{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.6687533259391785, "class": 0 } ], "prob": 0.6687533, "class": 0, "models": [ { "m": "az", "prob": 0.6687533, "class": 0 }, { "m": "az/native", "prob": 0.0051635113, "class": 0 }, { "m": "az/pe", "prob": 0.0023148148, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-12T18:54:56Z" }, "path": "215110", "raw": { "v": "4", "fs": [ { "f": "Md₂(Si)", "k": { "hash.imp": "2c99c15dac4782ab9840b492df8a8521", "pe.checksum": "0x001724e1", "pe.timestamp": 1398352625, "hash.authenti": "adffd6ffdcefa9fe1d440d351156ebb7c5baf112a41ead4b48313ec8f19b400b", "hash.rich_header": "9094be1f0b11a6eb53447ff613c6d536ffbedf84457d036d8b078b3adc913c40", "build.target_arch": "x86_64", "pe.linker_version": "10.0", "pe.resource_types[0]": "RT_MANIFEST", "pe.rich_header.xor_key": "0x6812df78", "pe.data_directories[0].rva": 1449020, "pe.data_directories[1].rva": 1515520, "pe.data_directories[2].rva": 1482752, "pe.data_directories[3].rva": 1519616, "pe.data_directories[4].rva": 1101824, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 436, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 32100, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 2668, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 3080, "pe.rich_header_compids[0].count": 1, "pe.rich_header_compids[1].count": 2, "pe.rich_header_compids[2].count": 18, "pe.rich_header_compids[3].count": 2, "pe.rich_header_compids[4].count": 9, "pe.rich_header_compids[5].count": 385, "pe.rich_header_compids[6].count": 38, "pe.rich_header_compids[7].count": 1, "binary.top_complex_unnamed[0].cc": 47, "binary.top_complex_unnamed[1].cc": 45, "binary.top_complex_unnamed[2].cc": 25, "binary.top_complex_unnamed[3].cc": 23, "binary.top_complex_unnamed[4].cc": 22, "binary.top_complex_unnamed[5].cc": 21, "binary.top_complex_unnamed[6].cc": 21, "binary.top_complex_unnamed[7].cc": 21, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 9981587, "pe.rich_header_compids[1].compid": 10394907, "pe.rich_header_compids[2].compid": 11181339, "pe.rich_header_compids[3].compid": 9664521, "pe.rich_header_compids[4].compid": 10263835, "pe.rich_header_compids[5].compid": 65536, "pe.rich_header_compids[6].compid": 11246875, "pe.rich_header_compids[7].compid": 10329371, "binary.top_complex_unnamed[0].bbs": 74, "binary.top_complex_unnamed[1].bbs": 73, "binary.top_complex_unnamed[2].bbs": 40, "binary.top_complex_unnamed[3].bbs": 39, "binary.top_complex_unnamed[4].bbs": 42, "binary.top_complex_unnamed[5].bbs": 36, "binary.top_complex_unnamed[6].bbs": 36, "binary.top_complex_unnamed[7].bbs": 36, "pe.rich_header_compids[5].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x14001b3f7", "binary.top_complex_unnamed[0].size": 924, "binary.top_complex_unnamed[1].addr": "0x14001b057", "binary.top_complex_unnamed[1].size": 920, "binary.top_complex_unnamed[2].addr": "0x14000a5f0", "binary.top_complex_unnamed[2].size": 1293, "binary.top_complex_unnamed[3].addr": "0x14007e917", "binary.top_complex_unnamed[3].size": 457, "binary.top_complex_unnamed[4].addr": "0x14004c19b", "binary.top_complex_unnamed[4].size": 512, "binary.top_complex_unnamed[5].addr": "0x14007e23c", "binary.top_complex_unnamed[5].size": 542, "binary.top_complex_unnamed[6].addr": "0x1400174e7", "binary.top_complex_unnamed[6].size": 417, "binary.top_complex_unnamed[7].addr": "0x14004bff7", "binary.top_complex_unnamed[7].size": 407, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".pdata", "pe.section_characteristics[4].name": ".rsrc", "pe.section_characteristics[5].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 2, "pe.rich_header.entries[2].use_count": 18, "pe.rich_header.entries[3].use_count": 2, "pe.rich_header.entries[4].use_count": 9, "pe.rich_header.entries[5].use_count": 385, "pe.rich_header.entries[6].use_count": 38, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[0].product_id": 152, "pe.rich_header.entries[1].product_id": 158, "pe.rich_header.entries[2].product_id": 170, "pe.rich_header.entries[3].product_id": 147, "pe.rich_header.entries[4].product_id": 156, "pe.rich_header.entries[5].product_id": 1, "pe.rich_header.entries[6].product_id": 171, "pe.rich_header.entries[7].product_id": 157, "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[0].build_number": 20115, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 40219, "pe.rich_header.entries[1].product_name": "Cvtres_VS2010", "pe.rich_header.entries[2].build_number": 40219, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 30729, "pe.rich_header.entries[3].