{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T06:09:14Z" }, "path": "71bb40a449db32dbb472b44691e1238cbbbba6e6019abe3ea20c5ce729cb3c8e.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 76176.0, "checksum_valid": 1.0, "computed_checksum": 76176.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 25000.0, "entropy": 6.15, "size_bytes": 25000.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.84, "overlay_size": 5032.0, "string_count": 387.0, "overlay_ratio": 0.2, "overlay_entropy": 7.19, "entropy_variance": 8.3, "avg_string_length": 21.59, "max_string_length": 1490.0, "code_to_data_ratio": 1.0, "string_length_stddev": 77.3, "largest_section_ratio": 0.76, "sentence_string_count": 6.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 18944.0, "entropy_max": 5.84, "entropy_mean": 2.96, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 8220, "u8", "BSJB" ], [ 10753, "u8", "IEnumerable`1" ], [ 10790, "u8", "ICollection`1" ], [ 10804, "u8", "IEnumerator`1" ], [ 10818, "u8", "EnumValues`1" ], [ 10839, "u8", "ToInt32" ], [ 10861, "u8", "ToUInt64" ], [ 10879, "u8", "\u003cModule\u003e" ], [ 10888, "u8", "System.IO" ], [ 10898, "u8", "bccdaeafbcebafcafcbaa" ], [ 10920, "u8", "aabfbeaccafcbdaa" ], [ 10937, "u8", "aacbadffbbcfcfebfbabefabfaa" ], [ 10965, "u8", "abbfccdeacfdfdaedacfaa" ], [ 10988, "u8", "daaccebbbcbfedcdcaceaccfaa" ], [ 11015, "u8", "aafaaeeaafefedbffebdca" ], [ 11038, "u8", "fdbbebda" ], [ 11047, "u8", "fdcbaeaacffcbaeeaeeeda" ], [ 11070, "u8", "dfefddefceaefacfeda" ], [ 11090, "u8", "abaaaea" ], [ 11098, "u8", "cfebfcaeeddcea" ], [ 11113, "u8", "badbafaacdea" ], [ 11126, "u8", "ProjectData" ], [ 11138, "u8", "aacdaaab" ], [ 11147, "u8", "cabfbffcbaaecfdebab" ], [ 11167, "u8", "dcffaedfdcdeadebbeefab" ], [ 11190, "u8", "aecbdeecbabebbbfbbfaaccbecfcb" ], [ 11220, "u8", "bedddebdacfcbbbdb" ], [ 11238, "u8", "eebefddb" ], [ 11247, "u8", "bbeedafabaeb" ], [ 11260, "u8", "eecdfbbadceaadecbcbbfddabbfeb" ], [ 11290, "u8", "cbcdcfebabaacbebdeeededeaefb" ], [ 11319, "u8", "bdecfddbeabeefb" ], [ 11335, "u8", "cbdfafefffeebdceccaabedfcfefb" ], [ 11365, "u8", "eefeefafefadeaeadcadaffb" ], [ 11390, "u8", "mscorlib" ], [ 11399, "u8", "effbcbbdcccbebddbbac" ], [ 11420, "u8", "ccfcbfdebac" ], [ 11432, "u8", "abceaccccffcecdcecdeaebefcac" ], [ 11461, "u8", "bbcfafaccabfaaabebfeac" ], [ 11484, "u8", "ecfaffdccedbc" ], [ 11498, "u8", "cfeccbfbc" ], [ 11508, "u8", "deddadbcc" ], [ 11518, "u8", "aaadffdeabaeecbfcadc" ], [ 11539, "u8", "cdbdcafdbddec" ], [ 11553, "u8", "babdefcfddec" ], [ 11566, "u8", "efacdbcaddfc" ], [ 11579, "u8", "fbdcfadeafabaacbebeddbbcaedfc" ], [ 11609, "u8", "afceeebffcdfebabbbfedceafefc" ], [ 11638, "u8", "System.Collections.Generic" ], [ 11665, "u8", "Microsoft.VisualBasic" ], [ 11687, "u8", "bbcdddbdddcfefabd" ], [ 11705, "u8", "fdffbffbebfdbeaefcfcbd" ], [ 11728, "u8", "bfdacdcbaccd" ], [ 11745, "u8", "acbeeecedd" ], [ 11756, "u8", "febaaffedfabbbaed" ], [ 11774, "u8", "ceffbdbecadaaebed" ], [ 11792, "u8", "bdbbeadecedddeced" ], [ 11810, "u8", "acacfbadbbfdfcdfcfed" ], [ 11831, "u8", "IsDefined" ], [ 11841, "u8", "Versioned" ], [ 11851, "u8", "ffeaadbfd" ], [ 11861, "u8", "debcbdfbbbcedfcefd" ], [ 11880, "u8", "ddbecdeebdfeefd" ], [ 11896, "u8", "afbbedbccbbaaaaffd" ], [ 11915, "u8", "ffadebfcffd" ], [ 11927, "u8", "aacdcfccaaaafddcae" ], [ 11946, "u8", "dbfadefcfefadae" ], [ 11962, "u8", "bfccddcecfddccddeeeaaaaeae" ], [ 11989, "u8", "dafcebeae" ], [ 11999, "u8", "debbbffdebfbdddcdccbfae" ], [ 12023, "u8", "fccdaccbdfdcaafcbbdeddebe" ], [ 