{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9606188535690308, "class": 0 } ], "prob": 0.96061885, "class": 0, "models": [ { "m": "az", "prob": 0.96061885, "class": 0 }, { "m": "az/native", "prob": 0.774942, "class": 0 }, { "m": "az/pe", "prob": 0.34715027, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-12T13:48:35Z" }, "path": "482913", "raw": { "v": "4", "fs": [ { "f": "O₅(CAsDyErEu)H₃(CmCrPo₃)Md(Si)", "k": { "hash.imp": "eea5ed0e04c30f48e2794c3f2581942e", "pe.timestamp": 1523357078, "hash.authenti": "5060d13e9fe2e5d9acfdab2f7c254b22b29555196c2e09ad36ea3641ba6402fa", "hash.rich_header": "36d660406ec8bfd077143783bd4090dd2e06ea9dcb7f8c4714bb36444ce04a14", "build.target_arch": "x86", "pe.linker_version": "12.0", "pe.resource_types[0]": "RT_MANIFEST", "pe.rich_header.xor_key": "0xc6cc7ca0", "pe.data_directories[0].rva": 258908, "pe.data_directories[1].rva": 290816, "pe.data_directories[2].rva": 294912, "pe.data_directories[3].rva": 242032, "pe.data_directories[4].rva": 208896, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 480, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12188, "pe.data_directories[3].name": "load_config", "pe.data_directories[3].size": 64, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 456, "pe.load_config.security_cookie": "0x43cde0", "pe.rich_header_compids[0].count": 1, "pe.rich_header_compids[1].count": 33, "pe.rich_header_compids[2].count": 132, "pe.rich_header_compids[3].count": 200, "pe.rich_header_compids[4].count": 15, "pe.rich_header_compids[5].count": 172, "pe.rich_header_compids[6].count": 6, "pe.rich_header_compids[7].count": 1, "pe.rich_header_compids[8].count": 1, "binary.top_complex_unnamed[0].cc": 384, "binary.top_complex_unnamed[1].cc": 121, "binary.top_complex_unnamed[2].cc": 111, "binary.top_complex_unnamed[3].cc": 89, "binary.top_complex_unnamed[4].cc": 89, "binary.top_complex_unnamed[5].cc": 65, "binary.top_complex_unnamed[6].cc": 57, "binary.top_complex_unnamed[7].cc": 52, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 13696989, "pe.rich_header_compids[1].compid": 14635334, "pe.rich_header_compids[2].compid": 14766406, "pe.rich_header_compids[3].compid": 14700870, "pe.rich_header_compids[4].compid": 13369309, "pe.rich_header_compids[5].compid": 65536, "pe.rich_header_compids[6].compid": 15028749, "pe.rich_header_compids[7].compid": 14373389, "pe.rich_header_compids[8].compid": 14569997, "binary.top_complex_unnamed[0].bbs": 436, "binary.top_complex_unnamed[1].bbs": 196, "binary.top_complex_unnamed[2].bbs": 190, "binary.top_complex_unnamed[3].bbs": 83, "binary.top_complex_unnamed[4].bbs": 83, "binary.top_complex_unnamed[5].bbs": 107, "binary.top_complex_unnamed[6].bbs": 108, "binary.top_complex_unnamed[7].bbs": 106, "pe.rich_header_compids[5].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x40dd48", "binary.top_complex_unnamed[0].size": 5878, "binary.top_complex_unnamed[1].addr": "0x42a3de", "binary.top_complex_unnamed[1].size": 1912, "binary.top_complex_unnamed[2].addr": "0x42ab86", "binary.top_complex_unnamed[2].size": 2516, "binary.top_complex_unnamed[3].addr": "0x407b40", "binary.top_complex_unnamed[3].size": 1604, "binary.top_complex_unnamed[4].addr": "0x408850", "binary.top_complex_unnamed[4].size": 1604, "binary.top_complex_unnamed[5].addr": "0x4202f6", "binary.top_complex_unnamed[5].size": 2149, "binary.top_complex_unnamed[6].addr": "0x42b603", "binary.top_complex_unnamed[6].size": 770, "binary.top_complex_unnamed[7].addr": "0x4298fa", "binary.top_complex_unnamed[7].size": 1394, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.section_characteristics[4].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 33, "pe.rich_header.entries[2].use_count": 132, "pe.rich_header.entries[3].use_count": 200, "pe.rich_header.entries[4].use_count": 15, "pe.rich_header.entries[5].use_count": 172, "pe.rich_header.entries[6].use_count": 6, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[0].product_id": 208, "pe.rich_header.entries[1].product_id": 223, "pe.rich_header.entries[2].product_id": 225, "pe.rich_header.entries[3].product_id": 224, "pe.rich_header.entries[4].product_id": 203, "pe.rich_header.entries[5].product_id": 1, "pe.rich_header.entries[6].product_id": 229, "pe.rich_header.entries[7].product_id": 