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[4].build_number": 40219, "pe.rich_header.entries[4].product_name": "Linker_VS2010", "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[6].build_number": 40219, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 40219, "pe.rich_header.entries[7].product_name": "Linker_VS2010_LTCG", "pe.section_characteristics[0].raw_size": 1094656, "pe.section_characteristics[1].raw_size": 365056, "pe.section_characteristics[2].raw_size": 4096, "pe.section_characteristics[3].raw_size": 32256, "pe.section_characteristics[4].raw_size": 512, "pe.section_characteristics[5].raw_size": 6656, "pe.section_characteristics[0].virtual_size": 1094462, "pe.section_characteristics[1].virtual_size": 364692, "pe.section_characteristics[2].virtual_size": 8280, "pe.section_characteristics[3].virtual_size": 32100, "pe.section_characteristics[4].virtual_size": 436, "pe.section_characteristics[5].virtual_size": 6372, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 1101824, "pe.section_characteristics[2].virtual_address": 1470464, "pe.section_characteristics[3].virtual_address": 1482752, "pe.section_characteristics[4].virtual_address": 1515520, "pe.section_characteristics[5].virtual_address": 1519616, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "40000040", "pe.section_characteristics[5].characteristics_hex": "42000040" }, "x": 7, "id": 0, "is": [ "??6QTextStream@@QEAAAEAV0@D@Z", "?remove@QByteArray@@QEAAAEAV1@HH@Z", "?chop@QByteArray@@QEAAXH@Z", "?endsWith@QByteArray@@QEBA_NPEBD@Z", "?startsWith@QByteArray@@QEBA_NPEBD@Z", "??6QTextStream@@QEAAAEAV0@AEBVQByteArray@@@Z", "?normalizedSignature@QMetaObject@@SA?AVQByteArray@@PEBD@Z", "?toAscii@QString@@QEBA?AVQByteArray@@XZ", "?shared_null@QHashData@@2U1@A", "?qt_assert_x@@YAXPEBD00H@Z", "?cap@QRegExp@@QEAA?AVQString@@H@Z", "?indexIn@QRegExp@@QEBAHAEBVQString@@HW4CaretMode@1@@Z", "?qFatal@@YAXPEBDZZ", "?toLocal8Bit@QString@@QEBA?AVQByteArray@@XZ", "?replace@QString@@QEAAAEAV1@AEBVQRegExp@@AEBV1@@Z", "?append@QString@@QEAAAEAV1@VQChar@@@Z", "?erase@QListData@@QEAAPEAPEAXPEAPEAX@Z", "?qHash@@YAIAEBVQString@@@Z", "?allocateNode@QHashData@@QEAAPEAXH@Z", "?node_delete@QMapData@@QEAAXQEAPEAUNode@1@HPEAU21@@Z", "?node_create@QMapData@@QEAAPEAUNode@1@QEAPEAU21@HH@Z", "?qHash@@YAIAEBVQByteArray@@@Z", "?clear@QString@@QEAAXXZ", "?createData@QMapData@@SAPEAU1@H@Z", "?prepend@QListData@@QEAAPEAPEAXXZ", "?remove@QListData@@QEAAXH@Z", "?insert@QListData@@QEAAPEAPEAXH@Z", "?rehash@QHashData@@QEAAXH@Z", "?append2@QListData@@QEAAPEAPEAXAEBU1@@Z", "?arg@QString@@QEBA?AV1@HHHAEBVQChar@@@Z", "?capturedTexts@QRegExp@@QEAA?AVQStringList@@XZ", "?matchedLength@QRegExp@@QEBAHXZ", "?willGrow@QHashData@@QEAA_NXZ", "??0QByteArray@@QEAA@HD@Z", "??6QTextStream@@QEAAAEAV0@H@Z", "??0QString@@QEAA@HVQChar@@@Z", "??YQString@@QEAAAEAV0@PEBD@Z", "?normalizedType@QMetaObject@@SA?AVQByteArray@@PEBD@Z", "?append@QString@@QEAAAEAV1@PEBD@Z", "?firstNode@QHashData@@QEAAPEAUNode@1@XZ", "?isEmpty@QString@@QEBA_NXZ", "??0QString@@QEAA@PEBD@Z", "?right@QString@@QEBA?AV1@H@Z", "??YQString@@QEAAAEAV0@AEBV0@@Z", "??0QString@@QEAA@XZ", "??9QString@@QEBA_NPEBD@Z", "?end@QListData@@QEBAPEAPEAXXZ", "??9QBasicAtomicInt@@QEBA_NH@Z", "?isEmpty@QListData@@QEBA_NXZ", "?ref@QBasicAtomicInt@@QEAA_NXZ", "?toInt@QString@@QEBAHPEA_NH@Z", "?begin@QListData@@QEBAPEAPEAXXZ", "?prepend@QString@@QEAAAEAV1@AEBV1@@Z", "?flush@QTextStream@@QEAAXXZ", "?data_ptr@QString@@QEAAAEAPEAUData@1@XZ", "?size@QString@@QEBAHXZ", "?at@QListData@@QEBAPEAPEAXH@Z", "?size@QListData@@QEBAHXZ", "?constData@QByteArray@@QEBAPEBDXZ", "??0QTextStream@@QEAA@PEAVQIODevice@@@Z", "??1QFile@@UEAA@XZ", "?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z", "??0QFile@@QEAA@AEBVQString@@@Z", "?setFieldWidth@QTextStream@@QEAAXH@Z", "?setFieldAlignment@QTextStream@@QEAAXW4FieldAlignment@1@@Z", "?toUpper@QString@@QEBA?AV1@XZ", "??8QBasicAtomicInt@@QEBA_NH@Z", "?tempPath@QDir@@SA?AVQString@@XZ", "?at@QString@@QEBA?BVQChar@@H@Z", "?toAscii@QChar@@QEBA?BDXZ", "?replace@QString@@QEAAAEAV1@VQChar@@0W4CaseSensitivity@Qt@@@Z", "?indexOf@QString@@QEBAHAEBV1@HW4CaseSensitivity@Qt@@@Z", "??4QRegExp@@QEAAAEAV0@$$QEAV0@@Z", "??0QRegExp@@QEAA@XZ", "?indexOf@QString@@QEBAHVQChar@@HW4CaseSensitivity@Qt@@@Z", "?count@QString@@QEBAHAEBV1@W4CaseSensitivity@Qt@@@Z", "??4QString@@QEAAAEAV0@VQChar@@@Z", "?startsWith@QString@@QEBA_NAEBVQChar@@W4CaseSensitivity@Qt@@@Z", "?contains@QString@@QEBA?AVQBool@@AEBVQRegExp@@@Z", "?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z", "?shared_null@QLinkedListData@@2U1@A", "?toNativeSeparators@QDir@@SA?AVQString@@AEBV2@@Z", "?mid@QByteArray@@QEBA?AV1@HH@Z", "??4QString@@QEAAAEAV0@AEBVQByteArray@@@Z", "?left@QByteArray@@QEBA?AV1@H@Z", "?indexOf@QByteArray@@QEBAHPEBDH@Z", "?fromLatin1_helper@QString@@CAPEAUData@1@PEBDH@Z", "?trimmed@QByteArray@@QEBA?AV1@XZ", "?readLine@QIODevice@@QEAA?AVQByteArray@@_J@Z", "??0QTextStream@@QEAA@PEAU_iobuf@@V?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z", "?exists@QFile@@SA_NAEBVQString@@@Z", "?arguments@QCoreApplication@@SA?AVQStringList@@XZ", "??0QDir@@QEAA@AEBVQString@@@Z", "?readAll@QIODevice@@QEAA?AVQByteArray@@XZ", "??1QCoreApplication@@UEAA@XZ", "??0QCoreApplication@@QEAA@AEAHPEAPEADH@Z", "?compare@QString@@QEBAHAEBV1@@Z", "?fromLatin1@QString@@SA?AV1@PEBDH@Z", "?detach@QByteArray@@QEAAXXZ", "??0QTextStream@@QEAA@PEAVQByteArray@@V?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z", "?shared_null@QByteArray@@0UData@1@A", "??0QObject@@QEAA@PEAV0@@Z", "?split@QByteArray@@QEBA?AV?