{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.07450331, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T11:33:34Z" }, "path": "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162.exe", "raw": { "v": "5", "fs": [ { "f": "O(As)H₂(DbPo)Md", "x": 10, "ff": { "i": [ [ "kernel32", "ExitProcess" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "SetEndOfFile" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "InitializeCriticalSectionEx" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "LCMapStringEx" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "RtlCaptureContext" ], [ "kernel32", "RtlLookupFunctionEntry" ], [ "kernel32", "RtlVirtualUnwind" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "IsProcessorFeaturePresent" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "InitializeSListHead" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "GetStartupInfoW" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "RtlUnwindEx" ], [ "kernel32", "RtlPcToFileHeader" ], [ "kernel32", "RaiseException" ], [ "kernel32", "InterlockedFlushSList" ], [ "kernel32", "GetLastError" ], [ "kernel32", "SetLastError" ], [ "kernel32", "InitializeCriticalSectionAndSpinCount" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsFree" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "GetModuleHandleExW" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapFree" ], [ "kernel32", "FlsAlloc" ], [ "kernel32", "FlsGetValue" ], [ "kernel32", "FlsSetValue" ], [ "kernel32", "FlsFree" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "GetLocaleInfoW" ], [ "kernel32", "IsValidLocale" ], [ "kernel32", "GetUserDefaultLCID" ], [ "kernel32", "EnumSystemLocalesW" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetFileType" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "GetFileSizeEx" ], [ "kernel32", "SetFilePointerEx" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "WriteFile" ], [ "kernel32", "GetConsoleOutputCP" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "ReadFile" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "FindClose" ], [ "kernel32", "FindFirstFileExW" ], [ "kernel32", "FindNextFileW" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "ReadConsoleW" ], [ "kernel32", "HeapSize" ], [ "kernel32", "RtlUnwind" ], [ "ole32", "CoLoadLibrary" ] ], "m": { "pe": { "has_cfg": 1.0, "checksum": 0.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 1.0, "checksum_stripped": 1.0, "computed_checksum": 643335.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 13.0, "base_relocation_entry_count": 1176.0 }, "file": { "size": 587264.0, "entropy": 6.78, "size_bytes": 587264.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.4, "data_entropy": 2.77, "string_count": 3147.0, "entropy_variance": 2.89, "avg_string_length": 84.81, "max_string_length": 12000.0, "code_to_data_ratio": 0.98, "string_length_stddev": 953.1, "largest_section_ratio": 0.57, "sentence_string_count": 97.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 5.0 }, "exports": { "count": 251.0 }, "imports": { "count": 85.0 }, "sections": { "count": 7.0, "code_size": 231424.0, "entropy_max": 6.4, "entropy_mean": 4.5, "name_entropy": 3.71, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 1.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 520, "u8", ".text" ], [ 599, "u8", "@.data" ], [ 640, "u8", ".pdata" ], [ 719, "u8", "@.rsrc" ], [ 759, "u8", "@.reloc" ], [ 1292, "u8", "L$ SVWH" ], [ 1463, "u8", "L$ SUVWH" ], [ 6988, "u8", "|$ UATAUAVAWH" ], [ 12016, "u8", "@USVWATAVAWH" ], [ 13962, "u8", "UWAVH" ], [ 15948, "u8", "t$ WATAUAVAWH" ], [ 48785, "u8", "|$ ATAVAWH" ], [ 48953, "u8", "SVWATAUAVAWH" ], [ 50645, "u8", "UVWATAUAVAWH" ], [ 53248, "u8", "@USVWATAUAVAWH" ], [ 54298, "u8", "VWAWH" ], [ 59922, "u8", "\\$ UVWH" ], [ 61687, "u8", "t$ UWAVH" ], [ 62469, "u8", "SVWH" ], [ 67481, "u8", "x ATAVAWH" ], [ 70386, "u8", "VWAVH" ], [ 70719, "u8", "l$ VWATAVAWH" ], [ 70887, "u8", "xuLc" ], [ 71935, "u8", "taL9Chu" ], [ 73465, "u8", "MOH3" ], [ 76327, "u8", "uxHc" ], [ 76769, "u8", "x AVH" ], [ 77796, "u8", "M H1E" ], [ 78450, "stack", "ntelGenu" ], [ 78453, "u8", "ntelA" ], [ 78460, "u8", "GenuD" ], [ 78480, "stack", "ineI" ], [ 79669, "u8", "ttIcF" ], [ 84032, "u8", "ob0f" ], [ 86772, "u8", "tRLcY" ], [ 89797, "u8", "HcO H" ], [ 89867, "u8", "HcG H" ], [ 90797, "u8", "E E3" ], [ 91550, "u8", "mwtMH" ], [ 93681, "u8", "HcK H" ], [ 94631, "u8", "IH9B" ], [ 94636, "u8", "tEHcR" ], [ 95116, "u8", "@SVWATAUAVAWH" ], [ 100442, "u8", "N0E3" ], [ 101385, "u8", "x AUAVAWH" ], [ 106733, "u8", "x UAVAWH" ], [ 114113, "u8", "HcC H" ], [ 121611, "u8", "t$ UWAUAVAWH" ], [ 122557, "u8", "s WATAUAVAWH" ], [ 124563, "u8", "l$ VWATH" ], [ 126659, "u8", "L$ VWAVH" ], [ 128262, "u8", "xOHcC" ], [ 128960, "u8", "E0E3" ], [ 146476, "u8", "t$ WAVAWH" ], [ 150777, "u8", "tmHc" ], [ 152785, "u8", "gfffffffH" ], [ 153137, "u8", "{ AUAVAWH" ], [ 153454, "u8", "80tWD" ], [ 153515, "u8", "gfffA" ], [ 154181, "u8", "s AWH" ], [ 162450, "u8", "\\$ UVWATAUAVAWH" ], [ 165279, "u8", "UVWH" ], [ 172300, "u8", "@UATAUAVAWH" ], [ 172651, "u8", "M H3" ], [ 172688, "u8", "@SUVWATAVAWH" ], [ 177994, "u8", "VWAV" ], [ 180819, "u8", "HcS H" ], [ 183402, "u8", "\\$ VWATAUAVH" ], [ 184843, "u8", "H 9Y" ], [ 184978, "u8", "fD91uTL9r" ], [ 186268, "u8", "@USVWATAUAVH" ], [ 190515, "u8", "f90t" ], [ 195891, "u8", "svDE3" ], [ 204998, "u8", "VWAUH" ], [ 