{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 }, { "id": 1, "prob": 0.762150764465332, "class": 0 }, { "id": 2, "prob": 0.7540042400360107, "class": 0 } ], "prob": 0.9815004, "class": 1, "oprob": 0.9163599, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T07:00:07Z" }, "path": "89209", "raw": { "v": "4", "fs": [ { "f": "K₂O₁₀(As₉C₅AlCoEr₄I₂LaP₃S₅Xe)H₆(F₃Os₄Po₆Cm₃DbDs)Md₅(Bi₇BkPa)", "x": 62, "id": 0, "is": [ "ORDINAL 9", "ORDINAL 2", "SendMessageA", "SetTimer", "DialogBoxParamW", "DialogBoxParamA", "SetWindowLongA", "GetWindowLongA", "SetWindowTextW", "LoadIconA", "LoadStringW", "LoadStringA", "CharUpperW", "CharUpperA", "DestroyWindow", "EndDialog", "PostMessageA", "ShowWindow", "MessageBoxW", "GetDlgItem", "KillTimer", "SetWindowTextA", "ShellExecuteExA", "GetStringTypeW", "GetStringTypeA", "LCMapStringW", "LCMapStringA", "InterlockedIncrement", "InterlockedDecrement", "GetProcAddress", "GetOEMCP", "GetACP", "GetCPInfo", "IsBadCodePtr", "IsBadReadPtr", "GetFileType", "SetHandleCount", "GetEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "FreeEnvironmentStringsA", "UnhandledExceptionFilter", "HeapSize", "GetCurrentProcess", "TerminateProcess", "IsBadWritePtr", "HeapCreate", "HeapDestroy", "GetEnvironmentVariableA", "SetUnhandledExceptionFilter", "TlsAlloc", "ExitProcess", "GetVersion", "GetCommandLineA", "GetStartupInfoA", "GetModuleHandleA", "WaitForSingleObject", "CloseHandle", "CreateProcessA", "SetCurrentDirectoryA", "GetCommandLineW", "GetVersionExA", "LeaveCriticalSection", "EnterCriticalSection", "DeleteCriticalSection", "MultiByteToWideChar", "WideCharToMultiByte", "GetLastError", "LoadLibraryA", "AreFileApisANSI", "GetModuleFileNameA", "GetModuleFileNameW", "LocalFree", "FormatMessageA", "FormatMessageW", "GetWindowsDirectoryA", "SetFileTime", "CreateFileW", "SetLastError", "SetFileAttributesA", "RemoveDirectoryA", "SetFileAttributesW", "RemoveDirectoryW", "CreateDirectoryA", "CreateDirectoryW", "DeleteFileA", "DeleteFileW", "lstrlenA", "GetFullPathNameA", "GetFullPathNameW", "GetCurrentDirectoryA", "GetTempPathA", "GetTempFileNameA", "FindClose", "FindFirstFileA", "FindFirstFileW", "FindNextFileA", "CreateFileA", "GetFileSize", "SetFilePointer", "ReadFile", "WriteFile", "SetEndOfFile", "GetStdHandle", "WaitForMultipleObjects", "Sleep", "VirtualAlloc", "VirtualFree", "CreateEventA", "SetEvent", "ResetEvent", "InitializeCriticalSection", "RtlUnwind", "RaiseException", "HeapAlloc", "HeapFree", "HeapReAlloc", "CreateThread", "GetCurrentThreadId", "TlsSetValue", "TlsGetValue", "ExitThread" ], "ms": { "pe": { "machine": 332.0, "checksum": 153019.0, "rsrc_size": 4096.0, "subsystem": 2.0, "timestamp": 1290097655.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.89, "entry_section": ".text", "size_of_image": 163840.0, "timestamp_day": 18.0, "file_alignment": 512.0, "resource_count": 6.0, "timestamp_year": 2010.0, "characteristics": 271.0, "entry_point_rva": 84740.0, "size_of_headers": 1024.0, "timestamp_month": 11.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 4.0, "manifest_present": true, "checksum_mismatch": true, "computed_checksum": 608850.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "rich_header_present": true, "linker_major_version": 6.0, "version_info_present": true, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 104960.0, "file_size": 565011.0, "entry_point": 84740.0, "has_overlay": true, "code_entropy": 6.61, "data_entropy": 1.92, "import_count": 122.0, "overlay_size": 423699.0, "string_count": 1207.0, "overlay_ratio": 0.75, "section_count": 5.0, "avg_complexity": 7.04, "function_count": 224.0, "import_density": 1.19, "max_complexity": 47.0, "string_density": 11.78, "overall_entropy": 3.45, "overlay_entropy": 6.59, "avg_basic_blocks": 11.17, "avg_section_size": 28057.6, "dependency_count": 4.0, "entropy_variance": 2.41, "function_density": 2.19, "avg_function_size": 194.02, "avg_string_length": 45.47, "complexity_per_kb": 0.07, "max_string_length": 6543.0, "wide_string_count": 190.0, "writable_sections": 2.0, "avg_string_entropy": 3.49, "code_to_data_ratio": 2.97, "data_to_file_ratio": 0.02, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.19, "total_basic_blocks": 2503.0, "embedded_file_count": 2.