{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 1.0, "class": 2 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T18:13:09Z" }, "path": "5714", "raw": { "v": "4", "fs": [ { "f": "O₂(CAs)H(Cm)Md₂(BiSi)", "k": { "hash.imp": "9bba2bc57225a92af32c961d1b0ff9a7", "pe.checksum": "0x00063f2c", "pe.timestamp": 1210923194, "hash.authenti": "9d399a5c061945569363243c85d8d8e1661dba79cf88533aa43afe38b8d0e144", "hash.rich_header": "1f398f657c77e04ee6a94fff5ef945a68aadecd207d652419919a507db7d8e16", "build.target_arch": "x86", "pe.linker_version": "8.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_MENU", "pe.resource_types[2]": "RT_DIALOG", "pe.resource_types[3]": "RT_STRING", "pe.resource_types[4]": "RT_GROUP_ICON", "pe.resource_types[5]": "RT_VERSION", "pe.resource_types[6]": "RT_MANIFEST", "pe.rich_header.xor_key": "0xd3603192", "pe.manifest.description": "AutoIt v3", "pe.data_directories[0].rva": 643668, "pe.data_directories[1].rva": 622592, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 784, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 21076, "pe.version_info.file_version": "3, 2, 12, 0", "pe.rich_header_compids[0].count": 2, "pe.rich_header_compids[1].count": 192, "pe.rich_header_compids[2].count": 9, "pe.rich_header_compids[3].count": 53, "pe.rich_header_compids[4].count": 27, "pe.rich_header_compids[5].count": 466, "pe.rich_header_compids[6].count": 58, "pe.rich_header_compids[7].count": 37, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.rich_header_compids[0].compid": 8307863, "pe.rich_header_compids[1].compid": 7194151, "pe.rich_header_compids[2].compid": 6229955, "pe.rich_header_compids[3].compid": 7259687, "pe.rich_header_compids[4].compid": 6098883, "pe.rich_header_compids[5].compid": 65536, "pe.rich_header_compids[6].compid": 7521831, "pe.rich_header_compids[7].compid": 8242727, "pe.rich_header_compids[8].compid": 8177191, "pe.rich_header_compids[9].compid": 7915047, "pe.version_info.file_description": "8\f\u0001FileVersion", "pe.rich_header_compids[5].product": "Unknown", "pe.manifest.assembly_identity.name": "AutoIt3", "pe.manifest.assembly_identity.type": "win32", "pe.section_characteristics[0].name": "UPX0", "pe.section_characteristics[1].name": "UPX1", "pe.section_characteristics[2].name": ".rsrc", "pe.section_characteristics[3].name": ".EUPX1", "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.rich_header.entries[0].use_count": 2, "pe.rich_header.entries[1].use_count": 192, "pe.rich_header.entries[2].use_count": 9, "pe.rich_header.entries[3].use_count": 53, "pe.rich_header.entries[4].use_count": 27, "pe.rich_header.entries[5].use_count": 466, "pe.rich_header.entries[6].use_count": 58, "pe.rich_header.entries[7].use_count": 37, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.manifest.dependencies[0].language": "*", "pe.rich_header.entries[0].product_id": 126, "pe.rich_header.entries[1].product_id": 109, "pe.rich_header.entries[2].product_id": 95, "pe.rich_header.entries[3].product_id": 110, "pe.rich_header.entries[4].product_id": 93, "pe.rich_header.entries[5].product_id": 1, "pe.rich_header.entries[6].product_id": 114, "pe.rich_header.entries[7].product_id": 125, "pe.rich_header.entries[8].product_id": 124, "pe.rich_header.entries[9].product_id": 120, "pe.manifest.assembly_identity.version": "3.0.0.0", "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[0].build_number": 50327, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 50727, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 4035, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 