{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9935870170593262, "class": 1 } ], "prob": 0.993587, "class": 1, "oprob": 0.5794602, "oclass": 0, "version": "v16.16", "thresholds": [ 0.993587, 0.99945134 ], "analyzed_at": "2026-04-28T13:50:01Z" }, "path": "virussign.com_77e702d63eae75aec93ea5fa2e3bfa60.vir", "raw": { "v": "4", "fs": [ { "f": "O₆(I₂As₇Er₃C₇PS)H₂(DsF)Md₅(Bi₆HePa)", "x": 129, "id": 0, "is": [ "VirtualFree", "VirtualAlloc", "GetLastError", "CreateMutexA", "ExitProcess", "GetProcAddress", "LoadLibraryExA", "GetModuleHandleA", "VirtualProtect", "GetModuleFileNameA", "MessageBoxA" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 2048.0, "subsystem": 2.0, "timestamp": 1300161967.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 2.32, "entry_section": ".ex_cod", "size_of_image": 40960.0, "timestamp_day": 15.0, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2011.0, "characteristics": 271.0, "entry_point_rva": 29762.0, "size_of_headers": 1024.0, "timestamp_month": 3.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 2.0, "computed_checksum": 6466723.0, "section_alignment": 4096.0, "number_of_sections": 4.0, "resource_timestamp": 0.0, "rich_header_present": true, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false, "entry_in_nonstandard_section": true }, "binary": { "code_size": 5632.0, "file_size": 6434816.0, "entry_point": 29762.0, "has_overlay": true, "wx_sections": 1.0, "code_entropy": 6.39, "data_entropy": 6.04, "import_count": 11.0, "overlay_size": 6409216.0, "string_count": 21256.0, "overlay_ratio": 1.0, "section_count": 4.0, "avg_complexity": 10.78, "function_count": 341.0, "import_density": 2.0, "max_complexity": 35.0, "string_density": 3864.73, "overall_entropy": 5.2, "overlay_entropy": 4.82, "avg_basic_blocks": 19.56, "avg_section_size": 6144.0, "dependency_count": 2.0, "entropy_variance": 2.14, "function_density": 62.0, "avg_function_size": 423.11, "avg_string_length": 154.55, "complexity_per_kb": 1.96, "max_string_length": 2509.0, "writable_sections": 3.0, "avg_string_entropy": 1.93, "code_to_data_ratio": 0.3, "data_to_file_ratio": 0.0, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.0, "total_basic_blocks": 176.0, "executable_sections": 1.0, "high_entropy_regions": 1.0, "string_length_stddev": 185.49, "largest_section_ratio": 0.0, "sentence_string_count": 21.0, "sentence_string_ratio": 0.0, "behavioral_import_ratio": 0.36, "function_analysis_depth": 2.0, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 496, ".data" ], [ 536, ".pdata" ], [ 576, ".ex_cod" ], [ 616, ".rsrc" ], [ 3099, "SUVW" ], [ 3554, "8WQV" ], [ 5715, "XPVSS" ], [ 9433, "6xuu" ], [ 10380, "MFC42.DLL" ], [ 10392, "__CxxFrameHandler" ], [ 10420, "fclose" ], [ 10430, "fread" ], [ 10438, "fseek" ], [ 10446, "fopen" ], [ 10454, "rename" ], [ 10464, "fwrite" ], [ 10498, "_beginthread" ], [ 10514, "_mbscmp" ], [ 10522, "MSVCRT.dll" ], [ 10544, "_XcptFilter" ], [ 10558, "exit" ], [ 10566, "_acmdln" ], [ 10576, "__getmainargs" ], [ 10592, "_initterm" ], [ 10604, "__setusermatherr" ], [ 10624, "_adjust_fdiv" ], [ 10640, "__p__commode" ], [ 10656, "__p__fmode" ], [ 10670, "__set_app_type" ], [ 10688, "_except_handler3" ], [ 10708, "_controlfp" ], [ 10722, "SetThreadPriority" ], [ 10742, "GetCurrentThread" ], [ 10762, "GetCurrentProcess" ], [ 10782, "SetPriorityClass" ], [ 10802, "lstrcatA" ], [ 10814, "lstrcpyA" ], [ 10826, "GetEnvironmentVariableA" ], [ 10852, "GetShortPathNameA" ], [ 10872, "GetModuleFileNameA" ], [ 10894, "GetFileAttributesA" ], [ 10916, "DeleteFileA" ], [ 10930, "SetFileAttributesA" ], [ 10952, "GetSystemDirectoryA" ], [ 10974, "WaitForSingleObject" ], [ 10996, "CreateProcessA" ], [ 11014, "Sleep" ], [ 11022, "GetLogicalDrives" ], [ 11042, "GetModuleHandleA" ], [ 11062, "GetStartupInfoA" ], [ 11078, "KERNEL32.dll" ], [ 11094, "MessageBoxA" ], [ 11118, "USER32.dll" ], [ 11132, "SHChangeNotify" ], [ 11150, "ShellExecuteExA" ], [ 11166, "SHELL32.dll" ], [ 13328, "Open" ], [ 13344, "/c del" ], [ 13352, "COMSPEC" ], [ 13372, ".exe" ], [ 13384, ".tmp" ], [ 13396, "\\Zombie.exe" ], [ 13560, ".bak" ], [ 13588, "WINNT" ], [ 13596, "WINDOWS" ], [ 14823, "AVQM" ], [ 17650, "LAW2" ], [ 18008, "eXPressor_InstanceChecker_" ], [ 18040, "This application was packed with an Unregistered version of eXPressor.