{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.868831, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T10:44:56Z" }, "path": "2026-03-08_ea78b2af6bce6aefb93eafe0d1465041_icedid_mespinoza_njrat_ryuk_vidar", "raw": { "v": "4", "fs": [ { "f": "KO₆(As₉Er₆Al₅C₂I₂P)H₆(DsOs₄PoCmDbMg)Md₄(Bi₃HePt)", "x": 96, "id": 0, "is": [ "AddAce", "CopySid", "GetAclInformation", "GetLengthSid", "GetSecurityDescriptorControl", "GetSecurityDescriptorDacl", "GetSecurityDescriptorGroup", "GetSecurityDescriptorOwner", "GetSecurityDescriptorSacl", "GetSidLengthRequired", "GetSidSubAuthority", "InitializeAcl", "InitializeSecurityDescriptor", "InitializeSid", "IsValidSid", "MakeAbsoluteSD", "RegisterServiceCtrlHandlerW", "SetSecurityDescriptorDacl", "SetSecurityDescriptorGroup", "SetSecurityDescriptorOwner", "SetServiceStatus", "StartServiceCtrlDispatcherW", "AcquireSRWLockExclusive", "CloseHandle", "CreateEventW", "CreateFileW", "DecodePointer", "DeleteCriticalSection", "DeleteFileW", "EncodePointer", "EnterCriticalSection", "EnumSystemLocalesW", "ExitProcess", "FindClose", "FindFirstFileExW", "FindNextFileW", "FlushFileBuffers", "FormatMessageA", "FreeEnvironmentStringsW", "FreeLibrary", "GetACP", "GetCPInfo", "GetCommandLineA", "GetCommandLineW", "GetConsoleCP", "GetConsoleMode", "GetCurrentDirectoryW", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThreadId", "GetEnvironmentStringsW", "GetEnvironmentVariableW", "GetFileType", "GetLastError", "GetLocalTime", "GetLocaleInfoW", "GetModuleFileNameW", "GetModuleHandleExW", "GetModuleHandleW", "GetNativeSystemInfo", "GetOEMCP", "GetProcAddress", "GetProcessHeap", "GetStartupInfoW", "GetStdHandle", "GetStringTypeW", "GetSystemInfo", "GetSystemTimeAsFileTime", "GetTickCount", "GetUserDefaultLCID", "HeapAlloc", "HeapCreate", "HeapDestroy", "HeapFree", "HeapReAlloc", "HeapSetInformation", "HeapSize", "InitializeCriticalSectionAndSpinCount", "InitializeSListHead", "IsDebuggerPresent", "IsProcessorFeaturePresent", "IsValidCodePage", "IsValidLocale", "LCMapStringW", "LeaveCriticalSection", "LoadLibraryExA", "LoadLibraryExW", "LocalFree", "MultiByteToWideChar", "OutputDebugStringA", "OutputDebugStringW", "QueryPerformanceCounter", "QueryPerformanceFrequency", "RaiseException", "ReadConsoleW", "ReadFile", "ReleaseSRWLockExclusive", "ResetEvent", "RtlCaptureContext", "RtlCaptureStackBackTrace", "RtlLookupFunctionEntry", "RtlPcToFileHeader", "RtlUnwindEx", "RtlVirtualUnwind", "SetEvent", "SetFilePointerEx", "SetLastError", "SetStdHandle", "SetUnhandledExceptionFilter", "Sleep", "SwitchToThread", "TerminateProcess", "TlsAlloc", "TlsFree", "TlsGetValue", "TlsSetValue", "TryAcquireSRWLockExclusive", "UnhandledExceptionFilter", "VirtualProtect", "VirtualQuery", "WaitForSingleObject", "WaitForSingleObjectEx", "WideCharToMultiByte", "WriteConsoleW", "WriteFile", "CoAddRefServerProcess", "CoInitializeEx", "CoInitializeSecurity", "CoRegisterClassObject", "CoReleaseServerProcess", "CoResumeClassObjects", "CoRevokeClassObject", "CoUninitialize", "CommandLineToArgvW", "timeGetTime" ], "ms": { "pe": { "machine": 34404.0, "checksum": 2005546.0, "pdb_path": "elevation_service.exe.pdb", "rsrc_size": 2560.0, "subsystem": 2.0, "timestamp": 1544504400.0, "image_base": 5368709120.0, "rsrc_entropy": 4.53, "entry_section": ".text", "size_of_image": 2039808.0, "timestamp_day": 11.0, "tls_callbacks": 1.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2018.0, "characteristics": 34.0, "entry_point_rva": 188048.0, "size_of_headers": 1536.0, "timestamp_month": 12.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 5.0, "manifest_present": true, "computed_checksum": 2005546.0, "section_alignment": 4096.0, "number_of_sections": 8.