$QList@VQByteArray@@@@D@Z", "?setDevice@QTextStream@@QEAAXPEAVQIODevice@@@Z", "?codecForCStrings@QString@@0PEAVQTextCodec@@EA", "?codecForName@QTextCodec@@SAPEAV1@PEBD@Z", "?absolutePath@QFileInfo@@QEBA?AVQString@@XZ", "?close@QFile@@UEAAXXZ", "?fileName@QFile@@QEBA?AVQString@@XZ", "?size@QFileInfo@@QEBA_JXZ", "?exists@QFileInfo@@QEBA_NXZ", "?number@QByteArray@@SA?AV1@NDH@Z", "?split@QString@@QEBA?AVQStringList@@AEBVQChar@@W4SplitBehavior@1@W4CaseSensitivity@Qt@@@Z", "?remove@QString@@QEAAAEAV1@VQChar@@W4CaseSensitivity@Qt@@@Z", "?write@QIODevice@@QEAA_JPEBD_J@Z", "?fileName@QFileInfo@@QEBA?AVQString@@XZ", "?setCurrent@QDir@@SA_NAEBVQString@@@Z", "??0QFileInfo@@QEAA@AEBVQString@@@Z", "?current@QDir@@SA?AV1@XZ", "?toStdString@QString@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ", "?convertSeparators@QDir@@SA?AVQString@@AEBV2@@Z", "?seek@QFile@@UEAA_N_J@Z", "??1QTemporaryFile@@UEAA@XZ", "??0QTemporaryFile@@QEAA@XZ", "?qWarning@@YAXPEBDZZ", "??8QString@@QEBA_NAEBVQLatin1String@@@Z", "?shared_null@QVectorData@@2U1@A", "?free@QVectorData@@SAXPEAU1@H@Z", "?qBadAlloc@@YAXXZ", "?allocate@QVectorData@@SAPEAU1@HH@Z", "?readLine@QTextStream@@QEAA?AVQString@@_J@Z", "?atEnd@QTextStream@@QEBA_NXZ", "?setFileName@QFile@@QEAAXAEBVQString@@@Z", "?contains@QString@@QEBA?AVQBool@@AEAVQRegExp@@@Z", "?qMemSet@@YAPEAXPEAXH_K@Z", "?reallocate@QVectorData@@SAPEAU1@PEAU1@HHH@Z", "?grow@QVectorData@@SAHHHH_N@Z", "?freeNode@QHashData@@QEAAXPEAX@Z", "?contains@QByteArray@@QEBA?AVQBool@@D@Z", "?hasShrunk@QHashData@@QEAAXXZ", "?contains@QString@@QEBA?AVQBool@@VQChar@@W4CaseSensitivity@Qt@@@Z", "??AQString@@QEBA?BVQChar@@H@Z", "?append@QString@@QEAAAEAV1@AEBVQLatin1String@@@Z", "?fromUtf8@QString@@SA?AV1@PEBDH@Z", "??BQByteArray@@QEBAPEBDXZ", "?toLatin1@QString@@QEBA?AVQByteArray@@XZ", "??9QString@@QEBA_NAEBV0@@Z", "??0QString@@QEAA@AEBVQLatin1String@@@Z", "??0QLatin1String@@QEAA@PEBD@Z", "?toDouble@QString@@QEBANPEA_N@Z", "?QStringList_sort@QtPrivate@@YAXPEAVQStringList@@@Z", "?toInt@QByteArray@@QEBAHPEA_NH@Z", "??0QByteArray@@QEAA@PEBD@Z", "?remove@QListData@@QEAAXHH@Z", "?exists@QFile@@QEBA_NXZ", "??0QString@@QEAA@AEBVQByteArray@@@Z", "?qRegisterResourceData@@YA_NHPEBE00@Z", "?qUnregisterResourceData@@YA_NHPEBE00@Z", "?toUInt@QString@@QEBAIPEA_NH@Z", "?toLower@QChar@@QEBA?AV1@XZ", "?remove@QString@@QEAAAEAV1@AEBVQRegExp@@@Z", "??4QFileInfo@@QEAAAEAV0@$$QEAV0@@Z", "??0QFileInfo@@QEAA@XZ", "?arg@QString@@QEBA?AV1@AEBV1@0@Z", "?fileName@QTemporaryFile@@QEBA?AVQString@@XZ", "?open@QTemporaryFile@@QEAA_NXZ", "?setAutoRemove@QTemporaryFile@@QEAAX_N@Z", "?isOpen@QIODevice@@QEBA_NXZ", "??0QString@@QEAA@PEBVQChar@@H@Z", "?isLetterOrNumber@QChar@@QEBA_NXZ", "?truncate@QString@@QEAAXH@Z", "?toLower@QString@@QEBA?AV1@XZ", "?mid@QString@@QEBA?AV1@HH@Z", "??MQString@@QEBA_NAEBV0@@Z", "?repeated@QString@@QEBA?AV1@H@Z", "??8QString@@QEBA_NAEBV0@@Z", "?deref@QBasicAtomicInt@@QEAA_NXZ", "?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z", "??8QString@@QEBA_NPEBD@Z", "??0QRegExp@@QEAA@AEBVQString@@W4CaseSensitivity@Qt@@W4PatternSyntax@0@@Z", "?indexOf@QString@@QEBAHAEAVQRegExp@@H@Z", "?exactMatch@QRegExp@@QEBA_NAEBVQString@@@Z", "?end@QString@@QEAAPEAVQChar@@XZ", "?isSpace@QChar@@QEBA_NXZ", "??AQString@@QEAA?AVQCharRef@@H@Z", "?isSpace@QCharRef@@QEBA_NXZ", "??6QTextStream@@QEAAAEAV0@AEBVQString@@@Z", "?endl@@YAAEAVQTextStream@@AEAV1@@Z", "??1QRegExp@@QEAA@XZ", "?split@QString@@QEBA?AVQStringList@@AEBV1@W4SplitBehavior@1@W4CaseSensitivity@Qt@@@Z", "?realloc@QListData@@QEAAXH@Z", "?detach_helper2@QHashData@@QEAAPEAU1@P6AXPEAUNode@1@PEAX@ZP6AX0@ZHH@Z", "?qt_assert@@YAXPEBD0H@Z", "?number@QString@@SA?AV1@HH@Z", "?contains@QString@@QEBA?AVQBool@@AEBV1@W4CaseSensitivity@Qt@@@Z", "??0QTextStream@@QEAA@PEAVQString@@V?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z", "?free_helper@QHashData@@QEAAXP6AXPEAUNode@1@@Z@Z", "?append@QListData@@QEAAPEAPEAXXZ", "?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z", "?detach@QListData@@QEAAPEAUData@1@H@Z", "?continueFreeData@QMapData@@QEAAXH@Z", "?shared_null@QString@@0UData@1@A", "??4QString@@QEAAAEAV0@PEBD@Z", "?trimmed@QString@@QEBA?AV1@XZ", "??4QString@@QEAAAEAV0@$$QEAV0@@Z", "?endsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z", "?left@QString@@QEBA?AV1@H@Z", "?lastIndexOf@QString@@QEBAHAEBV1@HW4CaseSensitivity@Qt@@@Z", "?prepend@QString@@QEAAAEAV1@PEBD@Z", "?nextNode@QHashData@@SAPEAUNode@1@PEAU21@@Z", "?insert@QString@@QEAAAEAV1@HVQChar@@@Z", "?insert@QString@@QEAAAEAV1@HPEBVQChar@@H@Z", "?shared_null@QMapData@@2U1@A", "?shared_null@QListData@@2UData@1@A", "?separator@QDir@@SA?AVQChar@@XZ", "??0QString@@QEAA@VQChar@@@Z", "?replace@QString@@QEAAAEAV1@AEBV1@0W4CaseSensitivity@Qt@@@Z", "??0QFileInfo@@QEAA@AEBVQFile@@@Z", "?dir@QFileInfo@@QEBA?AVQDir@@XZ", "??1QFileInfo@@QEAA@XZ", "?exists@QDir@@QEBA_NXZ", "?absolutePath@QDir@@QEBA?AVQString@@XZ", "?mkpath@QDir@@QEBA_NAEBVQString@@@Z", "??0QChar@@QEAA@UQLatin1Char@@@Z", "?fromAscii_helper@QString@@CAPEAUData@1@PEBDH@Z", "?arg@QString@@QEBA?AV1@AEBV1@HAEBVQChar@@@Z", "??1QDir@@QEAA@XZ", "?lastIndexOf@QString@@QEBAHVQChar@@HW4CaseSensitivity@Qt@@@Z", "??4QString@@QEAAAEAV0@AEBV0@@Z", "?remove@QString@@QEAAAEAV1@HH@Z", "?chop@QString@@QEAAXH@Z", "??0QChar@@QEAA@D@Z", "?endsWith@QString@@QEBA_NAEBVQChar@@W4CaseSensitivity@Qt@@@Z", "?disconnectNotify@QObject@@MEAAXPEBD@Z", "?connectNotify@QObject@@MEAAXPEBD@Z", "?customEvent@QObject@@MEAAXPEAVQEvent@@@Z", "?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z", "?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z", "?