{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.032786883, "class": 0 }, { "m": "az/pe", "prob": 0.0032894737, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T15:41:09Z" }, "path": "772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb.exe", "raw": { "v": "5", "fs": [ { "f": "O(As)H₃(DbOsPo)", "x": 10, "ff": { "i": [ [ "kernel32", "SetEndOfFile" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "SetLastError" ], [ "kernel32", "InitializeCriticalSectionAndSpinCount" ], [ "kernel32", "CreateEventW" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsFree" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "GetLocaleInfoW" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "SetEvent" ], [ "kernel32", "ResetEvent" ], [ "kernel32", "WaitForSingleObjectEx" ], [ "kernel32", "RtlCaptureContext" ], [ "kernel32", "RtlLookupFunctionEntry" ], [ "kernel32", "RtlVirtualUnwind" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "IsProcessorFeaturePresent" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "GetStartupInfoW" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "InitializeSListHead" ], [ "kernel32", "RtlPcToFileHeader" ], [ "kernel32", "RaiseException" ], [ "kernel32", "RtlUnwindEx" ], [ "kernel32", "GetLastError" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "InterlockedFlushSList" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "HeapFree" ], [ "kernel32", "GetModuleHandleExW" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "IsValidLocale" ], [ "kernel32", "GetUserDefaultLCID" ], [ "kernel32", "EnumSystemLocalesW" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetFileType" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "GetFileSizeEx" ], [ "kernel32", "SetFilePointerEx" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "WriteFile" ], [ "kernel32", "GetConsoleCP" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "ReadFile" ], [ "kernel32", "FindClose" ], [ "kernel32", "FindFirstFileExW" ], [ "kernel32", "FindNextFileW" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "ReadConsoleW" ], [ "kernel32", "HeapSize" ], [ "ole32", "CoLoadLibrary" ], [ "crypt32", "CryptStringToBinaryA" ] ], "m": { "pe": { "has_cfg": 1.0, "checksum": 0.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 1.0, "checksum_stripped": 1.0, "computed_checksum": 653864.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 16.0, "base_relocation_entry_count": 1624.0 }, "file": { "size": 595968.0, "entropy": 6.72, "size_bytes": 595968.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.39, "data_entropy": 2.82, "string_count": 3842.0, "entropy_variance": 4.5, "avg_string_length": 72.15, "max_string_length": 12000.0, "code_to_data_ratio": 0.98, "string_length_stddev": 869.1, "largest_section_ratio": 0.59, "sentence_string_count": 98.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 5.0 }, "exports": { "count": 252.0 }, "imports": { "count": 83.0 }, "sections": { "count": 8.0, "code_size": 220160.0, "entropy_max": 6.39, "entropy_mean": 3.98, "name_entropy": 3.52, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 1.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 240, "u8", "Rich" ], [ 520, "u8", ".text" ], [ 599, "u8", "@.data" ], [ 640, "u8", ".pdata" ], [ 679, "u8", "@.gfids" ], [ 760, "u8", ".rsrc" ], [ 799, "u8", "@.reloc" ], [ 1292, "u8", "L$ SVWH" ], [ 1463, "u8", "L$ SUVWH" ], [ 10103, "u8", "l$ WAVAWH" ], [ 10314, "u8", "A2D6" ], [ 10385, "u8", "x AVH" ], [ 40908, "u8", "PQE8" ], [ 40918, "stack", "7?bi" ], [ 40928, "u8", "u 1i" ], [ 40938, "u8", "K1VX" ], [ 40958, "u8", "/5Hz" ], [ 40968, "u8", "S4BY" ], [ 40978, "u8", "Hqcb" ], [ 40988, "u8", "SNPB" ], [ 40998, "stack", "@*Y\u003c" ], [ 41008, "u8", "014x" ], [ 41018, "u8", "9f5v" ], [ 41028, "u8", "pUfa" ], [ 41038, "u8", "39wc" ], [ 41048, "u8", "4RHS" ], [ 41068, "u8", "_P2\u003e" ], [ 41078, "u8", "bMqw" ], [ 41088, "u8", "fiMk" ], [ 41098, "u8", "/ygp" ], [ 41108, "u8", "MIJQ" ], [ 41128, "u8", "R8_1" ], [ 41158, "u8", "DPJ9" ], [ 41168, "u8", "Mssn" ], [ 41178, "u8", "[i)s" ], [ 41188, "u8", "ur2g" ], [ 41198, "u8", "XPFQ" ], [ 41208, "u8", "66wi" ], [ 41218, "u8", "ti%KHXqt" ], [ 41228, "u8", "5 OC" ], [ 41248, "stack", "4+fT" ], [ 41268, "u8", "N6hgaMdN" ], [ 41278, "u8", "yGju" ], [ 41288, "stack", ".-9as\u0026X]" ], [ 41298, "u8", "c.pd" ], [ 41318, "u8", "UFTV" ], [ 41328, "u8", "9W3R" ], [ 41338, "u8", "kw.p" ], [ 41348, "u8", "EWTK" ], [ 41368, "u8", "M3 B" ], [ 41378, "u8", "(#Kg ]Ag" ], [ 41398, "u8", "jyKh" ], [ 41408, "u8", "/HAB" ], [ 41418, "u8", "Dljg" ], [ 41428, "stack", "}59_097 " ], [ 41438, "u8", "9m2y" ], [ 41458, "u8", "j2\u003e6" ], [ 41468, "u8", "P1U3" ], [ 41488, "u8", " Z0_" ], [ 41498, "u8", "G_LK" ], [ 41518, "u8", "11tu" ], [ 41528, "u8", "gTqg" ], [ 41538, "stack", "B)#H" ], [ 41548, "u8", "Z9GS" ], [ 41558, "u8", "66in" ], [ 41568, "stack", "{NYx" ], [ 41578, "u8", "Ntzy" ], [ 41588, "u8", "ut{)" ], [ 41598, "u8", "bXxh" ], [ 41608, "u8", "RDJR" ], [ 41628, "u8", "/vPj" ], [ 41638, "stack", "QF|^" ], [ 41648, "u8", "51az" ], [ 41658, "u8", "a480" ], [ 41688, "u8", "cdQp" ], [ 41698, "u8", "AAFU" ], [ 41738, "u8", "H097" ], [ 41748, "u8", "GTKD" ], [ 41758, "u8", "O1V4" ], [ 41768, "u8", "G049" ], [ 