50727, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 4035, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[6].build_number": 50727, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 50727, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 50727, "pe.rich_header.entries[8].product_name": "unknown", "pe.rich_header.entries[9].build_number": 50727, "pe.rich_header.entries[9].product_name": "Cvtres_VS2008", "pe.section_characteristics[1].raw_size": 229376, "pe.section_characteristics[2].raw_size": 22016, "pe.section_characteristics[3].raw_size": 77824, "pe.section_characteristics[0].virtual_size": 389120, "pe.section_characteristics[1].virtual_size": 229376, "pe.section_characteristics[2].virtual_size": 24576, "pe.section_characteristics[3].virtual_size": 139264, "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 393216, "pe.section_characteristics[2].virtual_address": 622592, "pe.section_characteristics[3].virtual_address": 647168, "pe.section_characteristics[0].characteristics_hex": "e0000080", "pe.section_characteristics[1].characteristics_hex": "e0000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "e0000020", "pe.manifest.dependencies[0].processor_architecture": "*", "pe.manifest.assembly_identity.processor_architecture": "*" }, "x": 46, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "RegCloseKey", "ImageList_Create", "GetSaveFileNameW", "LineTo", "WNetUseConnectionW", "CoInitialize", "ORDINAL 35", "DragFinish", "GetDC", "VerQueryValueW", "timeGetTime", "ORDINAL 1" ], "ms": { "pe": { "entry": 621744.0, "machine": 332.0, "checksum": 409388.0, "rsrc_size": 22016.0, "subsystem": 2.0, "timestamp": 1210923194.0, "icon_count": 2.0, "image_base": 4194304.0, "has_checksum": true, "has_manifest": true, "rsrc_entropy": 4.03, "entry_section": "UPX1", "size_of_image": 786432.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 7.0, "resource_types": [ "RT_ICON", "RT_MENU", "RT_DIALOG", "RT_STRING", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST" ], "characteristics": 291.0, "has_rich_header": true, "overlay_padding": 36177.0, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 13.0, "computed_checksum": 409388.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 32768.0, "has_export_timestamp": false, "linker_major_version": 8.0, "bss_like_section_count": 1.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "api_hashing_indicator_count": 1.0, "entry_in_nonstandard_section": true }, "file": { "size": 369489.0 }, "binary": { "code_size": 307200.0, "func_count": 2.0, "has_overlay": true, "code_entropy": 3.37, "func_density": 0.01, "import_count": 18.0, "overlay_size": 39249.0, "string_count": 271.0, "avg_func_size": 224.5, "overlay_ratio": 0.11, "section_count": 4.0, "avg_complexity": 15.5, "import_density": 0.06, "max_complexity": 30.0, "string_density": 0.9, "overall_entropy": 3.54, "avg_basic_blocks": 28.0, "avg_section_size": 82304.0, "dependency_count": 13.0, "entropy_variance": 2.91, "wx_section_count": 3.0, "avg_string_length": 8.62, "complexity_per_kb": 0.05, "max_string_length": 73.0, "wide_string_count": 8.0, "avg_string_entropy": 2.49, "code_to_data_ratio": 13.95, "rsrc_to_file_ratio": 0.06, "total_basic_blocks": 56.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 8.88, "largest_section_ratio": 0.62, "sentence_string_count": 8.0, "sentence_string_ratio": 0.03, "writable_section_count": 4.0, "behavioral_import_ratio": 0.22, "entry_in_writable_region": true, "executable_section_count": 3.0, "nonstandard_section_count": 3.