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1544504400.0, "debug_timestamp_min": 1544504400.0, "dll_characteristics": 33056.0, "linker_major_version": 14.0, "version_info_present": true, "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 1879552.0, "file_size": 2004992.0, "entry_point": 188048.0, "wx_sections": 1.0, "code_entropy": 5.17, "data_entropy": 4.49, "export_count": 1.0, "import_count": 135.0, "string_count": 1041.0, "section_count": 8.0, "avg_complexity": 5.51, "function_count": 1184.0, "import_density": 0.07, "max_complexity": 60.0, "string_density": 0.57, "overall_entropy": 3.57, "avg_basic_blocks": 7.97, "avg_section_size": 250432.0, "dependency_count": 5.0, "entropy_variance": 2.26, "function_density": 0.65, "avg_function_size": 200.07, "avg_string_length": 15.98, "complexity_per_kb": 0.0, "max_string_length": 1008.0, "wide_string_count": 281.0, "writable_sections": 3.0, "avg_string_entropy": 2.96, "code_to_data_ratio": 15.17, "data_to_file_ratio": 0.0, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.15, "total_basic_blocks": 534.0, "executable_sections": 2.0, "high_entropy_strings": 3.0, "string_length_stddev": 33.26, "debug_reference_count": 1.0, "largest_section_ratio": 0.78, "sentence_string_count": 117.0, "sentence_string_ratio": 0.11, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode.$" ], [ 384, ".text" ], [ 463, "@.data" ], [ 504, ".pdata" ], [ 543, "@.00cfg" ], [ 624, ".rsrc" ], [ 663, "@.reloc" ], [ 1856, "AWAVATVWUSH" ], [ 3312, "VWSH" ], [ 3408, "AWAVATVWSH" ], [ 3760, "AVVWSH" ], [ 4448, "AWAVAUATVWUSH" ], [ 6224, "AVVWUSH" ], [ 12960, "G L9" ], [ 13392, "AWAVVWSH" ], [ 13920, "AWAVAUATVWSH" ], [ 15120, "VWUSH" ], [ 15456, "AWAVVWUSH" ], [ 30544, "UAWAVVWSH" ], [ 31088, "UAVVWSH" ], [ 31149, "C H9C" ], [ 31840, "UAWAVAUATVWSH" ], [ 35202, "K H9" ], [ 35289, "W H9" ], [ 36018, "O H9" ], [ 36882, "HXH9" ], [ 43204, "9L9O" ], [ 43563, "H97L" ], [ 50461, "M8H1" ], [ 60816, "UVWH" ], [ 61628, "A E1" ], [ 68644, "L$(I)" ], [ 69392, "AWAVVWSL" ], [ 72512, "UAWAVATVWSH" ], [ 75200, "PHH9" ], [ 88784, "UVWSH" ], [ 95138, "O L9" ], [ 95726, "N H9" ], [ 95898, "M L9" ], [ 97509, "M H9" ], [ 100940, "stack", "\u003cbr\u003e" ], [ 111310, "HISTOGRAH" ], [ 111318, "stack", "HISTOGRA" ], [ 111347, "UNKNOWN" ], [ 111355, "stack", "UNKNOWN" ], [ 111524, "ISTOGRAMH" ], [ 111538, "DUMMY_HIH" ], [ 111546, "stack", "DUMMY_HISTOGRAM" ], [ 113517, "/H9M" ], [ 115863, "Q H9" ], [ 116752, "AVVWUS" ], [ 123899, "gfffffffH" ], [ 129565, "effffff" ], [ 138724, "TUUUUUU" ], [ 147034, "MXH1" ], [ 155287, "unknown" ], [ 159491, "9P A" ], [ 171719, "WAVAWH" ], [ 176838, "VWAVH" ], [ 176886, "enti" ], [ 176934, "Genu" ], [ 178641, "x ATAVAWH" ], [ 181459, "UWATAVAWH" ], [ 183018, "MGH3" ], [ 184035, "UAVAWH" ], [ 186436, "@USVWATAUAVAWH" ], [ 186939, "MH9L8" ], [ 187221, "M H1E" ], [ 187739, "WATAUAVAWH" ], [ 188258, "VWATAVAWH" ], [ 190160, "8RCC" ], [ 190168, "8MOC" ], [ 193485, "s WATAUAVAWH" ], [ 195938, "N0E3" ], [ 196495, "WATAVH" ], [ 197008, "@USVWATAVAWH" ], [ 198883, "\u003c\u003c6u" ], [ 202784, "\u003c0u\u003e" ], [ 206838, "\\$ UVWATAUAVAWH" ], [ 209693, "UVWAVAWH" ], [ 213870, "UWAVH" ], [ 218181, "UVWATAUAVAWH" ], [ 218722, "VWAV" ], [ 219266, "VWATAVAW" ], [ 223152, "t$ WATAUAVAW" ], [ 224384, "t$ WATAUAVAWH" ], [ 236683, "t$ UWAUAVAWH" ], [ 239893, "VAVH" ], [ 244464, "@SVWATAUAVAWH" ], [ 246195, "SVWATAUAVAWH" ], [ 246599, "UATAUAVAWH" ], [ 248939, "AUAVAWH" ], [ 252783, "ATAVAWH" ], [ 256380, "@SUVWATAVAWH" ], [ 257177, "M H3" ], [ 257216, "@UATAUAVAWH" ], [ 262162, "\\$ VWATAUAVH" ], [ 269975, "H 9Y" ], [ 276714, "VWAUH" ], [ 282174, "\\$ UVWAVAWH" ], [ 283651, "f90t" ], [ 284627, "USVWAVH" ], [ 288896, "@SUVWATAUAVAWH" ], [ 301904, "ATAUAVH" ], [ 308224, "../../chrome/elevation_service/elevation_service.cc" ], [ 308276, "Failed to initialize COM" ], [ 308301, "ios_base::badbit set" ], [ 308322, "ios_base::failbit set" ], [ 308344, "ios_base::eofbit set" ], [ 308416, "string too long" ], [ 