{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.43843845, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T15:30:42Z" }, "path": "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe", "raw": { "v": "5", "fs": [ { "f": "Md(Bi₃)", "x": 4, "ff": { "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 2399291.0, "bss_like_section_count": 0.0, "section_overflow_count": 3.0, "misaligned_section_count": 0.0 }, "file": { "size": 2369753.0, "entropy": 7.98, "size_bytes": 2369753.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.98, "string_count": 44402.0, "entropy_variance": 14.14, "avg_string_length": 4.92, "max_string_length": 220.0, "code_to_data_ratio": 1.0, "string_length_stddev": 2.8, "largest_section_ratio": 1.84, "sentence_string_count": 4.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "sections": { "count": 3.0, "code_size": 4348928.0, "entropy_max": 7.98, "entropy_mean": 2.66, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 2536, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 2693, "u8", "PADPADP" ], [ 2748, "wide", "aafg31" ], [ 2806, "wide", "lÛuyp(w0uxilcuyphw0uxilãu" ], [ 2982, "wide", "lguypmu0u" ], [ 3042, "wide", "uxilceyphw0" ], [ 3098, "wide", "Bühw0uxilcuyphw" ], [ 3130, "wide", "MPilcuyphw0" ], [ 3158, "wide", "lcuyphw0uxilc" ], [ 3246, "wide", "lcuyphwp" ], [ 3328, "wide", "uxilcu9" ], [ 3347, "u8", "aDau" ], [ 3398, "wide", "Qlcuyphw0uxé" ], [ 3486, "wide", "Qlcuyph7" ], [ 3508, "wide", "ilsuyI" ], [ 3526, "wide", "Mxilcuy0" ], [ 3566, "wide", "O0uxilc5" ], [ 3624, "wide", "uyphw0uxilcuyphw0uxilcuyphw0uxilcuyphw0uxilcuyphw0uxilcuyphw0uxilcuyphw0uxilcuyphw0uxilcuyphw0ux" ], [ 4016, "u8", "mtZf" ], [ 5192, "u8", ")V6UqT W.S!" ], [ 5345, "u8", "DL021" ], [ 5736, "u8", "ufvoM" ], [ 5799, "u8", "DG04" ], [ 5845, "u8", "DQH0" ], [ 6174, "u8", "cHDEyH" ], [ 6720, "u8", "ifcof_" ], [ 7891, "u8", "LQH8" ], [ 8218, "u8", "lflop5" ], [ 8647, "u8", "lS x" ], [ 9674, "u8", "NCtSA" ], [ 10858, "u8", "WCnSD" ], [ 11835, "u8", "TLH21" ], [ 13341, "u8", "U9fco" ], [ 14302, "u8", "zez8uH" ], [ 15072, "u8", "380H" ], [ 15427, "u8", "DQF0" ], [ 15470, "u8", "qAlf" ], [ 15537, "u8", "TQL0" ], [ 15944, "u8", "68yf" ], [ 15980, "u8", "QDMP" ], [ 16672, "u8", "11sf" ], [ 17505, "u8", "TQ81" ], [ 17560, "u8", "qT W.S!" ], [ 18975, "u8", "THXR" ], [ 19145, "u8", "DQX0" ], [ 19485, "u8", "TQX1" ], [ 19708, "u8", "Y P UlYd\\t`H" ], [ 19748, "u8", "V8uEH" ], [ 20033, "u8", "Hkfzb" ], [ 21242, "u8", "qy38u" ], [ 22943, "u8", "C3GH" ], [ 23410, "u8", "zqD8u" ], [ 23674, "u8", "ziC8u" ], [ 25268, "u8", "oBkHL" ], [ 25320, "u8", "JM2uaH" ], [ 25552, "u8", "/8l1" ], [ 25636, "u8", "vPpHP" ], [ 26280, "u8", "-U\"T W/S8" ], [ 26295, "u8", "M68xD" ], [ 26786, "u8", "iTI8u" ], [ 26888, "u8", "x9dssH" ], [ 28019, "u8", "Cou4A" ], [ 29383, "u8", "LG09" ], [ 30915, "u8", "TQ00" ], [ 32139, "u8", "Dqcd" ], [ 33687, "u8", "Cwt5H" ], [ 34185, "u8", "LTxlA" ], [ 35112, "u8", "eIj80M" ], [ 35447, "u8", "TQ84" ], [ 36374, "u8", "mcq8lD" ], [ 38621, "u8", "DHTXCa" ], [ 38907, "u8", "THXJ" ], [ 39263, "u8", "DQ01" ], [ 39522, "u8", "ifcWn" ], [ 39847, "u8", "LQX0" ], [ 41065, "u8", "TGX9" ], [ 41286, "u8", "HTQX" ], [ 41859, "u8", "DQ09" ], [ 43232, "u8", "F80H" ], [ 43522, "u8", "xaH8i" ], [ 44350, "u8", "UME8wH" ], [ 