{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.7868712544441223, "class": 0 } ], "prob": 0.78687125, "class": 0, "models": [ { "m": "az", "prob": 0.78687125, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T16:38:24Z" }, "path": "14366", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "b90cae5398e45769a8b6a88b14be0e17", "pe.checksum": "0x0004fc37", "pe.timestamp": 1146164093, "hash.authenti": "43015d834aedb838f6843fbf43d0e33d6d6aec1d1add4e70ea0e18cba8503548", "build.target_arch": "x86", "pe.linker_version": "6.4", "pe.resource_types[0]": "RT_DIALOG", "pe.data_directories[0].rva": 20544, "pe.data_directories[1].rva": 372736, "pe.data_directories[2].rva": 376832, "pe.data_directories[3].rva": 20480, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 60, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1256, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 516, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 60, "binary.top_complex_unnamed[0].cc": 2, "binary.top_complex_unnamed[1].cc": 2, "binary.top_complex_unnamed[0].bbs": 4, "binary.top_complex_unnamed[1].bbs": 3, "binary.top_complex_unnamed[0].addr": "0x100016a6", "binary.top_complex_unnamed[0].size": 73, "binary.top_complex_unnamed[1].addr": "0x10002248", "binary.top_complex_unnamed[1].size": 30, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.section_characteristics[4].name": ".reloc", "pe.section_characteristics[0].raw_size": 12800, "pe.section_characteristics[1].raw_size": 512, "pe.section_characteristics[2].raw_size": 226816, "pe.section_characteristics[3].raw_size": 1536, "pe.section_characteristics[4].raw_size": 1024, "pe.section_characteristics[0].virtual_size": 12700, "pe.section_characteristics[1].virtual_size": 415, "pe.section_characteristics[2].virtual_size": 345816, "pe.section_characteristics[3].virtual_size": 4096, "pe.section_characteristics[4].virtual_size": 517, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 20480, "pe.section_characteristics[2].virtual_address": 24576, "pe.section_characteristics[3].virtual_address": 372736, "pe.section_characteristics[4].virtual_address": 376832, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 4, "id": 0, "is": [ "ShowWindow", "VirtualAlloc", "RtlMoveMemory", "MultiByteToWideChar", "lstrlenA", "lstrcmpiA", "lstrcmpA", "GetModuleHandleA", "GetModuleFileNameA", "GetCommandLineW", "GetCommandLineA", "GetACP", "ExitProcess" ], "ms": { "pe": { "entry": 10279.0, "machine": 332.0, "checksum": 326711.0, "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1146164093.0, "image_base": 268435456.0, "has_checksum": true, "rsrc_entropy": 3.23, "entry_section": ".text", "size_of_image": 377349.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_DIALOG" ], "characteristics": 8462.0, "overlay_padding": 62888.0, "size_of_headers": 1024.0, "export_timestamp": 0.0, "import_dll_count": 2.0, "computed_checksum": 354324.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "linker_minor_version": 4.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 306600.0 }, "binary": { "code_size": 12800.0, "func_count": 413.0, "has_overlay": true, "code_entropy": 5.78, "data_entropy": 3.93, "func_density": 33.04, "import_count": 13.0, "overlay_size": 62888.0, "string_count": 442.0, "avg_func_size": 37.15, "overlay_ratio": 0.21, "section_count": 5.0, "avg_complexity": 1.0, "import_density": 1.04, "max_complexity": 2.0, "string_density": 35.36, "overall_entropy": 4.18, "overlay_entropy": 8.0, "avg_basic_blocks": 1.01, "avg_section_size": 48537.6, "dependency_count": 2.0, "entropy_variance": 0.9, "avg_string_length": 10.73, "complexity_per_kb": 