{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.9028112, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T07:09:24Z" }, "path": "175630", "raw": { "v": "4", "fs": [ { "f": "O₇(As₁₁C₅I₂CoErPS)H₄(OsPo₂U₂Cm)Md₄(Bi₃Si)", "x": 157, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "CopySid", "ImageList_Add", "Pie", "memcpy", "NetWkstaGetInfo", "IsEqualGUID", "LresultFromObject", "VariantInit", "Shell_NotifyIconW", "GetDC", "VerQueryValueW", "sndPlaySoundW", "ClosePrinter" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 499200.0, "subsystem": 2.0, "timestamp": 1520601214.0, "image_base": 15728640.0, "rsrc_entropy": 7.98, "entry_section": "UPX1", "size_of_image": 11145216.0, "timestamp_day": 9.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2018.0, "characteristics": 33167.0, "entry_point_rva": 10643456.0, "size_of_headers": 4096.0, "timestamp_month": 3.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 14.0, "manifest_present": true, "computed_checksum": 6286145.0, "dos_stub_modified": true, "section_alignment": 4096.0, "delay_load_imports": 1.0, "number_of_sections": 3.0, "resource_timestamp": 1281982896.0, "linker_major_version": 2.0, "linker_minor_version": 25.0, "api_hashing_indicators": 1.0, "resource_timestamp_day": 16.0, "resource_timestamp_year": 2010.0, "export_timestamp_present": false, "resource_timestamp_month": 8.0, "resource_timestamp_present": true, "entry_in_nonstandard_section": true }, "binary": { "code_size": 5721088.0, "file_size": 6223360.0, "entry_point": 10643456.0, "has_overlay": true, "wx_sections": 2.0, "code_entropy": 3.93, "import_count": 19.0, "overlay_size": 2048.0, "string_count": 2919.0, "overlay_ratio": 0.0, "section_count": 3.0, "avg_complexity": 6.6, "function_count": 15.0, "import_density": 0.0, "max_complexity": 29.0, "string_density": 0.52, "overall_entropy": 5.28, "overlay_entropy": 7.71, "avg_basic_blocks": 10.07, "avg_section_size": 2073429.38, "dependency_count": 14.0, "entropy_variance": 3.74, "function_density": 0.0, "avg_function_size": 133.4, "avg_string_length": 5.68, "complexity_per_kb": 0.0, "max_string_length": 186.0, "wide_string_count": 28.0, "writable_sections": 3.0, "avg_string_entropy": 2.18, "code_to_data_ratio": 11.46, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.08, "total_basic_blocks": 151.0, "executable_sections": 2.0, "high_entropy_regions": 2.0, "string_length_stddev": 5.94, "largest_section_ratio": 0.92, "sentence_string_count": 5.0, "sentence_string_ratio": 0.0, "behavioral_import_ratio": 0.21, "function_analysis_depth": 2.0, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 80, "This program must be run under Win32\r\n$7" ], [ 504, "UPX0" ], [ 544, "UPX1" ], [ 584, ".rsrc" ], [ 987, "3.09" ], [ 1034, "Boolean" ], [ 1056, "True" ], [ 1061, "System" ], [ 1105, "ShortInt" ], [ 1173, "Ca.in" ], [ 1233, "NativeHs" ], [ 1303, "gCurrhcy" ], [ 1490, "HRESULT" ], [ 1583, "Rightk" ], [ 1690, "face" ], [ 2089, "Object" ], [ 2361, "gAddzsK" ], [ 2440, "Fnld" ], [ 2589, "Hash" ], [ 2739, "faul" ], [ 3003, "HPPGEN" ], [ 3175, "Lock" ], [ 3188, "sk67" ], [ 3375, "Timeou" ], [ 4088, "serve" ], [ 5647, "Unfoa" ], [ 6396, "LibModule" ], [ 6535, "Idlifi" ], [ 6608, "Mwoe" ], [ 6664, "6pon" ], [ 6765, "Plic" ], [ 7192, "k has occ" ], [ 9772, "SMBDZ" ], [ 17267, "ical" ], [ 19046, "HZTUWV" ], [ 19268, "r6t0" ], [ 21419, "ENDZ" ], [ 27024, "Hant" ], [ 27033, "@es-ES_tradn" ], [ 27069, "lhJRaz-Latn-AZ" ], [ 27183, "7ong" ], [ 27374, "Thre" ], [ 28170, "Xu h" ], [ 28603, "ngPathNameWu" ], [ 29229, "OYO5" ], [ 29880, "PInstItem" ], [ 29902, "T/.TBucketAr%" ], [ 29966, "ance" ], [ 30007, "hod36" ], [ 30062, "Regi" ], [ 30182, "ritiali" ], [ 30282, "move" ], [ 30372, "FT 0" ], [ 31232, "Z0HL" ], [ 31624, "KUTQMP" ], [ 33950, "v4vo" ], [ 35287, "6XRE" ], [ 36028, "tegerDynXeX" ], [ 36069, "TDuplicFss\\" ], [ 36099, "Accept" ], [ 36127, "ction" ], [ 36715, "Offs" ], [ 36826, "Right" ], [ 36949, "Width" ], [ 37326, "Perce" ], [ 