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 213.85, "embedded_binary_count": 2.0, "largest_section_ratio": 0.19, "sentence_string_count": 324.0, "sentence_string_ratio": 0.27, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "Rich" ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".sxdata" ], [ 640, ".rsrc" ], [ 3195, "PSSSSSS" ], [ 4227, "QSVW" ], [ 5276, "QQVW" ], [ 10672, "QQSV" ], [ 11836, "FSWF" ], [ 11946, "QQS3" ], [ 12111, "QSUVW" ], [ 13706, "SVW3" ], [ 13759, "AABB" ], [ 14512, "5P1B" ], [ 15101, "PPRPQPh" ], [ 15883, "f98t" ], [ 17107, "f99t" ], [ 21960, "t09u" ], [ 22067, "5D1B" ], [ 24041, "FXQWP" ], [ 24586, "FHPPQ" ], [ 27570, "RPSV" ], [ 28084, "t\\IItEIt2IIt!It" ], [ 31347, "VVVVP" ], [ 32012, "QQSV3" ], [ 36080, "SHVH" ], [ 42368, "G 90" ], [ 46121, "VRQW" ], [ 49658, "QQSVW" ], [ 59674, "QQSUV" ], [ 72371, "SUVW" ], [ 76481, "4SVW" ], [ 78725, "54ZB" ], [ 81458, "SVWU" ], [ 81699, "XSVW" ], [ 83791, "YYPW" ], [ 91909, "PSSW" ], [ 96443, "HSVHWtgHHtF" ], [ 98752, "FGQPS" ], [ 106773, "15.23.35.193:105" ], [ 108648, "__GLOBAL_HEAP_SELECTED" ], [ 108672, "__MSVCRT_HEAP_SELECT" ], [ 108744, "runtime error" ], [ 108764, "TLOSS error" ], [ 108780, "SING error" ], [ 108796, "DOMAIN error" ], [ 108812, "R6028\r\n- unable to initialize heap" ], [ 108819, "- unable to initialize heap" ], [ 108852, "R6027\r\n- not enough space for lowio initialization" ], [ 108859, "- not enough space for lowio initialization" ], [ 108908, "R6026\r\n- not enough space for stdio initialization" ], [ 108915, "- not enough space for stdio initialization" ], [ 108964, "R6025\r\n- pure virtual function call" ], [ 108971, "- pure virtual function call" ], [ 109004, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 109011, "- not enough space for _onexit/atexit table" ], [ 109060, "R6019\r\n- unable to open console device" ], [ 109067, "- unable to open console device" ], [ 109104, "R6018\r\n- unexpected heap error" ], [ 109111, "- unexpected heap error" ], [ 109140, "R6017\r\n- unexpected multithread lock error" ], [ 109147, "- unexpected multithread lock error" ], [ 109188, "R6016\r\n- not enough space for thread data" ], [ 109195, "- not enough space for thread data" ], [ 109232, "abnormal program termination" ], [ 109268, "R6009\r\n- not enough space for environment" ], [ 109275, "- not enough space for environment" ], [ 109312, "R6008\r\n- not enough space for arguments" ], [ 109319, "- not enough space for arguments" ], [ 109356, "R6002\r\n- floating point not loaded" ], [ 109363, "- floating point not loaded" ], [ 109396, "Microsoft Visual C++ Runtime Library" ], [ 109440, "Runtime Error!\n\nProgram:" ], [ 109472, "\u003cprogram name unknown\u003e" ], [ 109496, "GetLastActivePopup" ], [ 109516, "GetActiveWindow" ], [ 109532, "MessageBoxA" ], [ 109544, "user32.dll" ], [ 109612, "dddd, MMMM dd, yyyy" ], [ 109648, "December" ], [ 109660, "November" ], [ 109672, "October" ], [ 109680, "September" ], [ 109692, "August" ], [ 109700, "July" ], [ 109708, "June" ], [ 109716, "April" ], [ 109724, "March" ], [ 109732, "February" ], [ 109744, "January" ], [ 109800, "Saturday" ], [ 109812, "Friday" ], [ 109820, "Thursday" ], [ 109832, "Wednesday" ], [ 109844, "Tuesday" ], [ 109852, "Monday" ], [ 109860, "Sunday" ], [ 109896, "SunMonTueWedThuFriSat" ], [ 109920, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 121408, "OLEAUT32.dll" ], [ 121424, "MessageBoxW" ], [ 121438, "ShowWindow" ], [ 121452, "PostMessageA" ], [ 121468, "EndDialog" ], [ 121480, "DestroyWindow" ], [ 121496, "CharUpperA" ], [ 121510, "CharUpperW" ], [ 121524, "LoadStringA" ], [ 121538, "LoadStringW" ], [ 121552, "SetWindowTextA" ], [ 121570, "SetWindowTextW" ], [ 121588, "GetWindowLongA" ], [ 121606, "SetWindowLongA" ], [ 121624, "DialogBoxParamA" ], [ 121642, "DialogBoxParamW" ], [ 121660, "SetTimer" ], [ 121672, "SendMessageA" ], [ 121714, "KillTimer" ], [ 121724, "USER32.dll" ], [ 121738, "ShellExecuteExA" ], [ 121754, "SHELL32.dll" ], [ 