{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.22476366, "rte": "az", "prob": 0.22476366 }, { "cls": 0, "raw": 0.17744648, "rte": "az/native", "prob": 0.17744648 }, { "cls": 0, "raw": 0.11295918, "rte": "az/pe", "prob": 0.11295918 } ], "prob": 0.22476366, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.2247636616230011 } ], "version": "v18.18", "analyzed_at": "2026-06-10T14:27:29Z" }, "path": "72e9105cade1c5f92dad850ce2ffcf4792ae86e3f0039187bf2fbfb0bd949ff9.exe", "raw": { "v": "7", "tv": "46abf", "files": [ { "id": 0, "ctx": [ { "l": 29458, "t": "0a 06 72 6c 99 00 70 6f 35 00 00 0a 06 6f 36 00 00 0a 2a 5a 28 38 ..rl..po5....o6...*Z(8", "x": true }, { "l": 29480, "t": "00 00 0a 16 28 39 00 00 0a 73 01 00 00 06 28 3a 00 00 0a 2a 00 00 ....(9...s....(:...*..", "x": true }, { "l": 29502, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 29520, "z": 128 } ], "t": "00 00 5a 54 00 00 ce ca ef be 01 00 00 00 91 00 00 00 6c 53 79 73 ..ZT..............lSys", "x": true }, { "l": 29524, "t": "74 65 6d 2e 52 65 73 6f 75 72 63 65 73 2e 52 65 73 6f 75 72 63 65 tem.Resources.Resource", "x": true }, { "l": 51040, "t": "fa f1 e6 5c 33 40 49 54 37 cf 42 66 2f 8e a9 ed 51 18 7d ca cf 48 ...\\3@IT7.Bf/...Q.}..H", "x": true }, { "l": 51062, "t": "19 81 1e 66 6d e3 b6 ea c2 d5 49 df 7f f6 1c e4 e4 fe 1f b5 a6 1e ...fm.....I...........", "x": true }, { "l": 51084, "n": [ { "c": 2, "d": ".NET Assembly (mscoree.dll)", "i": "metadata/binary/framework::dotnet-assembly", "o": 51104, "z": 4 } ], "t": "ca f0 12 0c 56 00 00 00 00 49 45 4e 44 ae 42 60 82 0b 00 00 42 53 ....V....IEND.B`....BS", "x": true }, { "l": 51106, "t": "4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 32 2e 30 2e 35 30 37 JB............v2.0.507", "x": true }, { "l": 53328, "t": "64 75 6c 65 3e 00 31 2e 65 78 65 00 4d 75 73 69 63 45 78 70 72 65 dule\u003e.1.exe.MusicExpre", "x": true }, { "l": 53350, "t": "73 73 4d 61 69 6e 00 4d 75 73 69 63 45 78 70 72 65 73 73 00 4d 75 ssMain.MusicExpress.Mu", "x": true }, { "l": 53372, "n": [ { "c": 2, "d": "Windows Forms UI framework", "i": "metadata/lang/compiler/managed::winforms-ui", "o": 53390, "z": 20 } ], "t": "73 69 63 52 65 61 64 65 72 00 50 72 6f 67 72 61 6d 00 53 79 73 74 sicReader.Program.Syst", "x": true }, { "l": 53394, "t": "65 6d 2e 57 69 6e 64 6f 77 73 2e 46 6f 72 6d 73 00 46 6f 72 6d 00 em.Windows.Forms.Form.", "x": true }, { "l": 53416, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 53416, "z": 8 } ], "t": "6d 73 63 6f 72 6c 69 62 00 53 79 73 74 65 6d 00 4f 62 6a 65 63 74 mscorlib.System.Object", "x": true }, { "l": 53438, "t": "00 54 65 78 74 42 6f 78 00 74 65 78 74 42 6f 78 31 00 52 69 63 68 .TextBox.textBox1.Rich", "x": true }, { "l": 55000, "t": "79 46 69 6c 65 56 65 72 73 69 6f 6e 41 74 74 72 69 62 75 74 65 00 yFileVersionAttribute.", "x": true }, { "l": 55022, "t": "41 73 73 65 6d 62 6c 79 56 65 72 73 69 6f 6e 41 74 74 72 69 62 75 AssemblyVersionAttribu", "x": true }, { "l": 55044, "n": [ { "c": 2, "d": "Runtime interop services", "i": "metadata/lang/compiler/managed::runtime-interop", "o": 55047, "z": 30 } ], "t": "74 65 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 te.System.Runtime.Inte", "x": true }, { "l": 55066, "t": "72 6f 70 53 65 72 76 69 63 65 73 00 47 75 69 64 41 74 74 72 69 62 ropServices.GuidAttrib", "x": true }, { "l": 55264, "t": "74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 44 65 73 63 72 69 tribute.AssemblyDescri", "x": true }, { "l": 55286, "t": "70 74 69 6f 6e 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c ptionAttribute.Assembl", "x": true }, { "l": 55308, "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 55324, "z": 15 } ], "t": "79 54 69 74 6c 65 41 74 74 72 69 62 75 74 65 00 53 79 73 74 65 6d yTitleAttribute.System", "x": true }, { "l": 55330, "t": "2e 53 65 63 75 72 69 74 79 2e 50 65 72 6d 69 73 73 69 6f 6e 73 00 .Security.Permissions.", "x": true }, { "l": 96052, "t": "6f 78 69 6d 61 74 69 6f 6e 00 00 08 01 00 08 00 00 00 00 00 1e 01 oximation.............", "x": true }, { "l": 96074, "t": "00 01 00 54 02 16 57 72 61 70 4e 6f 6e 45 78 63 65 70 74 69 6f 6e ...T..WrapNonException", "x": true }, { "l": 96096, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 96109, "z": 128 } ], "t": "54 68 72 6f 77 73 01 80 9e 2e 01 80 84 53 79 73 74 65 6d 2e 53 65 Throws.......System.Se", "x": true }, { "l": 96118, "t": "63 75 72 69 74 79 2e 50 65 72 6d 69 73 73 69 6f 6e 73 2e 53 65 63 curity.Permissions.Sec", "x": true }, { "l": 96272, "t": "00 00 00 00 4e 96 01 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 ....N.... ............", "x": true }, { "l": 96294, "t": "00 00 00 00 00 00 00 00 00 00 40 96 01 00 00 00 00 00 00 00 00 00 ..........