41788, "u8", "51am" ], [ 41798, "stack", "1@Lj" ], [ 41808, "u8", "TU8A" ], [ 41818, "u8", "H5XR" ], [ 41828, "u8", ".tj." ], [ 41838, "stack", "@SXL" ], [ 41858, "u8", "EN1U" ], [ 41878, "u8", "c4d8" ], [ 41898, "u8", "Jbel" ], [ 41908, "u8", "qSoa" ], [ 41918, "u8", "/PJW" ], [ 41938, "u8", "y.Jh" ], [ 41968, "u8", "3LKB" ], [ 41978, "stack", "lSk2" ], [ 41998, "u8", "\"K627NRTM\u003e@{-kp{" ], [ 42028, "u8", "Hxlh" ], [ 42038, "u8", "A_VW" ], [ 42048, "u8", "wJev" ], [ 42058, "stack", "8@B\u0026" ], [ 42078, "u8", "M_32" ], [ 42088, "u8", "l.bn" ], [ 42098, "u8", "Q8Q5" ], [ 42108, "stack", "-w^s" ], [ 42118, "u8", "YILtL943U)1b" ], [ 42128, "u8", "BTF0" ], [ 42138, "u8", "F1IC" ], [ 42148, "u8", "Zr67.xl8" ], [ 42158, "u8", "i(I)" ], [ 42168, "u8", "C1RX" ], [ 42198, "stack", "\"E\u003eE" ], [ 42208, "u8", "kraa" ], [ 42218, "u8", "4KGS" ], [ 42228, "u8", "lfMk" ], [ 42238, "stack", "|Sk`taVl" ], [ 42254, "u8", "taVl" ], [ 42258, "u8", "o71x" ], [ 42268, "u8", "6jvsTsBk" ], [ 42298, "stack", "@OY1rddjedx6?o1w" ], [ 42308, "u8", "N951" ], [ 42358, "u8", "k1ik" ], [ 42368, "u8", "G5HL" ], [ 42378, "u8", "FAD4" ], [ 42388, "u8", "7S8yxdPj" ], [ 42398, "u8", "Jtrx" ], [ 42408, "u8", "/zm3" ], [ 42418, "u8", "V8YoQWZG" ], [ 42438, "stack", "!SJX" ], [ 42448, "u8", "/;QvtsuM" ], [ 42458, "u8", "nVix" ], [ 42468, "u8", "PSE8" ], [ 42478, "u8", "Llbz" ], [ 42488, "u8", "559U" ], [ 42498, "u8", "/bt8" ], [ 42508, "u8", "bc84" ], [ 42528, "stack", "^OK3" ], [ 42538, "u8", "/pmh" ], [ 42548, "u8", "Xoky" ], [ 42578, "stack", "SFL\u0026" ], [ 42588, "u8", "82XP" ], [ 42598, "u8", "R3SF" ], [ 42618, "u8", "z1s0" ], [ 42628, "stack", "iqKs" ], [ 42634, "u8", "iqKs" ], [ 42638, "u8", "mLve" ], [ 42658, "u8", "SM9L" ], [ 42668, "u8", "9s m" ], [ 42688, "stack", "FOY\u003cU8pn" ], [ 42718, "u8", "6W3W" ], [ 42758, "u8", "Hdro" ], [ 42768, "stack", "M5R+" ], [ 42778, "u8", "4I9J" ], [ 42788, "u8", "\u003cQW\u003e" ], [ 42808, "u8", "Aeby" ], [ 42818, "u8", "ShCGm4zL" ], [ 42828, "u8", "va7c" ], [ 42838, "u8", "G99Y" ], [ 42848, "u8", "Xpyr" ], [ 42868, "u8", "K9f{ .Q}" ], [ 42878, "u8", "Zkuo" ], [ 42888, "u8", "pMkm" ], [ 42908, "u8", "xzWi" ], [ 42928, "u8", "xHhx" ], [ 42938, "u8", "TGMs?2\u003eCx}?_" ], [ 42958, "u8", "AAEA" ], [ 42968, "u8", "xNdDbjgh" ], [ 42978, "u8", "EY74" ], [ 42988, "u8", "Tm.rjtrY" ], [ 43008, "u8", "7N8Y" ], [ 43018, "u8", "AD2D" ], [ 43028, "u8", "inRh" ], [ 43038, "u8", "KGB2" ], [ 43048, "u8", "Eirl" ], [ 43088, "u8", "LT5U" ], [ 43098, "u8", "SH3L" ], [ 43108, "u8", "eQcv" ], [ 43118, "stack", "$@X{" ], [ 43128, "u8", "vHFMrHID" ], [ 43158, "stack", "DrVm" ], [ 43198, "u8", "W3V_" ], [ 43208, "u8", "HBCL" ], [ 43228, "u8", "fFvr" ], [ 43248, "u8", "arap" ], [ 43268, "u8", "I6W0" ], [ 43278, "u8", "duYo" ], [ 43288, "u8", "4ZQW" ], [ 43298, "u8", "ZXE3" ], [ 43318, "u8", "X81V" ], [ 43328, "u8", "`X^`" ], [ 43338, "u8", "44YS" ], [ 43358, "u8", "51es" ], [ 43378, "u8", "z.Nq" ], [ 43398, "u8", "UWM7" ], [ 43408, "u8", "BV0P" ], [ 43418, "u8", "Dv9Zzhha" ], [ 43438, "stack", "`+|t" ], [ 43448, "u8", "b8 k" ], [ 43488, "u8", "7D1H" ], [ 43508, "u8", "SSQ4" ], [ 43518, "u8", "CwhyDFB" ], [ 43528, "u8", "YG_0" ], [ 43568, "u8", "VSQ4" ], [ 43578, "u8", "Gqba" ], [ 43588, "u8", "`X``" ], [ 43608, "u8", "/9oF" ], [ 43618, "u8", "FF7Q" ], [ 43638, "u8", "kGsc" ], [ 43648, "u8", "c1ef" ], [ 43668, "u8", "Egmq" ], [ 43678, "u8", "[]hd" ], [ 43708, "u8", "tvVC6hDq" ], [ 43728, "stack", "@OY0" ], [ 43758, "u8", "/roz" ], [ 43768, "u8", "skLs" ], [ 43778, "stack", "?j1s" ], [ 43788, "u8", "aAmu" ], [ 43808, "stack", "trVi" ], [ 43814, "u8", "trVi" ], [ 43828, "u8", "n V-Aj=Y" ], [ 43838, "u8", "TIZW" ], [ 43858, "u8", "D2\u003eM" ], [ 43868, "u8", "ln3o" ], [ 43888, "u8", "l6d2" ], [ 43898, "u8", "opGi" ], [ 43918, "u8", "UA_V" ], [ 43938, "u8", "NZP2" ], [ 43958, "u8", "Abwb" ], [ 43978, "u8", "s\u003c#9)*#:CUR@" ], [ 43998, "u8", "nDxj" ], [ 44008, "u8", "q{]d" ], [ 44018, "u8", "D2C0" ], [ 44038, "u8", "yRe6hv4XZ4[u" ], [ 44048, "u8", "mXel" ], [ 44058, "u8", "JT2M" ], [ 44078, "u8", "iip2" ], [ 44088, "u8", "k24u" ], [ 44108, "u8", "RU3S" ], [ 44138, "u8", "9A1G" ], [ 44148, "u8", "ss6i" ], [ 44158, "stack", "iA\\9" ], [ 44168, "u8", "mjHj" ], [ 44188, "u8", "Edvw" ], [ 44218, "u8", "/e59" ], [ 44248, "u8", "oy9z" ], [ 44268, "u8", "oUfx" ], [ 44318, "u8", "DFS0" ], [ 44408, "u8", "Ibsn" ], [ 44448, "u8", "c446" ], [ 44458, "u8", "Q25D" ], [ 44488, "u8", "/jJE" ], [ 44508, "u8", "DCMO" ], [ 44518, "u8", "Zsiz" ], [ 44538, "u8", "92MB" ], [ 44568, "u8", "AYXS" ], [ 44578, "u8", "Fevw" ], [ 44648, "u8", "2VUW" ] ], "v": { "file.stem": "772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb", "pe.imphash": "4d02b963e3c36d2acead6ebf58a74b73", "pe.machine": "x86_64", "pe.rich.key": 3740477594, "pe.rich.hash": "34ba2a6a329956576b8ae4544a3f60a8", "pe.subsystem": "windows_gui", "pe.timestamp": 1667846176, "file.basename": "772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb.exe", "pe.image_base": 6442450944, "pe.image_size": 622592, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 88136, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "719a4d0d20b2ff99ef4464b08c013484fb9dc305", "pe.export_timestamp": 