{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.17264573276042938, "class": 0 } ], "prob": 0.17264573, "class": 0, "models": [ { "m": "az", "prob": 0.17264573, "class": 0 }, { "m": "az/native", "prob": 0.0, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-25T20:10:11Z" }, "path": "46083", "raw": { "v": "5", "fs": [ { "f": "H₂(OsPo)Md₂(BiHe)", "x": 10, "ff": { "i": [ [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "lstrlenA" ], [ "kernel32", "SizeofResource" ], [ "kernel32", "LoadResource" ], [ "kernel32", "FindResourceW" ], [ "kernel32", "GetLastError" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "lstrcmpiW" ], [ "kernel32", "lstrcpynW" ], [ "kernel32", "DisableThreadLibraryCalls" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "HeapDestroy" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "lstrcpyW" ], [ "kernel32", "lstrcatW" ], [ "kernel32", "InterlockedIncrement" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "GlobalFindAtomW" ], [ "kernel32", "GetEnvironmentStrings" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "FreeEnvironmentStringsA" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "GetStringTypeA" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "GetShortPathNameW" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "lstrlenW" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "FlushInstructionCache" ], [ "kernel32", "GlobalAddAtomW" ], [ "kernel32", "InterlockedDecrement" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "LCMapStringA" ], [ "kernel32", "IsBadCodePtr" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "WriteFile" ], [ "kernel32", "GetStartupInfoA" ], [ "kernel32", "GetFileType" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "SetHandleCount" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "SetLastError" ], [ "kernel32", "TlsFree" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "LocalFree" ], [ "kernel32", "HeapFree" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetVersion" ], [ "kernel32", "RaiseException" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "GetEnvironmentVariableA" ], [ "kernel32", "GetVersionExA" ], [ "kernel32", "HeapCreate" ], [ "kernel32", "VirtualFree" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "user32", "KillTimer" ], [ "user32", "CallWindowProcW" ], [ "user32", "CharNextW" ], [ "user32", "SetTimer" ], [ "user32", "DefWindowProcW" ], [ "user32", "GetWindowLongW" ], [ "user32", "SetWindowLongW" ], [ "user32", "GetClassInfoExW" ], [ "user32", "LoadCursorW" ], [ "user32", "wsprintfW" ], [ "user32", "RegisterClassExW" ], [ "user32", "CreateWindowExW" ], [ "user32", "ShowWindow" ], [ "user32", "GetClientRect" ], [ "user32", "IsWindow" ], [ "advapi32", "RegQueryInfoKeyW" ], [ "advapi32", "RegSetValueExW" ], [ "advapi32", "RegEnumKeyExW" ], [ "advapi32", "RegOpenKeyExW" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "RegDeleteValueW" ], [ "advapi32", "RegCreateKeyExW" ], [ "advapi32", "RegDeleteKeyW" ], [ "advapi32", "RegEnumValueW" ], [ "shell32", "SHLoadInProc" ], [ "shell32", "StrStrIW" ], [ "ole32", "CoTaskMemAlloc" ], [ "ole32", "CoTaskMemRealloc" ], [ "ole32", "CoCreateInstance" ], [ "ole32", "StringFromGUID2" ], [ "ole32", "CoInitialize" ], [ "ole32", "OleRun" ], [ "ole32", "CoTaskMemFree" ], [ "oleaut32", "ORDINAL 161" ], [ "oleaut32", "ORDINAL 163" ], [ "oleaut32", "ORDINAL 277" ], [ "oleaut32", "ORDINAL 7" ], [ "oleaut32", "ORDINAL 162" ], [ "oleaut32", "ORDINAL 146" ], [ "oleaut32", "ORDINAL 9" ], [ "oleaut32", "ORDINAL 2" ], [ "oleaut32", "ORDINAL 6" ], [ "oleaut32", "ORDINAL 200" ] ], "m": { "pe": { "checksum": 121203.0, "has_overlay": 1.0, "overlay_end": 107543.0, "overlay_size": 1047.0, "checksum_valid": 0.0, "overlay_offset": 106496.0, "resource_count": 4.0, "overlay_padding": 1047.0, "has_version_info": 1.0, "computed_checksum": 122250.0, "aliased_export_count": 2.