@...........", "x": true }, { "l": 96316, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 96334, "z": 4 } ], "t": "00 00 00 00 00 00 5f 43 6f 72 45 78 65 4d 61 69 6e 00 6d 73 63 6f ......_CorExeMain.msco", "x": true }, { "l": 96338, "t": "72 65 65 2e 64 6c 6c 00 00 00 00 00 ff 25 00 20 40 00 00 00 00 00 ree.dll......%. @.....", "x": true }, { "l": 96800, "t": "00 00 00 00 00 00 01 00 01 00 00 00 30 00 00 80 00 00 00 00 00 00 ............0.........", "x": true }, { "l": 96822, "t": "00 00 00 00 00 00 00 00 01 00 00 00 00 00 48 00 00 00 58 a0 01 00 ..............H...X...", "x": true }, { "l": 96844, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 96862, "z": 15 } ], "t": "ec 02 00 00 00 00 00 00 00 00 00 00 ec 02 34 00 00 00 56 00 53 00 ..............4...V.S.", "x": true }, { "l": 96866, "t": "5f 00 56 00 45 00 52 00 53 00 49 00 4f 00 4e 00 5f 00 49 00 4e 00 _.V.E.R.S.I.O.N._.I.N.", "x": true }, { "l": 97020, "t": "01 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 69 00 6c 00 65 00 ..S.t.r.i.n.g.F.i.l.e.", "x": true }, { "l": 97042, "t": "49 00 6e 00 66 00 6f 00 00 00 28 02 00 00 01 00 30 00 30 00 30 00 I.n.f.o...(.....0.0.0.", "x": true }, { "l": 97064, "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 97082, "z": 11 } ], "t": "30 00 30 00 34 00 62 00 30 00 00 00 34 00 0a 00 01 00 43 00 6f 00 0.0.4.b.0...4.....C.o.", "x": true }, { "l": 97086, "t": "6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 m.p.a.n.y.N.a.m.e.....", "x": true }, { "l": 97108, "t": "63 00 68 00 69 00 65 00 66 00 74 00 61 00 69 00 6e 00 00 00 44 00 c.h.i.e.f.t.a.i.n...D.", "x": true }, { "l": 97130, "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 97134, "z": 15 } ], "t": "0e 00 01 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 ....F.i.l.e.D.e.s.c.r.", "x": true }, { "l": 97152, "t": "69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 61 00 70 00 70 00 i.p.t.i.o.n.....a.p.p.", "x": true }, { "l": 97174, "t": "72 00 6f 00 78 00 69 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 00 00 r.o.x.i.m.a.t.i.o.n...", "x": true }, { "l": 97196, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 97202, "z": 11 } ], "t": "38 00 0b 00 01 00 46 00 69 00 6c 00 65 00 56 00 65 00 72 00 73 00 8.....F.i.l.e.V.e.r.s.", "x": true }, { "l": 97218, "t": "69 00 6f 00 6e 00 00 00 00 00 31 00 2e 00 32 00 38 00 2e 00 31 00 i.o.n.....1...2.8...1.", "x": true }, { "l": 97240, "n": [ { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 97258, "z": 12 } ], "t": "34 00 2e 00 35 00 32 00 00 00 00 00 2c 00 06 00 01 00 49 00 6e 00 4...5.2.....,.....I.n.", "x": true }, { "l": 97262, "t": "74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 t.e.r.n.a.l.N.a.m.e...", "x": true }, { "l": 97328, "t": "74 00 00 00 61 00 6c 00 75 00 6d 00 69 00 6e 00 69 00 75 00 6d 00 t...a.l.u.m.i.n.i.u.m.", "x": true }, { "l": 97350, "t": "20 00 a9 00 20 00 67 00 6c 00 75 00 74 00 74 00 6f 00 6e 00 6f 00 ... .g.l.u.t.t.o.n.o.", "x": true }, { "l": 97372, "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 97386, "z": 16 } ], "t": "75 00 73 00 00 00 00 00 34 00 06 00 01 00 4f 00 72 00 69 00 67 00 u.s.....4.....O.r.i.g.", "x": true }, { "l": 97394, "t": "69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 i.n.a.l.F.i.l.e.n.a.m.", "x": true }, { "l": 97416, "t": "65 00 00 00 31 00 2e 00 65 00 78 00 65 00 00 00 30 00 07 00 01 00 e...1...e.x.e...0.....", "x": true }, { "l": 97438, "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 97438, "z": 11 } ], "t": "50 00 72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 P.r.o.d.u.c.t.N.a.m.e.", "x": true }, { "l": 97460, "t": "00 00 00 00 66 00 72 00 6f 00 7a 00 65 00 6e 00 00 00 00 00 3c 00 ....f.r.o.z.e.n.....\u003c.", "x": true }, { "l": 97482, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 97486, "z": 14 } ], "t": "0b 00 01 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 56 00 65 00 ....P.r.o.d.u.c.t.V.e.", "x": true }, { "l": 97504, "t": "72 00 73 00 69 00 6f 00 6e 00 00 00 31 00 2e 00 32 00 38 00 2e 00 r.s.i.o.n...1...2.8...", "x": true }, { "l": 102256, "t": "55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 U....Redmond1.0...U...", "x": true }, { "l": 102278, "t": "15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e .Microsoft Corporation", "x": true }, { "l": 102300, "n": [ { "c": 2, "d": "Microsoft code-signing certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "o": 