205863, "u8", "fB94Ou" ], [ 207914, "u8", "fD94Au" ], [ 208085, "u8", "fD94iu" ], [ 208594, "u8", "tSf91tNH" ], [ 210817, "u8", "s WAVAWH" ], [ 214088, "u8", "@SUVWATAUAVH" ], [ 215573, "u8", "SUWATAUAVAWH" ], [ 217783, "u8", "USVWAVH" ], [ 218834, "u8", "L$ fff" ], [ 224638, "u8", "iygE3" ], [ 226616, "u8", "u HcA\u003cH" ], [ 228352, "u8", "L9BHA" ], [ 233440, "u8", "bad allocation" ], [ 235440, "u8", "address family not supported" ], [ 235472, "u8", "address in use" ], [ 235488, "u8", "address not available" ], [ 235512, "u8", "already connected" ], [ 235536, "u8", "argument list too long" ], [ 235560, "u8", "argument out of domain" ], [ 235584, "u8", "bad address" ], [ 235600, "u8", "bad file descriptor" ], [ 235624, "u8", "bad message" ], [ 235640, "u8", "broken pipe" ], [ 235656, "u8", "connection aborted" ], [ 235680, "u8", "connection already in progress" ], [ 235712, "u8", "connection refused" ], [ 235736, "u8", "connection reset" ], [ 235760, "u8", "cross device link" ], [ 235784, "u8", "destination address required" ], [ 235816, "u8", "device or resource busy" ], [ 235840, "u8", "directory not empty" ], [ 235864, "u8", "executable format error" ], [ 235888, "u8", "file exists" ], [ 235904, "u8", "file too large" ], [ 235920, "u8", "filename too long" ], [ 235944, "u8", "function not supported" ], [ 235968, "u8", "host unreachable" ], [ 235992, "u8", "identifier removed" ], [ 236016, "u8", "illegal byte sequence" ], [ 236040, "u8", "inappropriate io control operation" ], [ 236080, "u8", "interrupted" ], [ 236096, "u8", "invalid argument" ], [ 236120, "u8", "invalid seek" ], [ 236136, "u8", "io error" ], [ 236152, "u8", "is a directory" ], [ 236168, "u8", "message size" ], [ 236184, "u8", "network down" ], [ 236200, "u8", "network reset" ], [ 236216, "u8", "network unreachable" ], [ 236240, "u8", "no buffer space" ], [ 236256, "u8", "no child process" ], [ 236280, "u8", "no link" ], [ 236288, "u8", "no lock available" ], [ 236312, "u8", "no message available" ], [ 236336, "u8", "no message" ], [ 236352, "u8", "no protocol option" ], [ 236376, "u8", "no space on device" ], [ 236400, "u8", "no stream resources" ], [ 236424, "u8", "no such device or address" ], [ 236456, "u8", "no such device" ], [ 236472, "u8", "no such file or directory" ], [ 236504, "u8", "no such process" ], [ 236520, "u8", "not a directory" ], [ 236536, "u8", "not a socket" ], [ 236552, "u8", "not a stream" ], [ 236568, "u8", "not connected" ], [ 236584, "u8", "not enough memory" ], [ 236608, "u8", "not supported" ], [ 236624, "u8", "operation canceled" ], [ 236648, "u8", "operation in progress" ], [ 236672, "u8", "operation not permitted" ], [ 236696, "u8", "operation not supported" ], [ 236720, "u8", "operation would block" ], [ 236744, "u8", "owner dead" ], [ 236760, "u8", "permission denied" ], [ 236784, "u8", "protocol error" ], [ 236800, "u8", "protocol not supported" ], [ 236824, "u8", "read only file system" ], [ 236848, "u8", "resource deadlock would occur" ], [ 236880, "u8", "resource unavailable try again" ], [ 236912, "u8", "result out of range" ], [ 236936, "u8", "state not recoverable" ], [ 236960, "u8", "stream timeout" ], [ 236976, "u8", "text file busy" ], [ 236992, "u8", "timed out" ], [ 237008, "u8", "too many files open in system" ], [ 237040, "u8", "too many files open" ], [ 237064, "u8", "too many links" ], [ 237080, "u8", "too many symbolic link levels" ], [ 237112, "u8", "value too large" ], [ 237128, "u8", "wrong protocol type" ], [ 237152, "u8", "unknown error" ], [ 238416, "u8", "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 239016, "u8", "bad exception" ], [ 240848, "u8", "__cdecl" ], [ 240856, "u8", "__pascal" ], [ 240872, "u8", "__stdcall" ], [ 240888, "u8", "__thiscall" ], [ 240904, "u8", "__fastcall" ], [ 240920, "u8", "__vectorcall" ], [ 240936, "u8", "__clrcall" ], [ 240948, "u8", "__eabi" ], [ 240960, "u8", "__swift_1" ], [ 240976, "u8", "__swift_2" ], [ 241000, "u8", "__restrict" ], [ 241016, "u8", "__unaligned" ], [ 241032, "u8", "restrict(" ], [ 241056, "u8", "delete" ], [ 241096, "u8", "operator" ], [ 241280, "u8", "`local static guard'" ], [ 241320, "u8", "`vbase destructor'" ], [ 241344, "u8", "`vector deleting destructor'" ], [ 241376, "u8", "`default constructor closure'" ], [ 241408, "u8", "`scalar deleting destructor'" ], [ 241440, "u8", "`vector constructor iterator'" ], [ 241472, "u8", "`vector destructor iterator'" ], [ 241504, "u8", "`vector vbase constructor iterator'" ], [ 241544, "u8", "`virtual displacement map'" ], [ 241576, "u8", "`eh vector constructor iterator'" ], [ 241616, "u8", "`eh vector destructor iterator'" ], [ 241648, "u8", "`eh vector vbase constructor iterator'" ], [ 241688, "u8", "`copy constructor closure'" ], [ 241720, "u8", "`udt returning'" ], [ 241752, "u8", "`local vftable'" ], [ 241768, "u8", "`local vftable constructor closure'" ], [ 241804, "u8", "new[]" ], [ 241816, "u8", "delete[]" ], [ 241832, "u8", "`omni callsig'" ], [ 241848, "u8", "`placement delete closure'" ], [ 241880, "u8", "`placement delete[] closure'" ], [ 241912, "u8", "`managed vector constructor iterator'" ], [ 241952, "u8", "`managed vector destructor iterator'" ], [ 241992, "u8", "`eh vector copy constructor iterator'" ], [ 242032, "u8", "`eh vector vbase copy constructor iterator'" ], [ 242080, "u8", "`dynamic initializer for '" ], [ 