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "entry_in_writable_section": 1.0, "base_relocation_block_count": 17.0, "base_relocation_entry_count": 1395.0 }, "file": { "size": 107543.0, "entropy": 5.4, "size_bytes": 107543.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 5.37, "overlay_size": 1047.0, "string_count": 922.0, "overlay_ratio": 0.01, "overlay_entropy": 0.0, "entropy_variance": 1.49, "avg_string_length": 11.11, "max_string_length": 629.0, "code_to_data_ratio": 1.0, "string_length_stddev": 21.77, "largest_section_ratio": 0.76, "sentence_string_count": 41.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "exports": { "count": 4.0 }, "imports": { "count": 115.0 }, "sections": { "count": 3.0, "code_size": 98304.0, "entropy_max": 7.74, "entropy_mean": 6.05, "name_entropy": 3.27, "writable_count": 2.0, "executable_count": 2.0, "nonstandard_count": 1.0, "executable_writable_count": 2.0 }, "dependencies": { "count": 6.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 232, "u8", "Rich" ], [ 496, "u8", ".text" ], [ 536, "u8", ".sedata" ], [ 576, "u8", ".reloc" ], [ 615, "u8", "B.rsrc" ], [ 655, "u8", "@.reloc" ], [ 9579, "u8", "F0Rhh" ], [ 12713, "u8", "AABBf" ], [ 13665, "u8", "QSVW" ], [ 14966, "u8", "PSVSSSW" ], [ 16507, "u8", "PPPPPPPQPPP" ], [ 16573, "u8", "VPVVVVVV" ], [ 16601, "u8", "u6VVV" ], [ 17667, "u8", "a93tX" ], [ 18443, "u8", "SUVW" ], [ 19427, "u8", "90u29p" ], [ 20042, "u8", "SPSSh" ], [ 25206, "u8", "uRFGHt" ], [ 26025, "u8", "wLVSP" ], [ 28789, "u8", "NWVS" ], [ 28808, "u8", "u7WPS" ], [ 29528, "u8", "WufS3" ], [ 30485, "u8", "uiSj" ], [ 32581, "u8", "SUVWu" ], [ 33337, "u8", "QQSV" ], [ 34587, "u8", "SVWUj" ], [ 34838, "u8", "SVWU" ], [ 36088, "u8", "HSVWh" ], [ 36799, "u8", "QQS3" ], [ 36863, "u8", "PSSW" ], [ 40664, "u8", "VWuBh" ], [ 41107, "u8", "QQSVW" ], [ 41653, "u8", "uFWWj" ], [ 41926, "u8", "tMWWS" ], [ 42563, "u8", "HSVHWtgHHtF" ], [ 43520, "u8", "FGQPS" ], [ 48016, "u8", "__GLOBAL_HEAP_SELECTED" ], [ 48040, "u8", "__MSVCRT_HEAP_SELECT" ], [ 48088, "u8", "runtime error" ], [ 48108, "u8", "TLOSS error" ], [ 48124, "u8", "SING error" ], [ 48140, "u8", "DOMAIN error" ], [ 48156, "u8", "R6028\r\n- unable to initialize heap" ], [ 48163, "u8", "- unable to initialize heap" ], [ 48196, "u8", "R6027\r\n- not enough space for lowio initialization" ], [ 48203, "u8", "- not enough space for lowio initialization" ], [ 48252, "u8", "R6026\r\n- not enough space for stdio initialization" ], [ 48259, "u8", "- not enough space for stdio initialization" ], [ 48308, "u8", "R6025\r\n- pure virtual function call" ], [ 48315, "u8", "- pure virtual function call" ], [ 48348, "u8", "R6024\r\n- not enough space for _onexit/atexit table" ], [ 48355, "u8", "- not enough space for _onexit/atexit table" ], [ 48404, "u8", "R6019\r\n- unable to open console device" ], [ 48411, "u8", "- unable to open console device" ], [ 48448, "u8", "R6018\r\n- unexpected heap error" ], [ 48455, "u8", "- unexpected heap error" ], [ 48484, "u8", "R6017\r\n- unexpected multithread lock error" ], [ 48491, "u8", "- unexpected multithread lock error" ], [ 48532, "u8", "R6016\r\n- not enough space for thread data" ], [ 48539, "u8", "- not enough space for thread data" ], [ 48576, "u8", "abnormal program termination" ], [ 48612, "u8", "R6009\r\n- not enough space for environment" ], [ 48619, "u8", "- not enough space for environment" ], [ 48656, "u8", "R6008\r\n- not enough space for arguments" ], [ 48663, "u8", "- not enough space for arguments" ], [ 48700, "u8", "R6002\r\n- floating point not loaded" ], [ 48707, "u8", "- floating point not loaded" ], [ 48740, "u8", "Microsoft Visual C++ Runtime Library" ], [ 48784, "u8", "Runtime Error!