219, "pe.rich_header.entries[8].product_id": 222, "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[0].build_number": 65501, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 20806, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 20806, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 20806, "pe.rich_header.entries[3].product_name": "Cvtres_VS2012", "pe.rich_header.entries[4].build_number": 65501, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[6].build_number": 21005, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 21005, "pe.rich_header.entries[7].product_name": "C_VS2012", "pe.rich_header.entries[8].build_number": 21005, "pe.rich_header.entries[8].product_name": "Linker_VS2012_LTCG", "pe.section_characteristics[0].raw_size": 202240, "pe.section_characteristics[1].raw_size": 52736, "pe.section_characteristics[2].raw_size": 10240, "pe.section_characteristics[3].raw_size": 512, "pe.section_characteristics[4].raw_size": 12288, "pe.section_characteristics[0].virtual_size": 202124, "pe.section_characteristics[1].virtual_size": 52710, "pe.section_characteristics[2].virtual_size": 28044, "pe.section_characteristics[3].virtual_size": 480, "pe.section_characteristics[4].virtual_size": 12188, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 208896, "pe.section_characteristics[2].virtual_address": 262144, "pe.section_characteristics[3].virtual_address": 290816, "pe.section_characteristics[4].virtual_address": 294912, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 50, "id": 0, "is": [ "LoadLibraryW", "Sleep", "GetProcAddress", "VirtualAlloc", "WriteProcessMemory", "WriteConsoleW", "SetStdHandle", "CreateFileW", "GetModuleFileNameW", "WideCharToMultiByte", "CloseHandle", "GetLastError", "GetCurrentProcess", "LocalFree", "TlsAlloc", "SetFilePointerEx", "GetConsoleMode", "GetConsoleCP", "FlushFileBuffers", "UnregisterWaitEx", "QueryDepthSList", "InterlockedFlushSList", "InterlockedPushEntrySList", "InterlockedPopEntrySList", "InitializeSListHead", "ReleaseSemaphore", "VirtualProtect", "VirtualFree", "MultiByteToWideChar", "GetStringTypeW", "DuplicateHandle", "WaitForSingleObject", "GetCurrentThread", "GetCurrentThreadId", "GetExitCodeThread", "EncodePointer", "DecodePointer", "EnterCriticalSection", "LeaveCriticalSection", "DeleteCriticalSection", "GetSystemTimeAsFileTime", "HeapFree", "HeapAlloc", "GetCommandLineA", "RaiseException", "RtlUnwind", "GetCPInfo", "IsProcessorFeaturePresent", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "SetLastError", "InitializeCriticalSectionAndSpinCount", "CreateEventW", "TerminateProcess", "VirtualQuery", "TlsGetValue", "TlsSetValue", "TlsFree", "GetStartupInfoW", "GetTickCount", "GetModuleHandleW", "CreateSemaphoreW", "CreateThread", "ExitThread", "LoadLibraryExW", "CreateTimerQueue", "SetEvent", "WaitForSingleObjectEx", "SignalObjectAndWait", "SwitchToThread", "SetThreadPriority", "GetThreadPriority", "GetLogicalProcessorInformation", "CreateTimerQueueTimer", "ChangeTimerQueueTimer", "DeleteTimerQueueTimer", "GetNumaHighestNodeNumber", "GetProcessAffinityMask", "SetThreadAffinityMask", "RegisterWaitForSingleObject", "UnregisterWait", "LCMapStringW", "GetLocaleInfoW", "IsValidLocale", "GetUserDefaultLCID", "EnumSystemLocalesW", "ExitProcess", "GetModuleHandleExW", "HeapSize", "GetProcessHeap", "GetStdHandle", "WriteFile", "GetFileType", "GetModuleFileNameA", "QueryPerformanceCounter", "GetCurrentProcessId", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "IsDebuggerPresent", "IsValidCodePage", "GetACP", "GetOEMCP", "HeapReAlloc", "OutputDebugStringW", "GetThreadTimes", "FreeLibrary", "FreeLibraryAndExitThread", "GetModuleHandleA", "GetVersionExW", "CreateWindowExW", "ORDINAL 9" ], "ms": { "pe": { "entry": 34504.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 512.0, "subsystem": 2.0, "timestamp": 1523357078.0, "image_base": 4194304.0, "has_manifest": true, "rsrc_entropy": 4.71, "entry_section": ".text", "size_of_image": 307200.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_MANIFEST" ], "characteristics": 258.0, "has_rich_header": true, "security_cookie": 4443616.0, "size_of_headers": 1024.0, "export_timestamp": 0.0, "import_dll_count": 3.0, "computed_checksum": 302215.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 33088.0, "has_export_timestamp": false, "linker_major_version": 12.