242112, "u8", "`dynamic atexit destructor for '" ], [ 242152, "u8", "`vector copy constructor iterator'" ], [ 242192, "u8", "`vector vbase copy constructor iterator'" ], [ 242240, "u8", "`managed vector copy constructor iterator'" ], [ 242288, "u8", "`local static thread guard'" ], [ 242336, "u8", "operator co_await" ], [ 242360, "u8", "operator\u003c=\u003e" ], [ 242376, "u8", "Type Descriptor'" ], [ 242400, "u8", "Base Class Descriptor at (" ], [ 242432, "u8", "Base Class Array'" ], [ 242456, "u8", "Class Hierarchy Descriptor'" ], [ 242488, "u8", "Complete Object Locator'" ], [ 242520, "u8", "`anonymous namespace'" ], [ 242568, "wide", "api-ms-win-core-fibers-l1-1-1" ], [ 242632, "wide", "api-ms-win-core-synch-l1-2-0" ], [ 242696, "wide", "kernel32" ], [ 242720, "wide", "api-ms-" ], [ 242744, "u8", "FlsAlloc" ], [ 242768, "u8", "FlsFree" ], [ 242784, "u8", "FlsGetValue" ], [ 242808, "u8", "FlsSetValue" ], [ 242832, "u8", "InitializeCriticalSectionEx" ], [ 243376, "wide", "(null)" ], [ 243392, "u8", "(null)" ], [ 244352, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 244736, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 247077, "u8", "obwQ4" ], [ 253553, "u8", "TUUUU" ], [ 253865, "u8", "3 FB" ], [ 256008, "wide", "mscoree.dll" ], [ 256032, "u8", "CorExitProcess" ], [ 256544, "wide", "api-ms-win-core-datetime-l1-1-1" ], [ 256608, "wide", "api-ms-win-core-file-l1-2-2" ], [ 256672, "wide", "api-ms-win-core-localization-l1-2-1" ], [ 256752, "wide", "api-ms-win-core-localization-obsolete-l1-2-0" ], [ 256848, "wide", "api-ms-win-core-processthreads-l1-1-2" ], [ 256928, "wide", "api-ms-win-core-string-l1-1-0" ], [ 256992, "wide", "api-ms-win-core-sysinfo-l1-2-1" ], [ 257056, "wide", "api-ms-win-core-winrt-l1-1-0" ], [ 257120, "wide", "api-ms-win-core-xstate-l2-1-0" ], [ 257184, "wide", "api-ms-win-rtcore-ntuser-window-l1-1-0" ], [ 257264, "wide", "api-ms-win-security-systemfunctions-l1-1-0" ], [ 257360, "wide", "ext-ms-win-ntuser-dialogbox-l1-1-0" ], [ 257440, "wide", "ext-ms-win-ntuser-windowstation-l1-1-0" ], [ 257520, "wide", "advapi32" ], [ 257568, "wide", "api-ms-win-appmodel-runtime-l1-1-2" ] ], "v": { "file.stem": "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162", "pe.imphash": "52070df51ae03170ced339768bc53be6", "pe.machine": "x86_64", "pe.rich.key": 1594727141, "pe.rich.hash": "527d4252fa77ae88a2e34414bedc7ef4", "pe.subsystem": "windows_gui", "pe.timestamp": 1667946704, "file.basename": "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162.exe", "pe.image_base": 6442450944, "pe.image_size": 610304, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 78736, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "142e8c65304ed426f5daf31ef37a1d1a17b88a1b", "pe.export_timestamp": 4294967295, "pe.load_config.size": 312, "pe.image_hash.sha256": "041e0695dfc8ef34626bd713d0d180eb7b4f7062a1b6fcbc6282929b4c839c6b", "pe.image_hash.sha384": "69b649aa61080245894912714f32236dffe90434e60ae8e059546c3b7b5183463caa3e73c7993411e3ebe065e5adee07", "pe.image_hash.sha512": "3a634c171392c73881b15ee2f1539b091d14dca4bdae94b4d2bfdd3867f9b5d00659fc9f786f019344ab5e2023d61db007576f1c76d614ee618dc3bd61f4d9ab", "pe.resource_types[0]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8226, "pe.linker_major_version": 14, "pe.linker_minor_version": 29, "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "pogo", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.data_directories[0].rva": 563696, "pe.data_directories[1].rva": 570400, "pe.data_directories[2].rva": 602112, "pe.data_directories[3].rva": 585728, "pe.data_directories[4].rva": 606208, "pe.data_directories[5].rva": 540928, "pe.data_directories[6].rva": 540960, "pe.data_directories[7].rva": 237568, "pe.dll_characteristics_raw": 352, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 6704, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 60, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 248, "pe.data_directories[3].name": "exception", "pe.data_directories[3].size": 10476, "pe.data_directories[4].name": "base_relocation", "pe.data_directories[4].size": 2468, "pe.data_directories[5].name": "debug", "pe.data_directories[5].size": 28, "pe.data_directories[6].name": "load_config", "pe.data_directories[6].size": 312, "pe.data_directories[7].name": "iat", "pe.data_directories[7].size": 696, "pe.debug.entries[0].type_id": 13, "pe.rich.entries[0].build_id": 259, "pe.rich.entries[1].build_id": 261, "pe.rich.entries[2].build_id": 260, "pe.rich.entries[3].build_id": 260, "pe.rich.entries[4].build_id": 259, "pe.rich.entries[5].build_id": 261, "pe.rich.entries[6].build_id": 257, "pe.rich.entries[7].build_id": 1, "pe.rich.entries[8].build_id": 265, "pe.rich.entries[9].build_id": 256, "pe.rich.entries[0].use_count": 11, "pe.rich.entries[10].build_id": 255, "pe.rich.entries[11].build_id": 258, "pe.rich.entries[1].use_count": 173, "pe.rich.entries[2].use_count": 19, "pe.rich.entries[3].use_count": 14, "pe.rich.entries[4].use_count": 10, "pe.rich.entries[5].use_count": 69, "pe.rich.entries[6].use_count": 5, "pe.rich.entries[7].use_count": 98, "pe.rich.entries[8].use_count": 2, "pe.rich.entries[9].use_count": 1, "pe.coff.dos_header_pe_pointer": 256, "pe.load_config.guard_flags[0]": "cf_instrumented", "pe.rich.entries[0].product_id": 29395, "pe.rich.entries[10].use_count": 1, "pe.rich.entries[11].use_count": 1, "pe.rich.entries[1].product_id": 