\n\nProgram:" ], [ 48816, "u8", "\u003cprogram name unknown\u003e" ], [ 48840, "u8", "GetLastActivePopup" ], [ 48860, "u8", "GetActiveWindow" ], [ 48876, "u8", "MessageBoxA" ], [ 48888, "u8", "user32.dll" ], [ 48980, "u8", "dddd, MMMM dd, yyyy" ], [ 49016, "u8", "December" ], [ 49028, "u8", "November" ], [ 49040, "u8", "October" ], [ 49048, "u8", "September" ], [ 49060, "u8", "August" ], [ 49068, "u8", "July" ], [ 49076, "u8", "June" ], [ 49084, "u8", "April" ], [ 49092, "u8", "March" ], [ 49100, "u8", "February" ], [ 49112, "u8", "January" ], [ 49168, "u8", "Saturday" ], [ 49180, "u8", "Friday" ], [ 49188, "u8", "Thursday" ], [ 49200, "u8", "Wednesday" ], [ 49212, "u8", "Tuesday" ], [ 49220, "u8", "Monday" ], [ 49228, "u8", "Sunday" ], [ 49264, "u8", "SunMonTueWedThuFriSat" ], [ 49288, "u8", "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 50154, "u8", "InterlockedDecrement" ], [ 50178, "u8", "FlushInstructionCache" ], [ 50202, "u8", "GetCurrentProcess" ], [ 50222, "u8", "lstrlenW" ], [ 50234, "u8", "LeaveCriticalSection" ], [ 50258, "u8", "EnterCriticalSection" ], [ 50282, "u8", "GetShortPathNameW" ], [ 50302, "u8", "GetModuleHandleW" ], [ 50322, "u8", "GetModuleFileNameW" ], [ 50344, "u8", "FreeLibrary" ], [ 50358, "u8", "MultiByteToWideChar" ], [ 50380, "u8", "lstrlenA" ], [ 50392, "u8", "SizeofResource" ], [ 50410, "u8", "LoadResource" ], [ 50426, "u8", "FindResourceW" ], [ 50442, "u8", "GetLastError" ], [ 50458, "u8", "LoadLibraryExW" ], [ 50476, "u8", "lstrcmpiW" ], [ 50488, "u8", "lstrcpynW" ], [ 50500, "u8", "DisableThreadLibraryCalls" ], [ 50528, "u8", "InitializeCriticalSection" ], [ 50556, "u8", "HeapDestroy" ], [ 50570, "u8", "DeleteCriticalSection" ], [ 50594, "u8", "lstrcpyW" ], [ 50606, "u8", "lstrcatW" ], [ 50618, "u8", "InterlockedIncrement" ], [ 50642, "u8", "GetCurrentThreadId" ], [ 50664, "u8", "GlobalAddAtomW" ], [ 50682, "u8", "GlobalFindAtomW" ], [ 50698, "u8", "KERNEL32.dll" ], [ 50714, "u8", "DefWindowProcW" ], [ 50732, "u8", "SetTimer" ], [ 50744, "u8", "KillTimer" ], [ 50756, "u8", "SetWindowLongW" ], [ 50774, "u8", "GetWindowLongW" ], [ 50792, "u8", "CallWindowProcW" ], [ 50810, "u8", "CharNextW" ], [ 50822, "u8", "IsWindow" ], [ 50834, "u8", "GetClientRect" ], [ 50850, "u8", "ShowWindow" ], [ 50864, "u8", "CreateWindowExW" ], [ 50882, "u8", "RegisterClassExW" ], [ 50902, "u8", "wsprintfW" ], [ 50914, "u8", "LoadCursorW" ], [ 50928, "u8", "GetClassInfoExW" ], [ 50944, "u8", "USER32.dll" ], [ 50958, "u8", "RegDeleteKeyW" ], [ 50974, "u8", "RegCreateKeyExW" ], [ 50992, "u8", "RegDeleteValueW" ], [ 51010, "u8", "RegCloseKey" ], [ 51024, "u8", "RegOpenKeyExW" ], [ 51040, "u8", "RegEnumKeyExW" ], [ 51056, "u8", "RegSetValueExW" ], [ 51074, "u8", "RegQueryInfoKeyW" ], [ 51094, "u8", "RegEnumValueW" ], [ 51108, "u8", "ADVAPI32.dll" ], [ 51124, "u8", "StrStrIW" ], [ 51136, "u8", "SHLoadInProc" ], [ 51150, "u8", "SHELL32.dll" ], [ 51164, "u8", "CoTaskMemFree" ], [ 51180, "u8", "CoTaskMemAlloc" ], [ 51198, "u8", "CoTaskMemRealloc" ], [ 51218, "u8", "CoCreateInstance" ], [ 51238, "u8", "StringFromGUID2" ], [ 51256, "u8", "CoInitialize" ], [ 51272, "u8", "OleRun" ], [ 51280, "u8", "ole32.dll" ], [ 51290, "u8", "OLEAUT32.dll" ], [ 51306, "u8", "LocalFree" ], [ 51318, "u8", "HeapFree" ], [ 51330, "u8", "HeapAlloc" ], [ 51342, "u8", "HeapReAlloc" ], [ 51356, "u8", "TlsSetValue" ], [ 51370, "u8", "TlsGetValue" ], [ 51384, "u8", "GetCommandLineA" ], [ 51402, "u8", "GetVersion" ], [ 51416, "u8", "RaiseException" ], [ 51434, "u8", "GetModuleHandleA" ], [ 51454, "u8", "GetModuleFileNameA" ], [ 51476, "u8", "GetEnvironmentVariableA" ], [ 51502, "u8", "GetVersionExA" ], [ 51518, "u8", "HeapCreate" ], [ 