44608, "u8", "nKY8y" ], [ 45070, "u8", "r9et" ], [ 46033, "u8", "9iuf" ], [ 46042, "u8", "EAptaH" ], [ 46190, "u8", "ieE8uH" ], [ 48244, "wide", "qhw0ux" ], [ 48264, "wide", "yphw0uxilcuyphw0uxilcuyphw0uxilcuyphw0uxilcuyphw:uxilcuyphw0uxil" ], [ 48554, "wide", "hw0uxilcuyphw0u" ], [ 49422, "wide", "ilcuyphw0uxil" ], [ 49750, "wide", "ûilcuyphw" ], [ 57656, "wide", "uyphw0uxelcuqphw0uxilcuyxhw0}xilcuyphw0ufilcwyphw0uxilcuqphw8uxilcuyphw0Wxilbuyphw0uxilc}yph" ], [ 57842, "wide", "0uxilcuyphw(uxincuyphw0uxilkuyp`w0uxilcuypha0uxklcuyphw0uxidcuyxhw0uxilcuyp|w0uzilcuyphw0uxalcuqphw0uxilcuy hw0wxilcuyphw0upilc}" ], [ 58186, "wide", "yphu0uxilcuyphw8uxidcuyphw0uxilőuypjw0uxilcuyph" ], [ 58282, "wide", "0uxalcuyphw0uxipcuyrhw0uxilcuyp`w0upilcuyphw0uxSlcu{phw0uxilcuyxhw0}xilcuyphw0u" ], [ 58442, "wide", "ilcwyphw0uxilcuqphw8uxilcuyphw0ixilauyphw0uxilc}yph" ], [ 58546, "wide", "0uxilcuyphwǂuxincuyphw0uxilkuyp`w0uxilcuyphk0uxklcuyphw0uxidcuyxhw0uxilcuypVw0uzilcuyphw0uxalcuqphw0uxilcuylhw0wxilcuyphw0upilc" ], [ 58986, "wide", "0uxalcuyphw0uxi$cuyrhw0uxilcuyp`w0upilcuyphw0uxulcu{phw0uxilcuyxhw0}xilcuyphw0u" ], [ 59146, "wide", "ilcwyphw0uxilcuqphw8uxilcuyphw0" ], [ 59210, "wide", "xilkuyphw0uxilc}yph" ], [ 59250, "wide", "0uxilcuyphwxuxincuyphw0uxilkuyp`w0uxilcuyphk0uxklcuyphw0uxidcuyxhw0uxilcuyp" ], [ 59402, "wide", "w0uzilcuyphw0uxalcuqphw0uxilcuyzhw0}xilcuyphw0upilc}yphw0uxilcu" ], [ 60843, "u8", "tOkdT" ], [ 60905, "u8", "67KH" ], [ 61471, "u8", "rHerq" ], [ 62806, "u8", "BZAxf" ], [ 64844, "u8", "AOS2" ], [ 64890, "u8", "PFFR" ], [ 65417, "u8", "62KF" ], [ 66428, "u8", "I3PC" ], [ 67503, "u8", "zzwjT" ], [ 67542, "u8", "jjBp" ], [ 68098, "u8", "OP2W" ], [ 68492, "u8", "MO32" ], [ 69501, "u8", "aIrk" ], [ 69757, "u8", "Lttn" ], [ 70499, "u8", "tT8O1G.B6]5" ], [ 70592, "u8", "IAJT" ], [ 70730, "u8", "VO3KGz" ], [ 71789, "u8", "jGzTI" ], [ 71851, "u8", "f$K Zi" ], [ 76438, "u8", "VO68" ], [ 76837, "u8", "FK2Y" ], [ 77222, "u8", "Xn[}" ], [ 77751, "u8", "/BhiK" ], [ 77849, "u8", "KF8Q" ], [ 78309, "u8", "FD2O" ], [ 79589, "u8", "yFlNK" ], [ 80390, "u8", "EnCrNR" ], [ 81532, "u8", "AGJ6" ], [ 81589, "u8", "wPka1" ], [ 82469, "u8", "yPlJK" ], [ 82892, "u8", "AO72" ], [ 83844, "u8", "tgCl" ], [ 85573, "u8", "yFlBK" ], [ 88713, "u8", "RH5_" ], [ 89743, "u8", "uIun" ], [ 89767, "u8", "cRwa" ], [ 90965, "u8", "ANOJ" ], [ 91777, "u8", "JRPzi" ], [ 92700, "u8", "BGX70" ], [ 93854, "u8", "qfIj" ], [ 94398, "u8", "DV0E" ], [ 95604, "u8", "HdrXC" ], [ 99242, "u8", "Z0E4" ], [ 100740, "u8", "Iadl" ], [ 100869, "u8", "aul7" ], [ 100965, "u8", "ailo" ], [ 101045, "u8", "oAkb" ], [ 101077, "u8", "o4kj" ], [ 101204, "u8", "Sohk8" ], [ 101237, "u8", "ouk7" ], [ 101301, "u8", "o7k2" ], [ 101380, "u8", "Cajl" ], [ 101461, "u8", "oak5" ], [ 101556, "u8", "Oookw" ], [ 101765, "u8", "aulw" ], [ 101813, "u8", "oak4" ], [ 102101, "u8", "ook3" ], [ 102708, "u8", "JApk5yQ" ], [ 104091, "u8", "/ahN" ], [ 104123, "u8", "/7hY" ], [ 109189, "u8", "fClk" ], [ 109255, "u8", "lwCJVO" ], [ 109517, "u8", "tluTx" ], [ 109699, "u8", "s{}wl" ], [ 110288, "u8", "wXt4H,N9]\u003cK5/cM" ], [ 110412, "u8", "nFyL Xv" ], [ 110838, "u8", "akgp7b3c:rGe" ], [ 110919, "u8", "l\"rdkqklz8x0a" ], [ 111629, "u8", "qm8TxY" ], [ 112005, "u8", "fClbQ" ], [ 112426, "u8", "/\tmKS" ], [ 