12049, "u8", "Replace" ], [ 12057, "u8", "ExceptionTrace" ], [ 12072, "u8", "eadadbdbaabefdddfefecdecce" ], [ 12099, "u8", "dbfacbcabbbbaccfcfeaeefdce" ], [ 12126, "u8", "eeeeccdece" ], [ 12137, "u8", "dfdabfcaaccdbecafeefce" ], [ 12160, "u8", "edbafcffeedecacde" ], [ 12178, "u8", "dcfeacecaee" ], [ 12190, "u8", "affdccabaaeecee" ], [ 12206, "u8", "abbdeabbbbabcdaffcbeceee" ], [ 12231, "u8", "daddfaafbacbbdffeeffe" ], [ 12253, "u8", "fbcbbbdbaafffe" ], [ 12268, "u8", "Newtonsoft.Json.Utilities.LinqBridge" ], [ 12305, "u8", "Invoke" ], [ 12312, "u8", "Enumerable" ], [ 12323, "u8", "IDisposable" ], [ 12335, "u8", "RuntimeTypeHandle" ], [ 12353, "u8", "GetTypeFromHandle" ], [ 12371, "u8", "AppWinStyle" ], [ 12383, "u8", "get_Name" ], [ 12392, "u8", "CallByName" ], [ 12403, "u8", "ChangeType" ], [ 12414, "u8", "GetUnderlyingType" ], [ 12432, "u8", "CallType" ], [ 12441, "u8", "SecurityProtocolType" ], [ 12462, "u8", "GetType" ], [ 12470, "u8", "Where" ], [ 12476, "u8", "System.Core" ], [ 12488, "u8", "get_InvariantCulture" ], [ 12509, "u8", "get_CurrentCulture" ], [ 12528, "u8", "Dispose" ], [ 12536, "u8", "Create" ], [ 12543, "u8", "CallSite" ], [ 12552, "u8", "ComVisibleAttribute" ], [ 12572, "u8", "AssemblyTitleAttribute" ], [ 12595, "u8", "AssemblyTrademarkAttribute" ], [ 12622, "u8", "TargetFrameworkAttribute" ], [ 12647, "u8", "AssemblyFileVersionAttribute" ], [ 12676, "u8", "AssemblyDescriptionAttribute" ], [ 12705, "u8", "FlagsAttribute" ], [ 12720, "u8", "CompilationRelaxationsAttribute" ], [ 12752, "u8", "AssemblyProductAttribute" ], [ 12777, "u8", "AssemblyCopyrightAttribute" ], [ 12804, "u8", "AssemblyCompanyAttribute" ], [ 12829, "u8", "WriteByte" ], [ 12839, "u8", "get_Value" ], [ 12849, "u8", "GetObjectValue" ], [ 12864, "u8", "GetValue" ], [ 12873, "u8", "set_Expect100Continue" ], [ 12895, "u8", "bedddebdacfcbbbdb.exe" ], [ 12917, "u8", "bdefdcacdbbabaf" ], [ 12933, "u8", "defdeaaefcdfccbcbf" ], [ 12952, "u8", "abceabbfdcbdbf" ], [ 12967, "u8", "ceaeabfbebf" ], [ 12979, "u8", "afdfddffbbebfbf" ], [ 12995, "u8", "bbfebacabbbfbecdccabdbbbadcf" ], [ 13024, "u8", "eeecfaaabdadfceccbcdf" ], [ 13046, "u8", "adeffbfdedf" ], [ 13058, "u8", "ddedecdedaddbecbbbcbcadeedf" ], [ 13086, "u8", "ccdbdeddabfadfbfdf" ], [ 13105, "u8", "fbadedef" ], [ 13114, "u8", "efaedfafabbdecbaeabcbaaffceef" ], [ 13144, "u8", "eeebecabfef" ], [ 13156, "u8", "beadbafaff" ], [ 13167, "u8", "baacccbceedccdfaedcfabff" ], [ 13192, "u8", "NewLateBinding" ], [ 13207, "u8", "System.Runtime.Versioning" ], [ 13233, "u8", "ToString" ], [ 13242, "u8", "GetString" ], [ 13252, "u8", "StartsWith" ], [ 13263, "u8", "FormatWith" ], [ 13274, "u8", "get_IsLiteral" ], [ 13288, "u8", "System.Collections.ObjectModel" ], [ 13319, "u8", "Shell" ], [ 13325, "u8", "set_SecurityProtocol" ], [ 13346, "u8", "MemoryStream" ], [ 13359, "u8", "get_Item" ], [ 13368, "u8", "System" ], [ 13375, "u8", "ArgumentTypeIsEnum" ], [ 13394, "u8", "ToBoolean" ], [ 13404, "u8", "Join" ], [ 13409, "u8", "System.Globalization" ], [ 13430, "u8", "Newtonsoft.Json.Serialization" ], [ 13460, "u8", "Interaction" ], [ 13472, "u8", "System.Reflection" ], [ 13490, "u8", "MissingManifestResourceException" ], [ 13523, "u8", "ArgumentNullException" ], [ 13545, "u8", "InvalidOperationException" ], [ 13571, "u8", "ArgumentException" ], [ 13589, "u8", "OverflowException" ], [ 13607, "u8", "Microsoft.ServiceBus.Common" ], [ 13635, "u8", "Newtonsoft.Json" ], [ 13651, "u8", "FieldInfo" ], [ 13661, "u8", "CultureInfo" ], [ 