{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 1.0, "class": 2 }, { "m": "az/native", "prob": 0.07763975, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:42:16Z" }, "path": "47550", "raw": { "v": "4", "fs": [ { "f": "O(As)Md₃(Bi₂Si)", "k": { "hash.imp": "fc785ac8507eb2f8e2af81f89b4cb6fd", "pe.timestamp": 946518507, "hash.authenti": "d87c6eadc08433f0317e72d94a7e5b94e4b7172e00497a7554b44a9a2df808a5", "hash.rich_header": "0bc73322cf12bff4d58c3701951a0696b4d94aee47d4cbadca3dc75e073ffb96", "build.target_arch": "x86", "pe.linker_version": "10.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.rich_header.xor_key": "0x07197eb3", "pe.data_directories[0].rva": 644984, "pe.data_directories[1].rva": 565248, "pe.data_directories[2].rva": 645200, "pe.data_directories[3].rva": 562120, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 216, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 79736, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 24, "pe.data_directories[3].name": "load_config", "pe.data_directories[3].size": 72, "pe.load_config.security_cookie": "0x4701b0", "pe.rich_header_compids[0].count": 7, "pe.rich_header_compids[1].count": 15, "pe.rich_header_compids[2].count": 2, "pe.rich_header_compids[3].count": 68, "pe.rich_header_compids[4].count": 5, "pe.rich_header_compids[5].count": 109, "pe.rich_header_compids[6].count": 1, "pe.rich_header_compids[7].count": 10, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 9795593, "pe.rich_header_compids[1].compid": 8681481, "pe.rich_header_compids[2].compid": 9664521, "pe.rich_header_compids[3].compid": 8615945, "pe.rich_header_compids[4].compid": 6098883, "pe.rich_header_compids[5].compid": 65536, "pe.rich_header_compids[6].compid": 8308263, "pe.rich_header_compids[7].compid": 11509019, "pe.rich_header_compids[8].compid": 10132763, "pe.rich_header_compids[9].compid": 10329371, "pe.rich_header_compids[5].product": "Unknown", "pe.section_characteristics[0].name": "UPX0", "pe.section_characteristics[1].name": "UPX1", "pe.section_characteristics[2].name": ".rsrc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 7, "pe.rich_header.entries[1].use_count": 15, "pe.rich_header.entries[2].use_count": 2, "pe.rich_header.entries[3].use_count": 68, "pe.rich_header.entries[4].use_count": 5, "pe.rich_header.entries[5].use_count": 109, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[7].use_count": 10, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 149, "pe.rich_header.entries[1].product_id": 132, "pe.rich_header.entries[2].product_id": 147, "pe.rich_header.entries[3].product_id": 131, "pe.rich_header.entries[4].product_id": 93, "pe.rich_header.entries[5].product_id": 1, "pe.rich_header.entries[6].product_id": 126, "pe.rich_header.entries[7].product_id": 175, "pe.rich_header.entries[8].product_id": 154, "pe.rich_header.entries[9].product_id": 157, "pe.rich_header.entries[0].build_number": 30729, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 30729, "pe.rich_header.entries[1].product_name": "Cpp_VS2008_LTCG", "pe.rich_header.entries[2].build_number": 30729, "pe.rich_header.entries[2].