102311, "z": 31 } ], "t": "31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 43 1(0\u0026..U....Microsoft C", "x": true }, { "l": 102322, "t": "6f 64 65 20 53 69 67 6e 69 6e 67 20 50 43 41 20 32 30 31 31 30 1e ode Signing PCA 20110.", "x": true }, { "l": 103796, "t": "6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 ond1.0...U....Microsof", "x": true }, { "l": 103818, "t": "74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 t Corporation1200..U..", "x": true }, { "l": 103840, "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 103841, "z": 11 } ], "t": "13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 .)Microsoft Root Certi", "x": true }, { "l": 103862, "t": "66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 31 30 ficate Authority 20110", "x": true }, { "l": 106590, "t": "24 06 03 55 04 0b 13 1d 54 68 61 6c 65 73 20 54 53 53 20 45 53 4e $..U....Thales TSS ESN", "x": true }, { "l": 106612, "t": "3a 33 32 42 44 2d 45 33 44 35 2d 33 42 31 44 31 25 30 23 06 03 55 :32BD-E3D5-3B1D1%0#..U", "x": true }, { "l": 106634, "n": [ { "c": 2, "d": "Microsoft timestamp certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "o": 106638, "z": 28 } ], "t": "04 03 13 1c 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 ....Microsoft Time-Sta", "x": true }, { "l": 106656, "t": "6d 70 20 53 65 72 76 69 63 65 a0 82 11 5f 30 82 07 10 30 82 04 f8 mp Service..._0...0...", "x": true }, { "l": 106766, "t": "52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 Redmond1.0...U....Micr", "x": true }, { "l": 106788, "t": "6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 osoft Corporation1\u00260$.", "x": true }, { "l": 106810, "n": [ { "c": 2, "d": "Microsoft timestamp certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "o": 106816, "z": 29 } ], "t": "03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 .U....Microsoft Time-S", "x": true }, { "l": 106832, "t": "74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 32 30 33 30 tamp PCA 20100...22030", "x": true } ], "mol": "Md₂(BiSi)", "sha": "72e9105cade1c5f92dad850ce2ffcf4792ae86e3f0039187bf2fbfb0bd949ff9", "fact": { "id": "pe", "imp": [ [ "mscoree", "CorExeMain" ] ], "met": { "pe": { "checksum": 0.0, "has_overlay": 1.0, "overlay_end": 102016.0, "overlay_size": 3712.0, "checksum_valid": 0.0, "overlay_offset": 98304.0, "resource_count": 1.0, "cert_table_size": 10144.0, "overlay_padding": 9344.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 156733.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.66, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 21594.0, "version.identity_symbol_ratio": 0.0, "clr.managed_resource_max_entropy": 7.98 }, "file": { "size": 117792.0, "entropy": 6.11, "size_bytes": 117792.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.65, "overlay_size": 19488.0, "string_count": 2898.0, "overlay_ratio": 0.17, "overall_entropy": 6.11, "overlay_entropy": 7.83, "entropy_variance": 5.13, "avg_string_length": 15.5, "max_string_length": 200.0, "code_to_data_ratio": 1.0, "string_length_stddev": 10.69, "largest_section_ratio": 0.82, "sentence_string_count": 19.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 96256.0, "entropy_max": 5.65, "entropy_mean": 2.83, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 512, 96256, 5.65, "r-x" ], [ ".rsrc", 96768, 1024, 2.75, "r--" ], [ ".reloc", 97792, 512, 0.1, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 29520, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 29677, "u8", "hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD" ], [ 29846, "u8", "QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" ], [ 29934, "u8", "System.Drawing.Bitmap" ], [ 29960, "u8", "Data" ], [ 29996, "u8", "IHDR" ], [ 30173, "u8", "rr6rrL" ], [ 31446, "u8", "0E6xrE" ], [ 33068, "u8", "lI n" ], [ 33572, "u8", "cu8s" ], [ 35899, "u8", "Y9mpq" ], [ 38655, "u8", "AZJQ5" ], [ 38822, "u8", "WIRV6KI" ], [ 39632, "u8", "Pjwk" ], [ 40158, "u8", "zKpt" ], [ 41271, "u8", "WYA79" ], [ 41882, "u8", "AVVR" ], [ 43109, "u8", "H_G5" ], [ 43437, "u8", "joRj" ], [ 43680, "u8", "wc9i" ], [ 50704, "u8", "FITR" ], [ 51093, "u8", "IEND" ], [ 51104, "u8", "BSJB" ], [ 53325, "u8", "\u003cModule\u003e" ], [ 53340, "u8", "MusicExpressMain" ], [ 53357, "u8", "MusicExpress" ], [ 53370, "u8", "MusicReader" ], [ 53382, "u8", "Program" ], [ 53390, "u8", "System.Windows.Forms" ], [ 53411, "u8", "Form" ], [ 53416, "u8", "mscorlib" ], [ 53425, "u8", "System" ], [ 53432, "u8", "Object" ], [ 53439, "u8", "TextBox" ], [ 53447, "u8", "textBox1" ], [ 53456, "u8", "RichTextBox" ], [ 