121768, "WaitForSingleObject" ], [ 121790, "CloseHandle" ], [ 121804, "CreateProcessA" ], [ 121822, "SetCurrentDirectoryA" ], [ 121846, "GetCommandLineW" ], [ 121864, "GetVersionExA" ], [ 121880, "LeaveCriticalSection" ], [ 121904, "EnterCriticalSection" ], [ 121928, "DeleteCriticalSection" ], [ 121952, "MultiByteToWideChar" ], [ 121974, "WideCharToMultiByte" ], [ 121996, "GetLastError" ], [ 122012, "LoadLibraryA" ], [ 122028, "AreFileApisANSI" ], [ 122046, "GetModuleFileNameA" ], [ 122068, "GetModuleFileNameW" ], [ 122090, "LocalFree" ], [ 122102, "FormatMessageA" ], [ 122120, "FormatMessageW" ], [ 122138, "GetWindowsDirectoryA" ], [ 122162, "SetFileTime" ], [ 122176, "CreateFileW" ], [ 122190, "SetLastError" ], [ 122206, "SetFileAttributesA" ], [ 122228, "RemoveDirectoryA" ], [ 122248, "SetFileAttributesW" ], [ 122270, "RemoveDirectoryW" ], [ 122290, "CreateDirectoryA" ], [ 122310, "CreateDirectoryW" ], [ 122330, "DeleteFileA" ], [ 122344, "DeleteFileW" ], [ 122358, "lstrlenA" ], [ 122370, "GetFullPathNameA" ], [ 122390, "GetFullPathNameW" ], [ 122410, "GetCurrentDirectoryA" ], [ 122434, "GetTempPathA" ], [ 122450, "GetTempFileNameA" ], [ 122470, "FindClose" ], [ 122482, "FindFirstFileA" ], [ 122500, "FindFirstFileW" ], [ 122518, "FindNextFileA" ], [ 122534, "CreateFileA" ], [ 122548, "GetFileSize" ], [ 122562, "SetFilePointer" ], [ 122580, "ReadFile" ], [ 122592, "WriteFile" ], [ 122604, "SetEndOfFile" ], [ 122620, "GetStdHandle" ], [ 122636, "WaitForMultipleObjects" ], [ 122662, "Sleep" ], [ 122670, "VirtualAlloc" ], [ 122686, "VirtualFree" ], [ 122700, "CreateEventA" ], [ 122716, "SetEvent" ], [ 122728, "ResetEvent" ], [ 122742, "InitializeCriticalSection" ], [ 122770, "RtlUnwind" ], [ 122782, "RaiseException" ], [ 122800, "HeapAlloc" ], [ 122812, "HeapFree" ], [ 122824, "HeapReAlloc" ], [ 122838, "CreateThread" ], [ 122854, "GetCurrentThreadId" ], [ 122876, "TlsSetValue" ], [ 122890, "TlsGetValue" ], [ 122904, "ExitThread" ], [ 122918, "GetModuleHandleA" ], [ 122938, "GetStartupInfoA" ], [ 122956, "GetCommandLineA" ], [ 122974, "GetVersion" ], [ 122988, "ExitProcess" ], [ 123002, "TlsAlloc" ], [ 123014, "SetUnhandledExceptionFilter" ], [ 123044, "GetEnvironmentVariableA" ], [ 123070, "HeapDestroy" ], [ 123084, "HeapCreate" ], [ 123098, "IsBadWritePtr" ], [ 123114, "TerminateProcess" ], [ 123134, "GetCurrentProcess" ], [ 123154, "HeapSize" ], [ 123166, "UnhandledExceptionFilter" ], [ 123194, "FreeEnvironmentStringsA" ], [ 123220, "FreeEnvironmentStringsW" ], [ 123246, "GetEnvironmentStrings" ], [ 123270, "GetEnvironmentStringsW" ], [ 123296, "SetHandleCount" ], [ 123314, "GetFileType" ], [ 123328, "IsBadReadPtr" ], [ 123344, "IsBadCodePtr" ], [ 123360, "GetCPInfo" ], [ 123382, "GetOEMCP" ], [ 123394, "GetProcAddress" ], [ 123412, "InterlockedDecrement" ], [ 123436, "InterlockedIncrement" ], [ 123460, "LCMapStringA" ], [ 123476, "LCMapStringW" ], [ 123492, "GetStringTypeA" ], [ 123510, "GetStringTypeW" ], [ 123526, "KERNEL32.dll" ], [ 124004, ",!@Install@!UTF-8!" ], [ 124024, ",!@InstallEnd@!" ], [ 124064, "wide", "Can not find setup.exe" ], [ 124112, "wide", "setup.exe" ], [ 124132, "wide", "Can not open file" ], [ 124168, "wide", "Can not load codecs" ], [ 124208, "wide", "Can not create temp folder archive" ], [ 124280, "wide", "ExecuteParameters" ], [ 124316, "wide", "ExecuteFile" ], [ 124340, "wide", "RunProgram" ], [ 124364, "wide", "Directory" ], [ 124392, "wide", "Progress" ], [ 124412, "wide", "BeginPrompt" ], [ 124436, "wide", "Title" ], [ 124448, "wide", "Config failed" ], [ 124484, "wide", "Can't load config info" ], [ 124550, "wide", "BUnsupported Method" ], [ 124592, "wide", "Can not open output file" ], [ 124644, "wide", "Can not delete output file" ], [ 124706, "wide", "BCan not open the file as archive" ], [ 124776, "wide", "Can not find archive file" ], [ 124828, "wide", "Default" ], [ 124912, ".?AVCNewException@@" ], [ 125028, "out of memory" ], [ 125056, ".?AUCSystemException@@" ], [ 125088, ".?AUCInBufferException@@" ], [ 125128, ".?AUCOutBufferException@@" ], [ 125164, "wide", "Unknown