{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.0021164021, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-18T04:18:16Z" }, "path": "VirusShare_98e8512075b49635cdacc78fa7ee98a8", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "0fbf32532db2d14e7ac3ea5fae7eb05b", "pe.timestamp": 1468261308, "hash.authenti": "7b04549267b479821c8b657fe717cf4375489e8f8e555a073bf8cf9efe651ad0", "build.target_arch": "x86", "pe.linker_version": "11.0", "pe.resource_types[0]": "RT_VERSION", "pe.data_directories[0].rva": 278532, "pe.data_directories[1].rva": 277996, "pe.data_directories[2].rva": 286720, "pe.data_directories[3].rva": 294912, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 79, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 688, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.version_info.file_version": "0.0.0.0", "pe.dll_characteristics.no_seh": true, "pe.version_info.internal_name": "Phcrws_sci.dll", "pe.version_info.legal_copyright": " ", "pe.version_info.product_version": "0.0.0.0", "pe.dll_characteristics.nx_compat": true, "pe.version_info.file_description": " ", "pe.version_info.original_filename": "Phcrws_sci.dll", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".sdata", "pe.section_characteristics[2].name": ".rsrc", "pe.section_characteristics[3].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[0].raw_size": 270336, "pe.section_characteristics[1].raw_size": 512, "pe.section_characteristics[2].raw_size": 1024, "pe.section_characteristics[3].raw_size": 512, "pe.section_characteristics[0].virtual_size": 269892, "pe.section_characteristics[1].virtual_size": 83, "pe.section_characteristics[2].virtual_size": 688, "pe.section_characteristics[3].virtual_size": 12, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 8192, "pe.section_characteristics[1].virtual_address": 278528, "pe.section_characteristics[2].virtual_address": 286720, "pe.section_characteristics[3].virtual_address": 294912, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "42000040" }, "x": 5, "id": 0, "is": [ "CorDllMain" ], "ms": { "pe": { "entry": 278078.0, "machine": 332.0, "checksum": 0.0, "is_dotnet": true, "rsrc_size": 1024.0, "subsystem": 3.0, "timestamp": 1468261308.0, "image_base": 268435456.0, "mixed_mode": true, "clr_version": "2.5", "rsrc_entropy": 2.21, "entry_section": ".text", "size_of_image": 303104.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 8450.0, "size_of_headers": 1024.0, "export_timestamp": 1468261308.0, "has_version_info": true, "import_dll_count": 1.0, "computed_checksum": 288179.0, "section_alignment": 8192.0, "resource_timestamp": 0.0, "dll_characteristics": 34112.0, "has_export_timestamp": true, "linker_major_version": 11.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 273408.0 }, "binary": { "code_size": 270336.0, "func_count": 22.0, "code_entropy": 5.33, "data_entropy": 0.98, "export_count": 1.0, "func_density": 0.08, "import_count": 1.0, "string_count": 428.0, "avg_func_size": 1031.14, "section_count": 4.0, "avg_complexity": 35.82, "import_density": 0.0, "max_complexity": 135.0, "string_density": 1.62, "overall_entropy": 2.16, "avg_basic_blocks": 81.18, "avg_section_size": 68096.0, "dependency_count": 1.0, "entropy_variance": 1.97, "avg_string_length": 17.52, "complexity_per_kb": 0.14, "max_string_length": 64.0, "wide_string_count": 12.0, "avg_string_entropy": 3.47, "code_to_data_ratio": 132.0, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.99, "total_basic_blocks": 1786.0, "func_analysis_depth": 2.0, "string_length_stddev": 10.13, "largest_section_ratio": 0.99, "sentence_string_count": 26.0, "sentence_string_ratio": 0.06, "writable_section_count": 1.0, "executable_section_count": 1.0, "nonstandard_section_count": 1.0, "high_complexity_func_count": 8.