13673, "u8", "MemberInfo" ], [ 13684, "u8", "CSharpArgumentInfo" ], [ 13703, "u8", "Microsoft.CSharp" ], [ 13720, "u8", "Char" ], [ 13725, "u8", "InvokeMember" ], [ 13738, "u8", "GetMember" ], [ 13748, "u8", "IFormatProvider" ], [ 13764, "u8", "Microsoft.CSharp.RuntimeBinder" ], [ 13795, "u8", "CallSiteBinder" ], [ 13810, "u8", "ResourceManager" ], [ 13826, "u8", "ServicePointManager" ], [ 13846, "u8", "ToInteger" ], [ 13856, "u8", "CreateProjectError" ], [ 13875, "u8", "ClearProjectError" ], [ 13893, "u8", "SetProjectError" ], [ 13909, "u8", "IEnumerator" ], [ 13921, "u8", "GetEnumerator" ], [ 13935, "u8", ".ctor" ], [ 13941, "u8", ".cctor" ], [ 13948, "u8", "GetFields" ], [ 13958, "u8", "System.Runtime.InteropServices" ], [ 13989, "u8", "Microsoft.VisualBasic.CompilerServices" ], [ 14028, "u8", "System.Runtime.CompilerServices" ], [ 14060, "u8", "System.Resources" ], [ 14077, "u8", "Newtonsoft.Json.Utilities" ], [ 14103, "u8", "GetEnvironmentVariables" ], [ 14127, "u8", "CSharpArgumentInfoFlags" ], [ 14151, "u8", "CSharpBinderFlags" ], [ 14169, "u8", "Equals" ], [ 14176, "u8", "StringUtils" ], [ 14188, "u8", "ValidationUtils" ], [ 14204, "u8", "TypeExtensions" ], [ 14219, "u8", "Conversions" ], [ 14231, "u8", "System.Collections" ], [ 14250, "u8", "StringSplitOptions" ], [ 14269, "u8", "RuntimeHelpers" ], [ 14284, "u8", "Operators" ], [ 14294, "u8", "Microsoft.ServiceBus" ], [ 14315, "u8", "Concat" ], [ 14322, "u8", "Format" ], [ 14329, "u8", "AddObject" ], [ 14339, "u8", "LateGet" ], [ 14347, "u8", "LateIndexGet" ], [ 14360, "u8", "System.Net" ], [ 14371, "u8", "Target" ], [ 14378, "u8", "Split" ], [ 14384, "u8", "SingleOrDefault" ], [ 14400, "u8", "WebClient" ], [ 14410, "u8", "Environment" ], [ 14422, "u8", "get_Current" ], [ 14434, "u8", "get_Count" ], [ 14444, "u8", "Convert" ], [ 14452, "u8", "MoveNext" ], [ 14461, "u8", "IDictionary" ], [ 14473, "u8", "Empty" ], [ 16303, "u8", "吾艾吾A" ], [ 16379, "u8", "斯维斯E" ], [ 16399, "u8", "弗克弗F" ], [ 16455, "u8", "诶艾诶I" ], [ 16475, "u8", "马艾马J" ], [ 16819, "u8", "迪吾迪x" ], [ 17403, "u8", "KQKQKQ" ], [ 17921, "u8", ".NETFramework,Version=v4.0" ], [ 19278, "u8", "mscoree.dll" ], [ 20034, "u8", "N0L0" ], [ 20177, "u8", "Microsoft Windows1" ], [ 20205, "u8", "Bill Gates1" ], [ 20226, "u8", "RE 9991" ], [ 20268, "u8", "201103064322Z" ], [ 20283, "u8", "211103064322Z0b1" ], [ 20559, "u8", "C0A0" ], [ 21378, "u8", "20201103064322Z" ], [ 21469, "u8", "DigiCert Inc1" ], [ 21492, "u8", "www.digicert.com110/" ], [ 21518, "u8", "(DigiCert SHA2 Assured ID Timestamping CA0" ], [ 21578, "u8", "301017000000Z0L1" ], [ 21617, "u8", "DigiCert, Inc.1$0\"" ], [ 21642, "u8", "TIMESTAMP-SHA256-2019-10-150" ], [ 22075, "u8", "https://www.digicert.com/CPS0" ], [ 22124, "wide", "RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability" ], [ 22548, "u8", "j0h02" ], [ 22558, "u8", ",http://crl3.digicert.com/sha2-assured-ts.crl02" ], [ 22610, "u8", ",http://crl4.digicert.com/sha2-assured-ts.crl0" ], [ 22686, "u8", "http://ocsp.digicert.com0O" ], [ 22723, "u8", "Chttp://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0" ], [ 23162, "u8", "www.digicert.com1$0\"" ], [ 23189, "u8", "DigiCert Assured ID Root CA0" ], [ 23220, "u8", "160107120000Z" ], [ 23235, "u8", "310107120000Z0r1" ] ], "v": { "file.stem": "71bb40a449db32dbb472b44691e1238cbbbba6e6019abe3ea20c5ce729cb3c8e", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1604385802, "file.basename": "71bb40a449db32dbb472b44691e1238cbbbba6e6019abe3ea20c5ce729cb3c8e.exe", "pe.image_base": 