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "api_hashing_indicator_count": 1.0 }, "file": { "size": 279040.0 }, "binary": { "code_size": 202240.0, "func_count": 1465.0, "code_entropy": 6.64, "data_entropy": 4.62, "func_density": 7.42, "import_count": 111.0, "string_count": 807.0, "avg_func_size": 275.21, "section_count": 5.0, "avg_complexity": 5.04, "import_density": 0.56, "max_complexity": 384.0, "string_density": 4.09, "overall_entropy": 5.42, "avg_basic_blocks": 7.86, "avg_section_size": 55603.2, "dependency_count": 3.0, "entropy_variance": 0.95, "avg_string_length": 18.29, "complexity_per_kb": 0.03, "max_string_length": 244.0, "wide_string_count": 229.0, "avg_string_entropy": 3.17, "code_to_data_ratio": 2.67, "data_to_file_ratio": 0.04, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.72, "total_basic_blocks": 11515.0, "func_analysis_depth": 2.0, "string_length_stddev": 16.51, "largest_section_ratio": 0.72, "sentence_string_count": 114.0, "sentence_string_ratio": 0.14, "writable_section_count": 1.0, "behavioral_import_ratio": 0.05, "executable_section_count": 1.0, "high_entropy_string_count": 3.0, "high_complexity_func_count": 9.0, "unnamed_complex_func_count": 9.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".rsrc" ], [ 647, "@.reloc" ], [ 37784, "PRSW" ], [ 39441, "QQSV" ], [ 40117, "YYPW" ], [ 40229, "8RCC" ], [ 40237, "8MOC" ], [ 41564, "WVPS" ], [ 59640, "SVW3" ], [ 60567, "5ntel" ], [ 62458, "PSQR" ], [ 67426, "PSSV" ], [ 68482, "FVWPP" ], [ 68520, "SVWPP" ], [ 69994, "v6j0" ], [ 70179, "PRSQ" ], [ 71276, "PSVW" ], [ 72072, "SVAW" ], [ 72964, "9E W" ], [ 73544, "5XXD" ], [ 75637, "f90t" ], [ 75670, "f97t" ], [ 75715, "QSVW" ], [ 80012, "f90u" ], [ 80030, "RVSQSWV" ], [ 86613, "GDQSP" ], [ 86681, "OHPSQ" ], [ 86998, "OHSSVSSW" ], [ 94682, "QQS3" ], [ 96616, "5LZD" ], [ 97465, "QVW3" ], [ 99465, "QQSVW" ], [ 101045, "5T0C" ], [ 110605, "NHB3" ], [ 112845, "QQVW" ], [ 115730, "UVWS" ], [ 117369, "UQPXY]Y[" ], [ 117929, "PWWWWV" ], [ 118084, "PSSSSV" ], [ 118560, "WVU3" ], [ 119668, "/PjSW" ], [ 138897, "9vdu" ], [ 166972, "Huzj" ], [ 170876, "HAO8" ], [ 179092, "KHVW3" ], [ 188914, "PRQW" ], [ 196750, "SVWU" ], [ 197304, "8SVW" ], [ 203952, "address not available" ], [ 203976, "already connected" ], [ 203996, "argument list too long" ], [ 204020, "argument out of domain" ], [ 204044, "bad address" ], [ 204056, "bad file descriptor" ], [ 204076, "bad message" ], [ 204088, "broken pipe" ], [ 204100, "connection aborted" ], [ 204120, "connection already in progress" ], [ 204152, "connection refused" ], [ 204172, "connection reset" ], [ 204192, "destination address required" ], [ 204224, "executable format error" ], [ 204248, "file too large" ], [ 204264, "host unreachable" ], [ 204284, "identifier removed" ], [ 204304, "illegal byte sequence" ], [ 204328, "inappropriate io control operation" ], [ 204364, "invalid seek" ], [ 204380, "is a directory" ], [ 204396, "message size" ], [ 204412, "network down" ], [ 204428, "network reset" ], [ 204444, "network unreachable" ], [ 204464, "no buffer space" ], [ 204480, "no child process" ], [ 204500, "no link" ], [ 204508, "no message available" ], [ 204532, "no message" ], [ 204544, "no protocol option" ], [ 204564, "no stream resources" ], [ 204584, "no such device or address" ], [ 204612, "no such process" ], [ 204628, "not a directory" ], [ 204644, "not a socket" ], [ 204660, "not a stream" ], [ 204676, "not connected" ], [ 204692, "not supported" ], [ 204708, "operation in progress" ], [ 204732, "operation not permitted" ], [ 204756, "operation not supported" ], [ 204780, "operation would block" ], [ 204804, "owner dead" ], [ 204816, "protocol error" ], [ 204832, "protocol not supported" ], [ 204856, "read only file system" ], [ 204880, "resource deadlock would occur" ], [ 204912, "result out of range" ], [ 204932, "state not recoverable" ], [ 204956, "stream timeout" ], [ 204972, "text file busy" ], [ 204988, "timed out" ], [ 205000, "too many files open in system" ], [ 205032, "too many links" ], [ 205048, "too many symbolic link levels" ], [ 205080, "value too large" ], [ 205096, "wrong protocol type" ], [ 206352, "permission denied" ], [ 206372, "file exists" ], [ 206384, "no such