.dll" ], [ 11317, "u8", "memset" ], [ 11326, "u8", "printf" ], [ 11335, "u8", "memcpy" ], [ 11344, "u8", "memmove" ], [ 11361, "u8", "wcslen" ], [ 11387, "u8", "strtol" ], [ 11396, "u8", "_wsystem" ], [ 11407, "u8", "_vsnprintf" ], [ 11420, "u8", "_vsnwprintf" ], [ 11434, "u8", "__set_app_type" ], [ 11451, "u8", "_controlfp" ], [ 11464, "u8", "__argc" ], [ 11473, "u8", "__argv" ], [ 11482, "u8", "_environ" ], [ 11493, "u8", "__getmainargs" ], [ 11509, "u8", "exit" ], [ 11514, "u8", "kernel32.dll" ], [ 11529, "u8", "FileTimeToSystemTime" ], [ 11552, "u8", "GetProcessHeap" ], [ 11569, "u8", "HeapAlloc" ], [ 11581, "u8", "HeapSize" ], [ 11592, "u8", "HeapReAlloc" ], [ 11606, "u8", "CreateFileW" ], [ 11620, "u8", "GetLastError" ], [ 11635, "u8", "Sleep" ], [ 11643, "u8", "WriteFile" ], [ 11655, "u8", "HeapFree" ], [ 11666, "u8", "CloseHandle" ], [ 11680, "u8", "SleepEx" ], [ 11690, "u8", "GetCommandLineW" ], [ 11708, "u8", "ExpandEnvironmentStringsW" ], [ 11734, "u8", "ntdll.dll" ], [ 11746, "u8", "NtQuerySystemInformation" ], [ 11773, "u8", "RtlGetNtVersionNumbers" ], [ 11796, "u8", "winhttp.dll" ], [ 11810, "u8", "WinHttpOpen" ], [ 11824, "u8", "WinHttpConnect" ], [ 11841, "u8", "WinHttpOpenRequest" ], [ 11862, "u8", "WinHttpSendRequest" ], [ 11883, "u8", "WinHttpReceiveResponse" ], [ 11908, "u8", "WinHttpQueryHeaders" ], [ 11930, "u8", "WinHttpQueryDataAvailable" ], [ 11958, "u8", "WinHttpReadData" ], [ 11976, "u8", "WinHttpCloseHandle" ], [ 11995, "u8", "bcrypt.dll" ], [ 12008, "u8", "BCryptEnumProviders" ], [ 12030, "u8", "BCryptEnumRegisteredProviders" ], [ 12062, "u8", "BCryptFinalizeKeyPair" ], [ 12086, "u8", "BCryptGenerateKeyPair" ], [ 12110, "u8", "BCryptGenRandom" ], [ 12128, "u8", "BCryptRemoveContextFunction" ] ], "v": { "file.stem": "63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be", "pe.imphash": "5f6279d60f7f9c85ae40aa1d60d6ed3d", "pe.machine": "x86_64", "pe.subsystem": "windows_cui", "file.basename": "63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be.exe", "pe.image_base": 4194304, "pe.image_size": 24576, "pe.machine_id": 34404, "pe.os_version": "4.0", "pe.entry_point": 11984, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.file_alignment": 512, "pe.image_hash.sha1": "d426a67f1f3b802998cac1b5634c35843f3f3246", "pe.image_hash.sha256": "ad5194b6cda9f60d8eee45c4f607646bbc2e769ccc33a1368eaedcd9f375d2c0", "pe.image_hash.sha384": "0b0d85e7c18d7b213c5de1e811ebb1c1a0e94e852b23bc7464991ec6429cf35ed487a4f59e721a738cd5c5b1d97e50f9", "pe.image_hash.sha512": "c898aabf654bc82f8df41e0901ed20ca5515cfcd47e4e192f3c329aef6d30f009face718f59b650de5e50e92ea16518f54ff88c123d54ebdfecb4e641ee2dcd4", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "large_address_aware", "pe.characteristics_raw": 559, "pe.linker_major_version": 6, "pe.data_directories[0].rva": 17472, "pe.data_directories[1].rva": 20480, "pe.data_directories[2].rva": 17592, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "exception", "pe.data_directories[1].size": 192, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 440, "pe.coff.dos_header_pe_pointer": 128 }, "id": "pe", "sc": [ [ ".text", 512, 8704, 5.13, "r-x" ], [ ".data", 9216, 3072, 4.3, "rw-" ], [ ".pdata", 12288, 512, 1.59, "r--" ] ] }, "id": 0, "sz": 12800, "ts": [ { "a": "T1071.001", "c": 0.8999999761581421, "d": "Create WinHTTP HTTP request handle", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request", "l": 3, "m": "C0002", "el": [ "0x45f8" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP read API string reference", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data-text", "l": 1, "m": "C0002", "el": [ "0x2eb6" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP send request text reference", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request-text", "l": 1, "m": "C0002", "el": [ "0x2e56" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 50.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 50.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x4588" ] }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Query WinHTTP buffered response bytes", "e": [ "WinHttpQueryDataAvailable" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-data-available", "l": 3, "m": "C0002", "el": [ "0x4618" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "Close WinHTTP handle object", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle", "l": 3, "m": "C0002", "el": [ "0x4628" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x4580" ] }, { "a": "T1071.001", "c": 0.8799999952316284, "d": "Query WinHTTP response headers", "e": [ "WinHttpQueryHeaders" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-headers", "l": 3, "m": "C0002", "el": [ "0x4610" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query system information", "e": [ "NtQuerySystemInformation" ], "i": "micro-behaviors/os/exception/handler::query-system-information", "l": 2, "m": "C0046", "el": [ "0x45d0" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 106.