1667846165, "pe.load_config.size": 148, "pe.image_hash.sha256": "b2a0b9993799d6dbe5ffbbc9dff24adb7509a8a5b99f3b8a856625c4b4bf0eeb", "pe.image_hash.sha384": "1066683b6b0690fd161d49a545bc89465a825a0ed6b0066c067ef5e015a123768478b150351a9447e7eb958e3d322429", "pe.image_hash.sha512": "1f9cad28adf70ba62c6fa3ba4665659702721ae7eeb918e3f0df93a5fea4db3d28ea3209bdaa4e095b385a31403814fcf7f706f30f2545cda1af618a83f71347", "pe.resource_types[0]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8226, "pe.linker_major_version": 14, "build.toolchain.compiler": "msvc", "pe.debug.entries[0].type": "pogo", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.data_directories[0].rva": 569696, "pe.data_directories[1].rva": 576576, "pe.data_directories[2].rva": 614400, "pe.data_directories[3].rva": 593920, "pe.data_directories[4].rva": 618496, "pe.data_directories[5].rva": 545744, "pe.data_directories[6].rva": 545928, "pe.data_directories[7].rva": 545776, "pe.data_directories[8].rva": 225280, "pe.dll_characteristics_raw": 352, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 6880, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 80, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 248, "pe.data_directories[3].name": "exception", "pe.data_directories[3].size": 10272, "pe.data_directories[4].name": "base_relocation", "pe.data_directories[4].size": 3396, "pe.data_directories[5].name": "debug", "pe.data_directories[5].size": 28, "pe.data_directories[6].name": "tls", "pe.data_directories[6].size": 40, "pe.data_directories[7].name": "load_config", "pe.data_directories[7].size": 148, "pe.data_directories[8].name": "iat", "pe.data_directories[8].size": 688, "pe.debug.entries[0].type_id": 13, "pe.rich.entries[0].build_id": 259, "pe.rich.entries[1].build_id": 260, "pe.rich.entries[2].build_id": 261, "pe.rich.entries[3].build_id": 259, "pe.rich.entries[4].build_id": 261, "pe.rich.entries[5].build_id": 260, "pe.rich.entries[6].build_id": 257, "pe.rich.entries[7].build_id": 1, "pe.rich.entries[8].build_id": 265, "pe.rich.entries[9].build_id": 256, "pe.rich.entries[0].use_count": 10, "pe.rich.entries[10].build_id": 255, "pe.rich.entries[11].build_id": 258, "pe.rich.entries[1].use_count": 19, "pe.rich.entries[2].use_count": 170, "pe.rich.entries[3].use_count": 8, "pe.rich.entries[4].use_count": 48, "pe.rich.entries[5].use_count": 34, "pe.rich.entries[6].use_count": 7, "pe.rich.entries[7].use_count": 95, "pe.rich.entries[8].use_count": 2, "pe.rich.entries[9].use_count": 1, "pe.coff.dos_header_pe_pointer": 256, "pe.load_config.guard_flags[0]": "cf_instrumented", "pe.rich.entries[0].product_id": 26715, "pe.rich.entries[10].use_count": 1, "pe.rich.entries[11].use_count": 1, "pe.rich.entries[1].product_id": 26715, "pe.rich.entries[2].product_id": 26715, "pe.rich.entries[3].product_id": 24123, "pe.rich.entries[4].product_id": 24123, "pe.rich.entries[5].product_id": 24123, "pe.rich.entries[6].product_id": 26715, "pe.rich.entries[8].product_id": 24215, "pe.rich.entries[9].product_id": 24215, "pe.debug.entries[0].size_bytes": 904, "pe.load_config.guard_flags_raw": 256, "pe.load_config.security_cookie": 6443032712, "pe.rich.entries[10].product_id": 24210, "pe.rich.entries[11].product_id": 24215, "pe.base_relocations.block_count": 16, "pe.base_relocations.entry_count": 1624, "pe.base_relocations.padding_count": 10, "pe.debug.entries[0].timestamp_unix": 1667846176, "pe.load_config.guard_cf_check_function_pointer": 6442676912, "pe.load_config.guard_cf_dispatch_function_pointer": 6442676920 }, "x": [ [ "AfsxiduaxDZtlg" ], [ "AiGPajP" ], [ "AzTmMTiaRPCcONOI" ], [ "BDrudPhQGHCchc" ], [ "BZrXBuaGwyYAguajIn" ], [ "BceSiqGIySLAqqaATgKeIryIfB" ], [ "BcyUZVfgVQIzsWz" ], [ "BhPcQdJTD" ], [ "CAYRmQOi" ], [ "CGviGomzLMNmAqrz" ], [ "CdaZtciErQfwlxqziFqM" ], [ "CkLIbfzVKkeMYfaoTKwyqdWy" ], [ "CxeZDyVOkEOG" ], [ "DJCglRJRUr" ], [ "DNmWIHnxGGHYi" ], [ "DVaJyBoggJzBsYhSJ" ], [ "DXVlMdnjQxUTJIm" ], [ "DYqKGkVUTGutvpvQYsNvrPeH" ], [ "DarDaQJgPGmzXIAQaCM" ], [ "DllRegisterServer" ], [ "EMphzPDtLYSLMlKyhFhYovPXjF" ], [ "ESVDTIUxLnLp" ], [ "EZYEDzTJfWTb" ], [ "EherQHLwMRCWWXhhEpzU" ], [ "EoPorjgWTBmNlyYFDhUC" ], [ "FCPzkprTrFqsZGRGzvE" ], [ "FIVQDRtNvYBbKxsjNMzd" ], [ "FXfmokBKPYPHnUSjaTKVdSNwu" ], [ "FZDaw" ], [ "FfcbuB" ], [ "FyKkIaPLQlKHcDBYphaNAF" ], [ "GTPFozRwHgTzcZkpkGZF" ], [ "GrmNmBQqNdgRKPkdFpcODUK" ], [ "HRlxtOioWgNZkuCOLlIw" ], [ "HbJTBlwuuphapSIeFadAxgl" ], [ "HnukraEVMZGtfGpLPqDuRnUdHM" ], [ "HpJOPgeGtGdwDWHniBYV" ], [ "HuiZQVgIRo" ], [ "HvLZfyQnChWoJ" ], [ "IDETNvSdSus" ], [ "IGFPMcBHmcnuYVxGZqijAye" ], [ "ILJDcPHrOaQQOJ" ], [ "IVqPyPpu" ], [ "IcMgnWeiSBdEIkc" ], [ "IhdfzGuvQUSKcYlaHl" ], [ "IwlFBUxwKvA" ], [ "JFSJYhsBipMoYgOPm" ], [ "JKNgoDXkEXnMxDGIh" ], [ "JLfpREGsWkHZZcNXbWSvdOoVH" ], [ "JfJIVUFBIvyiaCX" ], [ "JrcGhnMSnwGQMJKT" ], [ "KMBptUCtmohkkhEpuqD" ], [ "KWsihPxfYXRItLZYcomhvvYzs" ], [ "KXBolneTKjsemCEjW" ], [ "KrflUvTGXpRXvDhQMHRTavUovy" ], [ "KtOPMPlrxvxvN" ], [ "LgVegusFN" ], [ "LhxXbgaiTDlTXxzqCN" ], [ "LjnlBVFuwjrevhAvu" ], [ "LmuWirlfPJGrZLnXIN" ], [ "MMFvkqNwcg" ], [ "MNXtkNuILtatNlXbJzakMfgRfw" ], [ "MPQpSwLzCaIo" ], [ "MRPATSvAkDrKmtyYXnGsW" ], [ "MTnjpllAmrDrgUkvu" ], [ "MUuPjMcdowBqVjRDKr" ], [ "MaUpiEDkpZifzXibGZsnwjIYrX" ], [ "MuMwEhLpbDAG" ], [ "NfEQBrImnBQEdPil" ], [ "NgESefE" ], [ "OJpFHE" ], [ "OSecOUbUFTnMJHsnXeUQD" ], [ "OTQUvMNS" ], [ "OUKOBzXS" ], [ "OaVUGPbbV" ], [ "PABpHH" ], [ "PGAAPbZusHG" ], [ "PUXxrz" ], [ "PXXGDNcRLuCABHJUBxa" ], [ "PpWVWbesVCojnwk" ], [ "PuhFkV" ], [ "PvaQCZzl" ], [ "QBOoQFNe" ], [ "QcfmmlGxVKKxQIKYQiwkw" ], [ "QnKVFqxJ" ], [ "QrKlUtVPQVXVd" ], [ "RAzCCNxgyLixvdBKXz" ], [ "ROItwHmrWicDpfaAZmGMKoRi" ], [ "RtVrhitsle" ], [ "RwMLymmumGlZt" ], [ "SMymIPvSKEyLrw" ], [ "THGMkYKTFh" ], [ "TKXwLJvADWymJyhrvprvaD" ], [ "TMqUSgpzNFvcSetFTVTJfSTdEq" ], [ "TNbMXNzvnF" ], [ "TQqyReuItojXTtug" ], [ "TtCXnpFHz" ], [ "TxxOTl" ], [ "UDrrCbhUjqCBAxbgJUoEFmVYvx" ], [ "UNflBlFCNew" ], [ "USfwfiChJhUSJWJpS" ], [ "UooYERRXsRrosRnayNBm" ], [ "UxWbAIEFgBQX" ], [ "VImaxjVwJrxErfVyblVQsr" ], [ "VXoUgmtX" ], [ "VhtChdnGc" ], [ "VpXRyGcD" ], [ "VzvwLt" ], [ "WKfPVrgcv" ], [ "WKgQbPdhSILDTpzMTmsGir" ], [ "WkLzMFo" ], [ "XNSOxbbLTsWjwwPAIsj" ], [ "XQaYTeOJAFz" ], [ "XWZrYeWFHCTYeAxvODkpcrwSb" ], [ "XjRezGocVz" ], [ "XoUKZKjiT" ], [ "XptZCsafPvrjgpiBclBTu" ], [ "YCGNyCkMeEljZnzDKwp" ], [ "YFxUFsMzLItD" ], [ "YMqiuQbTFVmhcMpCZOR" ], [ "YYgCPVRDNIhiaiVk" ], [ "YkDFEuphfROKGltMVbBBeivQ" ], [ "YtLlvqCKQBVZWK" ], [ "YuoJgzIGsOFOnrZNLKUuyUieS" ], [ "aAsYzaPydwoVUSfpwwzG" ], [ "ahVorZYOMPNeGhuJQqtIwd" ], [ "aiGhlnHaSYMKjdfaPBJksARWO" ], [ "avIYUMSeN" ], [ "bDPzxRXCuBZcIe" ], [ "bexptBqCYkAzotWLhu" ], [ "bsMuZRqxUGVFDjrHrxKPsA" ], [ "bxUHEtRmBjuGvu" ], [ "bzIIALOAnXkESIsnGykUaNlcN" ], [ "cCnNmAF" ], [ "cjEqWaIi" ], [ "cujwhQELVvxsDhFhyigGvVKGoy" ], [ "dIPpBkkIwYK" ], [ "dNGOIRczTqlz" ], [ "dPVlBAUsuoYZCLoBDSrMPs" ], [ "dWLRgszo" ], [ "daLgpgbmRQpXbYKh" ], [ "dcGMNrSFTyjsv" ], [ "eCmEFyVejqyWOGTDW" ], [ "eDfeysXxmXfzrUSoYFQaB" ], [ "eFzkIJOZNEWE" ], [ "ePfPSqLfsPX" ], [ "eZKQTTkSBqmLLmpkWtsQJbT" ], [ "efnVLaYFkdTPoQoTxeY" ], [ "egyEpVXRJ" ], [ "eoyPmaeeAwaDeCqaqRQz" ], [ "eqGpFGXfhCQnOOML" ], [ "fBjzvlKKvMGAjAAzGOM" ], [ "fHojtKjBZhCEUH" ], [ "ffFKHtniGiUsYROwsNTWSiM" ], [ "flsjCGOThUcSYKTNuY" ], [ "fsPEvQIWTfiKSwxPYd" ], [ "fviicwG" ], [ "gDVfSdjFjD" ], [ "gOTstqGkpjiWXM" ], [ "gOfqpSRfES" ], [ "gRLrulRFizvLbBiDUVN" ], [ "gZMNZOipUlKLWcvHnGhXxhS" ], [ "gtuFbajrlWElviWBHIwBvaixK" ], [ "gyBlFDLloeRt" ], [ "hIzsurPKfRGOucWD" ], [ "hQooXrgOweVjOziZgZ" ], [ "hUDaGDNAjOvMe" ], [ "hlVBrsbbkyMVMvnCAsp" ], [ "hpGRVsxtIbXvCq" ], [ "htpONVRdGnVlrJDkykFc" ], [ "hzgAJfnxGpXxf" ], [ "iuoYXtAfIIULOpLrYtqTxZ" ], [ "ivzogVSwjeynPVt" ], [ "jOQqTUICrqTLR" ], [ "jZkGZtlvBuR" ], [ "jfbJLThzv" ], [ "jpzCuzILmdQ" ], [ "jrKKACRzp" ], [ "jvBaOuhAaG" ], [ "kiuIHqkrpVO" ], [ "lAzQYBVhFxzdxzVCWmKuDquY" ], [ "lEZNljVv" ], [ "ldYtHfJXhEltp" ], [ "llXNWnjaGEePUIrgGrSpuvhdZk" ], [ "llliNaResFALUVgcVCSQaze" ], [ "lmSOsWOLUl" ], [ "mIBrAsezrombkiB" ], [ "mJmbHR" ], [ "mbXvXHIGQsxrZgVxvl" ], [ "mgEpHFXLuEnREAeQw" ], [ "mlrEyBadMehsiMYP" ], [ "mxqIGUof" ], [ "nHNSrmVMOfzViNymmQEWRVmZwp" ], [ "nNXvEtWZnYzkrYdrHrtgiza" ], [ "nrMBhfZRLCRBaHERTXfcComPnd" ], [ "ntYhjZUW" ], [ "oStkJVZPe" ], [ "otaqhqJUfCoXiz" ], [ "ouNHlfxeeXlh" ], [ "owWAMtEeNWhCEuyrOfwgtgP" ], [ "oxxlGQYdFUSiNiFvUtbXF" ], [ "pJKtcrEHfWgQoWBghJWwAUkbG" ], [ "pJhDStNOb" ], [ "pYpgdsIQvnutuXUSpmp" ], [ "pvPTdKrwtlDyIEqQmpILOgkrQI" ], [ "qERuVoqzVJvxMWXwltv" ], [ "qRcEUOXaJQIXX" ], [ "qsREbyXsndtTYLkPKtknngLQR" ], [ "rJDNgXmgRhQWKDtgGLwIOxqZWo" ], [ "rPRPwVfvNRXPzAedXgDVam" ], [ "rRsIvmVuIPCqxHwmoMbQyC" ], [ "rmtizgpxDfFrBshgIaPVE" ], [ "roPcwvCERK" ], [ "sEFUuIK" ], [ "sGklQGwyFbQIWDF" ], [ "sRkgyPkj" ], [ "sZavSFmcNpVkapZQOAfHFmEda" ], [ "sjtXxkMRwzonoG" ], [ "sqnvGCRmOQnP" ], [ "tItrskj" ], [ "tIxAtjFnEspduYqqohRnr" ], [ "tKeNofsyHRwXQxXbRtLcR" ], [ "tinGmLEkejjSLmjf" ], [ "tlSVHIHHaHZAj" ], [ "tnNDviHnqzVfNoYPSuBwNYjV" ], [ "tqWERtFjHqVhJ" ], [ "twlDhaFjUHZvtvJvkLvn" ], [ "udjfygrmjJtgSawGVpi" ], [ "uquNBNTZ" ], [ "ussQRVMxuSKyzzUcMDoqIr" ], [ "uuiYrLNHuzpvmJJeRAlJ" ], [ "vIWIaIfuaDamXquqLxkdvYgF" ], [ "viFQNyDOvQQaAiPlcvSA" ], [ "vnvUmcdtMluRSjDF" ], [ "wHYghMxsh" ], [ "wSKJZsjZUDoUYSROAkGRGf" ], [ "wlPmUHKxbpYAQGiFTiHoLN" ], [ "woaxcwqDBFpcAxgBWrWrzELZKi" ], [ "wwZXnmEhLJppcUPrGCcUrVfit" ], [ "xOpgXZmyjuaVwGhdCOxcCW" ], [ "xTazzcmKkqfqVm" ], [ "xhNgKDUFMqvAcozneI" ], [ "xoOKuHkqZmWOsCPqKyJFcrPOzS" ], [ "xxgNkQk" ], [ "yVwwspbKvBJxiDydqYV" ], [ "yXzaTQhfyOOdea" ], [ "ybFXTByNolrwVWoN" ], [ "ypNjFQztLycecmaxmRxRk" ], [ "zMCILCQLnTCkHlwyjJgvy" ], [ "zQQqjtzhcYmnPaojpaoAy" ], [ "zhSUyHuu" ], [ "ztpiVpcGcWKHAbqCus" ] ], "id": "pe", "sc": [ [ ".text", 1024, 220160, 6.39, "r-x" ], [ ".rdata", 221184, 353792, 6.32, "r--" ], [ ".data", 574976, 4608, 3.13, "rw-" ], [ ".pdata", 579584, 10752, 5.54, "r--" ], [ ".gfids", 590336, 1024, 2.6, "r--" ], [ ".tls", 591360, 512, 0.02, "rw-" ], [ ".rsrc", 591872, 512, 2.52, "r--" ], [ ".reloc", 592384, 3584, 5.35, "r--" ] ] }, "id": 0, "sz": 595968, "ts": [ { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2, "el": [ "0x37168" ] }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2, "el": [ "0x371c8" ] }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024", "el": [ "0x83e08" ] }, { "a": "T1620", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "exports.count = 