\nFor registration, please visit www.cgsoftlabs.ro" ], [ 18111, "For registration, please visit www.cgsoftlabs.ro" ], [ 18160, "Info" ], [ 18721, "SVWP" ], [ 22922, "VirtualFree" ], [ 22936, "VirtualAlloc" ], [ 22952, "GetLastError" ], [ 22968, "CreateMutexA" ], [ 22984, "ExitProcess" ], [ 22998, "GetProcAddress" ], [ 23016, "LoadLibraryExA" ], [ 23054, "VirtualProtect" ], [ 24772, "555555555555s59534A5;555555565556555655555555E55?5556555344455555555444444444444444444444444444444444444444444444444444444444444" ], [ 26112, "mscordaccore_amd64_amd64_5.0.1522.11506.dll" ], [ 26231, "33333333#3US\u003e5AP3" ], [ 26253, "633333" ], [ 26301, "C33733" ], [ 26309, "C353" ], [ 26314, "t33C333333C33333333C333333C3333333333C333" ], [ 26376, "7333" ], [ 26501, "?33733333333333333S33" ], [ 26545, "?3333333333333s33sa" ], [ 26577, "B33C333{B3333333333333s33" ], [ 26625, "B3333333333333s33s" ], [ 26648, "t33'3333SC335333" ], [ 26665, "B3333333333333s33sa" ], [ 26745, "B3333333333333s33u33333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333" ], [ 27012, "C333" ], [ 27212, "42HK" ], [ 27395, "B32H" ], [ 27433, "B32H5" ], [ 27509, "033t" ], [ 27593, "0332H" ], [ 27691, "033f" ], [ 27824, "WS2H" ], [ 28040, "3733" ], [ 28087, "3332H" ], [ 28296, "433t" ], [ 28342, "333t" ], [ 28823, "2220" ], [ 28987, "i433t" ], [ 29258, "3332HK" ], [ 29472, "4333xf" ], [ 29497, "222f" ], [ 30168, "4333" ], [ 30264, "533w" ], [ 30325, "1433" ], [ 30501, "y433" ], [ 30663, "92HP" ], [ 30855, "3331" ], [ 30998, "1222" ], [ 31010, "i433" ], [ 31052, "333w" ], [ 31108, "3332" ], [ 31130, "433w" ], [ 31406, "Tjxf" ], [ 31414, "13335" ], [ 31503, "333f" ], [ 31574, "3339" ], [ 31910, "333xf" ], [ 31958, "LM53" ], [ 32374, "d533" ], [ 32436, "s433" ], [ 32549, "3313" ], [ 32555, "2243V" ], [ 32573, "3433xf" ], [ 32597, "k333" ], [ 32667, "s333x" ], [ 32765, "A3:550__Connections.provxml" ], [ 33028, "So\u003e;QQQQQQm" ], [ 33079, "So\u003e;QQQQQQQQm" ], [ 33171, "SQ`o\u003e;QQQQQQm`" ], [ 33256, "SQ`o\u003e;QQQQQQm" ], [ 34282, "desktop.ini" ], [ 34364, "ecduu_c_\\d_g`\\`_`q\\hu_g\\__pp__auhdct" ], [ 34604, "boxed-correct.avi" ], [ 34837, "///////////0//////////776/577/8::/?\u003e=/??\u003e/:\u003e?/\u003c?@/@CC/GFE/GGE/@FG/CHI/HJK/OML/RPM/EMO/KRS/SWX/a]X/icY/U^_/Xcd/bgh/qi[/qkb/vo^/xr" ], [ 34977, "n/]mo/bmo/^oq/gtv/h}" ], [ 40221, "///2//" ], [ 40317, "///8//" ], [ 40348, "T///3////N///8///" ], [ 40960, "BCD.LOG" ], [ 41636, "af.txt" ], [ 41707, "u\\gP9jOOc]_hOiO" ], [ 43646, "9999ah__9p" ], [ 43845, "]99999{" ], [ 44715, "9999U" ], [ 44782, "i999u" ], [ 44920, "i999" ], [ 44960, "9999t" ], [ 45857, "9ec__999" ], [ 46129, "]]]999999fc__9z" ], [ 46196, "]]]9999fd__99999fe__9|" ], [ 50942, "Outlook.lnk" ], [ 51011, "444444z" ], [ 51053, "644445444444444444444c6H4S" ], [ 51122, "4e44444" ], [ 51299, "87b4449" ], [ 51307, "hex", "tDtDDDDDDD" ], [ 51409, "hex", "tDdDDDDDDD" ], [ 51491, "74446444444444444444T" ], [ 51636, "444P4445444P444a4444444" ], [ 51738, "y44g4" ], [ 52281, "mdejddddadddzaddddaedddadddddddzzewy" ], [ 52330, "44444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444" ], [ 52698, "hex", "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD" ], [ 53009, "Z444" ], [ 53046, "444744" ], [ 53149, "u444e" ], [ 53173, "Y44484444S444=444" ], [ 53215, "444e" ], [ 53364, "Q444" ], [ 53380, "F444444" ], [ 57140, "OfficeIntegrator.ps1" ], [ 57642, "^B?UUUUB?UUUUY" ], [ 57868, "B?UUUUUUUUXU~" ], [ 58003, "W^B?UUUUUUUU" ], [ 