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z", "?event@QObject@@UEAA_NPEAVQEvent@@@Z", "?qt_metacall@QObject@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z", "?qt_metacast@QObject@@UEAAPEAXPEBD@Z", "?metaObject@QObject@@UEBAPEBUQMetaObject@@XZ", "??1QTextStream@@UEAA@XZ", "?qFree@@YAXPEAX@Z", "??1QObject@@UEAA@XZ", "??1QByteArray@@QEAA@XZ", "??6QTextStream@@QEAAAEAV0@PEBD@Z", "?QStringList_contains@QtPrivate@@YA?AVQBool@@PEBVQStringList@@AEBVQString@@W4CaseSensitivity@Qt@@@Z", "?QStringList_join@QtPrivate@@YA?AVQString@@PEBVQStringList@@AEBV2@@Z", "?fromAscii@QChar@@SA?AV1@D@Z", "??YQString@@QEAAAEAV0@VQChar@@@Z", "?fromAscii@QString@@SA?AV1@PEBDH@Z", "?free@QString@@CAXPEAUData@1@@Z", "??0QString@@QEAA@AEBV0@@Z", "?append@QString@@QEAAAEAV1@AEBV1@@Z", "??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z", "??1QString@@QEAA@XZ", "??0QXmlInputSource@@QEAA@PEAVQIODevice@@@Z", "??0QXmlSimpleReader@@QEAA@XZ", "?setContentHandler@QXmlSimpleReader@@UEAAXPEAVQXmlContentHandler@@@Z", "?setErrorHandler@QXmlSimpleReader@@UEAAXPEAVQXmlErrorHandler@@@Z", "?parse@QXmlSimpleReader@@UEAA_NPEBVQXmlInputSource@@_N@Z", "??1QXmlSimpleReader@@UEAA@XZ", "??1QXmlInputSource@@UEAA@XZ", "?index@QXmlAttributes@@QEBAHAEBVQString@@@Z", "?length@QXmlAttributes@@QEBAHXZ", "?localName@QXmlAttributes@@QEBA?AVQString@@H@Z", "?value@QXmlAttributes@@QEBA?AVQString@@H@Z", "?externalEntityDecl@QXmlDefaultHandler@@UEAA_NAEBVQString@@00@Z", "?internalEntityDecl@QXmlDefaultHandler@@UEAA_NAEBVQString@@0@Z", "?attributeDecl@QXmlDefaultHandler@@UEAA_NAEBVQString@@0000@Z", "?comment@QXmlDefaultHandler@@UEAA_NAEBVQString@@@Z", "?endCDATA@QXmlDefaultHandler@@UEAA_NXZ", "?startCDATA@QXmlDefaultHandler@@UEAA_NXZ", "?endEntity@QXmlDefaultHandler@@UEAA_NAEBVQString@@@Z", "?startEntity@QXmlDefaultHandler@@UEAA_NAEBVQString@@@Z", "?endDTD@QXmlDefaultHandler@@UEAA_NXZ", "?startDTD@QXmlDefaultHandler@@UEAA_NAEBVQString@@00@Z", "?resolveEntity@QXmlDefaultHandler@@UEAA_NAEBVQString@@0AEAPEAVQXmlInputSource@@@Z", "?unparsedEntityDecl@QXmlDefaultHandler@@UEAA_NAEBVQString@@000@Z", "?notationDecl@QXmlDefaultHandler@@UEAA_NAEBVQString@@00@Z", "?skippedEntity@QXmlDefaultHandler@@UEAA_NAEBVQString@@@Z", "?processingInstruction@QXmlDefaultHandler@@UEAA_NAEBVQString@@0@Z", "?ignorableWhitespace@QXmlDefaultHandler@@UEAA_NAEBVQString@@@Z", "?endPrefixMapping@QXmlDefaultHandler@@UEAA_NAEBVQString@@@Z", "?startPrefixMapping@QXmlDefaultHandler@@UEAA_NAEBVQString@@0@Z", "?endDocument@QXmlDefaultHandler@@UEAA_NXZ", "?startDocument@QXmlDefaultHandler@@UEAA_NXZ", "?setDocumentLocator@QXmlDefaultHandler@@UEAAXPEAVQXmlLocator@@@Z", "??0QXmlDefaultHandler@@QEAA@XZ", "??1QXmlDefaultHandler@@UEAA@XZ", "?value@QXmlAttributes@@QEBA?AVQString@@AEBV2@@Z", "?message@QXmlParseException@@QEBA?AVQString@@XZ", "?columnNumber@QXmlParseException@@QEBAHXZ", "?lineNumber@QXmlParseException@@QEBAHXZ", "?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z", "?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ", "?uncaught_exception@std@@YA_NXZ", "?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z", "?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z", "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z", "?endl@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z", "?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A", "?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A", "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z", "?_Xout_of_range@std@@YAXPEBD@Z", "?_Xlength_error@std@@YAXPEBD@Z", "?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ", "??3@YAXPEAX@Z", "CxxThrowException", "memcpy", "??2@YAPEAX_K@Z", "purecall", "memcmp", "iob_func", "fflush", "printf", "memset", "??0exception@std@@QEAA@AEBQEBD@Z", "?what@exception@std@@UEBAPEBDXZ", "isalpha", "??1exception@std@@UEAA@XZ", "memmove", "CxxFrameHandler3", "C_specific_handler", "unlock", "dllonexit", "lock", "onexit", "?terminate@@YAXXZ", "amsg_exit", "getmainargs", "XcptFilter", "exit", "cexit", "exit", "initenv", "initterm", "initterm_e", "configthreadlocale", "setusermatherr", "commode", "fmode", "set_app_type", "?_type_info_dtor_internal_method@type_info@@QEAAXXZ", "crt_debugger_hook", "isalnum", "isdigit", "isspace", "free", "??_V@YAXPEAX@Z", "realloc", "??0exception@std@@QEAA@AEBV01@@Z", "getenv", "snprintf", "strtoul", "strtol", "fopen", "fclose", "fread", "feof", "stat64i32", "puts", "GetCurrentProcessId", "GetCurrentThreadId", "GetTickCount", "QueryPerformanceCounter", "RtlCaptureContext", "RtlLookupFunctionEntry", "RtlVirtualUnwind", "IsDebuggerPresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "Sleep", "DecodePointer", "EncodePointer", "GetSystemTimeAsFileTime" ], "ms": { "pe": { "entry": 951080.0, "machine": 34404.0, "checksum": 1516769.0, "rsrc_size": 512.0, "subsystem": 3.0, "timestamp": 1398352625.0, "image_base": 5368709120.0, "has_checksum": true, "has_manifest": true, "rsrc_entropy": 5.1, "entry_section": ".text", "size_of_image": 1527808.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_MANIFEST" ], "characteristics": 34.0, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 0.0, "import_dll_count": 5.0, "computed_checksum": 1516769.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 33088.0, "has_export_timestamp": false, "linker_major_version": 10.