{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.05050505, "class": 0 }, { "m": "az/pe", "prob": 0.0028985508, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-18T23:36:24Z" }, "path": "VirusShare_8f1e364b1c82cfa4274c60284d31edad", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "pe.checksum": "0x0005d9b0", "pe.timestamp": 1230947733, "hash.rich_header": "e8e7cb6d40250550dd4dbd0940a9fa2161b3f1e6c6467047ad38140a17272874", "build.target_arch": "x86", "pe.linker_version": "9.0", "pe.rich_header.xor_key": "0x8ac6517d", "pe.inflated_sections[0]": ".data", "pe.data_directories[0].rva": 375168, "pe.data_directories[1].rva": 372812, "pe.data_directories[2].rva": 761856, "pe.data_directories[3].rva": 348640, "pe.data_directories[4].rva": 371280, "pe.data_directories[5].rva": 348160, "pe.overflowing_sections[0]": ".text", "pe.overflowing_sections[1]": ".rdata", "pe.overflowing_sections[2]": ".data", "pe.overflowing_sections[3]": ".reloc", "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 88, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 80, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 4652, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "load_config", "pe.data_directories[4].size": 64, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 408, "pe.rich_header_compids[0].count": 20, "pe.rich_header_compids[1].count": 127, "pe.rich_header_compids[2].count": 7, "pe.rich_header_compids[3].count": 108, "pe.rich_header_compids[4].count": 40, "pe.rich_header_compids[5].count": 1, "pe.rich_header_compids[6].count": 1, "binary.top_complex_unnamed[0].cc": 2, "pe.rich_header_compids[0].compid": 9785886, "pe.rich_header_compids[1].compid": 8606238, "pe.rich_header_compids[2].compid": 9664521, "pe.rich_header_compids[3].compid": 65536, "pe.rich_header_compids[4].compid": 8671774, "pe.rich_header_compids[5].compid": 9589278, "pe.rich_header_compids[6].compid": 9523742, "binary.top_complex_unnamed[0].bbs": 4, "pe.rich_header_compids[3].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x1001000", "binary.top_complex_unnamed[0].size": 266, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 20, "pe.rich_header.entries[1].use_count": 127, "pe.rich_header.entries[2].use_count": 7, "pe.rich_header.entries[3].use_count": 108, "pe.rich_header.entries[4].use_count": 40, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 149, "pe.rich_header.entries[1].product_id": 131, "pe.rich_header.entries[2].product_id": 147, "pe.rich_header.entries[3].product_id": 1, "pe.rich_header.entries[4].product_id": 132, "pe.rich_header.entries[5].product_id": 146, "pe.rich_header.entries[6].product_id": 145, "pe.rich_header.entries[0].build_number": 21022, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 21022, "pe.rich_header.entries[1].product_name": "C_VS2008_LTCG", "pe.rich_header.entries[2].build_number": 30729, "pe.rich_header.entries[2].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[3].