0.08, "max_string_length": 40.0, "wide_string_count": 2.0, "avg_string_entropy": 3.06, "code_to_data_ratio": 0.06, "data_to_file_ratio": 0.74, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.04, "total_basic_blocks": 419.0, "func_analysis_depth": 2.0, "string_length_stddev": 3.88, "largest_section_ratio": 0.74, "sentence_string_count": 2.0, "sentence_string_ratio": 0.0, "writable_section_count": 1.0, "behavioral_import_ratio": 0.08, "executable_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 440, ".text" ], [ 519, "@.data" ], [ 560, ".rsrc" ], [ 599, "@.reloc" ], [ 1501, "stack", "RVFv" ], [ 1504, "RVFvhUE" ], [ 3059, "stack", "m2iG" ], [ 4084, "Phil" ], [ 4132, "QQhKAaxhup" ], [ 5469, "hoihq" ], [ 5598, "Qhbd" ], [ 6680, "Phyts" ], [ 6833, "hf3o" ], [ 7548, "stack", "MGiQ" ], [ 8252, "Rhygj" ], [ 8327, "Rhbe" ], [ 8619, "Rhlo" ], [ 10303, "PPhBEe1QhEE3" ], [ 11603, "RRPhUjV" ], [ 11869, "ha61" ], [ 12564, "hCV8AhNsXpRhPAGx" ], [ 14010, "ShowWindow" ], [ 14022, "user32.dll" ], [ 14036, "VirtualAlloc" ], [ 14052, "RtlMoveMemory" ], [ 14068, "MultiByteToWideChar" ], [ 14090, "lstrlenA" ], [ 14102, "lstrcmpiA" ], [ 14114, "lstrcmpA" ], [ 14126, "GetModuleHandleA" ], [ 14146, "GetModuleFileNameA" ], [ 14168, "GetCommandLineW" ], [ 14186, "GetCommandLineA" ], [ 14214, "ExitProcess" ], [ 14226, "kernel32.dll" ], [ 14336, "MlXwfXlSYoQRehn" ], [ 14385, "RhrDJUjd" ], [ 14394, "62oqe8w" ], [ 14422, "isar3cg7m2gt" ], [ 14453, "21fbnvkdk6qay" ], [ 14485, "YDsG5n1eo2h6Q" ], [ 14499, "kaemqtxwgoxgri" ], [ 14514, "byrtqrswpsnywd" ], [ 14529, "hcyhgfnydony" ], [ 14542, "gqLKMhIAlGbxk" ], [ 14563, "V5MSgyOVCSIww" ], [ 14577, "LWVXKGQ" ], [ 14585, "jiclcka" ], [ 14619, "KybK7Qq4WxDnQb" ], [ 14634, "HDFDMUXTTPA" ], [ 14646, "2uqpps47FELT" ], [ 14667, "nINpoDLuxJal" ], [ 14696, "VSBEDVGVYCLCPHP" ], [ 14727, "adcufyvxtvg" ], [ 14745, "olljnb" ], [ 14785, "XHR1GEUQwBje" ], [ 14798, "RFOKYOVEB" ], [ 14808, "hmcmpjhlyraey" ], [ 14822, "eha8a" ], [ 14858, "HKJEIUYNJAH" ], [ 14870, "LGWUWWMESFJ" ], [ 14911, "33qarm83ssy2bep" ], [ 14927, "sdkvwuJTB48hH" ], [ 14941, "uqvguhmdxc" ], [ 14952, "FJTYTHU" ], [ 14960, "GIByiJlbqPjbfsA" ], [ 15000, "rlpokyisvlkawhr" ], [ 15026, "WWAfrU5s4Vkacm" ], [ 15041, "TXUXQXGHPTNIAIV" ], [ 15068, "v46VXtiyVvAD" ], [ 15093, "hfpgbqgddenbitj" ], [ 15160, "7518613" ], [ 15168, "h4ffsfro7hk" ], [ 15180, "ieftx6nlkxirvhl" ], [ 15196, "NVXAF" ], [ 185343, "m2n1" ], [ 204300, "UW_8L" ], [ 204794, "Gtiq" ], [ 229780, "kv.s" ], [ 230912, "XSKPdHNvFKBYU" ], [ 230926, "ffwksxshbdgnl" ], [ 230940, "ghbyexpv2jsveg" ], [ 230955, "nORHwPbkmNYFMRm" ], [ 230971, "IyJDNUFiuVml4" ], [ 230985, "tXeFrScDGmKsiHR" ], [ 231001, "hFkOhRGXIcTlEd" ], [ 231028, "BSAUGSCDSGBP" ], [ 231051, "JPBEQWASHIAGB" ], [ 231074, "lnGy1t4TUeVMs" ], [ 231134, "DUliEdJW58x7" ], [ 231154, "BFwGIxls" ], [ 231163, "HwddVgnA4ThR" ], [ 231176, "d62mm4padcp88" ], [ 231198, "saeoBdKaLdUv" ], [ 231211, "eOI7TfWeflkfa" ], [ 231225, "YHVWKAEJMWRQNHI" ], [ 231241, "dey8tcvo4u" ], [ 231252, "ycqaeecf" ], [ 231261, "3pbcuwqwi8" ], [ 231272, "sfBgMEAD" ], [ 231281, "IwPoyvt" ], [ 231295, "H2pEp2tFKGdBkN" ], [ 231310, "RDg6jo8MQLu5yJ" ], [ 231325, "xlytjrnawmbuynu" ], [ 231360, "uq28QlRlmBURsw" ], [ 231375, "p4ryfp82kjqm" ], [ 231388, "LCvfMcEvrcOn" ], [ 231416, "484323" ], [ 231423, "HLBRXQMWLJCPI" ], [ 231437, "73166" ], [ 231443, "gtpggnabtugcusv" ], [ 231470, "DCKBJHYBGNCNDHN" ], [ 231492, "hncqltfxei" ], [ 231503, "kaesv" ], [ 231515, "SAevRuy6ikJHfG7" ], [ 231540, "bcinuMdb" ], [ 231581, "olPFmllaK" ], [ 231591, "APSY7lU8nTHibqv" ], [ 231607, "gjsQBFaJXQVnVb" ], [ 231631, "xHDO8JlJkqm7St" ], [ 