308432, "iostream" ], [ 308441, "iostream stream error" ], [ 308491, "unknown exception" ], [ 311194, "wide", "az-az-cyrl" ], [ 311216, "wide", "az-az-latn" ], [ 311274, "wide", "bs-ba-latn" ], [ 311404, "wide", "div-mv" ], [ 312138, "wide", "kok-in" ], [ 312404, "wide", "quz-bo" ], [ 312418, "wide", "quz-ec" ], [ 312432, "wide", "quz-pe" ], [ 312542, "wide", "sma-no" ], [ 312556, "wide", "sma-se" ], [ 312570, "wide", "smj-no" ], [ 312584, "wide", "smj-se" ], [ 312598, "wide", "smn-fi" ], [ 312612, "wide", "sms-fi" ], [ 312638, "wide", "sr-ba-cyrl" ], [ 312660, "wide", "sr-ba-latn" ], [ 312682, "wide", "sr-sp-cyrl" ], [ 312704, "wide", "sr-sp-latn" ], [ 312762, "wide", "syr-sy" ], [ 312872, "wide", "uz-uz-cyrl" ], [ 312894, "wide", "uz-uz-latn" ], [ 312940, "wide", "zh-chs" ], [ 312954, "wide", "zh-cht" ], [ 313040, "wide", "CLSID" ], [ 313052, "wide", "Interface" ], [ 313078, "../../chrome/elevation_service/service_main.cc" ], [ 313125, "No positional parameters expected." ], [ 313160, "console" ], [ 313183, "FFactory creation failed; hr:" ], [ 313214, "IClassFactory object creation failed; hr:" ], [ 313257, "NotificationActivator registration failed; hr:" ], [ 313305, "NotificationActivator unregistration failed; hr:" ], [ 313392, "wide", "ChromeElevationService" ], [ 313438, "Failed to connect to the service control manager" ], [ 313487, "RegisterServiceCtrlHandler failed" ], [ 314305, "bad locale name" ], [ 314592, "false" ], [ 314598, "true" ], [ 314603, "invalid string position" ], [ 314698, "vector\u003cT\u003e too long" ], [ 314717, "map/set\u003cT\u003e too long" ], [ 314760, "VERBOSE" ], [ 314785, "Error (0x%lX) while retrieving error. (0x%lX)" ], [ 314838, "wide", "debug.log" ], [ 315176, "INFO" ], [ 315181, "WARNING" ], [ 315189, "ERROR" ], [ 315195, "FATAL" ], [ 315256, "wide", "Chrome" ], [ 315270, "wide", "beta" ], [ 315288, "wide", "canary" ], [ 315312, "wide", "name" ], [ 315428, "wide", "stable" ], [ 315496, "wide", "PROGRAMFILES" ], [ 315522, "wide", "PROGRAMFILES(X86)" ], [ 315558, "wide", "PROGRAMW6432" ], [ 315584, "wide", "\\Application" ], [ 315728, "wide", "api-ms-win-core-synch-l1-2-0.dll" ], [ 315800, "wide", "kernel32.dll" ], [ 315832, "InitializeConditionVariable" ], [ 315864, "SleepConditionVariableCS" ], [ 315896, "WakeAllConditionVariable" ], [ 315952, "Unknown exception" ], [ 315976, "unknown error" ], [ 318136, "address family not supported" ], [ 318168, "address in use" ], [ 318184, "address not available" ], [ 318208, "already connected" ], [ 318232, "argument list too long" ], [ 318256, "argument out of domain" ], [ 318280, "bad address" ], [ 318296, "bad file descriptor" ], [ 318320, "bad message" ], [ 318336, "broken pipe" ], [ 318352, "connection aborted" ], [ 318376, "connection already in progress" ], [ 318408, "connection refused" ], [ 318432, "connection reset" ], [ 318456, "cross device link" ], [ 318480, "destination address required" ], [ 318512, "device or resource busy" ], [ 318536, "directory not empty" ], [ 318560, "executable format error" ], [ 318584, "file exists" ], [ 318600, "file too large" ], [ 318616, "filename too long" ], [ 318640, "function not supported" ], [ 318664, "host unreachable" ], [ 318688, "identifier removed" ], [ 318712, "illegal byte sequence" ], [ 318736, "inappropriate io control operation" ], [ 318776, "interrupted" ], [ 318792, "invalid argument" ], [ 318816, "invalid seek" ], [ 318832, "io error" ], [ 318848, "is a directory" ], [ 318864, "message size" ], [ 318880, "network down" ], [ 318896, "network reset" ], [ 318912, "network unreachable" ], [ 318936, "no buffer space" ], [ 318952, "no child process" ], [ 318976, "no link" ], [ 318984, "no lock available" ], [ 319008, "no message available" ], [ 319032, "no message" ], [ 319048, "no protocol option" ], [ 319072, "no space on device" ], [ 319096, "no stream