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[3].build_number": 30729, "pe.rich_header.entries[3].product_name": "C_VS2008_LTCG", "pe.rich_header.entries[4].build_number": 4035, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[6].build_number": 50727, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 40219, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 40219, "pe.rich_header.entries[8].product_name": "C_VS2010", "pe.rich_header.entries[9].build_number": 40219, "pe.rich_header.entries[9].product_name": "Linker_VS2010_LTCG", "pe.section_characteristics[1].raw_size": 435712, "pe.section_characteristics[2].raw_size": 80384, "pe.section_characteristics[0].virtual_size": 122880, "pe.section_characteristics[1].virtual_size": 438272, "pe.section_characteristics[2].virtual_size": 81920, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 126976, "pe.section_characteristics[2].virtual_address": 565248, "pe.section_characteristics[0].characteristics_hex": "e0000080", "pe.section_characteristics[1].characteristics_hex": "e0000040", "pe.section_characteristics[2].characteristics_hex": "c0000040" }, "x": 43, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "free" ], "ms": { "pe": { "entry": 559072.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 80384.0, "subsystem": 2.0, "timestamp": 946518507.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.96, "entry_section": "UPX1", "size_of_image": 647168.0, "file_alignment": 512.0, "resource_count": 2.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON" ], "characteristics": 258.0, "has_rich_header": true, "security_cookie": 4653488.0, "size_of_headers": 4096.0, "export_timestamp": 0.0, "import_dll_count": 2.0, "computed_checksum": 568245.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "timestamp_pre_2000": true, "dll_characteristics": 33088.0, "has_export_timestamp": false, "linker_major_version": 10.0, "bss_like_section_count": 1.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "api_hashing_indicator_count": 1.0, "entry_in_nonstandard_section": true }, "file": { "size": 517120.0 }, "binary": { "code_size": 435712.0, "func_count": 1.0, "code_entropy": 4.0, "func_density": 0.0, "import_count": 7.0, "string_count": 222.0, "avg_func_size": 3046.0, "section_count": 3.0, "avg_complexity": 86.0, "import_density": 0.02, "max_complexity": 86.0, "string_density": 0.52, "overall_entropy": 4.32, "avg_basic_blocks": 155.0, "avg_section_size": 172032.0, "dependency_count": 2.0, "entropy_variance": 3.3, "wx_section_count": 2.0, "avg_string_length": 19.0, "complexity_per_kb": 0.2, "max_string_length": 126.0, "wide_string_count": 1.0, "avg_string_entropy": 1.92, "code_to_data_ratio": 5.42, "rsrc_to_file_ratio": 0.16, "total_basic_blocks": 155.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 30.58, "largest_section_ratio": 0.84, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "writable_section_count": 3.0, "behavioral_import_ratio": 0.57, "entry_in_writable_region": true, "executable_section_count": 2.0, "nonstandard_section_count": 2.0, "high_complexity_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 224, "Rich" ], [ 488, "UPX0" ], [ 528, "UPX1" ], [ 568, ".rsrc" ], [ 987, "3.09" ], [ 1969, "Pxyq" ], [ 4418, "E5Q6" ], [ 5651, "HS0F" ], [ 7596, "y88m" ], [ 8640, "Ptcy" ], [ 9869, "i1jr" ], [ 11092, "/PLws" ], [ 19539, "JGjRo/t" ], [ 22590, "T5R1" ], [ 25274, "G I6" ], [ 27945, "Nloux" ], [ 30407, "TQH0W" ], [ 39086, "QPTVD6" ], [ 41587, "/ZfU" ], [ 47294, "GLHUA" ], [ 51135, "DPZH" ], [ 51473, "Ye.m" ], [ 53927, "/DrdIPf" ], [ 54062, "tr_CD)" ], [ 54439, "_uLJyln" ], [ 56079, "RQU9" ], [ 56957, "Wwni" ], [ 64365, "yy.c" ], [ 68133, "413pn" ], [ 71049, "r575o" ], [ 71427, "es33" ], [ 72369, "ZHTE" ], [ 73235, "Hfdn" ], [ 80679, "PSG9" ], [ 84201, "w49h" ], [ 86471, "4OWL" ], [ 87676, "XC1X" ], [ 88718, "T9MX" ], [ 89355, "3UFL" ], [ 91002, "AIDE" ], [ 101180, "/UZa" ], [ 103251, "Jjid" ], [ 104976, "Hdif" ], [ 106782, "6pue" ], [ 109017, "86d9r" ], [ 111741, "IT8R_" ], [ 121932, "9g8z" ], [ 125089, "d34t" ], [ 125210, "HOHR" ], [ 