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 456, ".rsrc" ], [ 495, "@.reloc" ], [ 258124, "BSJB" ], [ 261041, "\u003cModule\u003e" ], [ 261050, "System.Runtime.CompilerServices" ], [ 261082, "RuntimeCompatibilityAttribute" ], [ 261112, ".ctor" ], [ 261118, "CompilationRelaxationsAttribute" ], [ 261150, "System" ], [ 261157, "Object" ], [ 261164, "CompilerGeneratedAttribute" ], [ 261191, "ValueType" ], [ 261201, "System.Collections" ], [ 261220, "Hashtable" ], [ 261230, "System.IO" ], [ 261240, "FileStream" ], [ 261251, "String" ], [ 261265, "Directory" ], [ 261275, "GetFiles" ], [ 261284, "get_Length" ], [ 261295, "get_Chars" ], [ 261305, "System.Text" ], [ 261317, "Encoding" ], [ 261326, "get_ASCII" ], [ 261336, "GetString" ], [ 261346, "Environment" ], [ 261358, "SpecialFolder" ], [ 261372, "GetFolderPath" ], [ 261392, "op_Inequality" ], [ 261406, "Byte" ], [ 261424, "RuntimeHelpers" ], [ 261439, "Array" ], [ 261445, "RuntimeFieldHandle" ], [ 261464, "InitializeArray" ], [ 261480, "Exit" ], [ 261485, "Stream" ], [ 261492, "AppDomain" ], [ 261502, "get_CurrentDomain" ], [ 261520, "get_BaseDirectory" ], [ 261538, "Remove" ], [ 261545, "GetDirectories" ], [ 261560, "Concat" ], [ 261567, "Read" ], [ 261572, "FileMode" ], [ 261581, "FileAccess" ], [ 261592, "FileShare" ], [ 261609, "op_Explicit" ], [ 261621, "System.Runtime.InteropServices" ], [ 261652, "Marshal" ], [ 261660, "Copy" ], [ 261665, "get_Unicode" ], [ 261677, "Char" ], [ 261682, "Split" ], [ 261688, "GetCurrentDirectory" ], [ 261708, "Close" ], [ 261714, "File" ], [ 261719, "Delete" ], [ 261726, "System.Runtime.ExceptionServices" ], [ 261759, "HandleProcessCorruptedStateExceptionsAttribute" ], [ 261806, "Phcrws_sci.dll" ], [ 261821, "mscorlib" ], [ 261830, "CNBPft_VisualC" ], [ 261845, "arlauurity_sirep" ], [ 261862, "CNBP__ConsolvHosk" ], [ 261880, "IoAAssignedAcment_Infrastructure_Native_Unmanaged" ], [ 261930, "SHExicons0_1_0" ], [ 261945, "icam3soft_BuiE3V" ], [ 261962, "System_Service_Tasos_v3_5" ], [ 261988, "EP0NMkfl_1_0" ], [ 262001, "qntmmosis_ComWrp" ], [ 262018, "SensorsClassExtengement_PolicyEngineApi_Interop" ], [ 262066, "pmnReta_Limapi" ], [ 262081, "dcpws_Vedrscli" ], [ 262096, "EGNH_BlockedShutdown" ], [ 262117, "EP0Lsoft_Wi71u" ], [ 262132, "HPBft_GroupPolicy_AdmTmplEditor_Resources" ], [ 262174, "Systemt_BackgroundIntelligentTransfer_Management_resources" ], [ 262233, "mwaws_SgstMUI05" ], [ 262249, "Micrnel_Scrchttp" ], [ 262266, "vwipws_sysation" ], [ 262282, "Policy_1_0P_217" ], [ 262298, "xwize_lell" ], [ 262309, "lfsvws_wrdr" ], [ 262321, "alerameworz_Resources" ], [ 262343, "xasgpng_Inpdspx" ], [ 262359, "RMActilesignon_permissions_resources" ], [ 262396, "RPCSgress_n5RC" ], [ 262411, "fveudge_Dt0260" ], [ 262426, "shs_Bac500nt" ], [ 262439, "EP0Nstem_TZM" ], [ 262452, "System_Web_Modows_Devices_SmartCirds" ], [ 262489, "wmtpsoft_Wbdth2" ], [ 262505, "WMVXws_MediaNCD" ], [ 262521, "PSModuleDiscoveryFroviia_Speech" ], [ 262553, "sbscmp20_mCdnter_TV_Tuners_Intetop" ], [ 262588, "kd_oru_Co3jp" ], [ 262601, "REDBO_reL02" ], [ 262613, "micrindows_Presentation" ], [ 262637, "iasnId_FrbMdm" ], [ 262651, "CNBIy_si_0287" ], [ 262665, "CNBBm_ManVR1I" ], [ 262679, "RASnel_vusr" ], [ 262691, "fdWCystem_qaiide" ], [ 262708, "hpdiI_Immcomn" ], [ 262722, "NlsLm_fibcoc" ], [ 262735, "bridgowerShell_Commands_Utility" ], [ 262767, "netm_Data_lass" ], [ 262782, "mlanga_EntityING" ], [ 262799, "smtsoft_nit" ], [ 262811, "EP0NriseServices_Wrapper" ], [ 262850, "setuasic_VE4I" ], [ 262864, "BCP44ment_resources" ], [ 262884, "obrbnt_tune" ], [ 262896, "dot6mands_ilmsg" ], [ 262912, "sdiag_wpb_security_sinwsesignon_permissions_resources" ], [ 262966, "wbempo_Trpsrv" ], [ 262980, "sprsoft_X16" ], [ 262992, "Systesoft_L0M" ], [ 263006, "msjBasic_Cocrypt" ], [ 263023, "authjws_De001" ], [ 263037, "EPNHtion_s2_32" ], [ 263052, "dfscml_Lincmn" ], [ 263066, "MSPBsoft_Busvc" ], [ 