{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9735293984413147, "class": 0 } ], "prob": 0.9735294, "class": 0, "models": [ { "m": "az", "prob": 0.67901236, "class": 0 }, { "m": "az/native", "prob": 0.9735294, "class": 0 }, { "m": "az/pe", "prob": 0.72279793, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-13T14:21:13Z" }, "path": "VirusShare_188b8a3d2bb91399dab3147d5d016bd7", "raw": { "v": "4", "fs": [ { "f": "O₂(CAs)H(Cm)Md₂(BiSi)", "k": { "hash.imp": "2ade00a659c2d06fbf3c1ee0bdb946b4", "hash.rich_header": "428bac5ba5c2e19985891c978f4c2abded26d11e385d8dcaa57dfd8db4e77676", "pe.rich_header.xor_key": "0x8a6c025e", "pe.inflated_sections[0]": ".data", "binary.top_complex_unnamed[0].cc": 113, "binary.top_complex_unnamed[1].cc": 110, "binary.top_complex_unnamed[2].cc": 65, "binary.top_complex_unnamed[3].cc": 57, "binary.top_complex_unnamed[4].cc": 50, "binary.top_complex_unnamed[5].cc": 50, "binary.top_complex_unnamed[6].cc": 49, "binary.top_complex_unnamed[7].cc": 49, "binary.top_complex_unnamed[0].bbs": 183, "binary.top_complex_unnamed[1].bbs": 175, "binary.top_complex_unnamed[2].bbs": 99, "binary.top_complex_unnamed[3].bbs": 109, "binary.top_complex_unnamed[4].bbs": 37, "binary.top_complex_unnamed[5].bbs": 37, "binary.top_complex_unnamed[6].bbs": 100, "binary.top_complex_unnamed[7].bbs": 100, "binary.top_complex_unnamed[0].addr": "0x410636", "binary.top_complex_unnamed[0].size": 1705, "binary.top_complex_unnamed[1].addr": "0x410d12", "binary.top_complex_unnamed[1].size": 2296, "binary.top_complex_unnamed[2].addr": "0x40d451", "binary.top_complex_unnamed[2].size": 1789, "binary.top_complex_unnamed[3].addr": "0x411738", "binary.top_complex_unnamed[3].size": 786, "binary.top_complex_unnamed[4].addr": "0x4064a0", "binary.top_complex_unnamed[4].size": 865, "binary.top_complex_unnamed[5].addr": "0x406e40", "binary.top_complex_unnamed[5].size": 865, "binary.top_complex_unnamed[6].addr": "0x40fb94", "binary.top_complex_unnamed[6].size": 1361, "binary.top_complex_unnamed[7].addr": "0x4100e5", "binary.top_complex_unnamed[7].size": 1361, "pe.rich_header.entries[0].use_count": 21, "pe.rich_header.entries[1].use_count": 40, "pe.rich_header.entries[2].use_count": 111, "pe.rich_header.entries[3].use_count": 7, "pe.rich_header.entries[4].use_count": 130, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[0].product_id": 158, "pe.rich_header.entries[1].product_id": 171, "pe.rich_header.entries[2].product_id": 170, "pe.rich_header.entries[3].product_id": 147, "pe.rich_header.entries[4].product_id": 1, "pe.rich_header.entries[5].product_id": 175, "pe.rich_header.entries[6].product_id": 154, "pe.rich_header.entries[7].product_id": 157, "pe.rich_header.entries[0].build_number": 30319, "pe.rich_header.entries[0].product_name": "Cvtres_VS2010", "pe.rich_header.entries[1].build_number": 30319, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 30319, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 30729, "pe.rich_header.entries[3].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[4].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[5].build_number": 30319, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].build_number": 30319, "pe.rich_header.entries[6].product_name": "C_VS2010", "pe.rich_header.entries[7].build_number": 30319, "pe.rich_header.entries[7].product_name": "Linker_VS2010_LTCG" }, "x": 119, "id": 0, "is": [ "BuildCommDCBAndTimeoutsA", "HeapAlloc", "ReadConsoleA", "WaitNamedPipeA", "GetSystemWindowsDirectoryW", "GetEnvironmentStringsW", "SetTapeParameters", "GetModuleHandleW", "GetTickCount", "WriteFile", "GetConsoleCP", "ReadConsoleInputA", "FreeConsole", "GetFileAttributesA", "VerifyVersionInfoA", "GetAtomNameW", "GetCPInfoExW", "GetProcAddress", "GetTapeStatus", "CreateConsoleScreenBuffer", "BeginUpdateResourceW", "ResetEvent", "InterlockedExchangeAdd", "LocalAlloc", "LockResource", "SetConsoleWindowInfo", "FoldStringW", "GetModuleFileNameA", "RequestDeviceWakeup", "GetConsoleTitleW", "DeleteCriticalSection", "GetWindowsDirectoryW", "QueryDepthSList", "lstrcpyW", "CommConfigDialogW", "CreateFileW", "WriteConsoleW", "lstrcpynA", "lstrlenA", "CreateMutexW", "SetDefaultCommConfigA", "ReleaseActCtx", "HeapReAlloc", "InterlockedIncrement", "InterlockedDecrement", "EncodePointer", "DecodePointer", "Sleep", "InitializeCriticalSection", "EnterCriticalSection", "LeaveCriticalSection", "GetLastError", "HeapFree", "GetCommandLineA", "HeapSetInformation", "GetStartupInfoW", "RaiseException", "RtlUnwind", "WideCharToMultiByte", "LCMapStringW", "MultiByteToWideChar", "GetCPInfo", "IsProcessorFeaturePresent", "HeapCreate", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "SetLastError", "GetCurrentThreadId", "SetFilePointer", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "TerminateProcess", "GetCurrentProcess", "ExitProcess", "GetStdHandle", "GetModuleFileNameW", "FreeEnvironmentStringsW", "SetHandleCount", "InitializeCriticalSectionAndSpinCount", "GetFileType", "QueryPerformanceCounter", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "HeapSize", "GetACP", "GetOEMCP", "IsValidCodePage", "GetStringTypeW", "SetStdHandle", "GetConsoleMode", "FlushFileBuffers", "LoadLibraryW", "CloseHandle", "GetAncestor", "BackupEventLogW", "NotifyChangeEventLog", "DeregisterEventSource", "RegQueryValueExW", "CloseEventLog" ], "ms": { "pe": { "checksum": 0.0, "export_timestamp": 0.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "has_resource_timestamp": false, "max_section_inflation_ratio": 777.45 }, "file": { "size": 157184.0 }, "binary": { "code_size": 91136.0, "func_count": 277.0, "func_density": 3.11, "import_count": 102.0, "string_count": 343.0, "avg_func_size": 180.64, "section_count": 6.0, "avg_complexity": 7.37, "import_density": 1.15, "max_complexity": 113.0, "string_density": 3.85, "overall_entropy": 5.53, "avg_basic_blocks": 11.68, "avg_section_size": 26026.67, "avg_string_length": 21.27, "complexity_per_kb": 0.08, "max_string_length": 481.0, "wide_string_count": 59.0, "avg_string_entropy": 3.21, "code_section_ratio": 0.17, "code_to_data_ratio": 1.4, "data_to_file_ratio": 0.05, "rsrc_to_file_ratio": 0.17, "text_to_file_ratio": 0.58, "total_basic_blocks": 3235.0, "func_analysis_depth": 2.0, "section_name_entropy": 3.59, "string_length_stddev": 36.46, "largest_section_ratio": 0.58, "sentence_string_count": 89.0, "sentence_string_ratio": 0.26, "writable_section_count": 4.0, "behavioral_import_ratio": 0.02, "has_malformed_structure": true, "normalized_import_count": 0.26, "executable_section_count": 1.0, "normalized_section_count": 0.35, "high_entropy_string_count": 3.0, "nonstandard_section_count": 2.0, "high_complexity_func_count": 4.0, "unnamed_complex_func_count": 4.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 472, ".text" ], [ 552, ".tls" ], [ 592, ".gap" ], [ 632, ".damoko" ], [ 672, ".rsrc" ], [ 1580, "generic" ], [ 1628, "iostream" ], [ 1668, "system" ], [ 1704, "iostream stream error" ], [ 1788, "Unknown exception" ], [ 1888, "bad allocation" ], [ 1936, "Visual C++ CRT: Not enough memory to complete call to strerror." ], [ 2031, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 2906, "wide", "h(((( H" ], [ 3584, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 3968, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 4316, "floor" ], [ 4324, "ceil" ], [ 4332, "atan" ], [ 4340, "exp10" ], [ 4368, "asin" ], [ 4380, "log10" ], [ 4394, "wide", "wKERNEL32.DLL" ], [ 4424, "FlsFree" ], [ 4432, "FlsSetValue" ], [ 4444, "FlsGetValue" ], [ 4456, "FlsAlloc" ], [ 4468, "CorExitProcess" ], [ 4484, "wide", "mscoree.dll" ], [ 4508, "wide", "runtime error" ], [ 4548, "wide", "TLOSS error" ], [ 4576, "wide", "SING error" ], [ 4604, "wide", "DOMAIN error" ], [ 4640, "wide", "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 5136, "wide", "R6032\r\n- not enough space for locale information" ], [ 5240, "wide", "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 5440, "wide", "R6030\r\n- CRT not initialized" ], [ 5504, "wide", "R6028\r\n- unable to initialize heap" ], [ 5584, "wide", "R6027\r\n- not