252.00" ], "i": "objectives/command-and-control/backdoor/loader/native-reflect::runtime-loader-with-encoded-data-cond-4--inline-14359", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "0x37048" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "0x371b8" ] }, { "c": 0.8999999761581421, "d": "Extended directory enumeration", "e": [ "FindFirstFileExW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-ex", "l": 2, "el": [ "0x37230" ] }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1, "el": [ "0x3c180" ] }, { "c": 0.8999999761581421, "d": "Reference to api-ms- Windows API string", "e": [ "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-rtcore-ntuser-window-l1-1-0", "api-ms-", "api-ms-win-appmodel-runtime-l1-1-2", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-localization-l1-2-1", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-processthreads-l1-1-2" ], "i": "micro-behaviors/os/api-resolution/manual::api-ms-string-reference", "l": 1, "el": [ "0x3f260", "0x3f0f0", "0x3f2a0", "0x3b300", "0x3f2e0", "0x3f4c8", "0x3f470", "0x3f060", "0x3f0a0", "0x3f220", "0x3efe0", "0x3f330", "0x3b2c0", "0x3f1a0", "0x3f150" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 83.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.9800000190734863, "d": "GetFileSizeEx import symbol", "e": [ "GetFileSizeEx" ], "i": "metadata/binary/symbols/imports::getfilesizeex-import", "l": 1, "el": [ "0x371f0" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 83.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x37178" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x13a0" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x3ee18" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2, "el": [ "0x37180" ] }, { "a": "T1005", "c": 0.8500000238418579, "d": "Get module from code address", "e": [ "RtlPcToFileHeader" ], "i": "micro-behaviors/os/exception/handler::pc-to-file-header", "l": 2, "el": [ "0x37160" ] }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "0x37040" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x37280" ] }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 83.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "0x37088" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2, "el": [ "0x37080" ] }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 6.32)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata", ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2, "el": [ "0x37228" ] }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2, "el": [ "0x371f8" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 3842.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "exports.count = 252.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2, "el": [ "0x37200" ] }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2, "el": [ "0x8c10c" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x37240" ] }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "42", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014", "el": [ "0xba44", "0x21cbc" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4608)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "0x37118" ] }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "0x8c364" ] }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039", "el": [ "0x370e0" ] }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2, "el": [ "0x37150" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 3842.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "exports.count = 252.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "c": 0.7200000286102295, "d": "Obfuscated Go PE network tokens", "e": [ "qjuDpMWDOGZcE", "GZFhUdPyIshhWBiuPAkl", "TpfuDpjrSMQC", "zcYbOTYe", "NrTIUqkAYggFUdPUWQdCmQEznA", "GetCPInfo", "TqXuDpbzNLX", "SROboTscW", "zcYbOTYa", "BDrudPhQGHCchc" ], "i": "objectives/impact/dos/attack::go-pe-obfuscated-network-tokens", "l": 1, "el": [ "0x73910", "0x5f080", "0x61f70", "0x4a7f0", "0x592a0", "0x8c11e", "0x6db30", "0x4d6e0", "0x67d50", "0x8ab91" ] }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2, "el": [ "0x370c0" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "0x371a0" ] }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "0x37070" ] }, { "c": 0.8999999761581421, "d": "High export count metric", "e": [ "exports.count = 252.00" ], "i": "micro-behaviors/communications/socket/route::high-export-count", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "exports.count = 252.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "d": "X11 xorg reference", "e": [ "XORG" ], "i": "micro-behaviors/dylib/library/family::x11-xorg-ref", "l": 2, "el": [ "0x823c0" ] }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "exports.count = 252.00" ], "i": "metadata/binary/metrics/threshold::many-exports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "TlsSetValue", "FlsSetValue", "value too large", "FlsGetValue", "TlsGetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x8c0a4", "0x378d0", "0x37308", "0x378c0", "0x8c096" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x3ee18" ] }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2, "el": [ "0x37158" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x15a59" ] }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "0x370a8" ] }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2, "el": [ "0x370a0" ] }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2, "el": [ "0x37038" ] }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2, "el": [ "0x370f8" ] }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2, "el": [ "0x371b0" ] }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "0x371d8" ] }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "0x371b8" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2, "el": [ "0x37100" ] }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2, "el": [ "0x37218" ] }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2, "el": [ "0x37018" ] }, { "c": 0.8999999761581421, "d": "ext-ms Windows API-set cluster", "e": [ "ext-ms-win-ntuser-windowstation-l1-1-0", "ext-ms-win-ntuser-dialogbox-l1-1-0" ], "i": "metadata/binary/linking/api-set::api-set-ext-cluster", "l": 2, "el": [ "0x3f3e0", "0x3f390" ] }, { "c": 0.8999999761581421, "d": "Decode base64/hex string via CryptoAPI", "e": [ "CryptStringToBinaryA" ], "i": "micro-behaviors/crypto/library/encoding::crypt-string-to-binary", "l": 2, "el": [ "0x37000" ] }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2, "el": [ "0x370f0" ] }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventW" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039", "el": [ "0x37078" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.39)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2, "el": [ "0x37278" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code UA token", "e": [ "/UA/" ], "i": "objectives/anti-analysis/geofencing/region/country-code-d::country-code-ua", "l": 1, "m": "B0007.003", "el": [ "0x4d6e0" ] }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "exports.count = 252.00" ], "i": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "0x37268", "0x37270" ] }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "0x37108" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2, "el": [ "0x37098" ] }, { "a": "T1574.002", "c": 0.8799999952316284, "d": "LoadLibraryExW API string", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w-string", "l": 2, "el": [ "0x8c2fe" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0x37110" ] }, { "c": 0.800000011920929, "d": "In-code MZ/PE compare immediate", "e": [ "MZf9\bu3HcH\u003cH\u0003ȁ9PE" ], "i": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "l": 1 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014", "el": [ "0x21d56" ] }, { "c": 0.8500000238418579, "d": "Inline MZ header validation constant", "e": [ "B8 4D 5A 00 00" ], "i": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "l": 1, "el": [ "0x147af" ] }, { "c": 1.0, "d": "High export count metric", "e": [ "exports.count = 252.00" ], "i": "metadata/binary/metrics/anomaly::high-export-count-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2, "el": [ "0x37010" ] }, { "a": "T1027.002", "c": 0.6499999761581421, "d": "DJB2 hash algorithm", "e": [ "DJb2" ], "i": "micro-behaviors/os/api-resolution/hash-based::djb2-hash", "l": 3, "m": "F0004", "el": [ "0x7c5e0" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 3842.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "0x37268" ] }, { "c": 0.8999999761581421, "d": "Directory enumeration", "e": [ "FindNextFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file", "l": 2, "el": [ "0x37238" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x8c12a" ] }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2, "el": [ "0x3f520", "0x8c3a0" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x8c0ea" ] }, { "c": 0.8500000238418579, "d": "LoadLibraryExW with LOAD_LIBRARY_SEARCH_SYSTEM32", "e": [ "41 B8 00 08 00 00" ], "i": "micro-behaviors/os/api-resolution/manual::load-library-ex-system32", "l": 1, "el": [ "0x17b5e" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x37208" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2, "el": [ "0x37090" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x371e8" ] }, { "c": 0.8999999761581421, "d": "Minimal resource section footprint", "e": [ ".rsrc (size: 512)" ], "i": "well-known/malware/virus/virlock::tiny-rsrc-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2, "el": [ "0x37220" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1, "el": [ "0x27cc", "0x1b330" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 83.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2, "el": [ "0x371e0" ] }, { "c": 0.949999988079071, "d": "COM registration export", "e": [ "DllRegisterServer" ], "i": "metadata/binary/symbols/exports::export-dll-register-server", "l": 1, "el": [ "0xc700" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "49", "4f" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x1a471", "0x1a9b3" ] }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2, "el": [ "0x370b8" ] }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2, "el": [ "0x37958" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x15442" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 3842.