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Receive WinHTTP server response", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response", "l": 3, "m": "C0002", "el": [ "0x4608" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 3072)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.9900000095367432, "d": "WINHTTP.dll string", "e": [ "WINHTTP.dll" ], "i": "objectives/command-and-control/dropper/elex-loader::winhttp-dll-string", "l": 1, "el": [ "0x2e14" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Send WinHTTP request to server", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request", "l": 3, "m": "C0002", "el": [ "0x4600" ] }, { "c": 0.8999999761581421, "d": "String comparison", "e": [ "strcmp" ], "i": "micro-behaviors/data/string/library::strcmp", "l": 2, "el": [ "0x44e8" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "0x4578" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0x4590" ] }, { "a": "T1071.001", "c": 0.8199999928474426, "d": "WinHTTP close-handle API string", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle-text", "l": 1, "m": "C0002", "el": [ "0x2ec8" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP query-headers API string", "e": [ "WinHttpQueryHeaders" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-headers-text", "l": 1, "m": "C0002", "el": [ "0x2e84" ] }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Read WinHTTP response body", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data", "l": 3, "m": "C0002", "el": [ "0x4620" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x254a" ] }, { "a": "T1620", "c": 0.8199999928474426, "d": "RegPhantom compact driver size", "e": [ "63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be.exe" ], "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2, "el": [ "0x2dd6" ] }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1, "el": [ "0x44f8" ] }, { "c": 0.8799999952316284, "d": "Small string table footprint", "e": [ "binary.string_count = 106.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x26f8" ] }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "0x44b8" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP open API string reference", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-text", "l": 1, "m": "C0002", "el": [ "0x2e22" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Connect WinHTTP to remote host", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-connect", "l": 3, "m": "C0002", "el": [ "0x45f0" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP connect API string reference", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-connect-text", "l": 1, "m": "C0002", "el": [ "0x2e30" ] }, { "a": "T1071.001", "c": 0.8799999952316284, "d": "WinHTTP DLL name string reference", "e": [ "winhttp.dll" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-dll-name-text", "l": 1, "m": "C0002", "el": [ "0x2e14" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP receive response text reference", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response-text", "l": 1, "m": "C0002", "el": [ "0x2e6b" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP request API string reference", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request-text", "l": 1, "m": "C0002", "el": [ "0x2e41" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x2d92" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x4598" ] }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x44c8" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x4560" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 50.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2, "el": [ "0x44d0" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "Windows %TEMP% or %TMP% environment reference", "e": [ "%tmp%" ], "i": "micro-behaviors/fs/path/temp::win-temp-env", "l": 2, "el": [ "0x26f8" ] }, { "c": 0.20000000298023224, "d": "tmp keyword", "e": [ "tmp" ], "i": "micro-behaviors/data/text/keywords/lexicon::tmp", "l": 1, "el": [ "0x26f8" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x45a0" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "WinHttpQueryHeaders" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1, "el": [ "0x2e84" ] }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2, "el": [ "0x4558" ] }, { "c": 0.8999999761581421, "d": "Formatted console output", "e": [ "printf" ], "i": "micro-behaviors/os/stdio::printf", "l": 2, "el": [ "0x44c0" ] }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1, "el": [ "0x4580" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x4568" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Initialize WinHTTP session", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open", "l": 3, "m": "C0002", "el": [ "0x45e8" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 50.