4194304, "pe.image_size": 40960, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 26974, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 5032, "pe.image_hash.sha1": "83aee313f3beb1a7b8966b5a5a5b81c4f0137423", "pe.image_hash.sha256": "113ab5701b002328f53640d56736535c46b2cc8175db26cfff0e1764d2adf681", "pe.image_hash.sha384": "5c2d9b558d9973d2b0df127495f53b75250af949e80d9af4ce4980207d7298f9d2cca9ea277ff204ee3d60a687359ff6", "pe.image_hash.sha512": "dd008babf66aa7a023c18a7a9455fc27d6402f9492bd99485713dc7a5ca4b00a6b32b4394d5418ca37c548159317c24d5a65b0d8f6aa00e8f14ac43aedbc19b4", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=RE 999,O=Bill Gates,CN=Microsoft Windows", "pe.signatures[0].serial": "00cc0d6415607cddf8470db4fa50117056", "pe.signatures[0].subject": "C=US,L=New York,OU=RE 999,O=Bill Gates,CN=Microsoft Windows", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 26888, "pe.data_directories[1].rva": 19968, "pe.data_directories[2].rva": 32768, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-11-03T06:43:22Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 5032, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-11-03T06:43:22Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "bf340af53574d5c09128a699f517311b57972e4b", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "113ab5701b002328f53640d56736535c46b2cc8175db26cfff0e1764d2adf681", "pe.signatures[0].thumbprint_sha256": "cb4aeb2acb2d4878fcaec9b7aa93580d74efe7ca9ca68c3ac0bb87de513651d1", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 18944, 5.84, "r-x" ], [ ".reloc", 19456, 512, 0.08, "r--" ] ] }, "id": 0, "sz": 25000, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x201c" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x201c" ] }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Windows", "e": [ "Microsoft Windows" ], "i": "metadata/signed/unknown::microsoft-windows", "l": 2 }, { "c": 1.0, "d": "Signed by Bill Gates", "e": [ "Bill Gates" ], "i": "metadata/signed/leaf::bill-gates", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "71bb40a449db32dbb472b44691e1238cbbbba6e6019abe3ea20c5ce729cb3c8e.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0x540e" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x3686" ] }, { "a": "T1140", "c": 0.8999999761581421, "d": "VB LateGet dispatch token", "e": [ "LateGet" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token", "l": 1, "m": "B0030", "el": [ "0x3803" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x34a0" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "0x3068" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x4b4e" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x35f2" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "71bb40a449db32dbb472b44691e1238cbbbba6e6019abe3ea20c5ce729cb3c8e.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x2c7e" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 387.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "DigiCert timestamp certificate chain", "e": [ "DigiCert SHA2 Assured ID Timestamping CA" ], "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain", "l": 2, "el": [ "0x540e" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.84" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "WebClient" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-4", "l": 1, "el": [ "0x3840" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0x4601" ] }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x566c" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x4b4e" ] }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1, "el": [ "0x3011" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x325f" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x461d" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8199999928474426, "d": "Type.InvokeMember reflection token", "e": [ "InvokeMember" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token", "l": 1, "el": [ "0x359d" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO", "System.Net" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x2a88", "0x3818" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "GetValue", "get_Value", "EnumValues`1", "GetObjectValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x3240", "0x3227", "0x2a42", "0x3231" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8500000238418579, "d": "Newtonsoft.Json serialization library reference", "e": [ "Newtonsoft.Json.Utilities.LinqBridge", "Newtonsoft.Json", "Newtonsoft.Json.Serialization", "Newtonsoft.Json.Utilities" ], "i": "micro-behaviors/data/serialize/json::json-newtonsoft", "l": 2, "el": [ "0x2fec", "0x3543", "0x3476", "0x36fd" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetString", "StringSplitOptions", "ToString", "StringUtils" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x33ba", "0x37aa", "0x33b1", "0x3760" ] }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic", "Microsoft.VisualBasic.CompilerServices" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x2d91", "0x36a5" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.7200000286102295, "d": "Reflection GetFields reference", "e": [ "GetFields" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-fields-call", "l": 1, "el": [ "0x367c" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1140", "c": 0.9200000166893005, "d": "VB NewLateBinding dispatch helper", "e": [ "NewLateBinding" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-newlatebinding", "l": 1, "m": "B0030", "el": [ "0x3388" ] }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "0x35f2" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariable" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001", "el": [ "0x3717" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "71bb40a449db32dbb472b44691e1238cbbbba6e6019abe3ea20c5ce729cb3c8e.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x325f" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyCompanyAttribute", "AssemblyTrademarkAttribute", "AssemblyFileVersionAttribute", "ArgumentNullException", "AssemblyCopyrightAttribute", "GetEnvironmentVariables", "InvalidOperationException", "AssemblyTitleAttribute", "AssemblyProductAttribute", "MissingManifestResourceException", "AssemblyDescriptionAttribute", "ComVisibleAttribute", "TargetFrameworkAttribute", "CompilationRelaxationsAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x3204", "0x3133", "0x3167", "0x34d3", "0x31e9", "0x3717", "0x34e9", "0x311c", "0x31d0", "0x34b2", "0x3184", "0x3108", "0x314e", "0x31b0" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "c": 1.0, "d": "System.Net.WebClient class usage", "e": [ "StringUtils", "StringSplitOptions", "WebClient", "GetString", "ToString" ], "i": "micro-behaviors/communications/http/client/managed::webclient", "l": 2, "el": [ "0x3760", "0x37aa", "0x3840", "0x33ba", "0x33b1" ] } ], "sha": "71bb40a449db32dbb472b44691e1238cbbbba6e6019abe3ea20c5ce729cb3c8e", "path": "71bb40a449db32dbb472b44691e1238cbbbba6e6019abe3ea20c5ce729cb3c8e.exe", "type": "pe" } ], "tv": "52045" } }