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "49", "4f" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014", "el": [ "0x1a471", "0x1a9b3" ] }, { "c": 0.9800000190734863, "d": "Regex component marker", "e": [ "exports.count = 252.00" ], "i": "micro-behaviors/process/terminate/kill::toolhelp-kill-loop-source-cond-5--inline-3845", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.39" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Dense api-ms-win-core string cluster", "e": [ "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-file-l1-2-2", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-core-localization-l1-2-1" ], "i": "metadata/binary/linking/api-set::api-set-core-cluster", "l": 1, "el": [ "0x3f150", "0x3f2a0", "0x3f0f0", "0x3f260", "0x3b300", "0x3b2c0", "0x3f1a0", "0x3f060", "0x3efe0", "0x3f220", "0x3f0a0" ] }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2, "el": [ "0x3ee30" ] }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2, "el": [ "0x37068" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x371a8" ] }, { "c": 1.0, "d": "Binary has 200+ exports (large library)", "e": [ "exports.count = 252.00" ], "i": "metadata/binary/metrics/threshold::many-exports-200", "l": 1 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1, "el": [ "0x37280" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x37198" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x8c620" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 83.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1, "el": [ "0x14404", "0x143a0" ] }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1, "el": [ "0x37d40" ] }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039", "el": [ "0x370d8" ] }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 83.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2, "el": [ "0x37138" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "0x37050" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "ETW event write blinding patch bytes", "e": [ "48 33 c0 c3" ], "i": "objectives/evasion/anti-av/platform/defender::etw-blinding-patch-bytes", "l": 1, "el": [ "0x17a2f" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 83.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2, "el": [ "0x37148" ] }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2, "el": [ "0x3ee18" ] }, { "a": "T1006", "c": 0.8999999761581421, "d": "Extended stack unwinding", "e": [ "RtlUnwindEx" ], "i": "micro-behaviors/os/exception/handler::unwind-ex", "l": 2, "el": [ "0x37170" ] }, { "c": 0.8999999761581421, "d": "Atomically flush thread-safe list", "e": [ "InterlockedFlushSList" ], "i": "micro-behaviors/mem/sync/mutex::interlocked-flush-slist", "l": 2, "el": [ "0x37190" ] }, { "c": 0.75, "d": "Large base64-like string (512+ chars)", "e": [ "aK85ZytfKThfK0J0LWdDWClBVCZyMVYAIFxTMyNeFz9MSkZUKIdFk3iiXORGHmpKfD9HM3ZQLWcvXwU4Wyt2dClnd1gtQWAmdjFWACBUXDMrXjw/RNlIJDllQ3NmJkYk" ], "i": "objectives/anti-static/obfuscation/payload/encoded::large-base64-string-dup", "l": 3, "el": [ "0x823c0" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "0x36d48" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "0x37270" ] }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2, "el": [ "0x37058" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x37020" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW", "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x37260", "0x37258" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LCMapStringEx", "string too long", "api-ms-win-core-string-l1-1-0", "FreeEnvironmentStringsW", "invalid string position", "CompareStringEx", "GetStringTypeW", "LCMapStringW", "GetEnvironmentStringsW", "CryptStringToBinaryA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x37c70", "0x83e28", "0x3f1a0", "0x8c4ee", "0x83e38", "0x37c50", "0x8bfc8", "0x8c0fc", "0x8c4d4", "0x8bf78" ] }, { "c": 0.8399999737739563, "d": "Enumerate installed locales", "e": [ "EnumSystemLocalesW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales-import", "l": 2, "el": [ "0x371d0" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x8c518" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1140", "c": 0.800000011920929, "d": "Large base64 encoded payload", "e": [ "aK85ZytfKThfK0J0LWdDWClBVCZyMVYAIFxTMyNeFz9MSkZUKIdFk3iiXORGHmpKfD9HM3ZQLWcvXwU4Wyt2dClnd1gtQWAmdjFWACBUXDMrXjw/RNlIJDllQ3NmJkYk" ], "i": "micro-behaviors/data/encode/payload::large-base64-payload", "l": 3, "m": "C0043", "el": [ "0x823c0" ] }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 512)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "0x37120" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "exports.count = 252.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-10--inline-29172", "l": 1, "m": "B0032" }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales callback API", "e": [ "EnumSystemLocalesW" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 1, "m": "E1106", "el": [ "0x371d0" ] }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1, "el": [ "0x3ee18" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x370b0" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x83d38" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x35f64" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 3.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Many stack-constructed strings detected", "e": [ "@SXL", "1@Lj", "lSk2", "8@B\u0026", "\"E\u003eE", "@*Y\u003c", "}59_097 ", "|Sk`taVl", "QF|^", "{NYx", ".