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[4].build_number": 21022, "pe.rich_header.entries[4].product_name": "Cpp_VS2008_LTCG", "pe.rich_header.entries[5].build_number": 21022, "pe.rich_header.entries[5].product_name": "Linker_VS2008_LTCG", "pe.rich_header.entries[6].build_number": 21022, "pe.rich_header.entries[6].product_name": "Linker_VS2008", "pe.section_characteristics[0].raw_size": 340992, "pe.section_characteristics[1].raw_size": 27136, "pe.section_characteristics[2].raw_size": 5120, "pe.section_characteristics[3].raw_size": 8192, "pe.section_characteristics[0].virtual_size": 340986, "pe.section_characteristics[1].virtual_size": 27096, "pe.section_characteristics[2].virtual_size": 381672, "pe.section_characteristics[3].virtual_size": 7924, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 348160, "pe.section_characteristics[2].virtual_address": 376832, "pe.section_characteristics[3].virtual_address": 761856, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "42000040" }, "x": 4, "id": 0, "ms": { "pe": { "entry": 285048.0, "machine": 332.0, "checksum": 383408.0, "subsystem": 2.0, "timestamp": 1230947733.0, "image_base": 16777216.0, "has_checksum": true, "entry_section": ".text", "size_of_image": 770048.0, "file_alignment": 512.0, "characteristics": 8450.0, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 0.0, "computed_checksum": 309509.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 64.0, "has_export_timestamp": false, "linker_major_version": 9.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "section_raw_overflow_count": 4.0, "max_section_inflation_ratio": 74.55 }, "file": { "size": 288819.0 }, "binary": { "code_size": 340992.0, "func_count": 2.0, "code_entropy": 6.58, "func_density": 0.01, "string_count": 572.0, "avg_func_size": 242633.0, "section_count": 4.0, "avg_complexity": 1.5, "max_complexity": 2.0, "string_density": 1.72, "overall_entropy": 1.65, "avg_basic_blocks": 6.0, "avg_section_size": 95360.0, "entropy_variance": 2.85, "avg_string_length": 5.96, "complexity_per_kb": 0.01, "max_string_length": 40.0, "avg_string_entropy": 1.63, "code_to_data_ratio": 8.43, "data_to_file_ratio": 0.02, "text_to_file_ratio": 1.18, "total_basic_blocks": 12.0, "func_analysis_depth": 2.0, "string_length_stddev": 2.4, "largest_section_ratio": 1.18, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "writable_section_count": 1.0, "executable_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 464, ".text" ], [ 543, "@.data" ], [ 584, ".reloc" ], [ 1256, "M7H3" ], [ 1534, "UWATH" ], [ 1980, "tteeww" ], [ 2060, "qqiigg" ], [ 2169, "eeqq" ], [ 2262, "wwppee" ], [ 2481, "zzii" ], [ 3085, "tteeb" ], [ 3612, "jjkkuutt" ], [ 3796, "pu6ee" ], [ 4378, "oozztt" ], [ 4471, "iicc" ], [ 4679, "Qccc" ], [ 5046, "qqttee" ], [ 5103, "zzuu" ], [ 5924, "iiggsszzpp" ], [ 6063, "wwqqjjnn" ], [ 6474, "eeii" ], [ 7154, "bqqffqq" ], [ 7952, "ttoobb" ], [ 8067, "wwnnii" ], [ 8398, "iiww" ], [ 8426, "jjnnii" ], [ 9551, "qquu" ], [ 9569, "iitt" ], [ 9884, "ccii" ], [ 9965, "eeppzz" ], [ 10094, "ffuu" ], [ 10564, "ttbbooww" ], [ 10654, "iiee" ], [ 11530, "wwee" ], [ 12217, "wwjjggzz" ], [ 12718, "ggwwee" ], [ 12814, "yyuu" ], [ 13037, "ssooww" ], [ 13554, "eeww" ], [ 13618, "cceeyyT" ], [ 14707, "wwccii" ], [ 15141, "eeoo" ], [ 15283, "ppii" ], [ 15506, "nnii" ], [ 15533, "yyii" ], [ 15809, "iisstt" ], [ 15993, "ettiijj" ], [ 16325, "bbee" ], [ 17018, "iiuu" ], [ 17306, "eecc" ], [ 18674, "Qujj" ], [ 18919, ".wtt" ], [ 18983, "yyeeee" ], [ 19088, "zzjjffwwpJ" ], [ 19127, "ffiiw" ], [ 19258, "eegg" ], [ 19948, "iiss" ], [ 20222, "eejj" ], [ 20311, "ffii" ], [ 20487, "ppiie" ], [ 22188, "qqccttqqoo" ], [ 22216, "eezz" ], [ 22412, "eenn" ], [ 23054, "oonncc" ], [ 23166, "kkbbee" ], [ 23190, "ggzzwwee" ], [ 24405, "ssii" ], [ 24484, "nnwwii" ], [ 24592, "zzqqiiee" ], [ 26200, "Jyggqqqq" ], [ 26234, "uuee8" ], [ 26465, "Ztoo" ], [ 26720, "xor", "55UUUU:://" ], [ 27046, "zwii" ], [ 