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 224, "Rich" ], [ 504, "UPX0" ], [ 544, "UPX1" ], [ 584, ".rsrc" ], [ 624, ".EUPX1" ], [ 987, "3.01" ], [ 1685, "P3ZM" ], [ 2827, "8igf" ], [ 4022, "8t1r" ], [ 6244, "X1PO" ], [ 11421, "/pMf" ], [ 11760, "CSWG" ], [ 14843, "C58Y" ], [ 18278, "/m\tV\t\\d" ], [ 18589, "E\u003c\u003cC=4" ], [ 23206, "3UHG" ], [ 24139, "USQW" ], [ 25506, "Rrbt" ], [ 26699, "h.jb" ], [ 27037, ".let" ], [ 28284, "\u003c/A\u003e" ], [ 28885, "V5Y_" ], [ 31492, "ik6v" ], [ 32188, "j2 8p" ], [ 33637, "N0EA" ], [ 34829, "8P0P" ], [ 34881, "JTG8" ], [ 37521, "6w h" ], [ 39154, "/Qmj" ], [ 43385, "FP_P" ], [ 43889, "RLSWZ" ], [ 47444, "Cwao" ], [ 48021, "7TOD" ], [ 54327, "AOY9" ], [ 54715, "Emlym" ], [ 56325, "E53L" ], [ 59766, "f90t" ], [ 62743, "RHQ4" ], [ 64270, "K4PM" ], [ 70211, "/XkZ" ], [ 70382, "FPShqCB" ], [ 72899, "C4AA" ], [ 77069, "Xjfv" ], [ 78113, "CKGI" ], [ 78349, "puu22" ], [ 79583, "KYTXX" ], [ 82821, "qe%uj0fx" ], [ 83919, "Vl u" ], [ 85453, "s3a5" ], [ 86653, "H3MHJ" ], [ 86804, "u3fk" ], [ 88129, "BYGT5" ], [ 88616, "08pp" ], [ 88820, "CGPO" ], [ 93012, "2G B" ], [ 95314, "66NH" ], [ 95522, "zjiu" ], [ 97588, "\u003c\u003cWWH" ], [ 97603, "W1LL" ], [ 98927, "SS1X" ], [ 101502, "s!.@mNF" ], [ 101703, "78ou" ], [ 104679, "/d9X" ], [ 104753, "Upma" ], [ 109446, "0973" ], [ 111407, "Za081O90.W" ], [ 112716, "BSJ9" ], [ 114385, "HLPT" ], [ 115147, "Brpkil" ], [ 116151, "140w" ], [ 116466, "/v7R" ], [ 116646, "Fztu" ], [ 116693, "6MAF" ], [ 118214, "B4HY" ], [ 124111, "N_IF" ], [ 127639, "Nhpn_l" ], [ 128172, "D883" ], [ 129731, "32uz" ], [ 130720, "8425" ], [ 131340, "0773" ], [ 133607, "INtPITPd" ], [ 133822, "LWP4" ], [ 134584, "KWRG" ], [ 139733, "Iesi" ], [ 140503, "UFHF" ], [ 141053, "W05E" ], [ 141260, "BTNK8" ], [ 141333, "/\tAZ" ], [ 141447, "Ljmt" ], [ 141456, "/Mx8" ], [ 147537, "ERCP" ], [ 153021, "/dsQ" ], [ 161667, "Baj p" ], [ 161739, "YHQD" ], [ 162526, "O wn" ], [ 164594, "t6mu" ], [ 165502, "LLQN" ], [ 166972, "o9dh" ], [ 168701, "806J" ], [ 170158, "Eleh" ], [ 170717, "E40K" ], [ 174685, "BMH5_" ], [ 175320, "WR06Y" ], [ 176756, "KYYW" ], [ 179216, "MBHK" ], [ 181416, "f9.6" ], [ 183482, "Q083N" ], [ 184568, ".ikih" ], [ 186616, "JAM 3" ], [ 187357, "XYYM" ], [ 190225, "VVRVH" ], [ 191488, "PD4U" ], [ 192794, "LCG8" ], [ 193820, "KDFGXK" ], [ 197471, "Mm.v" ], [ 199134, "`(!`" ], [ 199873, "UQPXY]YP0" ], [ 200522, "S0 W" ], [ 202489, "2r\u003c\u003cE~" ], [ 204389, "Ffof" ], [ 204716, "62DK" ], [ 204996, "DIW59" ], [ 206771, "EHMF" ], [ 206782, "IsDebuggerPresent/v" ], [ 207081, "COMMI" ], [ 207089, "AILV" ], [ 207124, "upp\nalnumscii" ], [ 207128, "alnumscii" ], [ 207153, "digijgra" ], [ 207167, "pri\u0026\nuncspace" ], [ 207172, "uncspace" ], [ 207265, "nd of pt*n\u0026c" ], [ 207284, "cognize." ], [ 207295, "~charac fol" ], [ 207327, "\u003cin {} quantifiK to" ], [ 207524, "o01df" ], [ 207579, "NULLHkfw" ], [ 207657, "failc g" ], [ 207844, "PCRE" ], [ 208214, "DEFINEoneS`" ], [ 208245, "HWLS" ], [ 208380, "\\E3@BSR_UNICODE)" ], [ 208401, "ANYCRLF" ], [ 208677, "rmukhsJ" ], [ 208756, "imbu" ], [ 208954, "Telu" ], [ 209475, "ijklm-" ], [ 209485, "pqBtuvwxyz[\\" ], [ 209662, "GHIJKLMNO7" ], [ 209848, ".mixc" ], [ 209860, "H Po.KERN" ], [ 209957, "TLOSS" ], [ 209968, "SINGnOM" ], [ 210743, "ceil" ], [ 210850, "uFriSayJhFebMarA" ], [ 212180, "Type" ], [ 212322, "Msig" ], [ 212352, "RTTI" ], [ 213205, "OFmOIsT" ], [ 213494, "givge" ], [ 213848, "Eawdc" ], [ 214138, "MzkWsjr" ], [ 214313, "FS.WINU0" ], [ 214327, "OWN/'LSHIFT" ], [ 214354, "CTRL" ], [ 214367, "B_XBUTTON2" ], [ 214393, "NCH_APP2" ], [ 