37366, "Timeout" ], [ 37375, "Abanu" ], [ 40802, "Bord" ], [ 40835, "Minim" ], [ 40849, "Help" ], [ 40929, "CharCas" ], [ 41022, "Fixe" ], [ 41056, "Proof" ], [ 41654, "ovrp/p" ], [ 41806, "PLPWSTR" ], [ 41923, "_CRIbCA" ], [ 41935, "SECON_DEBUG \t%" ], [ 42156, "HWND" ], [ 42168, "HHOOK1" ], [ 42195, "HACCELap_B" ], [ 42210, "MAP1" ], [ 42267, "ETTE" ], [ 42655, "E4AN" ], [ 42673, "vicej" ], [ 42706, "Vjdmw" ], [ 43358, "omboBox" ], [ 43405, "SCROLL" ], [ 43489, "o0UoGESTURE" ], [ 45238, "OVT2SW" ], [ 45749, "RSTU" ], [ 45757, "VWXY" ], [ 45788, "EFGH" ], [ 45796, "IJKL" ], [ 45804, "MNO0" ], [ 45812, "1234" ], [ 45820, "5678" ], [ 46032, "IJKLMHNHOH" ], [ 48293, "2wvi" ], [ 49588, "Km m" ], [ 50065, "OPQR" ], [ 50101, "de;fghi\u0026jkl\u003cmnoaeg" ], [ 50489, ".567" ], [ 52339, "Acquireo" ], [ 52461, "Args" ], [ 52727, "Throw" ], [ 53041, "validOp" ], [ 53621, "Math" ], [ 53850, "Cast" ], [ 53930, "cc(Violat" ], [ 54546, "tImpleN" ], [ 54659, "matSett" ], [ 55366, "ctive" ], [ 55425, "FHashTabl" ], [ 55701, ".ait" ], [ 56002, "MaxCapac" ], [ 56046, "Scrrr" ], [ 56232, "Vare" ], [ 56640, "Source" ], [ 56707, "Equal" ], [ 56929, "couk" ], [ 57812, "\"PADefafK" ], [ 58665, "MagNFMBToW" ], [ 58945, "IB1D" ], [ 59060, "IBAP" ], [ 62652, "ul54" ], [ 70381, "JEAV" ], [ 72451, "Sodts" ], [ 72679, "UOHP" ], [ 79785, "PUnitHashEntryl\u0026'kb" ], [ 79836, "Prev" ], [ 79885, "DupsAllo" ], [ 79940, "Validat" ], [ 79956, "Array" ], [ 87228, "6T1Q" ], [ 87979, "`wCq`" ], [ 88366, "Q0QI" ], [ 89624, "P8 8" ], [ 91021, "i0pd" ], [ 91108, "TDWordFiller" ], [ 91132, "TMessage" ], [ 91276, "TWMKeyC" ], [ 91318, "Unus" ], [ 91344, "Datac" ], [ 92133, "otAddSubMul" ], [ 92175, "Cmp_4FromStC\u003eRJ$dh" ], [ 92562, "Self" ], [ 92775, "Righ" ], [ 92856, "ions" ], [ 93320, "NotImpl" ], [ 93362, "OutOfMemory" ], [ 93451, "Dispatch" ], [ 93578, "Bicj" ], [ 94270, "FY_ZG" ], [ 95490, "7YU7K" ], [ 96641, "gq82" ], [ 107247, "/Wkd" ], [ 107850, "System.Variants'" ], [ 109025, "IEnumString" ], [ 109053, "W2api.ActiveX" ], [ 109077, "tagSTAT" ], [ 109103, "pwcsNam" ], [ 109184, "LocksSupportedL" ], [ 109222, "eBits/D" ], [ 109234, "reservy5" ], [ 109250, "ISequen" ], [ 109322, "cepInfo" ], [ 109339, "TFNDefZ" ], [ 109378, "EXCEPINFOp)" ], [ 109523, "78um" ], [ 109577, "fica" ], [ 109650, "F.TIFrll" ], [ 109831, "ELPHICLASS" ], [ 109868, "doOwnsKey" ], [ 109907, "Zshbs" ], [ 115300, "EInsufZ" ], [ 115313, "Rtti" ], [ 115363, "Error" ], [ 115398, "ENonPubl" ], [ 115635, "WMethod" ], [ 116111, "t/Boolea" ], [ 116537, "M_RVrfx" ], [ 117163, "Decl" ], [ 117325, "Kind" ], [ 117363, "Base" ], [ 117570, "Visibi" ], [ 117611, "6uctu" ], [ 117811, "Offse" ], [ 119564, "Virt" ], [ 119915, "VD6Q" ], [ 119940, "Isds" ], [ 120651, "Unit" ], [ 121568, "QEnumeru" ], [ 122013, "Dime" ], [ 122198, "OleAuto" ], [ 122561, "text" ], [ 122789, "Utils" ], [ 122903, "xj63" ], [ 123117, "/fa7GY2" ], [ 123213, "ics.4" ], [ 123266, "Item" ], [ 124089, "Deletcu" ], [ 124446, "Trim" ], [ 124451, "esq4x" ], [ 126172, "FGrowThreshol" ], [ 126856, "Heapb" ], [ 131250, "Uvsl" ], [ 131315, "Rfzf" ], [ 135263, "XA32" ], [ 135564, "P2RPV" ], [ 137799, "fied" ], [ 137889, "TOrphan" ], [ 138098, "Pool" ], [ 138412, "Next" ], [ 138611, "HashCode" ], [ 138701, "Defaults" ], [ 138726, "Event" ], [ 139265, "XA5X" ], [ 139958, "/6SG" ], [ 141681, "ackage" ], [ 144458, "akeClosurQ" ], [ 144499, "Custom" ], [ 144814, "Func" ], [ 144890, "umerator5" ], [ 145322, "AddRangei" ], [ 145533, "Deletc" ], [ 145730, "XI8G" ], [ 146604, "XH0T" ], [ 148153, "tance" ], [ 152228, "k0e8" ], [ 153294, "Crea" ], [ 154724, "NNNFO" ], [ 155929, "NNNFG" ], [ 156649, "/083" ], [ 157323, "Record" ], [ 163515, "FVirtual" ], [ 163605, "Handle" ], [ 166858, "ionary\u003cSystem.Poi" ], [ 166920, "Lapacity" ], [ 167988, "c1 x" ], [ 168813, "/WahX" ], [ 172128, "WHN1" ], [ 181438, "/BPSV" ], [ 181446, "JNUB" ], [ 182048, "8TComparison\u003cSystem.Rtti.TMet5" ], [ 182081, "hodI8l$enta\u0026B*P" ], [ 182121, "cs.Defaultso" ], [ 182714, "_?