51532, "u8", "VirtualFree" ], [ 51546, "u8", "VirtualAlloc" ], [ 51562, "u8", "ExitProcess" ], [ 51576, "u8", "RtlUnwind" ], [ 51588, "u8", "TlsAlloc" ], [ 51600, "u8", "TlsFree" ], [ 51610, "u8", "SetLastError" ], [ 51626, "u8", "TerminateProcess" ], [ 51646, "u8", "SetHandleCount" ], [ 51664, "u8", "GetStdHandle" ], [ 51680, "u8", "GetFileType" ], [ 51694, "u8", "GetStartupInfoA" ], [ 51712, "u8", "FreeEnvironmentStringsA" ], [ 51738, "u8", "FreeEnvironmentStringsW" ], [ 51764, "u8", "WideCharToMultiByte" ], [ 51786, "u8", "GetEnvironmentStrings" ], [ 51810, "u8", "GetEnvironmentStringsW" ], [ 51836, "u8", "WriteFile" ], [ 51848, "u8", "SetUnhandledExceptionFilter" ], [ 51878, "u8", "GetCPInfo" ], [ 51890, "u8", "GetACP" ], [ 51900, "u8", "GetOEMCP" ], [ 51912, "u8", "GetProcAddress" ], [ 51930, "u8", "LoadLibraryA" ], [ 51946, "u8", "IsBadCodePtr" ], [ 51962, "u8", "LCMapStringA" ], [ 51978, "u8", "LCMapStringW" ], [ 51994, "u8", "GetStringTypeA" ], [ 52012, "u8", "GetStringTypeW" ], [ 52112, "u8", "MediaPlayer.DLL" ], [ 52128, "u8", "DllCanUnloadNow" ], [ 52144, "u8", "DllGetClassObject" ], [ 52162, "u8", "DllRegisterServer" ], [ 52180, "u8", "DllUnregisterServer" ], [ 53296, "wide", "http://hao.newvnbc.info" ], [ 53344, "wide", "91878.com" ], [ 53364, "wide", "a8cn.com" ], [ 53384, "wide", "999w.com" ], [ 53404, "wide", "kuhao123.com" ], [ 53432, "wide", "99499.com" ], [ 53452, "wide", "5733.com" ], [ 53472, "wide", "kkklll.com" ], [ 53496, "wide", "91youa.com" ], [ 53520, "wide", "223la.com" ], [ 53540, "wide", "58hao123.com" ], [ 53568, "wide", "7999.com" ], [ 53588, "wide", "xingyundao.com" ], [ 53620, "wide", "wenz-x.com" ], [ 53644, "wide", "9495.com" ], [ 53664, "wide", "114yaa.com" ], [ 53688, "wide", "9wa.com" ], [ 53720, "wide", "2345a.com" ], [ 53740, "wide", "wanwan.cc" ], [ 53760, "wide", "115ye.com" ], [ 53780, "wide", "568.com" ], [ 53796, "wide", "17ok.net" ], [ 53816, "wide", "kaokaoni.ac.cn" ], [ 53848, "wide", "1dh.org" ], [ 53864, "wide", "dz4321.com" ], [ 53888, "wide", "365wz.net" ], [ 53908, "wide", "lemontv.cn" ], [ 53932, "wide", "tt1313.com" ], [ 53956, "wide", "160yes.com" ], [ 53980, "wide", "jmyes.com" ], [ 54016, "wide", "hao123.cn" ], [ 54036, "wide", "pp96.com" ], [ 54056, "wide", "dianxin.cn" ], [ 54080, "wide", "cccz.com" ], [ 54100, "wide", "500ya.com" ], [ 54120, "wide", "59744.com" ], [ 54140, "wide", "bobolm.com" ], [ 54164, "wide", "8684.cn" ], [ 54180, "wide", "15566.cn" ], [ 54200, "wide", "9678.com" ], [ 54220, "wide", "aba5.com" ], [ 54260, "wide", "2001.cc" ], [ 54276, "wide", "kan117.cn" ], [ 54296, "wide", "8420.cn" ] ], "v": { "pe.imphash": "0f4daa883db5e35f6147d42e19f70edc", "pe.machine": "i386", "pe.rich.key": 2717453203, "pe.rich.hash": "c37dddceb3549848d1e744f6199d84b2", "pe.subsystem": "windows_gui", "pe.timestamp": 1294471816, "pe.image_base": 268435456, "pe.image_size": 106496, "pe.machine_id": 332, "pe.os_version": "5.0", "pe.version.os": "unknown", "pe.entry_point": 28718, "pe.headers_size": 4096, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "a5ba92a1b1f20e0bfbb3461051379b39ac94f677", "pe.export_timestamp": 1294471816, "pe.image_hash.sha256": "2a9d4e33fe39494829ce6dd0ed82a348c3939800c9a2831871a9169ebc9741dd", "pe.image_hash.sha384": "22069edc7ed9953f9051e0d971fc2188e3a4e3d8e011d3001302ce41051f51bdb9365188e2bf10bd86a9a0e45d8a92a0", "pe.image_hash.sha512": "cbd6f2df6d8980def6548c439735b89d5359320ad3280f549d1969a574cc4cb81967759760ca6744fcb7540e2fc65e0b57b0d7719cf284fe8b1b7d6bd1c85c43", "pe.resource_types[0]": "RT_STRING", "pe.resource_types[1]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright 2010", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8462, "pe.version.description": "MediaPlayer Module", "pe.linker_major_version": 