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 1504256.0 }, "binary": { "code_size": 1094656.0, "func_count": 2675.0, "code_entropy": 6.21, "data_entropy": 5.08, "func_density": 2.5, "import_count": 380.0, "string_count": 2002.0, "avg_func_size": 561.86, "section_count": 6.0, "avg_complexity": 17.9, "import_density": 0.36, "max_complexity": 47.0, "string_density": 1.87, "overall_entropy": 4.93, "avg_basic_blocks": 31.14, "avg_section_size": 250538.67, "dependency_count": 5.0, "entropy_variance": 1.1, "avg_string_length": 27.52, "complexity_per_kb": 0.02, "max_string_length": 168.0, "wide_string_count": 1.0, "avg_string_entropy": 3.51, "code_to_data_ratio": 2.68, "data_to_file_ratio": 0.0, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.73, "total_basic_blocks": 903.0, "func_analysis_depth": 2.0, "string_length_stddev": 21.98, "largest_section_ratio": 0.73, "sentence_string_count": 432.0, "sentence_string_ratio": 0.22, "writable_section_count": 1.0, "behavioral_import_ratio": 0.01, "executable_section_count": 1.0, "high_entropy_string_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".pdata" ], [ 647, "@.rsrc" ], [ 687, "@.reloc" ], [ 1717, "SVWH" ], [ 2773, "SUVWH" ], [ 4389, "SUVWATH" ], [ 5237, "UVWH" ], [ 6521, "VWATH" ], [ 10339, "USVWH" ], [ 11157, "UVWATAUAVAWH" ], [ 14656, "@USVWATAUAVH" ], [ 15568, "@UVWATAUAVAWH" ], [ 24442, "USVWATAUAVAWH" ], [ 24628, "Uoff" ], [ 39410, "L$ UVWATAUAVAWH" ], [ 42349, "93~%fffffff" ], [ 43637, "H UATAUAVAWH" ], [ 45437, "93~'fffffff" ], [ 46062, "GXE3" ], [ 57884, "t$ WATAUAVAWH" ], [ 69858, "uoffff" ], [ 71412, "Q 9Q" ], [ 108447, "t/fffffff" ], [ 109475, "UWATH" ], [ 139475, "EX9E" ], [ 164991, "tEfffffff" ], [ 182560, "tQffffff" ], [ 248816, "t-ffffff" ], [ 253328, "@USVWATAUAVAWH" ], [ 253888, "EXH9EP" ], [ 255647, "tAfffffff" ], [ 304357, "USVWATH" ], [ 374805, "EHE3" ], [ 375003, "A 9A" ], [ 378359, "E8E3" ], [ 395457, "Uofffff" ], [ 397489, "Uwfffff" ], [ 406017, "tPfffff" ], [ 408303, "A9NH" ], [ 438276, "Mhff" ], [ 440471, "L1HH" ], [ 440502, "L1PH" ], [ 440577, "T1XH" ], [ 478288, "tRffffff" ], [ 483116, "I D3" ], [ 509776, "@SUVWATAUAVH" ], [ 525786, "SUVWATAUAVAWH" ], [ 532513, "tsfffff" ], [ 534146, "gffffffff" ], [ 536639, "SVWATH" ], [ 542092, "gfffffffL" ], [ 548895, "G03C0" ], [ 551216, "@SUVWATAUAVAWH" ], [ 555141, "USWH" ], [ 555470, "M7H3" ], [ 557417, "gfffffffI" ], [ 558158, "gfffffffM" ], [ 562178, "gfffffffH" ], [ 564230, "\u003c\u003ctm\u003c\"tiH" ], [ 575386, "\u003c\u003ctv\u003c\"trI" ], [ 576985, "/u2H" ], [ 582962, "L$ USVWATAUAVAWH" ], [ 616860, "H D3" ], [ 625792, "tfffffff" ], [ 628144, "@UATAUAVAWH" ], [ 703020, "AL2BL" ], [ 710063, "/HcE" ], [ 742828, "E H9E" ], [ 761713, "MXfffff" ], [ 801943, "A1F A" ], [ 852380, "V E3" ], [ 854977, "W E3" ], [ 872065, "UXE3" ], [ 879560, "P8E3" ], [ 880571, "UPE3" ], [ 883063, "l$ VATAUAVAWH" ], [ 926647, "lu.A8@" ], [ 930949, "8kui" ], [ 931093, "8ruu" ], [ 950277, "SUWH" ], [ 1093874, "t.ffff" ], [ 1099448, "unable to create directory '%1'" ], [ 1099812, "void" ], [ 1100616, "%ARGUMENTS" ], [ 1100632, "%ARGUMENT_NAMES" ], [ 1100648, "%FUNCTION_NAME" ], [ 1100664, "%RETURN_TYPE" ], [ 1100720, "c:\\qt\\qt-4.8.5-msvc2010-x64\\include\\qtcore\\../../src/corelib/tools/qlist.h" ], [ 1100960, "generating: %1" ], [ 1101088, "char" ], [ 1101184, "const char*" ], [ 1101480, "Couldn't find the package name!!" ], [ 1101808, "_wrapper.cpp" ], [ 1101864, "Shiboken::Object::destroy(wrapper, this);" ], [ 1101920, "SbkObject* wrapper = Shiboken::BindingManager::instance().retrieveWrapper(this);" ], [ 1102064, "::qt_metacast(_clname);" ], [ 1102088, "return" ], [ 1102096, "* \u003e(this));" ], [ 1102112, "return static_cast\u003cvoid*\u003e(const_cast\u003c" ], [ 1102152, "if (pySelf \u0026\u0026 PySide::inherits(Py_TYPE(pySelf), _clname))" ], [ 1102224, "SbkObject* pySelf = Shiboken::BindingManager::instance().retrieveWrapper(this);" ], [ 1102304, "if (!_clname) return 0;" ], [ 1102328, "::qt_metacast(const char* _clname)" ], [ 1102416, "Py_XDECREF(pyResult);" ], [ 1102448, "if (PyErr_Occurred()" ], [ 1102472, "|| !pyResult" ], [ 1102536, "if (!Shiboken::Object::isValid(" ], [ 1102608, "There's no user provided way (conversion rule, argument removal, custom code, etc) to handle the primitive %1 type '%2' in funct" ], [ 1102752, "argument" ], [ 1102784, "Py_INCREF(Py_None);" ], [ 1102808, "pyResult = Py_None;" ], [ 1103080, "is_%1_PythonToCpp_%2_Convertible" ], [ 1103264, "cppInRef" ], [ 1103280, "%OUTTYPE" ], [ 1103312, "%INTYPE" ], [ 1103416, "return Shiboken::Conversions::nonePythonToCppNullPtr;" ], [ 1103472, "if (pyIn == Py_None)" ], [ 1103520, "static PythonToCppFunc" ], [ 1103592, "Shiboken::Conversions::addPythonToCppValueConversion(" ], [ 1103696, "Shiboken::Conversions::registerConverterName(" ], [ 1103760, "PySequence" ], [ 1103800, "PyObject" ], [ 1103816, "= Shiboken::Conversions::createConverter(" ], [ 1103864, "// Register converter for type '" ], [ 1104000, "return reinterpret_cast\u003cPyTypeObject*\u003e(\u0026SbkObject_Type)-\u003etp_traverse(self, visit, arg);" ], [ 1104088, "_traverse(PyObject* self, visitproc visit, void* arg)" ], [ 1104144, "static int" ], [ 1104208, "return reinterpret_cast\u003cPyTypeObject*\u003e(\u0026SbkObject_Type)-\u003etp_clear(self);" ], [ 1104288, "_clear(PyObject* self)" ], [ 1104352, "return Shiboken::Conversions::copyToPython(Shiboken::Conversions::PrimitiveTypeConverter\u003cint\u003e(), \u0026val);" ], [ 1104520, "static PyObject*" ], [ 1104584, "return val != 0;" ], [ 