@Obj0\u003e\u003e.arrayofT" ], [ 182881, "VIEnumVable\t#\u003cJ" ], [ 183390, "9ZW9D" ], [ 183514, "Value" ], [ 183680, "Remov" ], [ 184095, "es9o" ], [ 190708, "isonc" ], [ 192217, "plementationtParamLoc" ], [ 194103, "Wp w" ], [ 195214, "TDL4" ] ], "sz": 6223360, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2919.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1036", "c": 0.8199999928474426, "d": "System tray icon manipulation", "e": [ "Shell_NotifyIconW" ], "i": "micro-behaviors/ui/window/notify::shell-notify-icon", "l": 3 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "jb o" ], "i": "micro-behaviors/crypto/symmetric/xor::asm-loop-control-transfer", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 499200)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "version.dll sideloading target", "e": [ "version.dll" ], "i": "objectives/command-and-control/dropper/sideload::sideload-target-version", "l": 1 }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 19.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Hidden task property", "e": [ "Hidden" ], "i": "objectives/persistence/login/scheduled-task::hidden-task-property", "l": 1, "m": "F0012" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Overrides WndProc method", "e": [ "ignWndProc" ], "i": "objectives/collection/clipboard/monitor::wndproc-override", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 499200, entropy: 7.98)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2919.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 2.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.60" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8799999952316284, "d": "Overlay manifest requires administrator", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator-overlay", "l": 3 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 499200.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.18" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "IJKLMHNHOH", "ELPHICLASS", "FNLVCOMPARE", "GDIPUTILE", "BBCANCEL", "BBIGNORE", "PREVIEWGLYPH", "SBDOWNDN", "SBLEFTDN", "SPINDOWN", "DLGTEMPLATE", "TEXTFILEDLG" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.28" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 6223360.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.800000011920929, "d": ".NET Socket Send/Receive methods", "e": [ "Send" ], "i": "micro-behaviors/communications/socket/create::socket-receive-send-str", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2919.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.9399999976158142, "d": "Hidden files visibility value", "e": [ "Hidden" ], "i": "metadata/file/text::hidden-files-value", "l": 3 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "binary.file_size = 6223360.00" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 6223360.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "175630" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 15.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1520601214.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "binary.file_size = 6223360.00" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "Resource-heavy PE with large .rsrc", "e": [ ".rsrc (size: 499200)" ], "i": "metadata/binary/resource::resource-heavy-rsrc", "l": 3 }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.98)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 3, "m": "C0027" }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 19.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1027.002", "c": 0.8500000238418579, "d": "High entropy PE resource section", "e": [ ".rsrc (size: 499200, entropy: 7.98)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-rsrc", "l": 4 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 5.68" ], "i": "objectives/anti-static/obfuscation/binary-metrics::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.8399999737739563, "d": "Compact high entropy overlay blob", "e": [ "binary.overlay_entropy = 7.71" ], "i": "objectives/anti-static/obfuscation/binary-metrics::compact-high-entropy-overlay", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2919.