6, "pe.version.file_version": "1, 0, 0, 1", "pe.version.product_name": "MediaPlayer Module", "build.toolchain.compiler": "msvc", "pe.version.internal_name": "MediaPlayer", "pe.data_directories[0].rva": 52032, "pe.data_directories[1].rva": 49528, "pe.data_directories[2].rva": 73728, "pe.data_directories[3].rva": 102400, "pe.data_directories[4].rva": 45056, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1, 0, 0, 1", "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 168, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 140, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 3376, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 2944, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 484, "pe.rich.entries[0].build_id": 11, "pe.rich.entries[1].build_id": 14, "pe.rich.entries[2].build_id": 10, "pe.rich.entries[3].build_id": 11, "pe.rich.entries[5].build_id": 19, "pe.rich.entries[6].build_id": 19, "pe.rich.entries[7].build_id": 1, "pe.rich.entries[8].build_id": 11, "pe.rich.entries[9].build_id": 6, "pe.rich.entries[0].use_count": 8, "pe.rich.entries[10].build_id": 4, "pe.rich.entries[1].use_count": 21, "pe.rich.entries[2].use_count": 61, "pe.rich.entries[3].use_count": 2, "pe.rich.entries[4].use_count": 13, "pe.rich.entries[5].use_count": 16, "pe.rich.entries[6].use_count": 11, "pe.rich.entries[7].use_count": 127, "pe.rich.entries[8].use_count": 7, "pe.rich.entries[9].use_count": 1, "pe.version.original_filename": "MediaPlayer.DLL", "pe.coff.dos_header_pe_pointer": 248, "pe.rich.entries[0].product_id": 9782, "pe.rich.entries[10].use_count": 1, "pe.rich.entries[1].product_id": 7299, "pe.rich.entries[2].product_id": 9782, "pe.rich.entries[3].product_id": 8798, "pe.rich.entries[5].product_id": 8022, "pe.rich.entries[6].product_id": 8034, "pe.rich.entries[8].product_id": 8168, "pe.rich.entries[9].product_id": 1735, "pe.rich.entries[10].product_id": 8168, "pe.base_relocations.block_count": 17, "pe.base_relocations.entry_count": 1395, "pe.base_relocations.padding_count": 9 }, "x": [ [ "DllCanUnloadNow" ], [ "DllGetClassObject" ], [ "DllRegisterServer" ], [ "DllUnregisterServer" ] ], "id": "pe", "sc": [ [ ".text", 4096, 81920, 4.9, "rwx" ], [ ".sedata", 86016, 16384, 7.74, "rwx" ], [ ".reloc", 102400, 4096, 5.51, "r--" ] ] }, "id": 0, "sz": 107543, "ts": [ { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "Microsoft Visual C++ Runtime Library" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "RegSetValueExW", "TlsGetValue", "RegDeleteValueW", "TlsSetValue", "RegEnumValueW" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.949999988079071, "d": "COM unregistration export", "e": [ "DllUnregisterServer" ], "i": "metadata/binary/symbols/exports::export-dll-unregister-server", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "46", "48" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "46083" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.4000000059604645, "d": "HKLM registry hive reference", "e": [ "HKLM" ], "i": "micro-behaviors/os/registry/access::hklm-hive", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1106", "c": 0.8799999952316284, "d": "Call window procedure", "e": [ "CallWindowProcW" ], "i": "micro-behaviors/ui/window/manage/control::call-window-proc", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 115.