1104608, "__nonzero(PyObject* self)" ], [ 1104688, "/*nb_index*/ 0" ], [ 1104720, "/*nb_inplace_true_divide*/ 0," ], [ 1104752, "/*nb_inplace_floor_divide*/ 0," ], [ 1104784, "/*nb_true_divide*/ 0," ], [ 1104816, "/*nb_floor_divide*/ 0," ], [ 1104848, "/*nb_inplace_or*/ 0," ], [ 1104880, "/*nb_inplace_xor*/ 0," ], [ 1104912, "/*nb_inplace_and*/ 0," ], [ 1104944, "/*nb_inplace_rshift*/ 0," ], [ 1104976, "/*nb_inplace_lshift*/ 0," ], [ 1105008, "/*nb_inplace_power*/ 0," ], [ 1105040, "/*nb_inplace_remainder*/ 0," ], [ 1105072, "/*nb_inplace_divide*/ 0," ], [ 1105104, "/*nb_inplace_multiply*/ 0," ], [ 1105136, "/*nb_inplace_subtract*/ 0," ], [ 1105168, "/*nb_inplace_add*/ 0," ], [ 1105200, "/*nb_hex*/ 0," ], [ 1105232, "/*nb_oct*/ 0," ], [ 1105264, "/*nb_long*/" ], [ 1105304, "/*nb_float*/ 0," ], [ 1105336, "/*nb_reserved*/ 0," ], [ 1105424, "/* nb_coerce */ 0," ], [ 1105472, "/*nb_or*/ (binaryfunc)" ], [ 1105536, "/*nb_xor*/ (binaryfunc)" ], [ 1105600, "/*nb_and*/ (binaryfunc)" ], [ 1105648, "/*nb_rshift*/ 0," ], [ 1105680, "/*nb_lshift*/ 0," ], [ 1105728, "/*nb_invert*/ (unaryfunc)" ], [ 1105784, "/*nb_nonzero*/" ], [ 1105816, "/*nb_absolute*/ 0," ], [ 1105848, "/*nb_positive*/ 0," ], [ 1105880, "/*nb_negative*/ 0," ], [ 1105912, "/*nb_power*/ 0," ], [ 1105944, "/*nb_divmod*/ 0," ], [ 1105976, "/*nb_remainder*/ 0," ], [ 1106016, "/* nb_divide */ 0," ], [ 1106064, "/*nb_multiply*/ 0," ], [ 1106096, "/*nb_subtract*/ 0," ], [ 1106128, "/*nb_add*/ 0," ], [ 1106176, "static PyNumberMethods" ], [ 1106240, "cppResult" ], [ 1106272, "cppResult = cppSelf" ], [ 1106424, "cppResult, cppSelf, cppArg;" ], [ 1106512, "flagsEntry" ], [ 1106528, "c:\\Downloads\\pyside-setup\\sources\\shiboken\\generator\\shiboken\\cppgenerator.cpp" ], [ 1106648, "PyBool_FromLong(cppResult)" ], [ 1106696, "cppResult =" ], [ 1106712, "bool" ], [ 1106792, "return PyObject_GenericSetAttr(self, name, value);" ], [ 1106848, "return PySide::Property::setValue(reinterpret_cast\u003cPySideProperty*\u003e(pp.object()), self, value);" ], [ 1106976, "Shiboken::AutoDecRef pp(reinterpret_cast\u003cPyObject*\u003e(PySide::Property::getObject(self, name)));" ], [ 1107168, "PyErr_SetString(PyExc_IndexError, \"" ], [ 1107264, "QList\u003cT\u003e::at" ], [ 1107280, "index out of range" ], [ 1107696, "cppSelf" ], [ 1107752, "std::swap(self, pyArg);" ], [ 1107776, "if (isReverse)" ], [ 1107816, "bool isReverse =" ], [ 1107880, "pythonToCpp%1" ], [ 1107896, "pyArgs(\\[\\d+[-]?\\d*\\])" ], [ 1108064, "else" ], [ 1108080, "if (Shiboken::Conversions::isImplicitConversion((SbkObjectType*)" ], [ 1108176, "(long)" ], [ 1108208, "%1_local" ], [ 1108408, "static void" ], [ 1108464, "PyObject_TypeCheck(pyIn, %1)" ], [ 1108576, "PyObject_TypeCheck(%in, %1)" ], [ 1108608, "User added implicit conversion for C++ type '%1' must provide either an input type check function or a non primitive type entry." ], [ 1108784, "PyObject_TypeCheck(%in, \u0026PyBaseObject_Type)" ], [ 1108832, "PyType_Check(%in)" ], [ 1108856, "PyTypeObject" ], [ 1108872, "Shiboken::Object::checkType(%in)" ], [ 1108912, "SbkObject" ], [ 1108928, "Shiboken::isShibokenEnum(%in)" ], [ 1108960, "SbkEnumType" ], [ 1108992, "*((%1*)cppOut)" ], [ 1109064, "return pyResult;" ], [ 1109104, "pyResult" ], [ 1109120, "___copy__(PyObject* self)" ], [ 1109200, "return pyOut;" ], [ 1109216, "Shiboken::Object::setParent(self, pyOut)" ], [ 1109264, ", false, true);" ], [ 1109280, "Shiboken::Object::newObject((SbkObjectType*)" ], [ 1109328, "PyObject* pyOut =" ], [ 1109352, "cppOut_local" ], [ 1109368, "cppOut_local =" ], [ 1109392, "fieldValue" ], [ 1109408, "fieldValue =" ], [ 1109520, "invert" ], [ 1109552, ", pyResult);" ], [ 1109568, "Shiboken::Object::setParent(" ], [ 1109672, "static Py_hash_t" ], [ 1109736, "} // extern C" ], [ 1109760, "return Shiboken::String::fromFormat(\"\u003c%s at %p\u003e\", str.constData(), self);" ], [ 1109840, "return Shiboken::String::fromFormat(\"\u003c%s.%s at %p\u003e\", Shiboken::String::toCString(mod), str.constData(), self);" ], [ 1109968, "PyObject* mod = PyDict_GetItemString(Py_TYPE(self)-\u003etp_dict, \"__module__\");" ], [ 1110048, "str.replace(0, idx, Py_TYPE(self)-\u003etp_name);" ], [ 1110112, "int idx = str.indexOf('(');" ], [ 1110144, "QByteArray str = buffer.data();" ], [ 1110176, "buffer.close();" ], [ 1110192, "dbg \u003c\u003c" ], [ 1110200, "QDebug dbg(\u0026buffer);" ], [ 1110224, "buffer.open(QBuffer::ReadWrite);" ], [ 1110264, "QBuffer buffer;" ], [ 1110304, "extern \"C\"" ], [ 1110320, "__repr__" ], [ 1110376, "*node == e || (*node)-\u003enext" ], [ 1110416, "c:\\qt\\qt-4.8.5-msvc2010-x64\\include\\qtcore\\../../src/corelib/tools/qhash.h" ], [ 1110736, "PyNumber_Check(pyIn)" ], [ 1110760, "number" ], [ 1110768, "(QFlag(PyLong_AsLong(pyLong.object())));" ], [ 1110816, "Shiboken::AutoDecRef pyLong(PyNumber_Long(pyIn));" ], [ 1110872, "(QFlag(Shiboken::Enum::getValue(pyIn)));" ], [ 1110936, "Shiboken::Enum::newItem(" ], [ 1110976, "reinterpret_cast\u003cPyObject*\u003e(PySide::QFlags::newObject(castCppIn," ], [ 1111088, ") Shiboken::Enum::getValue(pyIn)" ], [ 1111136, "(QFlag(PySide::QFlags::getValue(reinterpret_cast\u003cPySideQFlagsObject*\u003e(pyIn))))" ], [ 1111236, "enum" ], [ 1111696, "|METH_STATIC" ], [ 1111712, "|METH_KEYWORDS" ] ], "sz": 1504256, "ts": [ { "c": 0.8999999761581421, "d": "Close stdio file", "e": [ "fclose" ], "i": "micro-behaviors/os/stdio::fclose", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1398352625.