29395, "pe.rich.entries[2].product_id": 29395, "pe.rich.entries[3].product_id": 30034, "pe.rich.entries[4].product_id": 30034, "pe.rich.entries[5].product_id": 30034, "pe.rich.entries[6].product_id": 29395, "pe.rich.entries[8].product_id": 30146, "pe.rich.entries[9].product_id": 30146, "pe.debug.entries[0].size_bytes": 832, "pe.load_config.guard_flags_raw": 256, "pe.load_config.security_cookie": 6443024432, "pe.rich.entries[10].product_id": 30146, "pe.rich.entries[11].product_id": 30146, "pe.base_relocations.block_count": 13, "pe.base_relocations.entry_count": 1176, "pe.base_relocations.padding_count": 6, "pe.debug.entries[0].timestamp_unix": 1667946704, "pe.load_config.guard_cf_check_function_pointer": 6442689208, "pe.load_config.guard_cf_dispatch_function_pointer": 6442689224 }, "x": [ [ "ADXTOpJMSjuRwxcuksmzi" ], [ "ADjnkFtWxhdHgmsJqPQET" ], [ "APHXfqSCeK" ], [ "AikatooD" ], [ "AsHXQwWhLF" ], [ "BAQHBoHshwPXIBgxfRt" ], [ "BPaVYYXxYzqAumZeMkFJIDsRsb" ], [ "BblennjQgbVTAD" ], [ "BhtSAYlmVbOzKpcrDPMMDK" ], [ "COsSPHnCgwrtMKroVU" ], [ "CPnXbEj" ], [ "CPoQinjZOixXMaUSfhfc" ], [ "DHZVMrYfjQpTb" ], [ "DLYUEmDcJdYmbFijN" ], [ "DRdOLHawduQpBElgQQAy" ], [ "DhGgKPIouGCZeGLB" ], [ "DllRegisterServer" ], [ "DpCSeQxhBWOqcLLdAcekR" ], [ "DqhayeVTxkUkazoD" ], [ "ETqooeVAyzISKJvOd" ], [ "FCseLqHRulECZZmXghTlfbI" ], [ "FGgfQikJB" ], [ "FOHwCZpsYOY" ], [ "FWnnIKvrOmfpBkQcxZJFJose" ], [ "FgLMAJhvm" ], [ "FrgWxkoerZ" ], [ "FuYsGflElaFGRhANYxsYvNvwj" ], [ "GASLVbBI" ], [ "GTWLlbyBBCHqJivRbN" ], [ "GXPcKjevwJZAbrEG" ], [ "GYTNVuotixihh" ], [ "GbNmWwWYQ" ], [ "GdXuxc" ], [ "GdoZNrCkgFAXO" ], [ "GlyPTKlBzdbNEHNSrvImlmtkxN" ], [ "GomZPINrdGMrvUKkqs" ], [ "GwZdPAPGCxiFNuLQGNJtMF" ], [ "HFzIYkbPOjoxRTTeWvVkgtcF" ], [ "HHNRTXIBgSZQ" ], [ "HJwTVGwDNZAemtyaKaD" ], [ "HLeMaWjBefWbesLDSfooJ" ], [ "HcLWwFmHWwrQAf" ], [ "HstPofrxDfYCf" ], [ "HwThzHtWhja" ], [ "IGKxgXlkdIgblzc" ], [ "IGVdsRMcrbSYPgjqZyLy" ], [ "IjDzZnXeqHTS" ], [ "IwfTRTdGlqP" ], [ "JFiYdDtBWGjE" ], [ "JINgJeIjWMlnXrIGEhPOGg" ], [ "JLUtHLOmZFFBAQxeLDmKI" ], [ "JNRPzfyyLokNsJBUH" ], [ "JSiOlsAaLZNHomSGOuhPlggEh" ], [ "JSxsuYfEKprnSUlKlcQmFJO" ], [ "JYgLrjstsnF" ], [ "JZQaoxy" ], [ "JaCQYjQP" ], [ "JegDBKpLbtnsoSlrwootmniSKZ" ], [ "JlLBVNjzCADuOgYGajKMR" ], [ "JqeswwnDCvVzpNutrMY" ], [ "JyQGGAJHuICHyfZ" ], [ "KNGYlUOVjKJuPR" ], [ "KbgwFNFpFClrfsWHLcClBiZF" ], [ "KqPWLieaxFiotBVkkwEUNDcCKV" ], [ "LIaBDoEddbEH" ], [ "LJcCrnQKoAICjLJTuQGBTovbxy" ], [ "LdWDTxjcoxoSOXEl" ], [ "MAQbuAhsulqGx" ], [ "MBxnTgeUCAA" ], [ "MIOpfIbEvgRfiJctTyGh" ], [ "MPpBldKFs" ], [ "MQoLfdmlKjjFzoOFECXsrxu" ], [ "MSsRPxyTlM" ], [ "MVmDOJ" ], [ "McMWdJqgkKvaZN" ], [ "NUpjzFACWLTIdtP" ], [ "NXonycLxGrjV" ], [ "NYqGzBnLvFBvB" ], [ "NmWGPSMDcK" ], [ "NshyWXHhdYesOvG" ], [ "ONKRrQWzZYUjzSMhMnAEQO" ], [ "OaSUAYtjFPkgLkobyzMl" ], [ "OayPmPbJGWSUexpwPdfAAf" ], [ "OircqXHIycjIX" ], [ "OoUszvppyIHjcykGNznFDvXou" ], [ "OrzzdYBLTnndy" ], [ "OzqudGmExR" ], [ "PRLxsIXysvN" ], [ "PZLqxqgUNxZqUoqE" ], [ "PZffoijeAZqV" ], [ "PllcvR" ], [ "PmWDUhf" ], [ "PnNxFvewmcVHh" ], [ "PpsKMWxlolyGTStQ" ], [ "PqCWqUaCVxUMh" ], [ "PqsvOuTVfbLVUoyAIgGnqEjV" ], [ "QPToIl" ], [ "QnimQsCBkniy" ], [ "QoncSLhvAMpXtCvYTWY" ], [ "RCmbSOuVrsjLRcvWOUXNy" ], [ "RDDmpbEYQ" ], [ "RJgVmFYoTZnFNFRVCx" ], [ "RKtcRO" ], [ "RWlZcqMLCKbOweVQDrQSJd" ], [ "RayLPxW" ], [ "SBcAnEKuRunfIXa" ], [ "SHHHhPtUcoreSuGIe" ], [ "SNatNMePa" ], [ "SPPyyHb" ], [ "ShpgnVcEnOTREmx" ], [ "SkJpKfabMnbktuhh" ], [ "SmzsbAglNENlSQaTPZp" ], [ "StrKkdnifPYY" ], [ "SxYBilByGbaRbXrLAURaQBTI" ], [ "TCIzLXlQbvDOx" ], [ "TCNIRETvDYqIXN" ], [ "URJGeaPpU" ], [ "VEYqbWNvFi" ], [ "VPgfKvqYjKRLLPvSGue" ], [ "VQaUgJaWAKxnIFielImlvza" ], [ "VUxRTGgZtdyXmbnXtkTO" ], [ "VkFzeSGhpv" ], [ "VmjqUSRaBqcL" ], [ "VujaOc" ], [ "WvFuCNleJlguCxcFGahBRHdiGQ" ], [ "XGUpohIGEfVwvgf" ], [ "XXwytfUtxtRAyQBnngf" ], [ "XbSOdIHXmdQycPHpIaJc" ], [ "XkkJaIEOowYzNixc" ], [ "XsDkLSaBcXNhA" ], [ "YQbvAWJyGLG" ], [ "YWLCNhcRGMMArDMfsbUFAQ" ], [ "YiiMwrVGDOcGqMuXeXzog" ], [ "YikORHg" ], [ "YkTsmbd" ], [ "ZBbjMNza" ], [ "ZCPwfaHeaPQvDTtyiHGRIaEt" ], [ "ZNPBpuQrLwyrjMrwPcTvhm" ], [ "ZzWkjTiPWcMfmz" ], [ "aEjHUxfmrelTvyAfqcNm" ], [ "aZyhMeii" ], [ "ajJWSbuLqKZeGCEoN" ], [ "antHkWU" ], [ "atEOqSgVHUX" ], [ "ayTrvMJhhGwBPGRjhuDPBCjBR" ], [ "brbfKBVKVtAcgB" ], [ "cGEwyzHJjmMSqFaiIdN" ], [ "cKzkBiFS" ], [ "cQniulkaNFUjwIgYGGSshqV" ], [ "ccEZZoSIsqVczbEwGJaTYIidz" ], [ "clpPeeFVTHlVVXo" ], [ "cmSvfaZvhORWpbh" ], [ "cwlMeyawIF" ], [ "dgHUNxBLv" ], [ "djJvOdCvj" ], [ "dtAKQj" ], [ "eCfuCfmj" ], [ "eRllpqrHOdWObXaXMZAOSilMW" ], [ "ehOLmuUmSgSNupbaPAJDkhYF" ], [ "erIDZsn" ], [ "euuDWQqVyOkCwNvvWBUMNU" ], [ "eyJzam" ], [ "fVOJQZie" ], [ "fnnsDQQFOKNQRgVSmnLVAy" ], [ "frwwozNydAAuswOYHfnX" ], [ "gADdRakdQk" ], [ "gKScGvUb" ], [ "gPqaEGYHlnZB" ], [ "hNFDWsNEdUJLgSLLdHsN" ], [ "hPVAnH" ], [ "hTyvvkRqtTHKvbCqAwYAPO" ], [ "hgsxwqFyjoJOUMhlqfuo" ], [ "hziRaX" ], [ "iEfHojgJfz" ], [ "ifxuuqZXRqQtfVHzXz" ], [ "jNxGheFRyizJhMZftY" ], [ "jYlLoSBKjchBCYlavhiOICCj" ], [ "jjNosKmANZpDJHmyvSMv" ], [ "jyTgpLXnAtMAIC" ], [ "kHJhGHqXCyZjgEBuegdzCvXnRu" ], [ "kRPRXK" ], [ "kWXwmUJtmqdwFhOTeyQa" ], [ "kaJyKNuSfG" ], [ "kkOHFQNsJVvRDfpyKPzXeBBf" ], [ "kyHVuSquAxhjXPaZz" ], [ "lCKaAgYAOPN" ], [ "lNFhheLP" ], [ "lPSsPmKuHuQntmqqxpP" ], [ "lTlhwdNT" ], [ "laDptPBY" ], [ "mWyJiaIlv" ], [ "mYvHmSGHLuivcfDn" ], [ "mazGgIQSavDrn" ], [ "mfHJxcXIB" ], [ "mfzGgz" ], [ "mkXaANkyxJbYhUylRrK" ], [ "nDxlirCkcqPnTzwIeeXEbMSJor" ], [ "ngTshhmjVukcJdpuBmqmAvEcj" ], [ "oCUWiAWtoaiTo" ], [ "oSEHFi" ], [ "odeFXW" ], [ "okObyQXzZJ" ], [ "omqOcloRUmg" ], [ "pELirKkAVxZlyTybBlOZd" ], [ "pGhwKLCjIfnV" ], [ "pluhDUqPeTgasYWidzRHcev" ], [ "psUIXrwDesfDMyLZOYv" ], [ "pwBjVleLzrsBJt" ], [ "pyfYwINCBeyoEpryYyDtNTSBhU" ], [ "qZCtvgY" ], [ "qsRlzamxjH" ], [ "qxINKoBvidcFNQNkt" ], [ "rHRAgYBwu" ], [ "rKonkSszSliw" ], [ "rPOTwCthGApDkT" ], [ "rPlrVttbeOFdvRAeCKnvgsG" ], [ "riZNemrxyyOrygk" ], [ "rqWVjsBONZqmyagZTzxlbnv" ], [ "rzxndBOIwzzXylfinfjfqZHkUV" ], [ "sKWkUbbosBCcCntDStyfQdND" ], [ "sdRUWzYnFnDLqnc" ], [ "shsfvDZi" ], [ "spPrQsvuGQnuqnKkuf" ], [ "stLCyTmWpocOoHqd" ], [ "tWoBvkhVjYbWcOrffZ" ], [ "tXvHVJw" ], [ "tZVXfUyKyzCQbpzRAGQcxdpn" ], [ "tuXUZxmsJcslUuLWhyfPp" ], [ "tyXFaGfYQfOokTTTA" ], [ "uRibEyUqxzdRRfOIZOa" ], [ "uUoFzDTZSwVlBbKlfTihDoU" ], [ "vHrxlkTAhEM" ], [ "vMcwEWvevlnyo" ], [ "vbvYWLCFHCBsgxYlkxfc" ], [ "vnpLRVBK" ], [ "vpIWHGOWXVPxl" ], [ "wAOdWTHw" ], [ "wIohkhPrJcqRDEmmcmFgZkp" ], [ "wKjeWJWWWUmKQfejp" ], [ "wLidRNVIVsIDHMfEPYbf" ], [ "wPmXLOsSsdqkgWrIdJ" ], [ "wQdSAViAdnu" ], [ "wTwNmtfxFNCGCMmAAJqKVeq" ], [ "wwuVbCyAcVCKnS" ], [ "xESaVnQCeQKuXySjqnkcFR" ], [ "xWQHWfWZswgXRcduJtZIYc" ], [ "xlkuDEsSXeLvzu" ], [ "xxQMVBrKWeqrPXtwGprrXqcQ" ], [ "yHkztDPImVxpne" ], [ "yvIyZwBtyoOyKkkZwfz" ], [ "zyqSrKYYDHQMNIdzRPCDC" ] ], "id": "pe", "sc": [ [ ".text", 1024, 231424, 6.4, "r-x" ], [ ".rdata", 232448, 335360, 6.4, "r--" ], [ ".data", 567808, 5120, 2.77, "rw-" ], [ ".pdata", 572928, 10752, 5.6, "r--" ], [ "_RDATA", 583680, 512, 2.46, "r--" ], [ ".rsrc", 584192, 512, 2.52, "r--" ], [ ".reloc", 584704, 2560, 5.38, "r--" ] ] }, "id": 0, "sz": 587264, "ts": [ { "c": 0.8999999761581421, "d": "Minimal resource section footprint", "e": [ ".rsrc (size: 512)" ], "i": "well-known/malware/virus/virlock::tiny-rsrc-section", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 6.40)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount", "InitializeCriticalSectionEx" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "0x3a120", "0x3a040" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x3a170" ] }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-file-l1-2-2", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-win-core-localization-l1-2-1" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1, "el": [ "0x3eaf0", "0x3b388", "0x3b3c8", "0x3ea60", "0x3ecf0", "0x3ebe0", "0x3ee20", "0x3eba0", "0x3ec20", "0x3b420", "0x3ec60", "0x3ea20", "0x3eb50", "0x3eca0", "0x3eaa0" ] }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "0x8a6ae" ] }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1, "el": [ "0x3a350" ] }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2, "el": [ "0x3a028" ] }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2, "el": [ "0x3a010" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x3e808" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "0x39878" ] }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "0x3a168" ] }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "exports.count = 251.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 85.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 85.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 85.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Fiber-local storage assignment", "e": [ "FlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-set-value", "l": 2, "el": [ "0x3a190" ] }, { "c": 0.8999999761581421, "d": "Fiber-local storage allocation", "e": [ "FlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::fls-alloc", "l": 2, "el": [ "0x3a180" ] }, { "c": 0.8999999761581421, "d": "Fiber-local storage deallocation", "e": [ "FlsFree" ], "i": "micro-behaviors/process/tls/fiber::fls-free", "l": 2, "el": [ "0x3a198" ] }, { "c": 0.8500000238418579, "d": "Inline MZ header validation constant", "e": [ "B8 4D 5A 00 00" ], "i": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "l": 1, "el": [ "0x12a1b" ] }, { "c": 0.8999999761581421, "d": "High export count metric", "e": [ "exports.count = 251.00" ], "i": "micro-behaviors/communications/socket/route::high-export-count", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.40)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "exports.count = 251.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "exports.count = 251.00" ], "i": "objectives/command-and-control/backdoor/loader/native-reflect::runtime-loader-with-encoded-data-cond-4--inline-14359", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 3147.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2, "el": [ "0x3a0d0" ] }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "0x3a030" ] }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2, "el": [ "0x3a1d0" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 85.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 3147.