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "OleRun import (decoy triad)", "e": [ "OleRun" ], "i": "objectives/anti-static/obfuscation/decoy-imports::olerun-import", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key API string", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w-text", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.75, "d": "FlushInstructionCache call", "e": [ "FlushInstructionCache" ], "i": "micro-behaviors/mem/sync/cache::flush-instruction-cache", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFromGUID2", "FreeEnvironmentStringsW", "StringFileInfo", "GetStringTypeW", "GetStringTypeA", "GetEnvironmentStringsW", "LCMapStringA", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "LCMapStringW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.949999988079071, "d": "COM class factory export", "e": [ "DllGetClassObject" ], "i": "metadata/binary/symbols/exports::export-dll-get-class-object", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.949999988079071, "d": "COM unload export present", "e": [ "DllCanUnloadNow" ], "i": "metadata/binary/symbols/exports::export-dll-can-unload-now", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright 2010" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "msvcrt library (MSVC C runtime)", "e": [ "MSVCR" ], "i": "metadata/lang/compiler/native::msvcrt", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage/control::set-window-long", "l": 2 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48", "46" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.7599999904632568, "d": "Convert GUID to string", "e": [ "StringFromGUID2" ], "i": "micro-behaviors/os/com/invoke::string-from-guid2", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-w", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "RegSetValueExW" ], "i": "objectives/command-and-control/dropper/staging/embedded::registry-powershell-byte-payload--rx-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 0.00" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 200", "e": [ "ORDINAL 200" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut-ordinal-200", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value API string", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w-text", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExW" ], "i": "micro-behaviors/ui/window/manage/control::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "BEA890FE-A1F2-4021-B17E-747062A59A2A", "067247E0-0A6C-42D8-8A27-F80BC9DDEB4C" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Move to next character", "e": [ "CharNextW" ], "i": "micro-behaviors/ui/window/manage/control::char-next", "l": 2 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "MediaPlayer Module" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 922.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameW" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage/control::kill-timer", "l": 2 }, { "c": 0.699999988079071, "d": "Load cursor resource", "e": [ "LoadCursorW" ], "i": "micro-behaviors/ui/controls/widget::load-cursor", "l": 2 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.699999988079071, "d": "Default window procedure", "e": [ "DefWindowProcW" ], "i": "micro-behaviors/ui/window/manage/control::def-window-proc", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2 }, { "a": "T1574.002", "c": 0.8799999952316284, "d": "LoadLibraryExW API string", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w-string", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.949999988079071, "d": "COM registration export", "e": [ "DllRegisterServer" ], "i": "metadata/binary/symbols/exports::export-dll-register-server", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1, 0, 0, 1" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage/control::set-timer", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "MediaPlayer Module" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage/control::is-window", "l": 2 }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage/control::get-window-long", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "cc b1 00 10" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 115.