resources" ], [ 319120, "no such device or address" ], [ 319152, "no such device" ], [ 319168, "no such file or directory" ], [ 319200, "no such process" ], [ 319216, "not a directory" ], [ 319232, "not a socket" ], [ 319248, "not a stream" ], [ 319264, "not connected" ], [ 319280, "not enough memory" ], [ 319304, "not supported" ], [ 319320, "operation canceled" ], [ 319344, "operation in progress" ], [ 319368, "operation not permitted" ], [ 319392, "operation not supported" ], [ 319416, "operation would block" ], [ 319440, "owner dead" ], [ 319456, "permission denied" ], [ 319480, "protocol error" ], [ 319496, "protocol not supported" ], [ 319520, "read only file system" ], [ 319544, "resource deadlock would occur" ], [ 319576, "resource unavailable try again" ], [ 319608, "result out of range" ], [ 319632, "state not recoverable" ], [ 319656, "stream timeout" ], [ 319672, "text file busy" ], [ 319688, "timed out" ], [ 319704, "too many files open in system" ], [ 319736, "too many files open" ], [ 319760, "too many links" ], [ 319776, "too many symbolic link levels" ], [ 319808, "value too large" ], [ 319824, "wrong protocol type" ], [ 319872, "bad allocation" ] ], "sz": 2004992, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.949999988079071, "d": "Chrome elevation service binary name", "e": [ "elevation_service.exe" ], "i": "objectives/evasion/masquerade/debug::elevation-service-binary", "l": 1 }, { "c": 0.8600000143051147, "d": "Large .reloc section", "e": [ ".reloc (size: 1572864)" ], "i": "metadata/binary/section/metrics::large-reloc-section", "l": 3 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "a": "T1070", "c": 0.6000000238418579, "d": "Vectorized zero-fill blocks (xorps + movups stores)", "e": [ "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11", "0F 57 C0 0F 11" ], "i": "objectives/evasion/indicator-removal/cleanup::vectorized-zero-density", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1041.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.9800000190734863, "d": "user32 dynamic dispatch target", "e": [ "user32" ], "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 135.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8199999928474426, "d": "Query ACL information", "e": [ "GetAclInformation" ], "i": "micro-behaviors/os/security/descriptor::get-acl-information", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00", "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b9", "b9", "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1184.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 135.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b9", "b9", "b9", "b9", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-dialogbox-l1-1-0", "ext-ms-win-ntuser-windowstation-l1-1-0" ], "i": "metadata/binary/linking::api-set-ext-cluster", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001" }, { "c": 0.949999988079071, "d": "Chrome elevation service source path", "e": [ "../../chrome/elevation_service/", "../../chrome/elevation_service/" ], "i": "objectives/evasion/masquerade/debug::elevation-service-source-path", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales-import", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 135.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3", "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform::etw-blinding-patch-bytes", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW lock acquisition", "e": [ "AcquireSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-acquire", "l": 2 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 135.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.949999988079071, "d": "LLD PDB debug marker", "e": [ "@LLD PDB." ], "i": "metadata/lang/compiler/native::lld-pdb-marker", "l": 3 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 135.