58016, "UUUUUUUUUUUUUUB?UUUUUUUUUUUU" ], [ 58074, "B?UUUUB?UUUU" ], [ 58193, "^B?B?UUUUXU" ], [ 58446, "dgefed" ], [ 59103, "B?B?UUUUXU{" ], [ 59249, "UUUUUUUUB?UUUUUUUU" ], [ 59705, "UUUB?UUUUUUUUUUUUXU" ], [ 59797, "B?UUUUUUUUUUUU" ], [ 59836, "^^B?UUUUUUUUUUUU" ], [ 59853, "B?UUUUUUUUUUUUUUUUXU{" ], [ 59943, "aUB?UUUUUUUUUUUUUUUUXU" ], [ 59997, "WB?UUUUUUUUUUUUUUUUY" ], [ 60056, "B?UUUUUUUUUUUUUUUUY" ], [ 60185, "UB?UUUUUUUUUUUUUUUUY" ], [ 60247, "\\B?B?UUUUUUUUUUUUUUUUY" ], [ 60309, "\\^B?UUUUUUUUUUUUUUUU" ], [ 60356, "Ue^B?UUUUUUUUUUUUUUUU" ], [ 60378, "B?UUUUUUUUUUUUUUUUUUUUY" ], [ 60452, "B?B?UUUUUUUUUUUUUUUUUUUUY" ], [ 60555, "^B?UUUUUUUUUUUUUUUUUUUU" ], [ 60612, "^B?UUUUUUUUUUUUUUUUUUU" ], [ 60635, "B?UUUUUUUUUUUUUUUUUUUUUUUUY" ], [ 60750, "^B?B?UUUUUUUUUUUUUUUUUUUUUUUUXU" ], [ 60876, "cB?UUUUUUUUUUUUUUUUUUUUUUUUY" ], [ 60998, "B?UUUUUUUUUUUUUUUUUUUUUUUU" ], [ 61059, "Ue^B?UUUUUUUUUUUUUUUUUUUUUUUU" ], [ 61089, "B?UUUUUUUUUUUUUUUUUUUUUUUUUUUUY" ], [ 61317, "B?UUUUUUUUUUUUUUUUUUU" ], [ 61339, "B?UUUUUUUUUUUUUUUU" ], [ 61358, "UB?B?UUUUUUUUUUUUUUUU" ], [ 61900, "UUUUB?UUUUXU{" ], [ 62035, "B?UUUUUUUUXU" ], [ 62112, "B?UUUUUUUUy" ], [ 67196, "OneDrive.lnk" ], [ 72460, "Alphabet.xml" ], [ 72752, "uVTcrA\u003eTTTTp" ], [ 72933, "xgeVTcrA\u003eTTTTp" ], [ 73022, "yVTcrA\u003eTTTTp" ], [ 73377, "jyVTcrA\u003eTTTTp" ], [ 73420, "WVTcrA\u003eTTTTp" ], [ 73639, "gVTcrA\u003eTTTTp" ], [ 74116, "XVTcrA\u003eTTTTp" ], [ 74159, "zVTcrA\u003eTTTTp" ], [ 74826, "iVTcrA\u003eTTTTp" ], [ 74871, "oVTcrA\u003eTTTTp" ], [ 75543, "o}VTcrA\u003eTTTTp" ], [ 75891, "vVTcrA\u003eTTTTp" ], [ 76017, "mVTcrA\u003eTTTTp" ], [ 76580, "eVTcrA\u003eTTTTp" ], [ 77299, "qV`eb}VTcrA\u003eTTTTp" ], [ 77607, "qV[be~VTcrA\u003eTTTTp" ], [ 77734, "qVob[UVTcrA\u003eTTTTp" ], [ 77819, "qVUkfeVTcrA\u003eTTTTp" ], [ 78218, "xVTcrA\u003eTTTTp" ], [ 78439, "bVTcrA\u003eTTTTp" ], [ 78541, "eVrA\u003eTTTTTTp" ], [ 78730, "nTdfdTaTifjTiiTlkbpc" ], [ 78807, "Tficdhcemkgbpc" ], [ 79476, "oTj_ebpc" ], [ 79610, "TeTqTXTe`ilkkTqT" ], [ 79764, "Tlddbdddbpc" ], [ 80617, "Thbpc" ], [ 81268, "oT\\l_m]Tspc" ], [ 81843, "wTqTbbb" ], [ 81985, "nTdijmTghmTmmlbpc" ], [ 82236, "fVrA\u003eTTTTTTp" ], [ 82431, "Tedg" ], [ 82480, "TkdbilgoT" ], [ 82501, "Tkbigfbmifbpc" ] ], "sz": 6434816, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 10.78" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Accesses ComSpec environment variable", "e": [ "COMSPEC" ], "i": "micro-behaviors/os/env/vars::comspec-env-var", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 12800)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.75, "d": "Large hex-encoded string (1024+ chars)", "e": [ "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" ], "i": "objectives/anti-static/obfuscation/payload::large-hex-string-dup", "l": 3 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 341.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 341.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 6409216.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "cmd /c del argument fragment", "e": [ "/c del" ], "i": "objectives/evasion/self-delete/file::slash-c-del-fragment", "l": 3, "m": "F0007" }, { "c": 0.8500000238418579, "d": "Excludes Ghost image extensions", "e": [ ".GHO" ], "i": "objectives/impact/infect/binary::ghost-image-filter", "l": 1 }, { "c": 0.8500000238418579, "d": "Skips Windows installation directories", "e": [ "WINNT", "WINDOWS" ], "i": "objectives/impact/infect/binary::skip-windows-install-dir", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 6434816.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 21256.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 21256.00" ], "i": "metadata/package::high-string-count-pe", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1300161967.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.20" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 21256.