enough space for lowio initialization" ], [ 5696, "wide", "R6026\r\n- not enough space for stdio initialization" ], [ 5808, "wide", "R6025\r\n- pure virtual function call" ], [ 5888, "wide", "R6024\r\n- not enough space for _onexit/atexit table" ], [ 6000, "wide", "R6019\r\n- unable to open console device" ], [ 6088, "wide", "R6018\r\n- unexpected heap error" ], [ 6160, "wide", "R6017\r\n- unexpected multithread lock error" ], [ 6256, "wide", "R6016\r\n- not enough space for thread data" ], [ 6344, "wide", "R6010\r\n- abort() has been called" ], [ 6416, "wide", "R6009\r\n- not enough space for environment" ], [ 6504, "wide", "R6008\r\n- not enough space for arguments" ], [ 6592, "wide", "R6002\r\n- floating point support not loaded" ], [ 6862, "wide", "@Microsoft Visual C++ Runtime Library" ], [ 6956, "wide", "\u003cprogram name unknown\u003e" ], [ 7004, "wide", "Runtime Error!\n\nProgram:" ], [ 7232, "bad exception" ], [ 7256, "Illegal byte sequence" ], [ 7280, "Directory not empty" ], [ 7300, "Function not implemented" ], [ 7328, "No locks available" ], [ 7348, "Filename too long" ], [ 7368, "Resource deadlock avoided" ], [ 7396, "Result too large" ], [ 7416, "Domain error" ], [ 7432, "Broken pipe" ], [ 7444, "Too many links" ], [ 7460, "Read-only file system" ], [ 7484, "Invalid seek" ], [ 7500, "No space left on device" ], [ 7524, "File too large" ], [ 7540, "Inappropriate I/O control operation" ], [ 7576, "Too many open files" ], [ 7596, "Too many open files in system" ], [ 7628, "Invalid argument" ], [ 7648, "Is a directory" ], [ 7664, "Not a directory" ], [ 7680, "No such device" ], [ 7696, "Improper link" ], [ 7712, "File exists" ], [ 7724, "Resource device" ], [ 7740, "Unknown error" ], [ 7756, "Bad address" ], [ 7768, "Permission denied" ], [ 7788, "Not enough space" ], [ 7808, "Resource temporarily unavailable" ], [ 7844, "No child processes" ], [ 7864, "Bad file descriptor" ], [ 7884, "Exec format error" ], [ 7904, "Arg list too long" ], [ 7924, "No such device or address" ], [ 7952, "Input/output error" ], [ 7972, "Interrupted function call" ], [ 8000, "No such process" ], [ 8016, "No such file or directory" ], [ 8044, "Operation not permitted" ], [ 8100, "wide", "dddd, MMMM dd, yyyy" ], [ 8140, "wide", "MM/dd/yy" ], [ 8176, "wide", "December" ], [ 8196, "wide", "November" ], [ 8216, "wide", "October" ], [ 8232, "wide", "September" ], [ 8252, "wide", "August" ], [ 8268, "wide", "July" ], [ 8280, "wide", "June" ], [ 8292, "wide", "April" ], [ 8304, "wide", "March" ], [ 8316, "wide", "February" ], [ 8336, "wide", "January" ], [ 8448, "wide", "Saturday" ], [ 8468, "wide", "Friday" ], [ 8484, "wide", "Thursday" ], [ 8504, "wide", "Wednesday" ], [ 8524, "wide", "Tuesday" ], [ 8540, "wide", "Monday" ], [ 8556, "wide", "Sunday" ], [ 8640, "dddd, MMMM dd, yyyy" ], [ 8660, "MM/dd/yy" ], [ 8680, "December" ], [ 8692, "November" ], [ 8704, "October" ], [ 8712, "September" ], [ 8724, "August" ], [ 8732, "July" ], [ 8740, "June" ], [ 8748, "April" ], [ 8756, "March" ], [ 8764, "February" ], [ 8776, "January" ], [ 8832, "Saturday" ], [ 8844, "Friday" ], [ 8852, "Thursday" ], [ 8864, "Wednesday" ], [ 8876, "Tuesday" ], [ 8884, "Monday" ], [ 8892, "Sunday" ], [ 8932, "_nextafter" ], [ 8980, "_hypot" ], [ 9020, "atan2" ], [ 9064, "Complete Object Locator'" ], [ 9092, "Class Hierarchy Descriptor'" ], [ 9124, "Base Class Array'" ], [ 9144, "Base Class Descriptor at (" ], [ 9172, "Type Descriptor'" ], [ 9192, "`local static thread guard'" ], [ 9220, "`managed vector copy constructor iterator'" ], [ 9264, "`vector vbase copy constructor iterator'" ], [ 9308, "`vector copy constructor iterator'" ], [ 9344, "`dynamic atexit destructor for '" ], [ 9380, "`dynamic initializer for '" ], [ 9408, "`eh vector vbase copy constructor iterator'" ], [ 9452, "`eh vector copy constructor iterator'" ], [ 9492, "`managed vector destructor iterator'" ], [ 9532, "`managed vector constructor iterator'" ], [ 9572, "`placement delete[] closure'" ], [ 9604, "`placement delete