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.9800000190734863, "d": "Giant RWX UPX1 payload section", "e": [ "UPX1 (size: 5721088, entropy: 7.87, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::giant-rwx-upx1", "l": 4 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 6223360.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.699999988079071, "d": "Binary has 50 or fewer imports", "e": [ "binary.import_count = 19.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-50-imports", "l": 1 }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 5721088, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 0.800000011920929, "d": "winmm library import", "e": [ "winmm.dll" ], "i": "objectives/evasion/anti-av/import-pollution::winmm-library", "l": 1 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "binary.import_count = 19.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-80-imports", "l": 1 }, { "c": 0.7200000286102295, "d": "WinForms Label control token", "e": [ "Label" ], "i": "micro-behaviors/ui/controls/widget::winforms-label", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 19.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "c": 0.800000011920929, "d": "Abnormally low logic density for binary size", "e": [ "binary.complexity_per_kb = 0.00" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::low-complexity-large-binary", "l": 3 }, { "c": 0.699999988079071, "d": "Binary has 30 or fewer imports", "e": [ "binary.import_count = 19.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-30-imports", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1485", "c": 0.949999988079071, "d": "Large RWX UPX1 payload section", "e": [ "UPX1 (size: 5721088, perms: rwx)" ], "i": "objectives/impact/wipe/disk::fake-upx1-rwx", "l": 4 }, { "c": 0.75, "d": "Binary has 25 or fewer imports", "e": [ "binary.import_count = 19.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-25-imports", "l": 3 }, { "c": 0.949999988079071, "d": "links advapi32.dll (CopySid)", "e": [ "advapi32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links gdi32.dll (Pie)", "e": [ "gdi32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (memcpy)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (IsEqualGUID)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links oleaut32.dll (VariantInit)", "e": [ "oleaut32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (GetDC)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links winmm.dll (sndPlaySoundW)", "e": [ "winmm.dll" ], "i": "metadata/dylib::winmm/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links winspool.drv (ClosePrinter)", "e": [ "winspool.drv" ], "i": "metadata/dylib::winspool/drv", "l": 2 }, { "c": 0.949999988079071, "d": "links shell32.dll (Shell_NotifyIconW)", "e": [ "shell32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links netapi32.dll (NetWkstaGetInfo)", "e": [ "netapi32.dll" ], "i": "metadata/dylib::netapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comctl32.dll (ImageList_Add)", "e": [ "comctl32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links oleacc.dll (LresultFromObject)", "e": [ "oleacc.dll" ], "i": "metadata/dylib::oleacc/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links version.dll (VerQueryValueW)", "e": [ "version.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload::minimal-pe-dynamic-load", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with minimal imports", "e": [ "LoadLibraryA", "binary.import_count = 19.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::massive-file-minimal-imports", "l": 4, "m": "B0032" } ], "sha": "7057e61ab0a7593638e6c1558b9b0fec7c7f6e9ba63013cf5f757a8a1f15c326", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/175630", "type": "pe" } ], "tv": "2a0fe" } }