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 341.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 6434816.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 11.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1027.010", "d": "Custom base64 decode lookup table", "e": [ "}000000000x0{", "|000v000y000w000v000y000t000{", "|000q000y000v000w000{", "|000w000z000y000x000z000x000{", "|000q000y000t000v000v000t000x000q000{", "|000Y000v000U000n000X000m000a000s000f000{", "|000y000s000y000j000y000a000z000X000{", "|000v000z000t000z000p000{", "|000y000y000y000u000z000q000{", "}000N000x000T000s000U000p000S000x000Z000{", "|000v000v000y000o000{", "}000k000y000j000v000B000{", "|000l000y000r000v000v000t000{", "|000j000x000q000t000w000n000{", "}000w000z000{", "}000k000y000q000r000u000l000x000e000{" ], "i": "micro-behaviors/data/encode/base64::decode-table", "l": 2, "m": "B0032.001" }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 21256.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA (contains: CreateProcess)" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "a": "T1059.001", "c": 0.800000011920929, "d": "Embedded .ps1 script reference", "e": [ "OfficeIntegrator.ps1" ], "i": "objectives/command-and-control/backdoor/reflective-load::embedded-ps1", "l": 1, "m": "E1059" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".tmp" ], "i": "objectives/impact/infect/binary::tmp-extension-staging", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "d": ".ps1 extension reference", "e": [ ".ps1" ], "i": "micro-behaviors/fs/path/extension::ps1", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "PE overlay exceeds ninety percent", "e": [ "binary.overlay_ratio = 1.00" ], "i": "metadata/binary/layout::overlay-over-90pct", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "eXPressor code section name", "e": [ ".ex_cod" ], "i": "objectives/anti-static/pack/detect::expressor-code-section", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0x00000001", "0x10000000", "0x00000000", "0x000D000F", "0x000E000D", "0x000F000D", "0x000D000a", "0x000f000D", "0x000c000D", "0x000D000C", "0x000E000D", "0x000D000f", "0x000e000D", "0x000C000D", "0x000D000d", "0x000b000f" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1 }, { "c": 0.8500000238418579, "d": "Links legacy MFC42 runtime", "e": [ "MFC42.DLL" ], "i": "micro-behaviors/dylib/library::mfc42-ref", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 11.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 2048.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "binary.file_size = 6434816.00" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 11.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 1.93" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 40960.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1083", "c": 0.8799999952316284, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives-text", "l": 3, "m": "E1083" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with dense string corpus", "e": [ "binary.string_density = 3864.73" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-string-density-large-pe", "l": 1, "m": "B0032" }, { "c": 0.9599999785423279, "d": "Overlay size at least 1 MiB", "e": [ "binary.overlay_size = 6409216.00" ], "i": "metadata/binary/layout::large-overlay-1mb", "l": 2 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 1.00" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "c": 0.9599999785423279, "d": "PE overlay exceeds 1 MiB", "e": [ "binary.overlay_size = 6409216.00" ], "i": "metadata/binary/layout::overlay-over-1mb", "l": 2 }, { "c": 0.8500000238418579, "d": "Filters backup-style .bak targets", "e": [ ".bak" ], "i": "objectives/impact/infect/binary::bak-extension-filter", "l": 1 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "virussign.com_77e702d63eae75aec93ea5fa2e3bfa60.vir" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "binary.file_size = 6434816.00" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ "OneDrive.lnk (contains: .lnk)", "Outlook.lnk (contains: .lnk)" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Resource section entropy is unusually low", "e": [ "pe.rsrc_entropy = 2.32" ], "i": "objectives/anti-static/obfuscation/payload/section::low-entropy-rsrc", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "Binary has 25 or fewer imports", "e": [ "binary.import_count = 11.