112973, "u8", "XGzMy" ], [ 114379, "u8", "kckFz" ], [ 116887, "u8", "k9RYb" ], [ 117019, "u8", "b6FHr" ], [ 117065, "u8", "rJkeN" ], [ 117195, "u8", "kaMFz" ], [ 117371, "u8", "bLDHr" ], [ 117459, "u8", "alLBk" ], [ 117547, "u8", "kQNFz" ], [ 117899, "u8", "kiLFz" ], [ 118631, "u8", "lIvu" ], [ 118640, "u8", "wxSee" ], [ 118650, "u8", "XbYgg" ], [ 120970, "wide", "cuyphw0uxilcuyp" ], [ 122675, "u8", "aChGP" ], [ 123620, "u8", "pBclN" ], [ 123656, "u8", "ZrGkykizzx?achWkLpmbhc^rhemtlf4l" ], [ 126699, "u8", "kSkGzq" ], [ 126733, "u8", "kBzBxJaUh^kWp" ], [ 126747, "u8", "bYcNr_e@tIfHlLrEk" ], [ 126825, "u8", "rPkhkmzzx2aahMkrphbccEroeetdf" ], [ 126861, "u8", "k.z\u003cx\u003ea7h:k6pbb\"cIrGe" ], [ 126889, "u8", "rbkxkbzbxoa0h" ], [ 126903, "u8", "k^piblc:r`eetwfrlbr#k|kkz-xBaChBk+ptbdcmr-ehthf" ], [ 126961, "u8", "xGakh.kwpqbbclrUegtwffl" ], [ 126989, "u8", "krzyxkaShykepBblcbr!e,tdfll" ], [ 127025, "u8", "xZarhhk'pYbxccrwebt" ], [ 127045, "u8", "fzlwr{ktk)z" ], [ 127059, "u8", "aMhvk" ], [ 127065, "u8", "pObucgrwe4tSf" ], [ 127085, "u8", "kRzxxyafhMk`p*bcchr~eqt" ], [ 127111, "u8", "l;r$k6k.zdx7a\u003eh" ], [ 127133, "u8", "cIrfeotqf1lhrckikUzfxtaoh" ], [ 127159, "u8", "kMpvb;c^rietthf l(rpkeklz" ], [ 127193, "u8", "pHbcckr`eotHfkl3rvkfkwzoxgarh" ], [ 127223, "u8", "kApobbc0r" ], [ 127233, "u8", "ebtmfwldr/k=kDz%x;aqh6k:p6b$c(r=e:t+f;lKr:k|kazAxiarhUkrpkb#car:eat5f:l^rukuk.zfxmach+kspcb,cgr~eut" ], [ 127353, "u8", "p^bgcxrhe*txfjlvrPkfknzxxrazhik'p" ], [ 127387, "u8", "bJcyrzeBt" ], [ 127397, "u8", "fdldr\"k5k4zhxga" ], [ 127421, "u8", "cYrbekt7fslhrgkNkuz|xpa" ], [ 127447, "u8", "kRp1b~cSrxeqtgf6l" ], [ 127471, "u8", "zUxIayhukzp~bsctr^e~tff0lormkkk" ], [ 127503, "u8", "z6x7a8h-k*p1b`c" ], [ 127525, "u8", "fFlgrqkZkvz" ], [ 127537, "u8", "x9aOhek}pkb" ], [ 127557, "u8", "fPl1rnkzkmzdxnarhckmpnb" ], [ 128813, "u8", "nGJFI" ], [ 129236, "u8", "mtHBX" ], [ 129925, "u8", "k7X:C8\\5Z0JdHCQ" ], [ 130678, "u8", "dB5od" ], [ 130840, "u8", "6X D" ], [ 132597, "u8", "KGs7f" ], [ 133645, "u8", "kMzfxkawh0kDpQR" ], [ 135307, "u8", "BQ5A" ], [ 135546, "wide", "0uxilcu" ], [ 137045, "u8", "72oi" ], [ 137824, "u8", "QFZas6" ], [ 140253, "u8", "SL3Q" ], [ 140283, "u8", "VRT2A" ], [ 143064, "u8", "CXPjfq" ], [ 143300, "u8", "BZVZ" ], [ 143837, "u8", "CI4F" ], [ 144922, "u8", "SD5Y" ], [ 145415, "u8", "pxKx" ], [ 146789, "u8", "q Uo" ], [ 147844, "u8", "Z. d" ], [ 149693, "u8", "kyb n" ], [ 149964, "u8", "hu RW" ], [ 150342, "u8", "Oyqe" ], [ 150578, "u8", "vy77" ], [ 152142, "u8", "ZIxCg" ], [ 152221, "u8", "KixKl7l" ], [ 152456, "u8", "cxZt" ], [ 153359, "u8", "ZJyqy" ], [ 153823, "u8", "bdI7L" ], [ 154299, "u8", "ctZor" ], [ 155562, "u8", "gNwVG" ], [ 155801, "u8", "Hm2yk" ], [ 156970, "u8", "eCVIL5" ] ], "v": { "file.stem": "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1690204372, "file.basename": "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe", "pe.image_base": 4194304, "pe.image_size": 4374528, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4356766, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.linker_major_version": 11, "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 4356688, "pe.data_directories[1].rva": 4358144, "pe.data_directories[2].rva": 