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2, "el": [ "0x3a1b8" ] }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "42", "46", "48", "41" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014", "el": [ "0xbde4", "0xbea9", "0x233e4", "0x3753a" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0x3a090" ] }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1, "el": [ "0x3a280" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x3a280" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.40" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2, "el": [ "0x3a008" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "0x3a048" ] }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2, "el": [ "0x3a0f8" ] }, { "c": 1.0, "d": "Binary has 200+ exports (large library)", "e": [ "exports.count = 251.00" ], "i": "metadata/binary/metrics/threshold::many-exports-200", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2, "el": [ "0x3a148" ] }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2, "el": [ "0x3a050" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x3a258", "0x3a250" ] }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2, "el": [ "0x3a228" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "0x3a260" ] }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2, "el": [ "0x3a210" ] }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2, "el": [ "0x3a0f0" ] }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "0x3a0e8" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2, "el": [ "0x3a080" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "0x3a130" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "0x3a168" ] }, { "c": 0.949999988079071, "d": "COM registration export", "e": [ "DllRegisterServer" ], "i": "metadata/binary/symbols/exports::export-dll-register-server", "l": 1, "el": [ "0xca80" ] }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2, "el": [ "0x3e820" ] }, { "c": 0.8600000143051147, "d": "Uppercase _RDATA companion section", "e": [ "_RDATA" ], "i": "metadata/binary/section/metrics::uppercase-rdata-section", "l": 2 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x2068b" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x3a110" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x39d70" ] }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "exports.count = 251.00" ], "i": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "0x3a218" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform/defender::etw-blinding-patch-bytes", "l": 1, "el": [ "0x14c6f" ] }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2, "el": [ "0x3a1a0" ] }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2, "el": [ "0x3a0c8" ] }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2, "el": [ "0x3a220" ] }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2, "el": [ "0x3a1e8" ] }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "exports.count = 251.00" ], "i": "metadata/binary/metrics/threshold::many-exports-100", "l": 1 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x3e808" ] }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "exports.count = 251.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-5--inline-3845", "l": 1 }, { "c": 0.7200000286102295, "d": "Obfuscated Go PE network tokens", "e": [ "NgStuBOTHcnejB", "RAnIBoTZFcCGiUiQfw", "tHhrTboThmvTrB", "BRJXvwUBxKNGxTcpybZxQ", "RsyEPbotbbg", "ayTrvMJhhGwBPGRjhuDPBCjBR", "LmruDPMOkROdnkN", "EUskYbotfXIPrAEMaonRayomuB", "KPKgSUDPpT", "duKbMyGwyedlTWJRLsbrbOtwAeIqItFYOsKLHvYEwY", "GetCPInfo", "xuNcSitcPiO", "lsyhcbotKS" ], "i": "objectives/impact/dos/attack::go-pe-obfuscated-network-tokens", "l": 1, "el": [ "0x4cfb0", "0x4feb0", "0x5bab0", "0x79050", "0x6d490", "0x8992d", "0x5e9b0", "0x618b0", "0x52db0", "0x70380", "0x8a424", "0x58bb0", "0x76160" ] }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2, "el": [ "0x8a71e" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 85.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 85.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2, "el": [ "0x3a208" ] }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-xstate-l2-1-0" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1, "el": [ "0x3b388", "0x3ebe0", "0x3eaa0", "0x3ea60", "0x3b3c8", "0x3eba0", "0x3eb50", "0x3ec20", "0x3ea20", "0x3eaf0", "0x3ec60" ] }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2, "el": [ "0x3a278" ] }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014", "el": [ "0x2d200" ] }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2, "el": [ "0x3a070" ] }, { "c": 0.800000011920929, "d": "In-code MZ/PE compare immediate", "e": [ "MZf9\bu3HcH\u003cH\u0003ȁ9PE" ], "i": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x5ba98" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0xe9a7" ] }, { "c": 0.8999999761581421, "d": "Fiber-local storage retrieval", "e": [ "FlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::fls-get-value", "l": 2, "el": [ "0x3a188" ] }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1, "el": [ "0x18447" ] }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2, "el": [ "0x3a1f0" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2, "el": [ "0x3a128" ] }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2, "el": [ "0x3a298" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 85.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2, "el": [ "0x3a160" ] }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1, "el": [ "0x3ba80" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2, "el": [ "0x3a140" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 3147.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x13372" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x481" ] }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2, "el": [ "0x3a078" ] }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2, "el": [ "0x3a0e0" ] }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "0x3a260", "0x3a268" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 3147.