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-25-imports", "l": 3 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 21256.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "binary.import_count = 11.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-80-imports", "l": 1 }, { "c": 0.699999988079071, "d": "Binary has 30 or fewer imports", "e": [ "binary.import_count = 11.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-30-imports", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 6409216.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::wx-sections", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetEnvironmentVariableA", "GetModuleFileNameA", "GetSystemDirectoryA" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 3 }, { "a": "T1105", "c": 0.9599999785423279, "d": "Large overlay bundle component", "e": [ "binary.overlay_size = 6409216.00" ], "i": "objectives/command-and-control/dropper/execution/installer::large-overlay-bundle", "l": 1, "m": "B0022" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 1.00" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 341.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 2 }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 6409216.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Packed loader code-to-data ratio below 0.4", "e": [ "binary.code_to_data_ratio = 0.30" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-low-code-to-data-ratio", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.699999988079071, "d": "Large overlay relative to file", "e": [ "binary.overlay_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Binary has 50 or fewer imports", "e": [ "binary.import_count = 11.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-50-imports", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 6434816.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".ex_cod (size: 5632, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (VirtualFree, VirtualAlloc, GetLastError, CreateMutexA, ExitProcess, ... +5 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (MessageBoxA)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8199999928474426, "d": "Large PE with four standard sections", "e": [ "virussign.com_77e702d63eae75aec93ea5fa2e3bfa60.vir", "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::large-four-section-pe", "l": 3 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "CreateMutexA", "ExitProcess" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 3, "m": "F0007" }, { "a": "T1485", "c": 0.9700000286102295, "d": "Deletes non-whitelisted files across drives", "e": [ "DeleteFileA", "WINNT", ".exe", "GetLogicalDrives", "WINDOWS", "MFC42.DLL", ".GHO" ], "i": "objectives/impact/destroy/file-deletion::drive-wide-nonwhitelist-file-deleter", "l": 5, "m": "C0047" }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "binary.import_count = 11.00" ], "i": "objectives/evasion/masquerade/version-resource::low-import-pe-without-heavy-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: hex", "e": [ "encoding=hex, type=Unknown, preview=DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD" ], "i": "metadata/encoded-payload/hex", "l": 3 } ], "sha": "7b949c1b0a020f178a39cdc4de32351ad3c4ebdadf607e8ffb7672176a9ecf33", "path": "virussign.com_77e702d63eae75aec93ea5fa2e3bfa60.vir", "type": "pe" } ], "tv": "0b014" } }