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE TLS callback table present", "e": [ "pe.tls_callbacks = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-callbacks-metric", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 135.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2 }, { "a": "T1027", "c": 0.9599999785423279, "d": "Large RWX .reloc payload section", "e": [ ".reloc (size: 1572864, entropy: 3.86, perms: rwx)" ], "i": "objectives/anti-static/pack::reloc-rwx-payload-section", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1544504400.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "QueryPerformanceFrequency timing", "e": [ "QueryPerformanceFrequency" ], "i": "micro-behaviors/time/timing/check::query-performance-frequency", "l": 2, "m": "B0003.003" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cbr\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "AWAVATVWUSH", "AWAVATVWSH", "AWAVVWSH", "AWAVAUATVWSH", "AWAVVWUSH", "UAWAVVWSH", "AWAVVWSL", "UAWAVATVWSH", "HISTOGRAH", "HISTOGRA", "ISTOGRAMH", "UWATAVAWH", "WATAUAVAWH", "VWATAVAWH", "UVWAVAWH", "UVWATAUAVAWH" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".pdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.57" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1184.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Oversized low-entropy .reloc masking section", "e": [ ".reloc (size: 1572864, entropy: 3.86)" ], "i": "objectives/anti-static/pack::oversized-reloc-masking", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-xstate-l2-1-0" ], "i": "metadata/binary/linking::api-set-core-cluster", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 2004992.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringA", "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1184.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "elevation_service.exe.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1497.003", "c": 0.699999988079071, "d": "timeGetTime multimedia timing", "e": [ "timeGetTime" ], "i": "micro-behaviors/time/timing/check::timegettime", "l": 2, "m": "B0003.003" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.800000011920929, "d": "Dynamic object instantiation via Activator", "e": [ "NotificationActivator unregistration failed; hr:", "NotificationActivator registration failed; hr:" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::activator", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.96" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "binary.file_size = 2004992.00" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0", "0F 01 D0", "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "a": "T1546.012", "c": 0.8999999761581421, "d": "IFEO registry path", "e": [ "Image File Execution Options" ], "i": "objectives/persistence/login/ifeo/debugger::ifeo-registry-path", "l": 1, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Add ACE to ACL", "e": [ "AddAce" ], "i": "micro-behaviors/os/security/descriptor::add-ace", "l": 2 }, { "c": 0.699999988079071, "d": "Check if running under WoW64", "e": [ "IsWow64Process" ], "i": "micro-behaviors/os/compat/wow64::is-wow64-process", "l": 2 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "2026-03-08_ea78b2af6bce6aefb93eafe0d1465041_icedid_mespinoza_njrat_ryuk_vidar" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 2560.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 135.