28262, "F%ggtt" ], [ 28321, "Pjzz" ], [ 28550, "eekk" ], [ 28999, "wweez" ], [ 29518, "Nuss" ], [ 29589, "zppee" ], [ 30073, "ssee" ], [ 30125, "qqee" ], [ 30155, "Kjjyy" ], [ 30653, "@USVWATAUAVH" ], [ 31094, "Kigg" ], [ 31248, "qqoonnjj" ], [ 31410, "jjttee" ], [ 31632, "gguu" ], [ 32146, "nnqqjjb" ], [ 32903, "``ee``" ], [ 33036, "9yqffii" ], [ 33143, "bbuu" ], [ 33182, "iikk" ], [ 33887, "qqii" ], [ 35114, "qqoo" ], [ 36135, "eeuu" ], [ 36207, "Gwwssff" ], [ 36506, "WHCLH" ], [ 38139, "uuiiffiiqq" ], [ 38328, "iifft" ], [ 38555, "iiyyzz" ], [ 38778, "qqcckknn6n)I" ], [ 39055, "kkii" ], [ 39163, "Nccjj" ], [ 39352, "ffooqq" ], [ 39597, ".jqq" ], [ 40042, "Oppgg" ], [ 40161, "ppee" ], [ 40712, "jwwoo" ], [ 40869, "wwzzssyy" ], [ 41742, "iijj" ], [ 41824, "cciiii" ], [ 42104, "eeyy" ], [ 42112, "qqeeuz" ], [ 42344, "Beur" ], [ 43930, "eewwbb\\y$V[" ], [ 44094, "qqwwee" ], [ 44393, "wwii" ], [ 44677, "jjuunn" ], [ 45153, "tteeyytt" ], [ 45357, "nniiee" ], [ 45770, "iieeyy" ], [ 46535, "zzkkwwuu" ], [ 47404, "HKXY" ], [ 47425, "iigg" ], [ 47699, "jjee" ], [ 47784, "ttii" ], [ 49103, "oowwqqcc" ], [ 49602, "iigguu" ], [ 49657, "EY9R" ], [ 49973, "qqoozqt" ], [ 50750, "ttnneeuuc" ], [ 51024, "ssoo" ], [ 51956, "H08H" ], [ 52196, "HPHDL" ], [ 52726, "jjuu" ], [ 53466, ".uzz" ], [ 53772, "ppeeee4" ], [ 53995, "Tqccyy" ], [ 54103, "wwjjiiww" ], [ 54487, "Tinn" ], [ 54830, "TLEN" ], [ 55462, "eezzcc" ], [ 55672, "ggii" ], [ 55824, "oozzgg" ], [ 56597, "EH80" ], [ 56862, "iizzpp" ], [ 57383, "2eezz" ], [ 57624, "iissee" ], [ 58226, "fzzuugg" ], [ 58432, "ccee" ], [ 59236, "zzttjEw" ], [ 59384, "H_HH" ], [ 60634, "Zeff" ], [ 61719, "iizzss" ], [ 61860, "Rccuu" ], [ 61950, "kkiicc" ], [ 62230, "ffee" ], [ 63080, "ggttppjj" ], [ 63159, "o2 ff" ], [ 63195, "jjoo" ], [ 63731, "GXHH6" ], [ 63883, "jjqqffcc" ], [ 64013, "iizz" ], [ 64252, "uul1" ], [ 64303, "ttuu" ], [ 64524, "eebb" ], [ 65102, "zz1u" ], [ 65243, "kkee" ], [ 65925, "eeqqtt" ], [ 66149, "nneezz" ], [ 66448, "oozzzz" ], [ 66510, "wwuu" ], [ 66981, "tttteeff" ], [ 67006, "eetttt" ], [ 67944, "sjjsstt" ], [ 68145, "eejjyy" ], [ 68306, "jjii" ], [ 68539, "s3b1" ], [ 68782, "eeggff" ], [ 69217, "SVWU" ], [ 69234, ".kooqq" ], [ 70157, "ggiiuu" ], [ 70698, "ccoo" ], [ 71227, "ccssuu" ], [ 71796, "HHHD" ], [ 71971, "yyoo" ], [ 72101, "eezzyy" ], [ 72631, "eewwoo" ], [ 72740, "cckkoo" ], [ 72877, "iijjgg" ], [ 73238, "uukkpp" ], [ 73474, "ttzzkkoo" ], [ 73539, "oowwssqq" ], [ 73804, "peinn" ], [ 74138, "iissgg" ], [ 74671, "eeccyy" ], [ 74752, "Oymgg" ], [ 75016, "zzqqeegg" ], [ 75567, "Cqqww" ], [ 75588, "ttee" ], [ 75653, "nnwwoo" ], [ 76942, "eecc0" ], [ 77125, "oojjqqt" ], [ 77242, "iiqq" ], [ 78568, "HMLU" ], [ 79077, "jjjjjjzzuu" ], [ 79467, "ppeeyyN" ], [ 79794, "zzwwzzX" ], [ 79885, "kkeett" ], [ 80055, "oosszz" ], [ 80411, "ggwwii" ], [ 81486, "wwuutt" ], [ 82470, "=Wtj$zzwwqq" ], [ 83431, "jjoozz" ], [ 84069, "yyzzuu" ], [ 84225, "uussjj" ], [ 84637, "ssjjuu" ], [ 84734, "tttccnn" ], [ 84774, "wwii7" ], [ 85802, "bbiiee" ], [ 86131, "qewwnn" ], [ 86239, "iejj" ], [ 88475, "ttcc8o" ], [ 90732, "wXcceeqq" ], [ 90791, "bboopp" ], [ 90981, "hjjoouu" ], [ 92040, "Ftnq" ], [ 92183, "Kzii" ], [ 92423, "zzoo" ], [ 92440, "eett" ], [ 92487, "nneewwbb" ], [ 92760, "eebby" ], [ 92851, "nnffwwjj" ], [ 93250, "wweess" ], [ 93301, "nnppnnqqkk" ], [ 93551, "ggoo8" ], [ 93636, "iikkww" ], [ 93940, "zzwwqqww" ], [ 94341, "kgguu" ], [ 94387, "ppeeqq" ], [ 94955, "HMH0" ], [ 95615, "qqcczzcU" ], [ 96031, "qqzzqqcc" ], [ 96218, "wwwwnntt" ], [ 96763, "eejjzz" ], [ 97002, "iijjww" ], [ 99318, "eeccpp" ], [ 99647, "zzee" ], [ 99662, "V qgg" ], [ 100113, "DLH3" ], [ 100705, "ssjjzzbb" ], [ 100759, "Azztt" ], [ 101003, "Ejjnn" ], [ 101889, "jjuunnooqq" ] ], "sz": 288819, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1230947733.