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "215110" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "value = PyDict_GetItemString(kwds, \"", "if (PyDict_SetItemString(((SbkObjectType*)", "PyErr_SetString(PyExc_NotImplementedError, \"operator not implemented.\");", "return Shiboken::String::fromFormat(\"\u003c%s.%s at %p\u003e\", Shiboken::String::toCString(mod), str.constData(), self);", "QString", "PyErr_SetString(PyExc_TypeError, \"attributed value with wrong type, '", "PyErr_SetString(PyExc_TypeError, \"'", "PyErr_SetString(PyExc_TypeError, \"", "return Shiboken::String::fromFormat(\"\u003c%s at %p\u003e\", str.constData(), self);", "PyString", "PyDict_SetItemString(", "if (Shiboken::String::compare(name, \"", "PyErr_SetString(PyExc_IndexError, \"", "PyErr_SetString(PyExc_TypeError, \"wrong type attributed to '", "PyObject* mod = PyDict_GetItemString(Py_TYPE(self)-\u003etp_dict, \"__module__\");", "PyErr_SetString(PyExc_NotImplementedError, \"reverse operator not implemented.\");" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "File used for copyright headers of generated files" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 512.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.51" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 2002.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "token" ], "i": "micro-behaviors/data/text/keywords/lexicon::token", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 380.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "215110" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 380.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "215110" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "215110" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2002.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "… Replaces and overrides command line arguments" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.93" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 2675.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "c0", "c9" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014" }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 380.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output-directory=\u003cpath\u003e", "output-directory", "Can't create output directory:" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 380.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8500000238418579, "d": "XOR byte then zero-extend", "e": [ "fb ff" ], "i": "micro-behaviors/crypto/symmetric/xor/loop::x64-xor-imm8-widen-loop", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.93" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 2675.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "c:\\Downloads\\pyside-setup\\sources\\shiboken\\generator\\shiboken\\cppgenerator.cpp", "c:\\Downloads\\pyside-setup\\sources\\shiboken\\generator\\shiboken\\shibokengenerator.cpp" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1 }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0xa328acb1" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 380.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "binary.import_count = 380.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 380.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8500000238418579, "d": "Get stream buffer array", "e": [ "iob_func" ], "i": "micro-behaviors/os/stdio::iob-func", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 903.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 380.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Formatted console output", "e": [ "printf" ], "i": "micro-behaviors/os/stdio::printf", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.22" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Prototype pollution guard checks constructor", "e": [ "constructor" ], "i": "objectives/supply-chain/metadata-anomaly/prototype::js-proto-guard-constructor", "l": 2 }, { "c": 0.8999999761581421, "d": "Minimal resource section footprint", "e": [ ".rsrc (size: 512)" ], "i": "well-known/malware/virus/virlock::tiny-rsrc-section", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 380.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-over-120", "l": 1, "m": "B0032" }, { "d": "Polymorphic code terminology", "e": [ "polymorphic" ], "i": "objectives/anti-analysis/self-modify/runtime::polymorphic-ref", "l": 3 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 1.0, "d": "se comma space fragment", "e": [ ", false, true);" ], "i": "well-known/malware/dropper/nemucod::frag-se", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory compare", "e": [ "memcmp" ], "i": "micro-behaviors/mem/c-runtime/functions::memcmp", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "public", "Avoid the use of the '#define protected public' hack.", "#define protected public" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 380.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 380.