device" ], [ 206400, "filename too long" ], [ 206420, "device or resource busy" ], [ 206444, "io error" ], [ 206456, "directory not empty" ], [ 206476, "invalid argument" ], [ 206496, "no space on device" ], [ 206516, "no such file or directory" ], [ 206544, "function not supported" ], [ 206568, "no lock available" ], [ 206588, "not enough memory" ], [ 206608, "resource unavailable try again" ], [ 206640, "cross device link" ], [ 206660, "operation canceled" ], [ 206680, "too many files open" ], [ 206700, "permission_denied" ], [ 206720, "address_in_use" ], [ 206736, "address_not_available" ], [ 206760, "address_family_not_supported" ], [ 206792, "connection_already_in_progress" ], [ 206824, "bad_file_descriptor" ], [ 206844, "connection_aborted" ], [ 206864, "connection_refused" ], [ 206884, "connection_reset" ], [ 206904, "destination_address_required" ], [ 206936, "bad_address" ], [ 206948, "host_unreachable" ], [ 206968, "operation_in_progress" ], [ 206992, "interrupted" ], [ 207004, "invalid_argument" ], [ 207024, "already_connected" ], [ 207044, "too_many_files_open" ], [ 207064, "message_size" ], [ 207080, "filename_too_long" ], [ 207100, "network_down" ], [ 207116, "network_reset" ], [ 207132, "network_unreachable" ], [ 207152, "no_buffer_space" ], [ 207168, "no_protocol_option" ], [ 207188, "not_connected" ], [ 207204, "not_a_socket" ], [ 207220, "operation_not_supported" ], [ 207244, "protocol_not_supported" ], [ 207268, "wrong_protocol_type" ], [ 207288, "timed_out" ], [ 207300, "operation_would_block" ], [ 207324, "address family not supported" ], [ 207356, "address in use" ], [ 207496, "bad allocation" ], [ 207832, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 208220, "Unknown exception" ], [ 208336, "bad exception" ], [ 209800, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 210184, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 210408, "wide", "kernel32.dll" ], [ 210436, "FlsAlloc" ], [ 210448, "FlsFree" ], [ 210456, "FlsGetValue" ], [ 210468, "FlsSetValue" ], [ 210480, "InitializeCriticalSectionEx" ], [ 210508, "CreateEventExW" ], [ 210524, "CreateSemaphoreExW" ], [ 210544, "SetThreadStackGuarantee" ], [ 210568, "CreateThreadpoolTimer" ], [ 210592, "SetThreadpoolTimer" ], [ 210612, "WaitForThreadpoolTimerCallbacks" ], [ 210644, "CloseThreadpoolTimer" ], [ 210668, "CreateThreadpoolWait" ], [ 210692, "SetThreadpoolWait" ], [ 210712, "CloseThreadpoolWait" ], [ 210732, "FlushProcessWriteBuffers" ], [ 210760, "FreeLibraryWhenCallbackReturns" ], [ 210792, "GetCurrentProcessorNumber" ], [ 210820, "GetLogicalProcessorInformation" ], [ 210852, "CreateSymbolicLinkW" ], [ 210872, "SetDefaultDllDirectories" ], [ 210900, "EnumSystemLocalesEx" ], [ 210920, "CompareStringEx" ], [ 210936, "GetDateFormatEx" ], [ 210952, "GetLocaleInfoEx" ], [ 210968, "GetTimeFormatEx" ], [ 210984, "GetUserDefaultLocaleName" ], [ 211012, "IsValidLocaleName" ], [ 211032, "LCMapStringEx" ], [ 211048, "GetCurrentPackageId" ], [ 211068, "GetTickCount64" ], [ 211084, "GetFileInformationByHandleExW" ], [ 211116, "SetFileInformationByHandleW" ], [ 211144, "RoInitialize" ], [ 211160, "wide", "combase.dll" ], [ 211184, "RoUninitialize" ], [ 211212, "Lock already taken" ], [ 211396, "pEvents" ], [ 211416, "SetThreadGroupAffinity" ], [ 211440, "GetThreadGroupAffinity" ], [ 211464, "GetCurrentProcessorNumberEx" ], [ 211492, "GetLogicalProcessorInformationEx" ], [ 218004, "wide", "az-az-cyrl" ], [ 218028, "wide", "az-az-latn" ], [ 218088, "wide", "bs-ba-latn" ], [ 218220, "wide", "div-mv" ], [ 218956, "wide", "kok-in" ], [ 219224, "wide", "quz-bo" ], [ 219240, "wide", "quz-ec" ], [ 219256, "wide", "quz-pe" ], [ 219368, "wide", "sma-no" ], [ 219384, "wide", "sma-se" ], [ 219400, "wide", "smj-no" ], [ 219416, "wide", "smj-se" ], [ 219432, "wide", "smn-fi" ], [ 219448, "wide", "sms-fi" ], [ 219476, "wide", "sr-ba-cyrl" ], [ 219500, "wide", "sr-ba-latn" ], [ 219524, "wide", "sr-sp-cyrl" ], [ 219548, "wide", "sr-sp-latn" ], [ 219608, "wide", "syr-sy" ], [ 219720, "wide", "uz-uz-cyrl" ], [ 219744, "wide", "uz-uz-latn" ], [ 219792, "wide", "zh-chs" ], [ 219808, "wide", "zh-cht" ], [ 219896, "wide", "mscoree.dll" ], [ 219920, "CorExitProcess" ], [ 219944, "asin" ], [ 219952, "acos" ], [ 219960, "atan" ], [ 219968, "atan2" ], [ 