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 2 }, { "c": 0.9599999785423279, "d": "Chrome elevation service PDB name", "e": [ "elevation_service.exe.pdb" ], "i": "objectives/evasion/masquerade/debug::elevation-service-pdb", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with many wide strings", "e": [ "binary.wide_string_count = 281.00" ], "i": "objectives/anti-static/obfuscation/payload/section::heavy-wide-string-corpus", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Initialize COM security context", "e": [ "CoInitializeSecurity" ], "i": "micro-behaviors/os/com/invoke::co-initialize-security", "l": 3 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.57" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool", "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 0.9200000166893005, "d": "GetHandleVerifier export decoy name", "e": [ "GetHandleVerifier" ], "i": "objectives/evasion/masquerade/debug::gethandleverifier-export", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 2004992.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8799999952316284, "d": ".reloc section nearly as large as .text", "e": [ ".reloc", ".reloc = 512.9% of .text (1572864 / 306688 bytes)" ], "i": "metadata/binary/section/metrics::reloc-near-text-size", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "48", "47", "48", "41" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1041.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 534.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Modbus write single register frame", "e": [ "00 00", "00 00", "00 00", "00 00", "00 00", "00 00", "00 00", "00 00" ], "i": "micro-behaviors/communications/modbus::write-single-register", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8", "b8", "b9", "b8", "b8", "b9", "b9", "b9", "b8", "b9", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.48)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.800000011920929, "d": "Initialize COM apartment model", "e": [ "CoInitializeEx" ], "i": "micro-behaviors/os/com/invoke::co-initialize-ex", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 135.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8799999952316284, "d": "Initialize ACL structure", "e": [ "InitializeAcl" ], "i": "micro-behaviors/os/security/descriptor::initialize-acl", "l": 2 }, { "a": "T1129", "c": 0.6499999761581421, "d": "SRW lock release", "e": [ "ReleaseSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-release", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.51" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1184.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform::ntdll-dll-str", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".reloc (size: 1572864, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "NtCurrentProcess handle (-1) for NT API call", "e": [ "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF", "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::nt-current-process-handle", "l": 1, "m": "F0004" }, { "a": "T1543.003", "c": 0.8799999952316284, "d": "Report service status updates", "e": [ "SetServiceStatus" ], "i": "micro-behaviors/os/service/control::set-service-status", "l": 3 }, { "c": 0.8999999761581421, "d": "Flatten self-relative descriptor", "e": [ "MakeAbsoluteSD" ], "i": "micro-behaviors/os/security/descriptor::make-absolute-sd", "l": 3 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}", "{8A69D345-D564-463c-AFF1-A69D9E530F96}", "{5C65F4B0-3651-4514-B207-D10CB699B14B}", "{8237E44A-0054-442C-B6B6-EA0509993955}", "{401C381F-E0DE-4B85-8BD8-3F3F14FBDA57}", "{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}", "{1BEAC3E3-B852-44F4-B468-8906C062422E}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableW" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "a": "T1543.003", "c": 0.8999999761581421, "d": "Register service control handler", "e": [ "RegisterServiceCtrlHandlerW" ], "i": "micro-behaviors/os/service/control::register-service-handler", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1184.