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2, "el": [ "0x3a118" ] }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2, "el": [ "0x3a0c0" ] }, { "a": "T1574.002", "c": 0.8799999952316284, "d": "LoadLibraryExW API string", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w-string", "l": 2, "el": [ "0x8a686" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "FlsGetValue", "value too large", "FlsSetValue", "TlsGetValue", "TlsSetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x3b460", "0x39e38", "0x3b478", "0x8a640", "0x8a64e" ] }, { "a": "T1070", "c": 0.6000000238418579, "d": "Vectorized zero-fill blocks (xorps + movups stores)", "e": [ "0F 57 C0 0F 11" ], "i": "objectives/evasion/indicator-removal/cleanup::vectorized-zero-density", "l": 1, "el": [ "0x30e8" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "0x3a088" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2, "el": [ "0x3a100" ] }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2, "el": [ "0x3a230" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x3a270" ] }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2, "el": [ "0x3a1a8" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x3a1f8" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x8a78a" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x3a000" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "0x3a268" ] }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2, "el": [ "0x3e808" ] }, { "c": 0.8500000238418579, "d": "Locale-aware string mapping", "e": [ "LCMapStringEx" ], "i": "micro-behaviors/os/env/access::lcmap-string-ex", "l": 2, "el": [ "0x3a060" ] }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2, "el": [ "0x3a200" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata", ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LCMapStringEx", "api-ms-win-core-string-l1-1-0", "invalid string position", "GetStringTypeW", "LCMapStringW", "string too long", "CryptStringToBinaryA", "GetEnvironmentStringsW", "CompareStringEx", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x3ef78", "0x3eba0", "0x82250", "0x8a37c", "0x8a70e", "0x821a0", "0x55c98", "0x8a89a", "0x3eea8", "0x8a8b4" ] }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024", "el": [ "0x67698" ] }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2, "el": [ "0x3a108" ] }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "0x3a038" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1, "el": [ "0x2c9c3", "0x34da9" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2, "el": [ "0x3a138" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x8a674" ] }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-windowstation-l1-1-0", "ext-ms-win-ntuser-dialogbox-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2, "el": [ "0x3eda0", "0x3ed50" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5120)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1, "el": [ "0x1c640", "0x3ef5" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x3a178" ] }, { "c": 0.75, "d": "Large base64-like string (512+ chars)", "e": [ "2ccqSsG9byviyF1KnKZUdKTiQV4KlFVQubh1UPnxZ2FS41pqjrJHb3+tMVkRmEUlWaBIYQLkKSZ0n0g8H992d1vOXHaMn1JtfvpSI5n1YyZbmWhSxdVtZBegW1mShydF", "q6DSaKJzIN4PHBmxi4jlDn420tIm7EtXY9z9E6ZjE8+FUjWEClQrshxpST4lRekvUTDsXha+UH3a5BNcCdJDXrc5f1OsW19AojNNCCTcp+snHRUjrzP0HEFZTSVFqT95" ], "i": "objectives/anti-static/obfuscation/payload/encoded::large-base64-string-dup", "l": 3, "el": [ "0x81d20", "0x70380" ] }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2, "el": [ "0x8a756", "0x3eec0" ] }, { "c": 0.9800000190734863, "d": "GetFileSizeEx import symbol", "e": [ "GetFileSizeEx" ], "i": "metadata/binary/symbols/imports::getfilesizeex-import", "l": 1, "el": [ "0x3a1e0" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "l": 2, "el": [ "0x3a1c0" ] }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "0x3a1c8" ] }, { "c": 1.0, "d": "High export count metric", "e": [ "exports.count = 251.00" ], "i": "metadata/binary/metrics/anomaly::high-export-count-marker", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "exports.count = 251.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2, "el": [ "0x3a0b8" ] }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "0x3a098" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x8a8f0" ] }, { "a": "T1497.001", "d": "VBOX string detection", "e": [ "vBoX" ], "i": "objectives/anti-analysis/emulator-detect/hardware::vbox-string", "l": 1, "m": "B0032", "el": [ "0x73270" ] }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009", "el": [ "0x3a0a8" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 3147.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "06 00 e0 45", "0a 00 20 f4", "06 00 80 45" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1, "el": [ "0x84510", "0x84bac", "0x844e0" ] }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "0x3a0a0" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1, "el": [ "0x4a088" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "exports.count = 251.00" ], "i": "objectives/anti-static/obfuscation/payload/section::versioned-export-heavy-library-cond-1--inline-29160", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "exports.count = 251.