4366336, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.overflowing_sections[0]": ".text", "pe.overflowing_sections[1]": ".rsrc", "pe.overflowing_sections[2]": ".reloc", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 75, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1232, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.coff.dos_header_pe_pointer": 128 }, "id": "pe", "sc": [ [ ".text", 512, 4348928, 7.98, "r-x" ], [ ".rsrc", 4349440, 1536, 0.0, "r--" ], [ ".reloc", 4350976, 512, 0.0, "r--" ] ] }, "id": 0, "sz": 2369753, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 1.0, "d": "php code embedded in string", "e": [ "\u003c?=Pqh M" ], "i": "metadata/lang/embedded::php", "l": 2, "el": [ "embedded@0x1f6e9f:0x1f6e9f" ] }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 7.98, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 44402.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.98)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 44402.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x9e8" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "c1" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014", "el": [ "0x10bf8f" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 44402.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.98" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.84" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.84" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c9", "ce", "c2" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0x221c6d", "0x128cd7", "0x137f0d" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x11245a" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.98" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.84" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "41", "40" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x32d57", "0x195756" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 44402.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 44402.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x9e8" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 1.84" ], "i": "metadata/binary/metrics/structural::section-exceeds-file-size", "l": 1 }, { "c": 1.0, "d": "Large near-high entropy .text section", "e": [ ".text (size: 4348928, entropy: 7.98, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-large-near-high-entropy-text-raw", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x9e8" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 44402.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 44402.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.84" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.98" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 7.98, perms: r-x)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 4348928, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 1.84" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.92" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 44402.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.84" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.84" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" } ], "sha": "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0", "path": "7b33bb77e4f8aab82612ee438217ff05949adef082e815cdb96cfb6e5104a2d0.exe", "type": "pe" } ], "tv": "52045" } }