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 3 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027.007", "c": 0.9200000166893005, "d": "FNV-1a 64-bit prime loaded via movabs (x64)", "e": [ "48 b8" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-64bit-movabs", "l": 3, "m": "B0032.014" }, { "a": "T1027", "c": 0.8399999737739563, "d": ".reloc dominates PE image layout", "e": [ ".reloc", ".reloc = 78.4% of total (1572864 / 2004992 bytes)" ], "i": "objectives/anti-static/pack::reloc-dominates-image", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 2004992.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014" }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "FNV-1a 64-bit prime constant (0x100000001B3)", "e": [ "B3 01 00 00 00 01 00 00" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-64bit-literal", "l": 3, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1 }, { "a": "T1543.003", "c": 0.8999999761581421, "d": "Start service control dispatcher", "e": [ "StartServiceCtrlDispatcherW" ], "i": "micro-behaviors/os/service/control::start-service-dispatcher", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::wx-sections", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.8500000238418579, "d": "ProcessDebugPort info class (mov edx, 7)", "e": [ "BA 07 00 00 00", "BA 07 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-port-info-class", "l": 1, "m": "B0001" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "00 41 3e 2d 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1184.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1041.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoAddRefServerProcess, CoInitializeEx, CoInitializeSecurity, CoRegisterClassObject, CoReleaseServerProcess, ... +3 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (CommandLineToArgvW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (AcquireSRWLockExclusive, CloseHandle, CreateEventW, CreateFileW, DecodePointer, ... +98 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINMM.dll (timeGetTime)", "e": [ "WINMM.dll" ], "i": "metadata/dylib::winmm/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (AddAce, CopySid, GetAclInformation, GetLengthSid, GetSecurityDescriptorControl, ... +17 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetLocaleInfoW", "EnumSystemLocalesW", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::locale-fingerprinting-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1543.003", "c": 0.9200000166893005, "d": "Windows service control dispatch", "e": [ "SetServiceStatus", "RegisterServiceCtrlHandlerW", "StartServiceCtrlDispatcherW" ], "i": "micro-behaviors/os/service/control::service-control-dispatch", "l": 3 }, { "a": "T1055.012", "c": 0.8799999952316284, "d": "Self-process injection via indirect NT API calls", "e": [ "VirtualProtect", "ntdll.dll", "48 C7 C1 FF FF FF FF" ], "i": "objectives/evasion/anti-av/syscall::indirect-nt-api-self-injection", "l": 2, "m": "F0004" }, { "a": "T1129", "c": 0.699999988079071, "d": "SRW lock operations", "e": [ "AcquireSRWLockExclusive", "ReleaseSRWLockExclusive" ], "i": "micro-behaviors/process/threading/advanced-sync::srw-lock-ops", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "timeGetTime", "GetTickCount" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Packed service loader in RWX reloc", "e": [ "GetProcAddress", ".reloc (size: 1572864, entropy: 3.86)", ".reloc", ".reloc (size: 1572864, entropy: 3.86, perms: rwx)", "VirtualProtect", ".reloc = 78.4% of total (1572864 / 2004992 bytes)", "InitializeSecurityDescriptor", "SetSecurityDescriptorDacl" ], "i": "objectives/anti-static/pack::rwx-reloc-service-loader", "l": 4, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetUserDefaultLCID", "GetLocaleInfoW", "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "a": "T1543.003", "c": 0.949999988079071, "d": "Full Windows service dispatch triplet", "e": [ "RegisterServiceCtrlHandlerW", "SetServiceStatus", "StartServiceCtrlDispatcherW" ], "i": "micro-behaviors/os/service/control::service-dispatch-triad", "l": 3 }, { "a": "T1027.009", "c": 0.75, "d": "Versioned