263081, "InputPersonnalemevt_AspnetClienl_resdurces" ], [ 263124, "Systy_GpcgmtLib" ], [ 263140, "mwcia_MediaControl" ], [ 263159, "fxstm_DmtHost" ], [ 263173, "System_Daext" ], [ 263186, "bckgzsoft_agent" ], [ 263202, "Pre_Extnpp" ], [ 263213, "FXSCOent_Aspenral" ], [ 263231, "VDODm_ISENG" ], [ 263243, "Chanem_syL510" ], [ 263257, "sprans_resonesb" ], [ 263273, "lhmstm_manasvc" ], [ 263288, "CNBll_EditoO183" ], [ 263304, "System_IO_Lstem_RemoteDesktop" ], [ 263334, "RTL_Automation_Resouroes" ], [ 263359, "iscsiyour_Computer" ], [ 263378, "webFwk_Resources" ], [ 263395, "wsmprld_Enginror" ], [ 263412, "POWRPm_Deployrvice" ], [ 263431, "fingystem_Sstm32" ], [ 263448, "Portsoft_til" ], [ 263461, "CNBJOws_syShell" ], [ 263477, "pyaylisl1_1_0" ], [ 263491, "fhcation_Core" ], [ 263505, "IMEPicy_LIP" ], [ 263517, "Microtym_messaging" ], [ 263536, "MSYNld_Tasks_v3_5" ], [ 263554, "saaprosoft_VisualC_STLCLH" ], [ 263580, "EP0ubs_In6100" ], [ 263594, "kbdg_Throug_Vsa" ], [ 263610, "gentlicy_Putil" ], [ 263625, "dfsguws_sysisrpc" ], [ 263642, "System_C0010" ], [ 263655, "CNB_tionId_Patr28" ], [ 263673, "Preng_Inzlqent" ], [ 263688, "EPLVCws_Medqta" ], [ 263703, "System_Transacti24P" ], [ 263723, "dfrgs_U_192" ], [ 263735, "CNB_rvices_n09at" ], [ 263752, "SIGVent_Al4res" ], [ 263767, "csvdey_6_0OUND" ], [ 263782, "shostem_delsect" ], [ 263798, "Cryptft_Web_Management_WebDAVClient" ], [ 263834, "xchafsoft_Mednui" ], [ 263851, "sspws_UI_X_AGP" ], [ 263866, "msksoft_rov" ], [ 263878, "windo_MiJOP7U" ], [ 263892, "smserc_Windtcli" ], [ 263908, "System_WetControlSettings" ], [ 263934, "msdddIn_Cent" ], [ 263947, "imjpmws_immeapPr" ], [ 263964, "mspddIn_Cort" ], [ 263977, "winws_hmmedler" ], [ 263992, "Microybaik_MediaPlayer" ], [ 264015, "Systet_windasc" ], [ 264030, "LXAtters_Soap" ], [ 264044, "dmdskt_WSManvider" ], [ 264062, "System_ServicgModelqcxoriginal" ], [ 264093, "Oystem_Identitoge" ], [ 264111, "micter_UentSR" ], [ 264125, "Vdicower_Bllab" ], [ 264140, "winces_Cres" ], [ 264152, "microsId_RulhWizsrd_Resources" ], [ 264182, "obrm_Data_Sdwatq" ], [ 264199, "eapoput_ltr" ], [ 264211, "ehjows_sIGN" ], [ 264223, "CRBPws_Devllw73" ], [ 264251, "Microsoent_Automgtion_Resources" ], [ 264283, "spinsing_l1_1_0" ], [ 264299, "Evesoft_maetup" ], [ 264337, "ConI_Credenvbdx" ], [ 264353, "faxtial_evpst" ], [ 264378, "ndvsuws_UI_mmc" ], [ 264393, "mp4sd_Secursadsn" ], [ 264410, "sktp_f_xstate_l1_1_0" ], [ 264431, "storndows_Di0804" ], [ 264448, "_mssetors_Hoess" ], [ 264464, "KBDUZes_Pcsrss" ], [ 264479, "KBDPs_systipt" ], [ 264493, "System_Runtime_Serialization_Hormatters_Soaanhs" ], [ 264541, "Scim_Core_n3ext" ], [ 264557, "CNBIs_resources" ], [ 264573, "msam_Duta_xmem" ], [ 264588, "CLBent_Aohpen" ], [ 264602, "ipinisoft_SeW02" ], [ 264618, "FBScheduler_resodrces" ], [ 264640, "System_Data_tureEngive" ], [ 264663, "KBDZEole_Oesomadm" ], [ 264681, "bthWorkplase_WorkplaceSettings" ], [ 264712, "System_Workflow_Comm50" ], [ 264735, "Systeuv_orsvc" ], [ 264749, "WSMaws_sleepstudy_events" ], [ 264774, "ftpdoww_0311" ], [ 264787, "CNB__Instalanstc" ], [ 264804, "nvm62ws_lors" ], [ 264817, "TapiSynapIn_Resources" ], [ 264839, "CNBPle_resources" ], [ 264856, "logmModel_tics" ], [ 264871, "agp44ter_Mrfvd" ], [ 264886, "Wird_batteryutil" ], [ 264903, "drmundoms_Diagtosis_Commands_JpdakeDiagReport" ], [ 264949, "ED0NSsoft_lb_ps" ], [ 264965, "wmv8rivate_GBand" ], [ 264982, "wwanjs_Globanfg" ], [ 264998, "AuthHws_system_catetime_l1_1_0" ], [ 265029, "Dangerous_Crta0027" ], [ 265048, "AWDCXacBasic_Vsa" ], [ 265065, "netsrShell_oprt" ], [ 265081, "defra_Entity" ], [ 265094, "msnssoft_Write" ], [ 265109, "mqmaround_v89" ], [ 265123, "senst_Wengr" ], [ 265135, "System_Configurationallback" ], [ 265163, "asper_ProxyStub" ], [ 265179, "NlsOer_SvAPI" ], [ 265192, "sisbksoft_G2port" ], [ 265209, "EP0NR_windo_32" ], [ 