126340, "13XM" ], [ 126995, "/rUb" ], [ 127591, "eghr-s" ], [ 133613, "W gn" ], [ 136111, "E S9" ], [ 138166, "Xaww" ], [ 142768, "GBTN" ], [ 146969, "4I X" ], [ 150225, "ZMW2A" ], [ 155851, "B I2Z" ], [ 161229, "WB8R" ], [ 163437, "SPN2" ], [ 164292, "myTOW/i" ], [ 166503, "8 WOA" ], [ 169473, "/TAbv" ], [ 171577, "v06p" ], [ 177293, "e2\u003e-" ], [ 180537, "E.ox" ], [ 183229, "UIH6S" ], [ 185004, "WOW4" ], [ 187495, "X0HN" ], [ 187926, "Hswuq" ], [ 188578, "/453" ], [ 199956, "suxa" ], [ 211368, "WD_D2" ], [ 213169, "Lnke" ], [ 215099, "8blu" ], [ 215721, "WBOL" ], [ 217876, "/mNi6" ], [ 222327, "QCES" ], [ 223488, "Urhe" ], [ 223908, "SCL73" ], [ 230210, "C.bv" ], [ 235337, "zein" ], [ 238145, "B7HP" ], [ 239537, "8yaa" ], [ 243726, "Hxup" ], [ 245625, "G6XS" ], [ 249626, "TK25" ], [ 249676, "VBTD" ], [ 253371, "FPT9" ], [ 254067, "QCPL" ], [ 255584, "BGCB" ], [ 257088, "R1WO5" ], [ 259272, "/vwH" ], [ 259493, "KI8D" ], [ 262425, "HE0G" ], [ 264894, "OB3H" ], [ 271465, "GCYN" ], [ 273908, "WAZ6" ], [ 276991, "esqvh7" ], [ 279194, "zy8o" ], [ 280066, "N1WB9" ], [ 281320, "NPEB" ], [ 285717, "T1OM" ], [ 286375, "NOE5" ], [ 287601, "U9A8" ], [ 289809, "G1C9" ], [ 290442, "/vAR" ], [ 291118, "MSR7" ], [ 291580, "DK5B" ], [ 295743, "/uuQt" ], [ 297638, "Fdvt" ], [ 301648, "Qycg" ], [ 301876, "s57j" ], [ 305844, "AX7H" ], [ 305998, "H9UK0" ], [ 306169, "A6RF" ], [ 307560, "I5RT" ], [ 309161, "Enhf" ], [ 311929, "m.np" ], [ 313959, "IjhJf.5" ], [ 324674, "ELFQ" ], [ 329467, "GL5L" ], [ 332437, "P9Y6" ], [ 334834, "c09o" ], [ 334902, "Wqla" ], [ 339836, "Db2\u003eU2" ], [ 343214, "s54a" ], [ 344316, "T lw" ], [ 345365, "U 9I" ], [ 346080, "F82A1" ], [ 347293, "5vxe" ], [ 349398, "PA52" ], [ 351953, "2MXM" ], [ 354789, "v7g9" ], [ 355127, "|2\u003e0" ], [ 356094, "F3UN" ], [ 365827, "1762" ], [ 368148, "fo9d" ], [ 369085, "SJVI" ], [ 370175, "I.cb" ], [ 371000, "Tdin" ], [ 372536, "Jkrat" ], [ 373211, "/AeC" ], [ 377948, "GYDG" ], [ 379197, "3EHH" ], [ 387883, "z659" ], [ 392175, "TDKD" ], [ 403851, "62nw" ], [ 406513, "I_Y=" ], [ 411251, "MH72" ], [ 414964, "r7r9" ], [ 421109, "/SZa" ], [ 421277, "z9 ko" ], [ 425521, "2MNV" ], [ 431893, "R2PN" ], [ 433184, "UWVS" ], [ 436138, "XPTPSW" ], [ 437472, "wide", "IDI_MAIN_ICON" ], [ 438715, "3333330" ], [ 441657, "ha[]dlll" ], [ 441747, "[f}tttttttttt" ], [ 441845, "XwwwwwwwwwwwwwwSSSTTpNJBllll" ], [ 441894, "SSSSSSSSSSSSSSTTTTTTTTT:kK^l" ], [ 441942, "\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003cu9l" ], [ 442037, "V211111111111111111111111111" ], [ 443108, "[[[[[jxzW" ], [ 445219, "_glllll" ], [ 445253, "nhGFlllll" ], [ 445276, "[i\u003ewTTTTTTTTwpN" ], [ 445308, "[i)\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c:nK_l" ], [ 445340, "[i}\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003cwl" ], [ 447406, "[o2T\u003c\u003c\u003c\u003c\u003c\u003c\u003c11\u003ct9Ll" ], [ 449009, "IIIIIIIIIIIIIId7" ], [ 449028, "ttttttttj" ], [ 449118, "Id7(1IIIIIIIIIIII" ], [ 468143, "hex", "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU" ], [ 468335, "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB6" ], [ 468719, "DBBEBCEBBBCBBBEDDBBBDCCBBBBCBBCBBDDBCBBBCCCBCBBCBBEDBDEBCCBBCDBCEBCBCBBBBBBDCCDCCBDDDCBBD6" ], [ 468815, "EEECEEEEEBCCBCBEBEBECCBEEBCCEDECEEEDDBCDBECBEECECCECEEEBEDDBCEEBBDEEEEBBECCEDEEEEDBCECBBC6" ], [ 468911, "EEEEEEEEEEEEEEEEEEEEECDEEEEEDEECECEEEDEEEEEEEDECEDEEEEEEEECECEEECEEEBEEEECEBECCEEEEEEEEEE7" ], [ 469007, "EEEEEFEGEFFEGFGEEEEEFEGEFHFGGEEEEEGHEFFEFEEFFFEFEEEEHEGFEHEEGEEEFEEEEHEEEEEEFEEEEFGGEFFFE7" ], [ 