219996, "ceil" ], [ 220004, "floor" ], [ 220044, "_hypot" ], [ 220088, "_nextafter" ], [ 220112, "log10" ], [ 220318, "wide", "CR6002\r\n- floating point support not loaded" ], [ 220416, "wide", "R6008\r\n- not enough space for arguments" ], [ 220504, "wide", "R6009\r\n- not enough space for environment" ], [ 220592, "wide", "R6010\r\n- abort() has been called" ], [ 220664, "wide", "R6016\r\n- not enough space for thread data" ], [ 220752, "wide", "R6017\r\n- unexpected multithread lock error" ], [ 220848, "wide", "R6018\r\n- unexpected heap error" ], [ 220920, "wide", "R6019\r\n- unable to open console device" ], [ 221008, "wide", "R6024\r\n- not enough space for _onexit/atexit table" ], [ 221120, "wide", "R6025\r\n- pure virtual function call" ], [ 221200, "wide", "R6026\r\n- not enough space for stdio initialization" ], [ 221312, "wide", "R6027\r\n- not enough space for lowio initialization" ], [ 221424, "wide", "R6028\r\n- unable to initialize heap" ] ], "sz": 279040, "ts": [ { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 111.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "482913" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 807.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "a": "T1567", "c": 0.800000011920929, "d": "Google Drive domain", "e": [ "https://drive.google.com/uc?authuser=0\u0026id=1IUx5J…" ], "i": "objectives/exfiltration/cloud/object-store::gdrive-domain", "l": 3, "m": "E1567" }, { "c": 0.75, "d": "CreateTimerQueue import (rare, common padding symbol)", "e": [ "CreateTimerQueue" ], "i": "metadata/binary/anomaly/format::import-padding-timer-queue", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 111.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically pop entry from thread-safe list", "e": [ "InterlockedPopEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-pop-entry-slist", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.9800000190734863, "d": "DarkGate embedded C2 endpoint 12.114.130.55:45834", "e": [ "12.114.130.55:45834" ], "i": "well-known/malware/trojan/darkgate::c2-ip-45834", "l": 1 }, { "a": "T1622", "c": 0.8999999761581421, "d": "combase.dll resolved at runtime", "e": [ "combase.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::combase-runtime-resolve-string", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 11515.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.9900000095367432, "d": "HTTP/HTTPS URL parsing regular expression", "e": [ "https://drive.google.com/uc?authuser=0\u0026id=1IUx5JU9yRLMeiHHXkYBV-IxgCRPtMKcC\u0026export=download" ], "i": "objectives/command-and-control/dropper/elex-loader::url-parsing-regex", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.04" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.04" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.17" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.17" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.64" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 111.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "https://drive.google.com/uc?authuser=0\u0026id=1IUx5JU9yRLMeiHHXkYBV-IxgCRPtMKcC\u0026export=download" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ ".?AVResourceManager@details@Concurrency@@", ".?AUIResourceManager@Concurrency@@" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 307200.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "OHSSVSSW" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "Badvapi32.dll" ], "i": "metadata/binary/symbols/imports::imports-advapi32-dll", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LCMapStringEx", "CompareStringEx", "string too long", "FreeEnvironmentStringsW", "OutputDebugStringW", "GetEnvironmentStringsW", "invalid string position", "LCMapStringW", "GetStringTypeW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8500000238418579, "d": "Writable user path fragment", "e": [ "%appdata%" ], "i": "objectives/persistence/system/registry/com::writable-user-path-fragment", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.64)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Atomically push entry to thread-safe list", "e": [ "InterlockedPushEntrySList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-push-entry-slist", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 1465.