-9as\u0026X]", "@OY1rddjedx6?o1w", "7?bi", "-w^s", "B)#H", "4+fT" ], "i": "objectives/anti-static/obfuscation/string/anomaly::many-stack-strings", "l": 1, "m": "B0032", "el": [ "0xa36e", "0xa346", "0xa3fa", "0xa44a", "0xa4d6", "0xa026", "0xa1d4", "0xa4fe", "0xa2a6", "0xa260", "0xa148", "0xa53a", "0x9fd6", "0xa47c", "0xa242", "0xa120" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1, "el": [ "0x83d28" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 3842.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 83.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "exports.count = 252.00" ], "i": "objectives/anti-static/obfuscation/payload/section::versioned-export-heavy-library-cond-1--inline-29160", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "ReleaseSRWLockExclusive", "GetCurrentProcessorNumber", "GetFileInformationByHandleEx", "GetSystemTimePreciseAsFileTime", "AcquireSRWLockExclusive", "GetCurrentPackageId", "FreeLibraryWhenCallbackReturns", "WaitForThreadpoolTimerCallbacks", "InitializeConditionVariable", "InitializeCriticalSectionEx", "EnumSystemLocalesEx", "TryAcquireSRWLockExclusive", "GetUserDefaultLocaleName", "FlushProcessWriteBuffers", "SleepConditionVariableCS", "SleepConditionVariableSRW" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x37bd0", "0x37a48", "0x37aa8", "0x37ae8", "0x37b98", "0x37a80", "0x37a28", "0x37988", "0x37b08", "0x378e0", "0x3f520", "0x37bb0", "0x3f5e0", "0x37a08", "0x37b60", "0x37be8" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "05 39 01 00", "9d 1a 00 00", "a6 12 02 00", "fb e9 01 00", "5d e0 00 00", "56 e9 00 00", "74 3a 00 00", "ca 29 01 00", "2c e5 00 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1, "el": [ "0x22c6d", "0x34ad5", "0x15284", "0x17b77", "0x28515", "0x27c1c", "0x32afe", "0x23ba8", "0x28046" ] }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "00 41 3e 2d 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1, "el": [ "0x24937" ] }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009", "el": [ "0x37128" ] }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "08 00 70 33" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1, "el": [ "0x85e74" ] }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "0x37120" ] }, { "c": 0.949999988079071, "d": "links ole32 (CoLoadLibrary)", "e": [ "ole32" ], "i": "metadata/dylib::ole32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links crypt32 (CryptStringToBinaryA)", "e": [ "crypt32" ], "i": "metadata/dylib::crypt32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (SetEndOfFile, WriteConsoleW, ExitProcess, WideCharToMultiByte, MultiByteToWideChar, ... +76 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "81 symbols" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2, "el": [ "0x37268", "0x37270" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesEx", "EnumSystemLocalesW", "GetUserDefaultLCID", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2, "el": [ "0x3f520", "0x8c3a0", "0x371c8", "0x8c10c" ] }, { "c": 0.9200000166893005, "d": "Fingerprint host locale configuration", "e": [ "GetUserDefaultLCID", "EnumSystemLocalesW", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-fingerprinting-imports", "l": 2, "el": [ "0x371c8", "0x371d0", "0x370c0" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x371b0", "0x370b0", "0x370a8" ] }, { "a": "T1129", "c": 0.699999988079071, "d": "Interlocked SList sync", "e": [ "InterlockedFlushSList", "InitializeSListHead" ], "i": "micro-behaviors/process/threading/advanced-sync::slist-sync-ops", "l": 2, "el": [ "0x37190", "0x37158" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 1, "el": [ "0x37110", "0x37108" ] }, { "c": 0.9200000166893005, "d": "Custom API resolver logic (manual module/export resolution)", "e": [ "GetModuleHandleExW", "api-ms-win-core-localization-l1-2-1", "41 B8 00 08 00 00", "api-ms-win-core-fibers-l1-1-1", "api-ms-win-core-datetime-l1-1-1", "api-ms-win-security-systemfunctions-l1-1-0", "api-ms-win-core-winrt-l1-1-0", "api-ms-win-core-localization-obsolete-l1-2-0", "api-ms-win-rtcore-ntuser-window-l1-1-0", "GetProcAddress", "api-ms-win-core-processthreads-l1-1-2", "api-ms-win-core-xstate-l2-1-0", "api-ms-win-core-synch-l1-2-0", "api-ms-win-core-string-l1-1-0", "api-ms-win-core-sysinfo-l1-2-1", "api-ms-win-appmodel-runtime-l1-1-2" ], "i": "micro-behaviors/os/api-resolution/manual::custom-api-resolver-logic", "l": 2, "el": [ "0x371b0", "0x3f0a0", "0x17b5e", "0x3b2c0", "0x3efe0", "0x3f330", "0x3f260", "0x3f0f0", "0x3f2e0", "0x370b0", "0x3f150", "0x3f2a0", "0x3b300", "0x3f1a0", "0x3f220", "0x3f470" ] }, { "a": "T1497", "c": 0.8500000238418579, "d": "Adaptive behavior based on environment", "e": [ "imports.count = 83.00", "IsProcessorFeaturePresent", "IsDebuggerPresent", "exports.count = 252.00", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "objectives/anti-analysis/environment-detect/runtime::environment-adaptive-behavior", "l": 2, "m": "B0001", "el": [ "", "0x37128", "0x37130", "", "0x37270", "0x37268" ] } ], "sha": "772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-11/772095296ada3b4a2747d76d5f8ae78a5bd828a24ac34911b32708ebfd229fbb.exe", "type": "pe" } ], "tv": "176d6" } }