{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.00005370378494262695 } ], "prob": 0.000053703785, "models": [ { "m": "az", "raw": 0.000053703785, "prob": 0.000053703785, "class": 0 }, { "m": "az/source", "raw": 0.00049367547, "prob": 0.00049367547, "class": 0 }, { "m": "az/c", "raw": 0.002537638, "prob": 0.002537638, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T07:03:01Z" }, "path": "syscalls.c", "raw": { "v": "6", "fs": [ { "f": "O(Er)H(Os)", "x": 3, "ff": { "i": [ [ "", "RVAtoRawOffset" ], [ "", "RVAtoRawOffset" ], [ "", "RVAtoRawOffset" ], [ "", "RVAtoRawOffset" ], [ "", "strcmp" ], [ "", "memcpy" ], [ "", "VirtualProtect" ], [ "", "VirtualProtect" ], [ "", "memcpy" ], [ "", "VirtualProtect" ], [ "", "CreateFileA" ], [ "", "GetFileSize" ], [ "", "HeapAlloc" ], [ "", "GetProcessHeap" ], [ "", "ReadFile" ], [ "", "IMAGE_FIRST_SECTION" ], [ "", "strncmp" ], [ "", "RVAtoRawOffset" ], [ "", "\u003cntdef.h\u003e" ], [ "", "\u003ctlhelp32.h\u003e" ], [ "", "\u003cwindows.h\u003e" ], [ "", "\u003cwinternl.h\u003e" ], [ "", "syscalls.h" ] ], "m": { "ast": { "op.eq": 2.0, "op.lt": 2.0, "op.add": 8.0, "op.mul": 2.0, "op.sub": 1.0, "op.band": 6.0, "max_depth": 13.0, "op.concat": 3.0, "bind_count": 10.0, "call_count": 20.0, "node_count": 855.0, "member_count": 17.0, "op_density.eq": 0.0, "op_density.lt": 0.0, "op_density.add": 0.01, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.01, "identifier_count": 86.0, "member_depth_max": 3.0, "op_density.concat": 0.0, "string_literal_count": 3.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 3529.0, "entropy": 5.45, "size_bytes": 3529.0 }, "text": { "tab_count": 31.0, "digit_ratio": 0.02, "space_count": 463.0, "total_lines": 88.0, "char_entropy": 5.45, "mixed_indent": 1.0, "unique_chars": 75.0, "escape_density": 0.65, "string_density": 0.03, "avg_line_length": 39.11, "max_line_length": 186.0, "empty_line_ratio": 0.22, "hex_escape_count": 23.0, "last_line_length": 1.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.04, "identifier_density": 2.51, "line_length_stddev": 44.16, "normalized_string_count": 0.32, "repeated_char_sequences": 10.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 23.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 13.31 }, "binds": { "count": 10.0 }, "calls": { "count": 20.0 }, "binary": { "overall_entropy": 5.45 }, "source": { "class_count": 2.0, "function_count": 4.0 }, "imports": { "count": 5.0, "unique_modules": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "members": { "count": 17.0 }, "strings": { "total": 3.0, "avg_length": 36.0, "max_length": 92.0, "avg_entropy": 2.13, "total_bytes": 108.0, "entropy_stddev": 0.48, "unicode_heavy_strings": 1.0 }, "functions": { "count": 6.0 }, "identifiers": { "count": 86.0, "total": 221.0, "avg_length": 11.93, "max_length": 28.0, "min_length": 1.0, "avg_entropy": 2.99, "reuse_ratio": 0.39, "unique_count": 86.0, "length_stddev": 5.6, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.01, "high_entropy_count": 17.0, "high_entropy_ratio": 0.2, "all_lowercase_ratio": 0.07, "all_uppercase_ratio": 0.3, "underscore_prefix_count": 2.0 } }, "s": [ [ 9, "u8", "\u003cwindows.h\u003e" ], [ 30, "u8", "\u003cntdef.h\u003e" ], [ 49, "u8", "\u003ctlhelp32.h\u003e" ], [ 71, "u8", "\u003cwinternl.h\u003e" ], [ 94, "u8", "syscalls.h" ], [ 95, "u8", "syscalls.h" ], [ 523, "10", "0" ], [ 845, "10", "0" ], [ 1115, "10", "1" ], [ 1242, "10", "0" ], [ 1541, "10", "0" ], [ 1568, "u8", "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" ], [ 2050, "10", "0" ], [ 2558, "10", "0" ], [ 3154, "10", "0" ], [ 3249, "u8", ".rdata" ], [ 3250, "u8", ".rdata" ], [ 3259, "10", "6" ], [ 1544, "unicode-escape", "CHAR* pcOverWrite = \"\";" ] ], "v": { "file.stem": "syscalls", "file.basename": "syscalls.c", "source.language": "c", "source.imports[0]": "\u003cntdef.h\u003e", "source.imports[1]": "\u003ctlhelp32.h\u003e", "source.imports[2]": "\u003cwindows.h\u003e", "source.imports[3]": "\u003cwinternl.h\u003e", "source.imports[4]": "CreateFileA", "source.imports[5]": "GetFileSize", "source.imports[6]": "GetProcessHeap", "source.imports[7]": "HeapAlloc", "source.imports[8]": "IMAGE_FIRST_SECTION", "source.imports[9]": "RVAtoRawOffset", "source.strings[0]": ".rdata", "source.strings[1]": "\u003cntdef.h\u003e", "source.strings[2]": "\u003ctlhelp32.h\u003e", "source.strings[3]": "\u003cwindows.h\u003e", "source.strings[4]": "\u003cwinternl.h\u003e", "source.strings[5]": "CHAR* pcOverWrite = \"\";", "source.strings[6]": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00", "source.strings[7]": "syscalls.h", "source.has_imports": true, "source.imports[10]": "ReadFile", "source.imports[11]": "VirtualProtect", "source.imports[12]": "memcpy", "source.imports[13]": "strcmp", "source.imports[14]": "strncmp", "source.imports[15]": "syscalls.h", "source.functions[0]": "CleanSyscall(LPVOID syscallStub)", "source.functions[1]": "MakeSyscall(LPCSTR functionName, PIMAGE_EXPORT_DIRECTORY exportDirectory, LPVOID fileData, PIMAGE_SECTION_HEADER textSection, PIMAGE_SECTION_HEADER rdataSection, LPVOID syscallStub)", "source.functions[2]": "ParseNtdll(struct NtInfo *NtdllInfo, struct Syscalls *SyscallTable)", "source.functions[3]": "RVAtoRawOffset(DWORD_PTR RVA, PIMAGE_SECTION_HEADER section)" }, "ct": [ "CreateFileA", "GetFileSize", "GetProcessHeap", "HeapAlloc", "IMAGE_FIRST_SECTION", "RVAtoRawOffset", "ReadFile", "VirtualProtect", "memcpy", "strcmp", "strncmp" ], "id": "c", "mc": [ "NtdllInfo.lpRawData", "NtdllInfo.pExprtDir", "NtdllInfo.pRdataSection", "NtdllInfo.pTextSection", "SyscallTable.NtAllocateVirtualMemory", "SyscallTable.NtProtectVirtualMemory", "dosHeader.e_lfanew", "exportDirectory.AddressOfFunctions", "exportDirectory.AddressOfNames", "exportDirectory.NumberOfNames", "imageNTHeaders.FileHeader", "imageNTHeaders.FileHeader.NumberOfSections", "imageNTHeaders.OptionalHeader", "imageNTHeaders.OptionalHeader.DataDirectory", "section.Name", "section.PointerToRawData", "section.VirtualAddress" ] }, "id": 0, "sz": 3529, "ts": [ { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "928" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "Parse export function table", "e": [ "AddressOfFunctions" ], "i": "micro-behaviors/os/api-resolution/manual::export-function-table", "l": 3 }, { "c": 0.800000011920929, "d": "PE PointerToRawData reference", "e": [ "PointerToRawData" ], "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-pointerraw", "l": 1 }, { "c": 0.800000011920929, "d": "PE VirtualAddress reference", "e": [ "VirtualAddress" ], "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-virtualaddr", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "Parse export name table", "e": [ "AddressOfNames" ], "i": "micro-behaviors/os/api-resolution/manual::export-name-table", "l": 3 }, { "c": 0.800000011920929, "d": "PE NumberOfSections reference", "e": [ "NumberOfSections" ], "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-sections", "l": 1 }, { "c": 0.8500000238418579, "d": "Inline assembly with direct syscall", "e": [ "syscall" ], "i": "objectives/evasion/kernel-hide/lkm/internals::asm-syscall-invocation", "l": 3 }, { "a": "T1055", "c": 0.8999999761581421, "d": "PAGE_EXECUTE_READWRITE flag", "e": [ "PAGE_EXECUTE_READWRITE" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021", "el": [ "534" ] }, { "c": 0.949999988079071, "d": "Winternl header include", "e": [ "#include \u003cwinternl.h\u003e" ], "i": "metadata/lang/source::winternl-include", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1, "el": [ "534" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "PAGE_EXECUTE_READ allocation", "e": [ "PAGE_EXECUTE_READ" ], "i": "objectives/evasion/process/injection/memory::page-execute-read", "l": 1, "m": "E1055" }, { "c": 0.800000011920929, "d": "Source references PE section layout fields", "e": [ "PointerToRawData", "NumberOfSections", "VirtualAddress" ], "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout", "l": 2 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "\u003cbinary data\u003e \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2, "el": [ "offset:1544" ] } ], "sha": "7cf6ed9d158aa5ffef272ffb57f353bdbcc42787c1739d30e6565e7dbd55ad68", "path": "syscalls.c", "type": "c" } ], "tv": "8e9ac" } }