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 10240)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 1465.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1523357078.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise thread execution priority", "e": [ "SetThreadPriority" ], "i": "micro-behaviors/process/thread/priority::set-thread-priority", "l": 3 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.6000000238418579, "d": "%appdata% reference", "e": [ "%appdata%\\microsoft\\windows\\flashplayer29pp_ja_install.exe" ], "i": "objectives/command-and-control/dropper/builder::appdata-single", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 111.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateTimerQueueTimer symbol", "e": [ "CreateTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback/create::create-timer-queue-timer-sym", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "binary.func_count = 1465.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-6--inline-3846", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.9800000190734863, "d": "DarkGate embedded C2 endpoint 168.227.253.142:38056", "e": [ "168.227.253.142:38056" ], "i": "well-known/malware/trojan/darkgate::c2-ip-38056", "l": 1 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 111.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48", "49", "46", "42" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "d": "overflow keyword", "e": [ "_DebugMallocator\u003cT\u003e::allocate() - Integer overflow." ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 111.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 1.0, "d": "WriteProcessMemory/NtWriteVirtualMemory symbol", "e": [ "WriteProcessMemory" ], "i": "objectives/evasion/fileless/memory::write-memory-sym", "l": 1 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.42" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8399999737739563, "d": "asInvoker execution manifest in resources", "e": [ "\u003crequestedExecutionLevel level='asInvoker' uiAccess='false' /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 111.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "DeleteTimerQueueTimer symbol", "e": [ "DeleteTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback/delete::delete-timer-queue-timer-sym", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 512.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 111.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 1465.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.699999988079071, "d": "GetCurrentThread API call", "e": [ "GetCurrentThread" ], "i": "micro-behaviors/process/info/current::get-current-thread", "l": 2 }, { "c": 0.8500000238418579, "d": "DarkGate C2 record with embedded key anchor", "e": [ "8bunz8" ], "i": "well-known/malware/trojan/darkgate::c2-record-key-anchor", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1573", "c": 1.0, "d": "RC4 loop decrypts byte stream", "e": [ "43 f8" ], "i": "micro-behaviors/crypto/symmetric/stream::rc4-xor-loop", "l": 3, "m": "C0027" }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "spanish-dominican republic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "168.227.253.142:38056", "12.114.130.55:45834" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-rdata-pair", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "LocalContextCacheSize", ".?AVCacheLocalScheduleGroupSegment@details@Concurrency@@", ".?AVCacheLocalScheduleGroup@details@Concurrency@@" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.func_count = 1465.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.9300000071525574, "d": "External IPv4:port literal in rdata", "e": [ "12.114.130.55:45834", "168.227.253.142:38056" ], "i": "objectives/command-and-control/infrastructure/ip-port::external-ipv4-port-rdata-large", "l": 1 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 3, "m": "E1106" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.6000000238418579, "d": "High maximum function complexity", "e": [ "binary.max_complexity = 384.00" ], "i": "metadata/binary/metrics/structural::high-max-complexity", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 1465.