53468, "u8", "richTextBox1" ], [ 53481, "u8", "textBox2" ], [ 53490, "u8", "textBox3" ], [ 53499, "u8", "Button" ], [ 53506, "u8", "button1" ], [ 53514, "u8", "button2" ], [ 53522, "u8", "button3" ], [ 53530, "u8", "button4" ], [ 53538, "u8", "button5" ], [ 53546, "u8", "button6" ], [ 53554, "u8", "button7" ], [ 53562, "u8", "button8" ], [ 53570, "u8", "button9" ], [ 53578, "u8", "button10" ], [ 53587, "u8", "button11" ], [ 53596, "u8", "button12" ], [ 53605, "u8", "button13" ], [ 53614, "u8", "button14" ], [ 53623, "u8", "button15" ], [ 53632, "u8", "button16" ], [ 53641, "u8", "button17" ], [ 53650, "u8", "button18" ], [ 53659, "u8", "button19" ], [ 53668, "u8", "button20" ], [ 53677, "u8", "button21" ], [ 53686, "u8", "button22" ], [ 53695, "u8", "button23" ], [ 53704, "u8", "button24" ], [ 53713, "u8", "button25" ], [ 53722, "u8", "button26" ], [ 53731, "u8", "button27" ], [ 53740, "u8", "button28" ], [ 53749, "u8", "button29" ], [ 53758, "u8", "button30" ], [ 53767, "u8", "button31" ], [ 53776, "u8", "button32" ], [ 53785, "u8", "button33" ], [ 53794, "u8", "button34" ], [ 53803, "u8", "button35" ], [ 53812, "u8", "button36" ], [ 53821, "u8", "button37" ], [ 53830, "u8", "button38" ], [ 53839, "u8", "textBox4" ], [ 53848, "u8", "button39" ], [ 53857, "u8", "button40" ], [ 53866, "u8", "button41" ], [ 53875, "u8", "button42" ], [ 53884, "u8", "button43" ], [ 53893, "u8", "button44" ], [ 53902, "u8", "button45" ], [ 53911, "u8", "button46" ], [ 53920, "u8", "button47" ], [ 53929, "u8", "button48" ], [ 53938, "u8", "button49" ], [ 53947, "u8", "button50" ], [ 53956, "u8", "button51" ], [ 53965, "u8", "button52" ], [ 53974, "u8", "button53" ], [ 53983, "u8", "button54" ], [ 53992, "u8", "button55" ], [ 54001, "u8", "button56" ], [ 54010, "u8", "button57" ], [ 54019, "u8", "button58" ], [ 54028, "u8", "button59" ], [ 54037, "u8", "button60" ], [ 54046, "u8", "button61" ], [ 54055, "u8", "button62" ], [ 54064, "u8", "button63" ], [ 54073, "u8", "button64" ], [ 54082, "u8", "textBox5" ], [ 54091, "u8", "textBox6" ], [ 54100, "u8", "textBox7" ], [ 54109, "u8", "button65" ], [ 54118, "u8", "button66" ], [ 54127, "u8", "button67" ], [ 54136, "u8", "button68" ], [ 54145, "u8", "button69" ], [ 54154, "u8", "button70" ], [ 54163, "u8", "button71" ], [ 54172, "u8", "button72" ], [ 54181, "u8", "button73" ], [ 54190, "u8", "button74" ], [ 54199, "u8", "button75" ], [ 54208, "u8", "button76" ], [ 54217, "u8", "CheckBox" ], [ 54226, "u8", "checkBox1" ], [ 54236, "u8", "checkBox2" ], [ 54246, "u8", "checkBox3" ], [ 54256, "u8", "checkBox4" ], [ 54266, "u8", "checkBox5" ], [ 54276, "u8", "checkBox6" ], [ 54286, "u8", "checkBox7" ], [ 54296, "u8", "checkBox8" ], [ 54306, "u8", "checkBox9" ], [ 54316, "u8", "checkBox10" ], [ 54327, "u8", "textBox8" ], [ 54336, "u8", "textBox9" ], [ 54345, "u8", "textBox10" ], [ 54355, "u8", "textBox11" ], [ 54365, "u8", "textBox12" ], [ 54375, "u8", "textBox13" ], [ 54385, "u8", "textBox14" ], [ 54395, "u8", "textBox15" ], [ 54405, "u8", "textBox16" ], [ 54415, "u8", "textBox17" ], [ 54425, "u8", "textBox18" ], [ 54435, "u8", "textBox19" ], [ 54445, "u8", "textBox20" ], [ 54455, "u8", "textBox21" ], [ 54465, "u8", "textBox22" ], [ 54475, "u8", "Label" ], [ 54481, "u8", "label1" ], [ 54488, "u8", "label2" ], [ 54495, "u8", "label3" ], [ 54502, "u8", "label4" ], [ 54509, "u8", "label5" ], [ 54516, "u8", "label6" ], [ 54523, "u8", "label7" ], [ 54530, "u8", "label8" ], [ 54537, "u8", "label9" ], [ 54544, "u8", "label10" ], [ 54552, "u8", "label11" ], [ 54560, "u8", "label12" ], [ 54568, "u8", "label13" ], [ 54576, "u8", "label14" ], [ 54584, "u8", "label15" ], [ 54592, "u8", "button77" ], [ 54601, "u8", "button78" ], [ 54610, "u8", "button79" ], [ 54619, "u8", "button80" ], [ 54628, "u8", "button81" ], [ 54637, "u8", "button82" ], [ 54646, "u8", "button83" ], [ 54655, "u8", "button84" ], [ 54664, "u8", "button85" ], [ 54673, "u8", "button86" ], [ 54682, "u8", "button87" ], [ 54691, "u8", "button88" ], [ 54700, "u8", "button89" ], [ 54709, "u8", "button90" ], [ 54718, "u8", "button91" ], [ 54727, "u8", "button92" ], [ 54736, "u8", "button93" ], [ 54745, "u8", "button94" ], [ 54754, "u8", "button95" ], [ 54763, "u8", "button96" ], [ 54772, "u8", "button97" ], [ 54781, "u8", "button98" ], [ 54790, "u8", "button99" ], [ 54799, "u8", "button100" ], [ 54809, "u8", "textBox23" ], [ 54819, "u8", "System.ComponentModel" ], [ 54841, "u8", "IContainer" ], [ 54852, "u8", "components" ], [ 54863, "u8", ".ctor" ], [ 54869, "u8", "InitializeComponent" ], [ 54889, "u8", "init" ], [ 