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Signal application directory", "e": [ "signal/" ], "i": "objectives/supply-chain/trojanized/app/asar::signal-app-path", "l": 1, "m": "E1478" }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.21" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "DESIGNABLE", "UVWATAUAVAWH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 2675.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2002.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has many functions", "e": [ "binary.func_count = 2675.00" ], "i": "metadata/lang/compiler/aot::huge-runtime-function-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Reallocate memory", "e": [ "realloc" ], "i": "micro-behaviors/mem/c-runtime/functions::realloc", "l": 2 }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "binary.func_count = 2675.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-6--inline-3846", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2002.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.699999988079071, "d": "Read stream (fread)", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "One .text section dominates file", "e": [ "binary.text_to_file_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::text-heavy-binary", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2002.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "?absolutePath@QDir@@QEBA?AVQString@@XZ", "?tempPath@QDir@@SA?AVQString@@XZ", "?absolutePath@QFileInfo@@QEBA?AVQString@@XZ", "Paths used when searching for typesystems" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "/*tp_cache*/ 0," ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.import_count = 380.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-3--inline-29165", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 2675.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemTimeAsFileTime", "SetUnhandledExceptionFilter", "GetCurrentProcessId", "MultipleInheritanceInitFunction", "PrimitiveTypeConverter", "RtlLookupFunctionEntry", "SbkDeallocWrapperWithPrivateDtor", "UnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.func_count = 2675.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "0a 00 20 fb", "0b 00 a0 67", "05 00 e0 72", "06 00 d0 fd", "06 00 e0 7b", "06 00 20 6b", "06 00 b0 87", "06 00 30 a6", "04 00 10 43", "09 00 b0 3f", "08 00 b0 1e" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 2675.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.func_count = 2675.00" ], "i": "objectives/command-and-control/dropper/execution/inject::self-map-extract-execute-cond-4--inline-11988", "l": 1 }, { "c": 0.30000001192092896, "d": "getenv function (read environment variable)", "e": [ "getenv" ], "i": "micro-behaviors/os/env/vars/access::getenv", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.import_count = 380.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-9--inline-29171", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "13.48.152.126:4562" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "215110" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "13.48.152.126:4562" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.9300000071525574, "d": "External IPv4:port literal in rdata", "e": [ "13.48.152.126:4562" ], "i": "objectives/command-and-control/infrastructure/ip-port::external-ipv4-port-rdata-large", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "args" ], "i": "well-known/malware/backdoor/supernova::supernova-parameter-set--rx-2", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 380.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-4--inline-29205", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, RtlCaptureContext, ... +11 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links QtCore4.dll (??6QTextStream@@QEAAAEAV0@D@Z, ?remove@QByteArray@@QEAAAEAV1@HH@Z, ?chop@QByteArray@@QEAAXH@Z, ?endsWith@QByteArray@@QEBA_NPEBD@Z, ?startsWith@QByteArray@@QEBA_NPEBD@Z, ... +253 more)", "e": [ "QtCore4.dll" ], "i": "metadata/dylib::qtcore4/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCP100.dll (?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ, ?uncaught_exception@std@@YA_NXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ... +8 more)", "e": [ "MSVCP100.dll" ], "i": "metadata/dylib::msvcp100/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links QtXml4.dll (??0QXmlInputSource@@QEAA@PEAVQIODevice@@@Z, ??0QXmlSimpleReader@@QEAA@XZ, ?setContentHandler@QXmlSimpleReader@@UEAAXPEAVQXmlContentHandler@@@Z, ?setErrorHandler@QXmlSimpleReader@@UEAAXPEAVQXmlErrorHandler@@@Z, ?parse@QXmlSimpleReader@@UEAA_NPEBVQXmlInputSource@@_N@Z, ... +33 more)", "e": [ "QtXml4.dll" ], "i": "metadata/dylib::qtxml4/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVCR100.dll (??3@YAXPEAX@Z, CxxThrowException, memcpy, ??2@YAPEAX_K@Z, purecall, ... +50 more)", "e": [ "MSVCR100.dll" ], "i": "metadata/dylib::msvcr100/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.has_rich_header = 1.00", "binary.import_count = 380.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.func_count = 2675.00", "binary.overall_entropy = 4.93" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "esnq,uxqd,doushdr\u003c#=UxqdDousx1?Z:UxqdDou \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "6b457f177571eebdc87c1128049be7f1b716d564b12fb2a6ba9cd3e994e63d9b", "path": "/data/samples/good/datasets/pe-machine-learning-dataset/215110", "type": "pe" } ], "tv": "4872c" } }