231646, "UmWYPqjGhrSlt" ], [ 231660, "WLPsrg8Jx3VRww" ], [ 231702, "jnnwgoi" ], [ 231710, "o34kpl" ], [ 231717, "muJDNQh" ], [ 231731, "ujeLSnbLYqhErd" ], [ 231746, "363646" ], [ 231776, "lbqQCSYWfS" ], [ 231808, "DNBXVVV" ], [ 231816, "SDDPuEUJW8UVYjd" ], [ 231844, "x8vbhax5p" ], [ 231854, "kkVMGoduua" ], [ 231865, "GIPKO" ], [ 231871, "PDTLX3Pv6gnKQoF" ], [ 231898, "RFSQMDTB" ], [ 231914, "vvDvlhJ7GOyF" ], [ 231927, "ljyaLQXmMIa" ], [ 231939, "WMFUSMSOOH" ], [ 231950, "yirnvudnavxn" ], [ 231963, "IAmxLbsv" ], [ 232028, "vSmsQudBdilOCw4" ], [ 232044, "jYH6maQvihlp1U" ], [ 232059, "Pnrvt" ], [ 232065, "bWtsHXBhEHowk" ], [ 232113, "kfiwpytfvhfufjv" ], [ 232156, "VDQTEAAIYDTOUU" ], [ 232171, "qtbiaoqgg" ], [ 232189, "DtQLFlwgVnHnnC" ], [ 232204, "UlVLhfyBlXHR" ], [ 232244, "cvFJ7F2arwBrw" ], [ 232258, "yfiKskhQGwYLTSX" ], [ 232304, "DJQJHNMHH" ], [ 232341, "gpnsdstqgblwpm" ], [ 232356, "ncYi1lTnEX5L7f" ], [ 232371, "mutfo" ], [ 232377, "HWYIAXFK" ], [ 232386, "f2na7" ], [ 232405, "mOAsiTP" ], [ 232421, "bHDKWWRoCKRh" ], [ 232449, "x6bnDnRfRrD1n" ], [ 232463, "bndHMyKmhPur" ], [ 232476, "OGNVXII" ], [ 232495, "JMHGUNDKOOTD" ], [ 232514, "tsmbkhasun" ], [ 232525, "RFXXYUECHBOV" ], [ 232544, "qousvgepmmj" ], [ 232556, "TvCreWJPTQ6V" ], [ 232569, "CNIYQCXLWJMY" ], [ 232582, "eamR152JmSEdbsj" ], [ 232609, "VoEQRvcw" ], [ 232629, "iuvnkgvqubxucg" ], [ 232676, "NPouKjhwiMAk" ], [ 232731, "JJMhgGTjOQC" ], [ 232743, "DSNBINCC" ], [ 232752, "s6anErV8Iax3" ], [ 232777, "2rran1lxu1b3dcu" ], [ 232800, "sjkTRGVev" ], [ 232832, "BGsKb3BSIOsQd" ], [ 232852, "iamlj" ], [ 232858, "CAGPKUAILTFLNUD" ], [ 232900, "xodttiej" ], [ 232917, "VsULHkrHIvcR" ], [ 232937, "Uyw7iRR23g7KEn" ], [ 232952, "gCSHQXM" ], [ 232960, "ynenyppxi" ], [ 232977, "STTFFJLSKTGIAPE" ], [ 232993, "tksXCFNYpLmd" ], [ 233006, "OIBPHK" ], [ 233013, "qtry5as2lxidry6" ], [ 233029, "phHLGdysT" ], [ 233039, "QdoanBPdfFVFcAp" ], [ 233067, "llGmIhoLGHaGYDQ" ], [ 233093, "NSYIVKMDPX" ], [ 233104, "UGDYAUO" ], [ 233119, "UehPOBt4rCLk" ], [ 233142, "HLvGEPsACTkgP" ], [ 233156, "jcu6rl" ], [ 233163, "DVKJMU" ], [ 233170, "tEgplaDtHMdKEfC" ], [ 233186, "IiOOnTssngxusi" ], [ 233210, "QChS51kO1KKFyw" ], [ 233263, "CUXETJP" ], [ 233303, "xjiaCEHmvRuN" ], [ 233329, "fvwP4UKFC2eVIHv" ], [ 233345, "kyxueagswnqy" ], [ 233370, "SFSARULAAGO" ], [ 233407, "oTP12yxU6fa1" ], [ 233420, "AfhkACcSCR" ], [ 233431, "svuqgFPhpHg5u7N" ], [ 233447, "TEPXAUDM" ], [ 233456, "7862661" ], [ 233464, "mih3xlmCcx3l" ], [ 233477, "hjiwbeunsffl" ], [ 233504, "i2U4KpKOgb71M" ], [ 233518, "BgrD27kmRUl5bA" ], [ 233533, "mvLbdAv" ], [ 233553, "XMC6CUXI" ], [ 233562, "173875" ], [ 233569, "CdMFLtB2VSVq" ], [ 233598, "biDUJytksQudBmS" ], [ 233614, "solXTvUtBlqKE" ], [ 233628, "ARATJFEAM" ], [ 233662, "IXRFP" ], [ 233668, "kknjtdeg" ], [ 233677, "om4s8" ], [ 233689, "xoTPwspSYpqtVC" ], [ 234620, "`\u003eZ0`" ], [ 235945, "Nuyfb" ], [ 237130, "4166ocb" ], [ 237138, "NAmdpIjBBjhP" ], [ 237151, "3u5oj6lnqaumum" ], [ 237210, "VBYukLXtAtgejfD" ], [ 237238, "v1vNSvtYVmskyM" ], [ 237253, "cLKJu3anVUofa" ], [ 237277, "RJwmqnABmH" ], [ 237288, "bekkgdljsjskes" ], [ 237303, "AEWPUVMUMIAABE" ], [ 237328, "cpnuhfopsy" ], [ 237361, "YoyWRXCERFpcI" ], [ 237383, "26JAHQQQFOnrR" ], [ 237397, "AaLGNd5qXbQbd" ], [ 237428, "gAJyIJbmgWqWOKY" ], [ 237444, "yeexostyctuexvs" ], [ 237460, "MEFWYAHPMPWFWR" ], [ 237475, "BPnWVStKRjVQ" ], [ 237488, "vgd4e" ], [ 237518, "bCDljVAaAugE" ], [ 237537, "I4oWra8dbHXlS" ], [ 237551, "hBNjSnhdOfedo" ], [ 237593, "BULBDIDQOC" ], [ 237604, "RhRROSRgpJ" ], [ 237624, "EygDXDt" ], [ 237632, "jlcja1vb3p37vw" ], [ 237658, "kXYXchU" ], [ 237686, "jWPl5F3Iw6H7P" ] ], "sz": 306600, "ts": [ { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.06" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 419.