54894, "u8", "Browse" ], [ 54901, "u8", "GetMusic" ], [ 54910, "u8", "Play" ], [ 54915, "u8", "EventArgs" ], [ 54925, "u8", "MusicExpressMain_Load" ], [ 54947, "u8", "get_Path" ], [ 54956, "u8", "_getPath" ], [ 54965, "u8", "Path" ], [ 54970, "u8", "Main" ], [ 54975, "u8", "System.Reflection" ], [ 54993, "u8", "AssemblyFileVersionAttribute" ], [ 55022, "u8", "AssemblyVersionAttribute" ], [ 55047, "u8", "System.Runtime.InteropServices" ], [ 55078, "u8", "GuidAttribute" ], [ 55092, "u8", "ComVisibleAttribute" ], [ 55112, "u8", "AssemblyCultureAttribute" ], [ 55137, "u8", "AssemblyTrademarkAttribute" ], [ 55164, "u8", "AssemblyCopyrightAttribute" ], [ 55191, "u8", "AssemblyProductAttribute" ], [ 55216, "u8", "AssemblyCompanyAttribute" ], [ 55241, "u8", "AssemblyConfigurationAttribute" ], [ 55272, "u8", "AssemblyDescriptionAttribute" ], [ 55301, "u8", "AssemblyTitleAttribute" ], [ 55324, "u8", "System.Security.Permissions" ], [ 55352, "u8", "SecurityPermissionAttribute" ], [ 55380, "u8", "SecurityAction" ], [ 55395, "u8", "System.Runtime.CompilerServices" ], [ 55427, "u8", "CompilationRelaxationsAttribute" ], [ 55459, "u8", "RuntimeCompatibilityAttribute" ], [ 55491, "u8", "Control" ], [ 55499, "u8", "SuspendLayout" ], [ 55513, "u8", "System.Drawing" ], [ 55528, "u8", "Point" ], [ 55534, "u8", "set_Location" ], [ 55547, "u8", "set_Name" ], [ 55556, "u8", "Size" ], [ 55561, "u8", "set_Size" ], [ 55570, "u8", "set_TabIndex" ], [ 55583, "u8", "set_Text" ], [ 55592, "u8", "TextBoxBase" ], [ 55604, "u8", "set_Multiline" ], [ 55618, "u8", "ButtonBase" ], [ 55629, "u8", "set_UseVisualStyleBackColor" ], [ 55657, "u8", "set_AutoSize" ], [ 55670, "u8", "RightToLeft" ], [ 55682, "u8", "set_RightToLeft" ], [ 55698, "u8", "HorizontalAlignment" ], [ 55718, "u8", "set_TextAlign" ], [ 55732, "u8", "SystemColors" ], [ 55745, "u8", "Color" ], [ 55751, "u8", "get_ActiveCaptionText" ], [ 55773, "u8", "set_BackColor" ], [ 55787, "u8", "set_ClientSize" ], [ 55802, "u8", "ControlCollection" ], [ 55820, "u8", "get_Controls" ], [ 55837, "u8", "EventHandler" ], [ 55859, "u8", "ResumeLayout" ], [ 55872, "u8", "PerformLayout" ], [ 55886, "u8", "AppDomain" ], [ 55896, "u8", "get_CurrentDomain" ] ], "val": { "file.stem": "72e9105cade1c5f92dad850ce2ffcf4792ae86e3f0039187bf2fbfb0bd949ff9", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1528736851, "file.basename": "72e9105cade1c5f92dad850ce2ffcf4792ae86e3f0039187bf2fbfb0bd949ff9.exe", "pe.image_base": 4194304, "pe.image_size": 122880, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 104030, "pe.headers_size": 512, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "e403297032f8b3d8884607c7575b829e9484458d", "pe.version.company": "chieftain", "pe.image_hash.sha256": "4c8c8241495b55abd8a2f16bb5f1047c7177f482abefde99abfd9199365ca773", "pe.image_hash.sha384": "4e57e23eb66f352c773f8afc47a705ac9032087eee39be6389b82159512b328d5aef81bbec1debfabf787b2f6748f94d", "pe.image_hash.sha512": "66a004448e771ae71a622d331ab1c7c59f858461b766ad9d5cc87803a3434adcb837c7582ecc93d35af2bc84ad5ae9a4cc60d1f0e9022e515759f7013952cf9a", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "aluminium © gluttonous", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.version.description": "approximation", "pe.linker_major_version": 8, "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].serial": "33000002528b33aaf895f339db000000000252", "pe.version.file_version": "1.28.14.52", "pe.version.product_name": "frozen", "pe.signatures[0].subject": "CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.version.internal_name": "1.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 103944, "pe.data_directories[1].rva": 106496, "pe.data_directories[2].rva": 102016, "pe.data_directories[3].rva": 114688, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2022-09-01T18:32:59Z", "pe.version.product_version": "1.28.14.52", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 840, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 10144, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.signatures[0].not_before": "2021-09-02T18:32:59Z", "pe.version.original_filename": "1.