error" ], [ 125208, "wide", "Are you sure you want to cancel?" ], [ 125296, ".?AVCInArchiveException@N7z@NArchive@@" ], [ 125424, "wide", "BCJ2" ], [ 125512, "wide", "Copy" ], [ 125568, "wide", "LZMA2" ], [ 125624, "wide", "LZMA" ] ], "sz": 565011, "ts": [ { "c": 0.8999999761581421, "d": "Tiny JavaScript sidecar loader", "e": [ "text.total_lines = 1.00" ], "i": "objectives/supply-chain/hidden-payload/encoding::tiny-loader-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 511.00" ], "i": "metadata/package/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "d": "JSON.stringify call", "e": [ "JSON.stringify" ], "i": "micro-behaviors/data/serialize/json::json-stringify-call", "l": 2 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "89209##plain@0x24ba2" ], "i": "objectives/supply-chain/metadata-anomaly/markers/npm::small-file-5k", "l": 1 }, { "a": "T1195.002", "c": 0.9700000286102295, "d": "Empty catch hides loader errors", "e": [ "catch(e){}" ], "i": "objectives/supply-chain/trojanized/library::swallowed-loader-errors", "l": 1 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Top-level try/catch empty handler", "e": [ "catch(e){}" ], "i": "objectives/supply-chain/install-hook/dropper::top-level-try-catch-empty", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "javascript code embedded in string", "e": [ "Detected javascript at offset 0x24ba2" ], "i": "metadata/lang/embedded::javascript", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "Embedded PE binary at file offset 0x2942a (~204800 bytes)", "e": [ "kind=Pe32 estimated_size=204800", "kind=Pe32 estimated_size=241664" ], "i": "binary/embedded/pe", "l": 3 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "SQLite extension", "e": [ ".sqlite", ".sqlite", ".sqlite", ".sqlite", ".sqlite" ], "i": "objectives/collection/file-targeting/filter::sqlite-extension", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1207.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.8500000238418579, "d": "File API ANSI check", "e": [ "AreFileApisANSI" ], "i": "micro-behaviors/os/env/access::are-file-apis-ansi", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "Unknown command '%s'", "CExecuteProgram::Start: empty command", "CGlobalContext::ExecuteCommands: no commands to execute (%d)", "CGlobalContext::ExecuteCommands: %d commands to execute", "CGlobalContext::OnQuestion: Execution command-list '%s' not-found or empty" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.27" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration", "e": [ "FindFirstFileW" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box", "e": [ "DialogBoxParamW" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetModuleFileNameExA dynamic resolve", "e": [ "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::get-module-filename-ex-string", "l": 1 }, { "c": 1.0, "d": "Makefile all target", "e": [ "DllInstall: : exit: C:%d" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "d": "USERNAME environment variable", "e": [ "USERNAME" ], "i": "micro-behaviors/os/env/vars/user-info::username-var", "l": 2 }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "WAdvapi32.dll", "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4096.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 423699.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 12800)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Principal", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "d": "INSERT INTO SQL keyword", "e": [ "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "c": 0.9399999976158142, "d": "7-Zip BCJ2 method string", "e": [ "BCJ2" ], "i": "metadata/binary/installer/sfx::7zip-bcj2-method", "l": 1 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "urlmon library reference", "e": [ "urlmon.dll" ], "i": "micro-behaviors/communications/http/get::urlmon-dll-reference", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 122.