469103, "FHHHHFGFHGFHFGEFFEFFHEFEFFFFFFFFGHHHFHGHHHFHHHHFGFGFGHGGEHFHFGGHGGGGHHFFHGHGFFEEEHHEHGHHF8" ], [ 469199, "HIHIIIKHJKKHHIHKHKHKIJKHIJHJIHIJHKJHHHHHIJIIIKHIHIIHHIKIKKKIKIJJIIHKIHKJJJIIKKHHHKHKHIIIH:" ], [ 469295, "KKKIKKKKKKKKIKIIKIKKKKKIKKKKKKKIKKKKKKKKKKIIKKKKKKIKKKKKIKKKIIKKKKIKKLKKKKKKKKIKKKKIIKKKK9" ], [ 469391, "LMLLLKKNKKNLMKKLKKLLKLKKLKNLLKLLLKKLLMKKNKLNKKNLLKLNMKKLKLKKNNMMLMLLNLKMKKLMKLKLLNKLKLNNL;" ], [ 469487, "NNNNMNNNNNLNLLNNNNLLNNLLNNLNNNNLLNLLNLNLNNLLLLNNMNLLNLLNNNNLNLNLLLNNNNLLLNLNNNNNNNLNNLLLN\u003e" ], [ 469583, "OOONOOONOQNONONOOONONONOONONNORONOQNONOOOONRNORNNQNNOOONOOOONOOOQOQONOQNNRONQNNOORNOONNNN\u003c" ], [ 469679, "RRRRRRRROORORRROOORRRORROORRRRRORRRORROOPRRRRORROORRRRRRROROROOSRRRRRRORRRRRRRROORRORRRRR\u003c" ], [ 469775, "RSSRRRRSSSRRSVRSRRRSSSSRVSSRRSRRSRSSSSSSUURSSRRRSSRSUSUSVSRSSRURSRRSSUSVURSSSSSRRVRSRRVVS=" ], [ 469871, "SSVVVVSVVTSSTVTVTSTVVVVWTSTVVWTVVVVVVVVSVSSSSSVSWSSWWVVVVSSVVVVVSVVVSVVVVVWVSSVVVWSVVSSSS@" ], [ 469967, "WVZWWWVWWZZWWWVWWWWWWVWWWYZWWWWWVWVWWVWWVZZZWWWWWWWZWZWWWVWWVZWWWWWWYYWVWWVWWWWZZZWWYVWWV@" ], [ 470063, "Z[Z[WWZZWWZZZXXZZZZWZXZZ[X[[[ZZWZZZZZWZZXWWZXZWZWZZZZZZZZZ[ZW[ZZ[ZZ[ZWWZ[[ZZWZZZZ[[WZZZZZA" ], [ 470351, "ba_`__aa_____aaaab__a_aa``ab__a__a___b__a____`___a__a______a_a_b_a__a__`_aa`a__aa_abaa``a." ], [ 470447, "abbbbbbbababbabebababbbbbbbbbbbbbbbbbabaaababbabbbbbbaabbabbaabbabbdbabbbaaabbabbabababbb." ], [ 470543, "eeebeccbefbefefeffbbbeffeecbfbeeeebefebebefbceefeceefefffffbfebeebeeebebfeebfecbbbeeecffc/" ], [ 470639, "ffiffffffffififfffffffffffffieffffffffffiifffiiffffiffiifffffffiffffffiffffffhffffffffiif/" ], [ 470735, "ijjgijggjfifjjgijijjjjigjijgjiiijijjiiiffjijjjjjjijjijijjiijiijjjiigfijjjjjijjjjjjjgijjjj0" ], [ 470831, "jjmjjjjjllllljjjkljlkjjmljljljjjkkjjjmkljjjjkjjjmljjklljljljjjkllkjmjjlljlkllmkllkklljllj1" ], [ 470927, "mmlmmlmmmmlmmmmmkmmlmmlmmmmmmmmmmmmmmmmmlmmmmlmmlmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm2" ], [ 471023, "npoppnomnomnmppnopomopommmnopmpnmonpppomopmooopmoppponpppmmpnompmompopnnompnopmmmmmoopoom2" ], [ 471119, "ppppppqpppppppppsqpqprpppppppprpqppqrrprpqspppqrppprpppprqqrppppqpppprprpqpppqppppppppppr'" ], [ 471215, "pssssssqrssssssspqssssssprqsssssssqrqssqsrrsqssrrqrsssrqsspsqqsspsqqsssspsssssqqqrrsqssss(" ], [ 471311, "vtwvtvvttstvwwvtwsvsswvtsvtsvtwstwvsssvvtsssssswvswsssswsttvsssswwsssvwstwvswvssswtvvsvvv(" ], [ 471407, "wwwwwwwwwwwwxwwwxwwwwwwwwwwtwwwwwwxwwwwwuwwwwwwxtwwwwwwwwwwwwwwwwwwxwxwwwwwwwwwwwwwxwwwww)" ], [ 471503, "xyyzzzwyzyzzzzwzwwxzzyxzzzyyzzxxzzwxxxyxxxzzzzxyyyywzzzxyyxzzxzxzxyywyzzzwxxzxzyyxzzxwzzz*" ], [ 471599, "xyyzzzwyzyzzzzwzwwxzzyxzzzyyzzxxzzwxxzz|zz|{zzz{|zzz{z{zzzzzzz|z{z{z{{z{zzzzzz{{{zzz{z{{{+" ], [ 471695, "zz{{zz|{zzzzzz|}zzzzzzzzzz{z{|zz{zzz|{}}}}{}}}}{}{}}}}{}}}}{}}}}}}}{}}{}{}}{{}}zz}}}{}}}}," ], [ 476419, "333333333333333333333333333333333333333333333333333333333333333333333" ], [ 476626, "hex", "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD" ], [ 476721, "hex", "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD" ], [ 476816, "hex", "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD" ], [ 516568, "KERNEL32.DLL" ], [ 516581, "msvcrt.dll" ], [ 516594, "LoadLibraryA" ], [ 516608, "GetProcAddress" ], [ 516624, "VirtualProtect" ], [ 516640, "VirtualAlloc" ], [ 516654, "VirtualFree" ], [ 516668, "ExitProcess" ], [ 516682, "free" ] ], "sz": 517120, "ts": [ { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "47550" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 222.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.32" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 946518507.