214440, "PREVNEXT" ], [ 214449, "VOLUM" ], [ 214483, "FAJRTIES'" ], [ 214521, "BACK" ], [ 214579, "OTSUB2" ], [ 214599, "8765" ], [ 214607, "4321" ], [ 214669, "4GHTGG2" ], [ 214753, "M040" ], [ 215182, "Toolhelp32Sn~sho" ], [ 215210, "N do" ], [ 215406, "LNDWK" ], [ 215524, "EA0602X" ], [ 215630, "BGX7" ], [ 215950, "DCAG" ], [ 216442, "JGPW" ], [ 216581, "FWOF" ], [ 216982, "SG7G" ], [ 217763, "6OOO" ], [ 218744, "zXWfnet" ], [ 218823, "Icmp" ], [ 218855, "rlW'Connect" ], [ 218916, "/Hk6" ], [ 220257, "/\t8X" ], [ 220476, "SelfWdjus" ], [ 220895, "pYxribu" ], [ 221709, "sinu" ], [ 222936, "HMXB" ], [ 223919, "h.h,v 1.1 2004" ], [ 223942, "9:50:3" ], [ 223949, "jonbe/" ], [ 224472, "E6XC" ], [ 225634, "/Qij" ], [ 226510, "pViewOfe" ], [ 226738, "ByfWideCh0fa" ], [ 226906, "qySVolu" ], [ 226976, "auhb" ], [ 229353, "i4s9" ], [ 229957, "XPTPSW" ], [ 250130, "wide", "VS_VERSION_INFO" ], [ 250222, "wide", "StringFileInfo" ], [ 250282, "wide", "FileDescription" ], [ 250322, "wide", "FileVersion" ], [ 250378, "wide", "CompiledScript" ], [ 250408, "wide", "AutoIt v3 Script : 3, 2, 12, 0" ], [ 250478, "wide", "VarFileInfo" ], [ 250510, "wide", "Translation" ], [ 250544, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e" ], [ 250601, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 250676, "\u003cassemblyIdentity" ], [ 250696, "type=\"win32\"" ], [ 250715, "processorArchitecture=\"*\"" ], [ 250747, "version=\"3.0.0.0\"" ], [ 250797, "\u003cdescription\u003eAutoIt v3\u003c/description\u003e" ], [ 250838, "\u003c!-- Identify the application security requirements. --\u003e" ], [ 250897, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\"\u003e" ], [ 250952, "\u003csecurity\u003e" ], [ 250966, "\u003crequestedPrivileges\u003e" ], [ 250992, "\u003crequestedExecutionLevel" ], [ 251022, "level=\"asInvoker\"" ], [ 251046, "uiAccess=\"false\"/\u003e" ], [ 251071, "\u003c/requestedPrivileges\u003e" ], [ 251098, "\u003c/security\u003e" ], [ 251113, "\u003c/trustInfo\u003e" ], [ 251130, "\u003c!-- Identify the application dependencies. --\u003e" ], [ 251180, "\u003cdependency\u003e" ], [ 251195, "\u003cdependentAssembly\u003e" ], [ 251258, "name=\"Microsoft.Windows.Common-Controls\"" ], [ 251304, "version=\"6.0.0.0\"" ], [ 251327, "language=\"*\"" ], [ 251376, "publicKeyToken=\"6595b64144ccf1df\"" ], [ 251422, "\u003c/dependentAssembly\u003e" ], [ 251446, "\u003c/dependency\u003e" ], [ 251462, "\u003c/assembly\u003e" ], [ 251880, "KERNEL32.DLL" ], [ 251893, "ADVAPI32.dll" ], [ 251906, "COMCTL32.dll" ], [ 251919, "comdlg32.dll" ], [ 251932, "GDI32.dll" ], [ 251942, "MPR.dll" ], [ 251950, "ole32.dll" ], [ 251960, "OLEAUT32.dll" ], [ 251973, "SHELL32.dll" ], [ 251985, "USER32.dll" ], [ 251996, "VERSION.dll" ], [ 252008, "WINMM.dll" ], [ 252018, "WSOCK32.dll" ], [ 252032, "LoadLibraryA" ] ], "sz": 369489, "ts": [ { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1210923194.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "publicKeyToken=\"6595b64144ccf1df\"" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "WNetUseConnectionW", "rlW'Connect" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "3, 2, 12, 0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8600000143051147, "d": "PE has medium sized overlay", "e": [ "binary.overlay_size = 39249.00" ], "i": "metadata/binary/section/metrics::medium-overlay-pe", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.54" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.49" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.54" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 0.00" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage/control::get-dc", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 271.