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…ssembly\u003ePADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "a": "T1546.015", "c": 0.949999988079071, "d": "Executable path in TypeLib redirection", "e": [ "i:\\\"\\\" Zc.dll" ], "i": "objectives/persistence/system/registry/com-hijack::typelib-executable-path", "l": 1 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.04" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requests highest available privileges", "e": [ "\u003crequestedExecutionLevel level=\"highestAvailable" ], "i": "micro-behaviors/os/privilege/manifest::highest-available", "l": 3 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "FireFox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 1.0, "d": ".js extension", "e": [ "\"meI.js\"" ], "i": "objectives/command-and-control/dropper/builder::js-ext", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadWritePtr anti-debug style probe", "e": [ "IsBadWritePtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-write-ptr", "l": 1, "m": "B0001" }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "crxdrop.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (romChar)", "e": [ "…(c);if(128\u003ed)b+=String.fromCharCode(d),", "…=(f\u00263)\u003c\u003c6|g,b=b+String.fromCharCode(d\u003c\u003c2|e\u003e\u003e4);64!=f\u0026\u00260…", "…(c);if(128\u003ed)b+=String.fromCharCode(d),c++;else if(191\u003c…", "…CodeAt(c+2),b=b+String.fromCharCode((d\u002615)\u003c\u003c12|(e\u002663)\u003c\u003c…", "…CodeAt(c+1),b=b+String.fromCharCode((d\u002631)\u003c\u003c6|e\u002663),c=c…", "…64!=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003ci\u0026\u0026(b+…", "…64!=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003cj\u0026\u0026", "(b+=String.fromCharCode(j))}return this._ut…", "…64!=g\u0026\u00260\u003ci\u0026\u0026(b+=String.fromCharCode(i))}return this._ut…" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-romchar", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Can not delete output file", "Can not open output file" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.49" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "d": "CREATE TABLE SQL keyword", "e": [ "CREATE TABLE", "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-create-table", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SECURITY", "REGISTRY", "JPICONFDATA", "BOOTSTRAP", "USERPROFILE", "USERNAME" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.45" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "d": "DELETE FROM SQL keyword", "e": [ "delete from" ], "i": "micro-behaviors/data/db/conn/sql::sql-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 565011.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8399999737739563, "d": "ATL ForceRemove registry directive", "e": [ "ForceRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-forceremove-directive", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 163840.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "FbiRat keylogger output filename", "e": [ "log.txt" ], "i": "well-known/malware/rat/fbirat::keylog-output-file", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "7z SFX installer config marker", "e": [ "…XPADDINGPADDINGXXPADDING;!@Install@!UTF-8!" ], "i": "objectives/anti-static/obfuscation/binary-metrics::7zsfx-config-marker", "l": 1, "m": "B0032" }, { "a": "T1059.003", "c": 0.8999999761581421, "d": "ShellExecuteExA ANSI extended API", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/system::shell-execute-ex-a", "l": 3, "m": "E1059.003" }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT * FROM", "SELECT url,scode,epoch FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e", "TODO: \u003cProduct name\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.699999988079071, "d": "Set window title/text", "e": [ "SetWindowTextW" ], "i": "micro-behaviors/ui/window/manage::set-window-text", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1207.