service installation markers", "e": [ "RegisterServiceCtrlHandlerW", "VS_VERSION_INFO", "StartServiceCtrlDispatcherW", "SetServiceStatus" ], "i": "objectives/anti-static/obfuscation/payload/self-read::versioned-service-binary", "l": 2, "m": "B0032" }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Timing-based anti-debugging pattern", "e": [ "IsDebuggerPresent", "timeGetTime", "GetTickCount", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug", "l": 1, "m": "B0003.003" }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameW" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1027", "c": 0.9900000095367432, "d": "LLD service facade with RWX reloc", "e": [ ".reloc", "GetProcAddress", ".reloc = 78.4% of total (1572864 / 2004992 bytes)", "@LLD PDB.", "SetServiceStatus", "GetModuleHandleW", "StartServiceCtrlDispatcherW", "RegisterServiceCtrlHandlerW", ".reloc (size: 1572864, entropy: 3.86)", "GetModuleHandleExW", ".reloc (size: 1572864, entropy: 3.86, perms: rwx)" ], "i": "objectives/anti-static/pack::masqueraded-lld-service-loader", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetEnvironmentStringsW", "GetLocaleInfoW", "EnumSystemLocalesW", "FreeEnvironmentStringsW", "GetUserDefaultLCID", "EnumSystemLocalesEx" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 2, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with low average complexity", "e": [ "binary.file_size = 2004992.00", "binary.avg_complexity = 5.51", "binary.overall_entropy = 3.57", "binary.string_count = 1041.00", "binary.function_count = 1184.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-binary-low-average-complexity", "l": 2, "m": "B0032" }, { "a": "T1082", "c": 0.9300000071525574, "d": "Profile locale environment and launch context", "e": [ "GetCommandLineA", "EnumSystemLocalesW", "GetCommandLineW", "GetEnvironmentStringsW", "GetUserDefaultLCID", "GetLocaleInfoW", "FreeEnvironmentStringsW", "GetCurrentThreadId" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling-windows-loader", "l": 2, "m": "E1082" }, { "c": 0.9800000190734863, "d": "Masquerades as Chrome service binary", "e": [ "@LLD PDB.", "elevation_service.exe.pdb", "SetServiceStatus", "GetHandleVerifier", "RegisterServiceCtrlHandlerW", "StartServiceCtrlDispatcherW", "elevation_service.exe", "../../chrome/elevation_service/" ], "i": "objectives/evasion/masquerade/debug::fake-chrome-service-facade", "l": 4 }, { "c": 0.9399999976158142, "d": "Rewrite ACLs and security descriptor", "e": [ "MakeAbsoluteSD", "SetSecurityDescriptorDacl", "GetAclInformation", "InitializeAcl", "InitializeSecurityDescriptor", "AddAce" ], "i": "micro-behaviors/os/security/descriptor::acl-rewrite-cluster", "l": 3 }, { "c": 0.9700000286102295, "d": "Chrome elevation service masquerade", "e": [ "GetHandleVerifier", "elevation_service.exe", "../../chrome/elevation_service/", "elevation_service.exe.pdb" ], "i": "objectives/evasion/masquerade/debug::chrome-elevation-service-decoy", "l": 4 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.overall_entropy = 3.57", "binary.function_count = 1184.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "c": 0.8999999761581421, "d": "Active self-modification behavior", "e": [ "VirtualProtect", "00 41 3e 2d 75" ], "i": "objectives/anti-analysis/self-modify/runtime::active", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetLocaleInfoW", "GetCommandLineA", "GetCommandLineW", "GetUserDefaultLCID", "EnumSystemLocalesW", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "EnumSystemLocalesEx", "GetSystemTimeAsFileTime" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 2, "m": "E1082" } ], "sha": "72dae3743891457a56b30be11b00df43c139c0c7a2a4fcfe398caaf57d9c6ea3", "path": "/data/samples/bad/harvest/vxug/2026-03-08_ea78b2af6bce6aefb93eafe0d1465041_icedid_mespinoza_njrat_ryuk_vidar", "type": "pe" } ], "tv": "50726" } }