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 86.00" ], "i": "metadata/binary/metrics/anomaly::high-complexity-marker", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 1.92" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 7.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.32" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 1.92" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "47550" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 1.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 647168.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 80384.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 435712, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "c": 0.9900000095367432, "d": "Single-function packed stub layout", "e": [ "binary.func_count = 1.00" ], "i": "well-known/malware/worm/mydoom::metric-function-count-1", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Single function with high complexity (monolithic stub)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::single-complex-function", "l": 3 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 7.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "XwwwwwwwwwwwwwwSSSTTpNJBllll" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 7.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp predates 2000", "e": [ "pe.timestamp_pre_2000 = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "l": 1 }, { "c": 0.9900000095367432, "d": "Exactly seven imports", "e": [ "binary.import_count = 7.00" ], "i": "well-known/malware/worm/mydoom::metric-import-count-7", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (free)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9900000095367432, "d": "Single-function UPX stub layout", "e": [ "UPX0", "UPX1", "binary.func_count = 1.00" ], "i": "well-known/malware/worm/mydoom::metric-function-count-1-upx-context", "l": 1 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "well-known/malware/trojan/shellobject/strings::misleading-upx-sections", "l": 1 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "c": 0.8500000238418579, "d": "High complexity but very few functions", "e": [ "binary.func_count = 1.00", "binary.avg_complexity = 86.00" ], "i": "metadata/binary/anomaly/format::high-complexity-decoy-dll", "l": 4 }, { "c": 1.0, "d": "High complexity but very few functions", "e": [ "binary.func_count = 1.00", "binary.avg_complexity = 86.00" ], "i": "objectives/evasion/decoy/binary::high-complexity-decoy-dll", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 2, "m": "B0032" }, { "a": "T1027.002", "c": 0.949999988079071, "d": "UPX dynamic loader stub", "e": [ "GetProcAddress", "UPX0", "UPX1", "VirtualAlloc", "VirtualFree", "VirtualProtect", "binary.func_count = 1.00", "pe.entry_in_nonstandard_section = 1.00" ], "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub", "l": 3, "m": "F0001" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: hex", "e": [ "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU \u003chex\u003e", "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD \u003chex\u003e" ], "i": "metadata/encoded-payload/hex", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: hex → base64", "e": [ "\u003cbinary data\u003e \u003chex+base64\u003e" ], "i": "metadata/encoded-payload/hex-base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: hex → hex", "e": [ "\u003cbinary data\u003e \u003chex+hex\u003e" ], "i": "metadata/encoded-payload/hex-hex", "l": 3 } ], "sha": "66fa33199eb2f732164220deba5bd08527735d1b21632169e977fde55fc1e3c9", "path": "47550", "type": "pe" } ], "tv": "46790" } }