265224, "HPVSCt_IEMBG" ], [ 265237, "TsUsbRedirecls_UI_CredentialPicker" ], [ 265272, "licesic_VECD" ], [ 265285, "wmidk_Gpowersilter" ], [ 265304, "Sin_Uindow0405" ], [ 265319, "fscfdows_GSIG" ], [ 265333, "lxa3_Securihrtz" ], [ 265349, "pmc_Security_ApplicationId_Wizards_AutomaticRuleGenerationWizard" ], [ 265414, "System_Wnext" ], [ 265427, "rasdtpm_resources" ], [ 265445, "Ccr_Blueto63883" ], [ 265461, "pacagnosis_W32" ], [ 265476, "SysWWizFwk_0251" ], [ 265492, "RunLegacyCPLEloft_Transactions_Bridgt" ] ], "sz": 273408, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x3f04c" ], "i": "metadata/dotnet/bsjb-signature", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.47" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1468261308.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 0.8500000238418579, "d": "RAR archive reference", "e": [ "YISPLAY NIBRARY Audio Decoder DMX Soap SDK" ], "i": "well-known/malware/trojan/shellobject/strings::rar-archive-marker", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8450.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.16" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 1.0, "d": ".NET binary (PE with BSJB metadata)", "e": [ "pe.is_dotnet = 1.00" ], "i": "metadata/binary/metrics/threshold::dotnet-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 303104.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 22.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.75, "d": "Text section dominates file", "e": [ "binary.text_to_file_ratio = 0.99" ], "i": "metadata/binary/layout::text-section-dominates-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "String", "GetString", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.47" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1786.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "ValueType" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/metrics/structural::minimal-exports", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_98e8512075b49635cdacc78fa7ee98a8" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.6000000238418579, "d": "AppDomain.CurrentDomain accessor", "e": [ "get_CurrentDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "l": 1 }, { "c": 0.75, "d": "Binary exports one symbol", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/symbols/exports::single-export", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.16" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 35.82" ], "i": "metadata/binary/metrics/anomaly::high-complexity-marker", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 428.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1036", "c": 0.949999988079071, "d": "PE FileDescription is single-character placeholder", "e": [ " " ], "i": "objectives/evasion/masquerade/identity/fabricated::pe-file-description-single-char", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "0.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 1468261308.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.550000011920929, "d": "High basic blocks per function", "e": [ "binary.avg_basic_blocks = 81.18" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-basic-blocks", "l": 3, "m": "B0032" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree.dll (CorDllMain)", "e": [ "mscoree.dll" ], "i": "metadata/dylib::mscoree/dll", "l": 2 }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1 }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "0.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1 }, { "c": 1.0, "d": ".NET Assembly (mscoree.dll)", "e": [ "pe.is_dotnet = 1.00", "BSJB" ], "i": "metadata/binary/framework::dotnet-assembly", "l": 2 } ], "sha": "71f5e719d2b7471ca599f586e3f6ca86f40ccc924a7fffb9d2be3a81dd508879", "path": "VirusShare_98e8512075b49635cdacc78fa7ee98a8", "type": "pe" } ], "tv": "60127" } }