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "168.227.253.142:38056", "12.114.130.55:45834" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "WriteProcessMemory API reference", "e": [ "WriteProcessMemory" ], "i": "micro-behaviors/process/inject/runtime/call::write-process-memory-binary", "l": 3, "m": "C0032" }, { "c": 0.8999999761581421, "d": "Set thread CPU affinity", "e": [ "SetThreadAffinityMask" ], "i": "micro-behaviors/process/control/affinity::set-thread-affinity-mask", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "38 30 43 00", "2c 30 43 00", "7c 30 43 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "12.114.130.55:45834", "168.227.253.142:38056" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.func_count = 1465.00" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute-cond-4--inline-11988", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 1465.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetLogicalProcessorInformation", "SetThreadStackGuarantee", "SetThreadGroupAffinity", "WaitForThreadpoolTimerCallbacks", "SetDefaultDllDirectories", "EnumSystemLocalesEx", "GetCurrentPackageId", "FlushProcessWriteBuffers", "InitializeCriticalSectionEx", "GetFileInformationByHandleExW", "GetUserDefaultLocaleName", "GetThreadGroupAffinity", "FreeLibraryWhenCallbackReturns", "SetFileInformationByHandleW", "GetCurrentProcessorNumber", "GetCurrentProcessorNumberEx" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "High maximum function complexity (obfuscation)", "e": [ "binary.max_complexity = 384.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-max-complexity", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.72" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 9)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (LoadLibraryW, Sleep, GetProcAddress, VirtualAlloc, WriteProcessMemory, ... +104 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CreateWindowExW)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetProcessWindowStation", "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetLocaleInfoW", "GetUserDefaultLCID", "EnumSystemLocalesW", "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "EnumSystemLocalesW", "GetUserDefaultLCID", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-fingerprinting-imports", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Timer queue create + delete lifecycle", "e": [ "CreateTimerQueueTimer", "DeleteTimerQueueTimer" ], "i": "micro-behaviors/time/schedule/callback/lifecycle::timer-queue-lifecycle", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.has_rich_header = 1.00", "binary.import_count = 111.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InterlockedFlushSList", "InterlockedPopEntrySList", "InterlockedPushEntrySList", "InitializeSListHead" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2 }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "EnumSystemLocalesW", "GetUserDefaultLCID", "GetCommandLineA", "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetCurrentThreadId", "GetEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1059.003", "c": 0.8799999952316284, "d": "Locale window-station gating in C2 implant", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW", "12.114.130.55:45834", "GetUserDefaultLCID", "GetProcessWindowStation", "168.227.253.142:38056", "GetLocaleInfoW" ], "i": "objectives/command-and-control/reverse-shell/socket::locale-window-station-c2-gating", "l": 4 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "EnumSystemLocalesEx", "GetUserDefaultLCID", "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetEnvironmentStringsW", "EnumSystemLocalesW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Query and modify CPU affinity", "e": [ "GetProcessAffinityMask", "SetThreadAffinityMask" ], "i": "micro-behaviors/process/control/affinity::affinity-mask-control", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "Sleep", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetCommandLineA", "FreeEnvironmentStringsW", "EnumSystemLocalesEx", "GetEnvironmentStringsW", "GetSystemTimeAsFileTime", "GetLocaleInfoW", "EnumSystemLocalesW", "GetUserDefaultLCID" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" } ], "sha": "6868cdac0f06232608178b101ca3a8afda7f31538a165a045b439edf9dadf048", "path": "482913", "type": "pe" } ], "tv": "46790" } }