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"language\":\"*\",\"processor_architecture\":\"*\",\"pub" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"assembly_identity\":{\"type\":\"win32\",\"processor_architecture\":\"*\",\"version\":\"3.0.0.0\",\"name\":\"AutoIt3\"},\"description\":\"AutoIt v3" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 786432.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "a": "T1497.003", "c": 0.699999988079071, "d": "timeGetTime multimedia timing", "e": [ "timeGetTime" ], "i": "micro-behaviors/time/timing/check::timegettime", "l": 2, "m": "B0003.003" }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "5714" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.49" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "PREVNEXT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "Create image list", "e": [ "ImageList_Create" ], "i": "micro-behaviors/ui/controls/widget::image-list-create", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "8\f\u0001FileVersion" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AZ token", "e": [ "\tAZ" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-az", "l": 1, "m": "B0007.003" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".EUPX1 (size: 77824, perms: rwx)", "UPX1 (size: 229376, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "c": 0.7200000286102295, "d": "WSOCK32 Winsock DLL import", "e": [ "WSOCK32.dll" ], "i": "micro-behaviors/communications/socket/init::wsock32-dll-marker", "l": 3 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 39249.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.9599999785423279, "d": "Compact RWX UPX1 payload section", "e": [ "UPX1 (size: 229376, entropy: 7.93, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::compact-rwx-upx1", "l": 4 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 18.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 18.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 32768.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MPR.dll (WNetUseConnectionW)", "e": [ "MPR.dll" ], "i": "metadata/dylib::mpr/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comdlg32.dll (GetSaveFileNameW)", "e": [ "comdlg32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (ImageList_Create)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 35)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (DragFinish)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetDC)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (LineTo)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINMM.dll (timeGetTime)", "e": [ "WINMM.dll" ], "i": "metadata/dylib::winmm/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WSOCK32.dll (ORDINAL 1)", "e": [ "WSOCK32.dll" ], "i": "metadata/dylib::wsock32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "well-known/malware/trojan/shellobject/strings::misleading-upx-sections", "l": 1 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027.002", "c": 0.949999988079071, "d": "UPX dynamic loader stub", "e": [ "pe.entry_in_nonstandard_section = 1.00", "VirtualProtect", "VirtualAlloc", "binary.func_count = 2.00", "GetProcAddress", "UPX0", "VirtualFree", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub", "l": 3, "m": "F0001" } ], "sha": "6a93e748d00a3fb94378fa45d305bf8bfc1980e6070e06da370c9d2bda503f4f", "path": "5714", "type": "pe" } ], "tv": "46790" } }