closure'" ], [ 9632, "`omni callsig'" ], [ 9648, "delete[]" ], [ 9668, "`local vftable constructor closure'" ], [ 9704, "`local vftable'" ], [ 9732, "`udt returning'" ], [ 9748, "`copy constructor closure'" ], [ 9776, "`eh vector vbase constructor iterator'" ], [ 9816, "`eh vector destructor iterator'" ], [ 9848, "`eh vector constructor iterator'" ], [ 9884, "`virtual displacement map'" ], [ 9912, "`vector vbase constructor iterator'" ], [ 9948, "`vector destructor iterator'" ], [ 9980, "`vector constructor iterator'" ], [ 10012, "`scalar deleting destructor'" ], [ 10044, "`default constructor closure'" ], [ 10076, "`vector deleting destructor'" ], [ 10108, "`vbase destructor'" ], [ 10140, "`local static guard'" ], [ 10328, "operator" ], [ 10364, "delete" ], [ 10380, "__unaligned" ], [ 10392, "__restrict" ], [ 10412, "__eabi" ], [ 10420, "__clrcall" ], [ 10432, "__fastcall" ], [ 10444, "__thiscall" ], [ 10456, "__stdcall" ], [ 10468, "__pascal" ], [ 10480, "__cdecl" ], [ 10892, "GetProcessWindowStation" ], [ 10916, "GetUserObjectInformationW" ], [ 10944, "GetLastActivePopup" ], [ 10964, "GetActiveWindow" ], [ 10980, "MessageBoxW" ], [ 10990, "wide", "WUSER32.DLL" ], [ 11072, "wide", "kernel32.dll" ], [ 11100, "LocalAlloc" ], [ 11112, "wide", "Lafosopijib" ], [ 11136, "wide", "Jasak cozocayixatu" ], [ 11176, "wide", "Calijucomesi copukasive mib tepexa" ], [ 11276, "VebtualProtect" ], [ 11296, "invalid string position" ], [ 11320, "string too long" ], [ 26718, "QSVW" ], [ 30102, "QQSV" ], [ 37078, "f90u" ], [ 39547, "YYPV" ], [ 47759, "SVW3" ], [ 50402, "UVWS" ], [ 55017, "UQPXY]Y[" ], [ 57129, "SQRP" ], [ 59657, "SSSSW" ], [ 60464, "WVU3" ], [ 78705, "R08YK" ], [ 80946, "V 00" ], [ 81005, "QMWZ" ], [ 85682, "7enx" ], [ 89814, "HeapReAlloc" ], [ 89828, "SetDefaultCommConfigA" ], [ 89852, "CreateMutexW" ], [ 89868, "lstrlenA" ], [ 89880, "lstrcpynA" ], [ 89892, "BuildCommDCBAndTimeoutsA" ], [ 89920, "HeapAlloc" ], [ 89932, "ReadConsoleA" ], [ 89948, "WaitNamedPipeA" ], [ 89966, "GetSystemWindowsDirectoryW" ], [ 89996, "GetEnvironmentStringsW" ], [ 90022, "SetTapeParameters" ], [ 90042, "GetModuleHandleW" ], [ 90062, "GetTickCount" ], [ 90078, "WriteFile" ], [ 90090, "GetConsoleCP" ], [ 90106, "ReadConsoleInputA" ], [ 90126, "FreeConsole" ], [ 90140, "GetFileAttributesA" ], [ 90162, "VerifyVersionInfoA" ], [ 90184, "GetAtomNameW" ], [ 90200, "ReleaseActCtx" ], [ 90216, "GetCPInfoExW" ], [ 90232, "GetProcAddress" ], [ 90250, "GetTapeStatus" ], [ 90266, "CreateConsoleScreenBuffer" ], [ 90294, "BeginUpdateResourceW" ], [ 90318, "ResetEvent" ], [ 90332, "InterlockedExchangeAdd" ], [ 90372, "LockResource" ], [ 90388, "SetConsoleWindowInfo" ], [ 90412, "FoldStringW" ], [ 90426, "GetModuleFileNameA" ], [ 90448, "RequestDeviceWakeup" ], [ 90470, "GetConsoleTitleW" ], [ 90490, "DeleteCriticalSection" ], [ 90514, "GetWindowsDirectoryW" ], [ 90538, "QueryDepthSList" ], [ 90556, "lstrcpyW" ], [ 90568, "CommConfigDialogW" ], [ 90586, "KERNEL32.dll" ], [ 90602, "GetAncestor" ], [ 90614, "USER32.dll" ], [ 90628, "RegQueryValueExW" ], [ 90648, "DeregisterEventSource" ] ], "sz": 157184, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE header too corrupted to parse: Malformed entity: ResourceString value_len (53840) exceeds available bytes (4)", "e": [ "Malformed entity: ResourceString value_len (53840) exceeds available bytes (4)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.37" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 343.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Input/output error" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 0.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.9900000095367432, "d": "MSVC C++ runtime strerror diagnostic string", "e": [ "Visual C++ CRT: Not enough memory to complete call to strerror." ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-strerror-string", "l": 1 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 777.45" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 0.00" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "c": 1.0, "d": "Links to ADVAPI32.dll (Service Management)", "e": [ "DeregisterEventSource" ], "i": "micro-behaviors/os/service/host::advapi32-link", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 3235.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.26" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::lock-resource", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "Uses named pipe IPC APIs", "e": [ "WaitNamedPipeA" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage", "l": 3 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "a": "T1559", "c": 0.699999988079071, "d": "Wait for named pipe server", "e": [ "WaitNamedPipeA" ], "i": "micro-behaviors/communications/ipc/named-pipe::wait-named-pipe", "l": 3 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.05" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_188b8a3d2bb91399dab3147d5d016bd7" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".rsrc (size: 26112, entropy: 0.00, perms: -r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 277.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 0.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExW" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "FoldStringW", "string too long", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "LCMapStringW", "GetStringTypeW", "invalid string position" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.21" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.8799999952316284, "d": "Get system Windows directory path", "e": [ "GetSystemWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-windows-directory", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 7168)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 102.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.53" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-query-value", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.21" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount", "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 277.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 277.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.800000011920929, "d": "Repeated consonant-vowel token", "e": [ "jowupajutabeciy", "wunawubomexose", "logusezihutazis" ], "i": "objectives/anti-static/obfuscation/string/junking::consonant-vowel-gibberish", "l": 3 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "binary.has_malformed_structure = 1.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "BuildCommDCBAndTimeoutsA", "BeginUpdateResourceW", "InterlockedExchangeAdd", "GetUserObjectInformationW", "CreateConsoleScreenBuffer", "SetConsoleWindowInfo", "GetModuleFileNameA", "GetProcessWindowStation", "SetDefaultCommConfigA", "DeregisterEventSource", "GetSystemWindowsDirectoryW", "GetWindowsDirectoryW", "InitializeCriticalSection", "WideCharToMultiByte", "InterlockedIncrement", "InterlockedDecrement" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 277.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (BuildCommDCBAndTimeoutsA, HeapAlloc, ReadConsoleA, WaitNamedPipeA, GetSystemWindowsDirectoryW, ... +91 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (BackupEventLogW, NotifyChangeEventLog, DeregisterEventSource, RegQueryValueExW, CloseEventLog)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetAncestor)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "CreateMutexW", "ExitProcess", "GetLastError" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "a": "T1027.002", "c": 0.9200000166893005, "d": "Control-flow-flattened packer loading .NET payload", "e": [ "pe.max_section_inflation_ratio = 777.45", "CorExitProcess" ], "i": "objectives/command-and-control/dropper/execution/loader::flattened-packer-clr-loader", "l": 5, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "761c9ffb4aa46223aa7b5d7b200365a876be8b81d996c80dab6f45a3b3f76cfa", "path": "/data/samples/bad/datasets/various/VirusShare/VirusShare_188b8a3d2bb91399dab3147d5d016bd7", "type": "pe" } ], "tv": "92e78" } }