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "sections.executable_writable_count = 2.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Windows RegDeleteValue API reference", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 1, "m": "F0007" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "FlushInstructionCache" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1045", "c": 0.949999988079071, "d": "Multiple W+X sections (packer pattern)", "e": [ "sections.executable_writable_count = 2.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-wx-sections", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariableA" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".sedata (size: 16384, perms: rwx)", ".text (size: 81920, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetModuleFileNameA", "InterlockedIncrement", "GetEnvironmentVariableA", "InitializeCriticalSection", "MultiByteToWideChar", "SunMonTueWedThuFriSat", "DisableThreadLibraryCalls", "InterlockedDecrement", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetModuleFileNameW", "WideCharToMultiByte", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExW" ], "i": "micro-behaviors/ui/window/manage/control::create-window-ex", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "GUID-formatted token", "e": [ "{067247E0-0A6C-42D8-8A27-F80BC9DDEB4C}", "{BEA890FE-A1F2-4021-B17E-747062A59A2A}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 1, "m": "C0042" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "c": 0.949999988079071, "d": "links oleaut32 (ORDINAL 161, ORDINAL 163, ORDINAL 277, ORDINAL 7, ORDINAL 162, ... +5 more)", "e": [ "oleaut32" ], "i": "metadata/dylib::oleaut32", "l": 2 }, { "c": 0.949999988079071, "d": "links advapi32 (RegQueryInfoKeyW, RegSetValueExW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, ... +4 more)", "e": [ "advapi32" ], "i": "metadata/dylib::advapi32", "l": 2 }, { "c": 0.949999988079071, "d": "links kernel32 (MultiByteToWideChar, lstrlenA, SizeofResource, LoadResource, FindResourceW, ... +67 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2 }, { "c": 0.949999988079071, "d": "links shell32 (SHLoadInProc, StrStrIW)", "e": [ "shell32" ], "i": "metadata/dylib::shell32", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32 (CoTaskMemAlloc, CoTaskMemRealloc, CoCreateInstance, StringFromGUID2, CoInitialize, ... +2 more)", "e": [ "ole32" ], "i": "metadata/dylib::ole32", "l": 2 }, { "c": 0.949999988079071, "d": "links user32 (KillTimer, CallWindowProcW, CharNextW, SetTimer, DefWindowProcW, ... +10 more)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2 }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "MediaPlayer Module", "Copyright 2010", "imports.count = 115.00" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleW", "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExW", "RegCreateKeyExW", "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExW", "RegCreateKeyExW", "RegSetValueExW", "RegOpenKeyExW", "HKCU", "RegCreateKeyExW", "HKLM" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "c": 0.949999988079071, "d": "Standard COM server export set", "e": [ "DllRegisterServer", "DllGetClassObject", "DllCanUnloadNow", "DllUnregisterServer" ], "i": "metadata/binary/symbols/exports::standard-com-server-exports", "l": 2 }, { "a": "T1497", "c": 0.8500000238418579, "d": "Adaptive behavior based on environment", "e": [ "GetEnvironmentVariableA", "imports.count = 115.00", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "objectives/anti-analysis/environment-detect/runtime::environment-adaptive-behavior", "l": 2, "m": "B0001" } ], "sha": "75d7d22854788471941982f858017be059f78c8e77895bf2fbfddea4e6687df6", "path": "46083", "type": "pe" } ], "tv": "cf883" } }