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "8740df4acb749640ad318e4be842f72ec651ad80", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 2, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "c8361aec219d230e6aba29521f523e79cac271f3ce45418d80681438dcdbedc0", "pe.signatures[0].thumbprint_sha256": "2eb421fbb33bbf9c8f6b58c754b0405f40e02cb6328936aae39db7a24880ea21", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" } }, "find": [ { "id": "metadata/signed/unknown::microsoft-corporation", "conf": 1.0, "crit": 2, "desc": "Authenticode chain CN: Microsoft Corporation" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "objectives/anti-static/pack/upx::no-compression-grade-section", "atk": "T1027.002", "mbc": "F0001.008", "conf": 0.8999999761581421, "crit": 1, "desc": "No section reaches compression-grade entropy" }, { "id": "metadata/binary/section/names::pe-runtime-standard-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE standard runtime section" }, { "id": "metadata/package/versioning::pe-originalfilename-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE OriginalFilename metadata field" }, { "id": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "conf": 0.8500000238418579, "crit": 2, "desc": "IPv4-like .NET assembly version" }, { "id": "metadata/package/versioning::pe-file-description-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE FileDescription field is populated" }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileDescription metadata field" }, { "id": "metadata/binary/section/names::pe-code-data-standard-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE standard code/data section" }, { "id": "metadata/binary/section/metrics::tiny-rsrc-section", "conf": 0.8399999737739563, "crit": 1, "desc": "Minimal resource section footprint" }, { "id": "metadata/signed/certificate::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" }, { "id": "metadata/binary/framework::exe-extension", "conf": 0.8999999761581421, "crit": 1, "desc": "PE file uses .exe extension" }, { "id": "metadata/package/versioning::pe-file-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE FileVersion resembles IPv4" }, { "id": "metadata/lang/compiler/managed::mscorlib", "conf": 0.8999999761581421, "crit": 2, "desc": "mscorlib reference" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "conf": 0.8999999761581421, "crit": 1, "desc": "SOCKS5 client greeting bytes" }, { "id": "objectives/anti-static/obfuscation/payload/resource::clr-resource-high-entropy", "atk": "T1027.009", "conf": 0.699999988079071, "crit": 1, "desc": "High-entropy CLR managed resource present" }, { "id": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "atk": "T1027", "mbc": "B0032", "conf": 0.8399999737739563, "crit": 1, "desc": "VB6 PE with three sections" }, { "id": "well-known/malware/worm/ludbaruma::metric-section-count-3", "conf": 0.9900000095367432, "crit": 1, "desc": "Exactly three sections" }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "conf": 0.949999988079071, "crit": 2, "desc": "Microsoft code-signing certificate chain" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/lang/compiler/managed::winforms-ui", "conf": 0.800000011920929, "crit": 2, "desc": "Windows Forms UI framework" }, { "id": "metadata/hardening/mitigation::pe-no-seh", "conf": 1.0, "crit": 2, "desc": "NO_SEH (SafeSEH not used)" }, { "id": "metadata/binary/section/names::reloc-section-presence", "conf": 0.8999999761581421, "crit": 2, "desc": "PE .reloc section presence" }, { "id": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "conf": 0.8999999761581421, "crit": 1, "desc": "Binary has high overall entropy (packed/encrypted)" }, { "id": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca", "conf": 1.0, "crit": 2, "desc": "Issued by a Microsoft Code Signing PCA" }, { "id": "metadata/binary/framework::is-binary", "conf": 1.0, "crit": 1, "desc": "File is a compiled binary" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::invokemember-token", "conf": 0.8199999928474426, "crit": 1, "desc": "Type.InvokeMember reflection token" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "conf": 0.6000000238418579, "crit": 1, "desc": "AppDomain.CurrentDomain accessor" }, { "id": "metadata/binary/layout::has-overlay", "conf": 1.0, "crit": 3, "desc": "PE binary has trailing overlay data" }, { "id": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "conf": 0.949999988079071, "crit": 2, "desc": "Microsoft timestamp certificate chain" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE InternalName metadata field" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-createinstance-token", "conf": 0.7200000286102295, "crit": 1, "desc": "Activator.CreateInstance instantiation token" }, { "id": "micro-behaviors/data/embedded/payload/image::dotnet-bitmap-type-token", "atk": "T1027.003", "mbc": "F0001.006", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET Bitmap type