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Wide string length", "e": [ "wcslen" ], "i": "micro-behaviors/data/string/library::wcslen", "l": 2, "el": [ "0x44e0" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 50.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows BCrypt DLL name", "e": [ "bcrypt.dll" ], "i": "micro-behaviors/crypto/symmetric/aes/cng::bcrypt-dll-name", "l": 1, "m": "C0021", "el": [ "0x2edb" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x45b8" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP query-data API string reference", "e": [ "WinHttpQueryDataAvailable" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-data-available-text", "l": 1, "m": "C0002", "el": [ "0x2e9a" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ExpandEnvironmentStringsW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x2dbc" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x2d56" ] }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform/defender::ntdll-dll-str", "l": 1, "el": [ "0x2dd6" ] }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 12800 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 50.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 50.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x2cfa" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x26f8" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "WinHttpQueryDataAvailable", "FileTimeToSystemTime" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x2e9a", "0x2d09" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 50.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014", "el": [ "0x2dd6" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.68" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links winhttp (WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, WinHttpSendRequest, WinHttpReceiveResponse, ... +4 more)", "e": [ "winhttp" ], "i": "metadata/dylib::winhttp", "l": 2, "el": [ "9 symbols" ] }, { "c": 0.949999988079071, "d": "links ntdll (NtQuerySystemInformation, RtlGetNtVersionNumbers)", "e": [ "ntdll" ], "i": "metadata/dylib::ntdll", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (FileTimeToSystemTime, GetProcessHeap, HeapAlloc, HeapSize, HeapReAlloc, ... +9 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "14 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcrt (memset, printf, memcpy, memmove, rand, ... +14 more)", "e": [ "msvcrt" ], "i": "metadata/dylib::msvcrt", "l": 2, "el": [ "19 symbols" ] }, { "c": 0.949999988079071, "d": "links bcrypt (BCryptEnumProviders, BCryptEnumRegisteredProviders, BCryptFinalizeKeyPair, BCryptGenerateKeyPair, BCryptGenRandom, ... +1 more)", "e": [ "bcrypt" ], "i": "metadata/dylib::bcrypt", "l": 2, "el": [ "6 symbols" ] }, { "a": "T1071.001", "c": 0.9300000071525574, "d": "Dynamically resolved WinHTTP downloader flow", "e": [ "WinHttpConnect", "WinHttpCloseHandle", "WinHttpReadData", "winhttp.dll", "WinHttpOpen", "WinHttpReceiveResponse", "WinHttpSendRequest", "WinHttpQueryHeaders", "WinHttpQueryDataAvailable", "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-downloader-flow-text", "l": 3, "m": "C0002", "el": [ "0x2e30", "0x2ec8", "0x2eb6", "0x2e14", "0x2e22", "0x2e6b", "0x2e56", "0x2e84", "0x2e9a", "0x2e41" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "WinHTTP request response data flow", "e": [ "WinHttpSendRequest", "WinHttpQueryHeaders", "WinHttpReceiveResponse", "WinHttpReadData", "WinHttpQueryDataAvailable", "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-request-flow", "l": 3, "m": "C0002", "el": [ "0x4600", "0x4610", "0x4608", "0x4620", "0x4618", "0x45f8" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "Runtime API string decryption (DLL names without loader imports)", "e": [ "ntdll.dll", "imports.count = 50.00", "kernel32.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::runtime-api-decryption", "l": 4, "m": "B0032.014", "el": [ "0x2dd6", "", "0x2cfa" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "\u003cbinary data\u003e \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:9414" ] } ], "sha": "63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-06/63b9e01e885d01fc3783497ade1a93115f4094d1c89fcc8b52d2e4e9917599be.exe", "type": "pe" } ], "tv": "176d6" } }