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 413.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 377349.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8600000143051147, "d": "PE has medium sized overlay", "e": [ "binary.overlay_size = 62888.00" ], "i": "metadata/binary/section/metrics::medium-overlay-pe", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 413.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.18" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.78" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Dominant text section ratio", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "well-known/malware/trojan/elex-technoinox::runner-dominant-text-ratio", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "sub.kernel32.dll_GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 413.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "RFOKYOVEB", "HDFDMUXTTPA", "HWYIAXFK", "HKJEIUYNJAH", "CNIYQCXLWJMY", "RFXXYUECHBOV", "RFSQMDTB", "JMHGUNDKOOTD", "SFSARULAAGO", "BSAUGSCDSGBP", "DSNBINCC", "LGWUWWMESFJ", "DJQJHNMHH", "NSYIVKMDPX", "WMFUSMSOOH", "TEPXAUDM" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.18" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.45)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.7799999713897705, "d": "Short CamelCase Run value token", "e": [ "TMoOn" ], "i": "objectives/persistence/login/registry/autostart::short-camel-on-run-value-token", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1055", "c": 0.8799999952316284, "d": "Go RtlMoveMemory API name", "e": [ "RtlMoveMemory" ], "i": "objectives/evasion/process/injection/shellcode::go-rtlmovememory-api", "l": 1, "m": "B0033" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 442.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.06" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1146164093.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "14366" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 62888.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Large .data section (\u003e70% of", "e": [ "binary.data_to_file_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::large-data-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 413.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".data", ".rdata+.data = 1776.0% of text (227328 / 12800 bytes)", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "PE code-to-data ratio below 0.08", "e": [ "binary.code_to_data_ratio = 0.06" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::code-data-ratio-below-008", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "MultiByteToWideChar", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 13.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 13.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 13.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.74" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".rdata", ".rdata+.data = 1776.0% of text (227328 / 12800 bytes)", ".data" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".rdata", ".data", ".rdata+.data = 1776.0% of text (227328 / 12800 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links kernel32.dll (VirtualAlloc, RtlMoveMemory, MultiByteToWideChar, lstrlenA, lstrcmpiA, ... +7 more)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (ShowWindow)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "71f477b96212b0889a022237cc641c8703cc8c5f132e77acdf48a3ec65db0deb", "path": "14366", "type": "pe" } ], "tv": "46790" } }