reference" }, { "id": "metadata/package/versioning::pe-productname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductName metadata field" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "conf": 0.6499999761581421, "crit": 1, "desc": "AppDomain class token" }, { "id": "metadata/binary/layout::legacy-few-sections", "conf": 0.699999988079071, "crit": 2, "desc": "PE has few sections" }, { "id": "metadata/library/wpf::wpf-namespace-ref", "conf": 0.8999999761581421, "crit": 1, "desc": ".NET WPF namespace reference" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "conf": 0.699999988079071, "crit": 1, "desc": "Reflection method namespace token" }, { "id": "objectives/command-and-control/infrastructure/config::max-sections-4", "conf": 1.0, "crit": 1, "desc": "Binary has 4 or fewer sections" }, { "id": "metadata/binary/resource::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "objectives/anti-static/pack/section-anomaly::reloc-overhang-ratio-high", "atk": "T1027", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "Reloc section mostly non-relocation bytes" }, { "id": "metadata/binary/anomaly/format::version-info-file-version-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE version info numeric fields present" }, { "id": "metadata/binary/metrics/threshold::string-count-1000-plus", "conf": 1.0, "crit": 2, "desc": "Binary has 1000 or more strings" }, { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "conf": 0.6200000047683716, "crit": 1, "desc": "Assembly Load method token" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" }, { "id": "metadata/hardening/mitigation::pe-aslr", "conf": 1.0, "crit": 2, "desc": "ASLR enabled (DYNAMIC_BASE)" }, { "id": "metadata/package/versioning::pe-product-name-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE ProductName field is populated" }, { "id": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "atk": "T1027", "mbc": "B0032", "conf": 0.699999988079071, "crit": 1, "desc": "Code section dominates file layout" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference" }, { "id": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "atk": "T1027", "mbc": "B0032", "conf": 0.9900000095367432, "crit": 1, "desc": "PE version resource text" }, { "id": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "conf": 0.800000011920929, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/data/text/keywords/lexicon::notification-config-word", "conf": 0.8600000143051147, "crit": 1, "desc": "notify/sender vocabulary word" }, { "id": "metadata/lang/compiler/managed::system-namespace", "conf": 0.800000011920929, "crit": 2, "desc": "System namespace reference" }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.8999999761581421, "crit": 1, "desc": "Microsoft vendor marker in certificate data" }, { "id": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "atk": "T1027", "conf": 0.8999999761581421, "crit": 1, "desc": "High plaintext string count" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.699999988079071, "crit": 1, "desc": "PE import table has exactly one entry" }, { "id": "metadata/hardening/mitigation::pe-dep", "conf": 1.0, "crit": 2, "desc": "DEP / NX enabled (NX_COMPAT)" }, { "id": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "atk": "T1620", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "mscoree DLL string reference" }, { "id": "objectives/anti-static/obfuscation/encoding/content::encoded-ms-ocsp-url", "conf": 0.8199999928474426, "crit": 1, "desc": "Encoded Microsoft OCSP URL" }, { "id": "metadata/package/versioning::pe-legal-copyright-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE LegalCopyright field is populated" }, { "id": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "conf": 0.8999999761581421, "crit": 1, "desc": "PE has under ten imports" }, { "id": "objectives/command-and-control/dropper/staging/embedded::createinstance-token", "atk": "T1140", "mbc": "B0030", "conf": 0.8399999737739563, "crit": 1, "desc": "CreateInstance activation token" }, { "id": "metadata/lang/compiler/managed::runtime-interop", "conf": 0.75, "crit": 2, "desc": "Runtime interop services" }, { "id": "metadata/binary/layout::cert-table-present", "conf": 0.8999999761581421, "crit": 1, "desc": "PE certificate table entry populated" }, { "id": "metadata/file/extension::exe", "conf": 1.0, "crit": 2, "desc": "Windows executable extension" }, { "id": "metadata/binary/layout::many-readable-strings", "conf": 0.699999988079071, "crit": 2, "desc": "PE has many readable strings" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE CompanyName metadata