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-10--inline-29172", "l": 1, "m": "B0032" }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales callback API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 1, "m": "E1106", "el": [ "0x3a1c0" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1140", "c": 0.800000011920929, "d": "Large base64 encoded payload", "e": [ "2ccqSsG9byviyF1KnKZUdKTiQV4KlFVQubh1UPnxZ2FS41pqjrJHb3+tMVkRmEUlWaBIYQLkKSZ0n0g8H992d1vOXHaMn1JtfvpSI5n1YyZbmWhSxdVtZBegW1mShydF", "q6DSaKJzIN4PHBmxi4jlDn420tIm7EtXY9z9E6ZjE8+FUjWEClQrshxpST4lRekvUTDsXha+UH3a5BNcCdJDXrc5f1OsW19AojNNCCTcp+snHRUjrzP0HEFZTSVFqT95" ], "i": "micro-behaviors/data/encode/payload::large-base64-payload", "l": 3, "m": "C0043", "el": [ "0x81d20", "0x70380" ] }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "24 34 01 00", "1b f6 00 00", "35 50 01 00", "a1 fa 00 00", "d5 f1 00 00", "15 47 00 00", "a1 25 00 00", "af 10 02 00", "4a 63 02 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1, "el": [ "0x260e6", "0x29eef", "0x244d5", "0x29a69", "0x2a335", "0x34df5", "0x36f69", "0x1845b", "0x13188" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x4cf88" ] }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "01 48 ef 01 75", "00 41 39 2d 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1, "el": [ "0xe0ba", "0x25921" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 2.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x38ae0" ] }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1, "el": [ "0x3e808" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x5ba98" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x3a150" ] }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GomZPINrdGMrvUKkqs", "CryptStringToBinaryA", "KbgwFNFpFClrfsWHLcClBiZF", "AppPolicyGetProcessTerminationMethod", "KybNugjWxkJbLskVlHJdLwwGP", "GlyPTKlBzdbNEHNSrvImlmtkxN", "BhtSAYlmVbOzKpcrDPMMDK", "OayPmPbJGWSUexpwPdfAAf", "GetUserDefaultLocaleName", "JegDBKpLbtnsoSlrwootmniSKZ", "JqeswwnDCvVzpNutrMY", "EnumSystemLocalesEx", "InitializeCriticalSectionEx", "PqsvOuTVfbLVUoyAIgGnqEjV", "GxcfuQVAkMUzyuFxBtARXC", "QoncSLhvAMpXtCvYTWY" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x8923b", "0x55c98", "0x8941b", "0x3efc8", "0x647b0", "0x89220", "0x89078", "0x8956c", "0x3ef28", "0x893b7", "0x893e8", "0x3eec0", "0x3b490", "0x8962a", "0x79050", "0x89657" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 85.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "0x3a0a0" ] }, { "c": 0.949999988079071, "d": "links kernel32 (ExitProcess, WriteConsoleW, SetEndOfFile, WideCharToMultiByte, MultiByteToWideChar, ... +79 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "84 symbols" ] }, { "c": 0.949999988079071, "d": "links ole32 (CoLoadLibrary)", "e": [ "ole32" ], "i": "metadata/dylib::ole32", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetLocaleInfoW", "GetUserDefaultLCID", "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2, "el": [ "0x8a71e", "0x3a1b8", "0x3eec0", "0x8a756" ] }, { "a": "T1129", "c": 0.75, "d": "Fiber-based thread local storage", "e": [ "FlsSetValue", "FlsAlloc", "FlsGetValue" ], "i": "objectives/evasion/process/injection/native::fiber-local-storage-ops", "l": 1, "el": [ "0x3a190", "0x3a180", "0x3a188" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2, "el": [ "0x3a260", "0x3a268" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x3a160", "0x3a150", "0x3a0e8" ] }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetUserDefaultLCID", "EnumSystemLocalesW", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-fingerprinting-imports", "l": 2, "el": [ "0x3a1b8", "0x3a1c0", "0x3a1a8" ] }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InterlockedFlushSList", "InitializeSListHead" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2, "el": [ "0x3a108", "0x3a0d0" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 1, "el": [ "0x3a088", "0x3a090" ] }, { "c": 0.9200000166893005, "d": "Custom API resolver logic (manual module/export resolution)", "e": [ "api-ms-win-core-datetime-l1-1-1", "41 B8 00 08 00 00", "api-ms-win-security-systemfunctions-l1-1-0", "GetModuleHandleExW", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-file-l1-2-2", "api-ms-win-rtcore-ntuser-window-l1-1-0", "GetProcAddress", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-processthreads-l1-1-2" ], "i": "micro-behaviors/os/api-resolution/manual::custom-api-resolver-logic", "l": 2, "el": [ "0x3ea20", "0x18447", "0x3ecf0", "0x3a160", "0x3ec60", "0x3ec20", "0x3b388", "0x3ebe0", "0x3ea60", "0x3eca0", "0x3a150", "0x3eaf0", "0x3b420", "0x3b3c8", "0x3eba0", "0x3eb50" ] }, { "a": "T1497", "c": 0.8500000238418579, "d": "Adaptive behavior based on environment", "e": [ "GetEnvironmentStringsW", "imports.count = 85.00", "IsProcessorFeaturePresent", "exports.count = 251.00", "IsDebuggerPresent", "FreeEnvironmentStringsW" ], "i": "objectives/anti-analysis/environment-detect/runtime::environment-adaptive-behavior", "l": 2, "m": "B0001", "el": [ "0x3a260", "", "0x3a0a8", "", "0x3a0d8", "0x3a268" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "r=hz;P}!z@c]kmbD]OM]\\xMkLReCEMk=M\u003e8^]~AZ \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3, "el": [ "offset:308085" ] } ], "sha": "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162", "path": "63e1af6d2722fa21f5afe257d5e91dd9b3f7e97d2201394eac8119e83a292162.exe", "type": "pe" } ], "tv": "52045" } }