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.50" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 770048.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 0.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8399999737739563, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8450.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_8f1e364b1c82cfa4274c60284d31edad" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.02" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8600000143051147, "d": "Extremely large average function size", "e": [ "binary.avg_func_size = 242633.00" ], "i": "metadata/binary/metrics/structural::giant-average-function", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 1.63" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_func_size = 242633.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 572.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "49", "46" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.58)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 74.55" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".reloc (size: 8192, entropy: 0.00, perms: r--)", ".rdata (size: 27136, entropy: 0.00, perms: r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.58" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 0.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "49" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 1.18" ], "i": "metadata/binary/metrics/structural::section-exceeds-file-size", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.18" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 0.00)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload/compression::gzip-magic", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 0.8999999761581421, "d": "Import count is exactly zero", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 1.65" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5120)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 1.63" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 1.65" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 0.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.75, "d": "Text section dominates file", "e": [ "binary.text_to_file_ratio = 1.18" ], "i": "metadata/binary/layout::text-section-dominates-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Average function size over 50KB", "e": [ "binary.avg_func_size = 242633.00" ], "i": "metadata/binary/metrics/pe-details::extremely-large-avg-function", "l": 2 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with single import", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 0.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.50" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.18" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.18" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" } ], "sha": "6858a4a2c20e24d03a2e14b5347b44a125eeb0a9bc6c2cb710bf1e14eb495557", "path": "/data/samples/bad/datasets/various/VirusShare/VirusShare_8f1e364b1c82cfa4274c60284d31edad", "type": "pe" } ], "tv": "012f9" } }