field" }, { "id": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "atk": "T1027.009", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET ResourceReader payload access" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Binary has normal code entropy (\u003e5.5)" }, { "id": "metadata/binary/metrics/threshold::many-strings-2000", "conf": 1.0, "crit": 1, "desc": "Binary has 2000+ strings" }, { "id": "metadata/binary/symbols/imports::pe-imports-max-six", "conf": 0.699999988079071, "crit": 1, "desc": "PE with six or fewer imports" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "metadata/binary/section/names::pe-resource-section", "conf": 0.8999999761581421, "crit": 1, "desc": "PE resource section" }, { "id": "objectives/anti-static/pack/runtime::dotnet-interop-services-string", "atk": "T1027.002", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 1, "desc": "Embedded System.Runtime.InteropServices name" }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference" }, { "id": "metadata/package/files::exe-extension-basename", "conf": 0.949999988079071, "crit": 1, "desc": "Filename ends with .exe" }, { "id": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "atk": "T1105", "mbc": "B0022", "conf": 0.8999999761581421, "crit": 1, "desc": "Dominant high entropy overlay" }, { "id": "objectives/evasion/masquerade/identity/fabricated::identity-nondegenerate-entropy", "atk": "T1036.005", "conf": 0.6000000238418579, "crit": 1, "desc": "VERSIONINFO identity fields carry non-degenerate entropy" }, { "id": "metadata/binary/resource::png-magic-in-text", "conf": 0.8999999761581421, "crit": 1, "desc": "PNG image magic in text section" }, { "id": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "atk": "T1055", "mbc": "C0041", "conf": 0.9200000166893005, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "atk": "T1027.009", "mbc": "B0032", "conf": 0.800000011920929, "crit": 1, "desc": "High entropy overlay data" }, { "id": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "atk": "T1027", "conf": 0.800000011920929, "crit": 1, "desc": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)" }, { "id": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "atk": "T1105", "mbc": "E1105", "conf": 0.800000011920929, "crit": 1, "desc": "Compact PE import table" }, { "id": "metadata/binary/framework::bsjb-marker", "conf": 1.0, "crit": 1, "desc": ".NET BSJB metadata marker" }, { "id": "objectives/impact/services/stop::versioned-service-stop-context", "atk": "T1489", "conf": 0.699999988079071, "crit": 1, "desc": "Versioned service stop context" }, { "id": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "conf": 0.949999988079071, "crit": 1, "desc": "Filename has EXE extension" }, { "id": "micro-behaviors/ui/controls/widget::winforms-button", "conf": 0.7200000286102295, "crit": 1, "desc": "WinForms Button control token" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "atk": "T1027", "mbc": "B0032", "crit": 1, "desc": "Binary has overlay data" }, { "id": "micro-behaviors/ui/controls/widget::winforms-label", "conf": 0.7200000286102295, "crit": 1, "desc": "WinForms Label control token" }, { "id": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "atk": "T1053.005", "mbc": "F0012", "conf": 0.8799999952316284, "crit": 1, "desc": "Regex component marker" }, { "id": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "atk": "T1027", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "Regex component marker" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)" }, { "id": "metadata/package/versioning::version-number-ipv4-metadata", "conf": 0.949999988079071, "crit": 1, "desc": "PE version numbers look like IPv4" }, { "id": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "atk": "T1036.005", "conf": 0.9399999976158142, "crit": 1, "desc": "Two dotted-quad version strings" }, { "id": "metadata/package/versioning::version-resource-metadata", "conf": 0.8999999761581421, "crit": 2, "desc": "PE version resource metadata" }, { "id": "metadata/binary/metrics/pe-details::dotnet-normal-entropy-profile", "conf": 0.699999988079071, "crit": 1, "desc": ".NET assembly with normal (unpacked) code entropy" }, { "id": "metadata/package/versioning::dotnet-versioned-assembly", "conf": 0.699999988079071, "crit": 2, "desc": "Versioned .NET assembly structure" }, { "id": "metadata/signed/platform::microsoft-certificate-chain", "conf": 1.0, "crit": 1, "desc": "Microsoft certificate chain markers" } ], "path": "72e9105cade1c5f92dad850ce2ffcf4792ae86e3f0039187bf2fbfb0bd949ff9.exe", "risk": 5, "size": 117792, "type": "pe" } ] } }