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Two or more embedded PE headers", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::multiple-pe-embedded", "l": 1 }, { "d": "USERPROFILE environment variable", "e": [ "USERPROFILE" ], "i": "micro-behaviors/os/env/vars/user-info::userprofile-var", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.9950000047683716, "d": "japproxy sync C2 URL", "e": [ "…jsHrdw7rHrEpdnMgNr0rn==;http://japproxy.net/sync/?q=hfZ9ojYGqchEAen0pjn7tMqL…" ], "i": "well-known/malware/trojan/elex/dropper::japproxy-sync-c2", "l": 4 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4e", "40", "40", "47", "46", "4a", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 2503.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "GetFolder", "GetFolder", "GetFolder", "GetFolder", "GetFolder", "GetFolder" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadReadPtr anti-debug style probe", "e": [ "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-read-ptr", "l": 1, "m": "B0001" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 565011.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (Unicode)", "e": [ "RemoveDirectoryW" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-w", "l": 2 }, { "c": 0.8399999737739563, "d": "ATL NoRemove registry directive", "e": [ "NoRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-noremove-directive", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform", "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetProcessImageFileNameA dynamic resolve", "e": [ "GetProcessImageFileNameA" ], "i": "micro-behaviors/process/enumerate/psapi::get-process-image-filename-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.45" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA", "CExecuteProgram::Start: CreateProcess E:0x%0x" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Port 80 (HTTP)", "e": [ ":80" ], "i": "objectives/command-and-control/infrastructure/ip::port-80", "l": 1, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.75" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.9399999976158142, "d": "7-Zip LZMA2 method string", "e": [ "LZMA2" ], "i": "metadata/binary/installer/sfx::7zip-lzma2-method", "l": 1 }, { "c": 0.9800000190734863, "d": "zycript custom alphabet", "e": [ "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/", "….url})}},zycript={xlat:\"abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/\",decode:function(a){for…", "….url})}},zycript={xlat:\"abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/\"," ], "i": "well-known/malware/trojan/elex/dropper::zycript-custom-alphabet", "l": 4 }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 122.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1562.001", "c": 0.9800000190734863, "d": "AMSI scan buffer memory patch bytes (E_INVALIDARG)", "e": [ "b8 57 00 07 80 c3", "b8 57 00 07 80 c3" ], "i": "objectives/evasion/anti-av/platform::amsi-memory-patch-hex-bytes", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "open the file as archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "JavaScript function keyword in non-code file", "e": [ "function include(", "function loadIntoWindow(", "function unloadFromWindow(", "function startup(", "function shutdown(", "function install(", "function uninstall(" ], "i": "objectives/anti-static/obfuscation/payload::js-function-in-noncode", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "String.fromCharCode fragment (CharCode)", "e": [ "…=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003ci\u0026\u0026(b+=Str…", "…;if(128\u003ed)b+=String.fromCharCode(d),c++;else if(191\u003cd\u0026\u00262…", "…=f\u0026\u00260\u003ch\u0026\u0026(b+=String.fromCharCode(h));64!=g\u0026\u00260\u003cj\u0026\u0026", "…eAt(c+1),b=b+String.fromCharCode((d\u002631)\u003c\u003c6|e\u002663),c=c+2;e…", "(b+=String.fromCharCode(j))}return this._utf8_d…", "…\u00263)\u003c\u003c6|g,b=b+String.fromCharCode(d\u003c\u003c2|e\u003e\u003e4);64!=f\u0026\u00260\u003ch\u0026\u0026…", "…;if(128\u003ed)b+=String.fromCharCode(d),", "…eAt(c+2),b=b+String.fromCharCode((d\u002615)\u003c\u003c12|(e\u002663)\u003c\u003c6|f\u0026…", "…=g\u0026\u00260\u003ci\u0026\u0026(b+=String.fromCharCode(i))}return this._utf8_d…" ], "i": "objectives/execution/interpreter/script/wsh-fragments::from-char-code-fragment-charcode", "l": 1 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.30000001192092896, "d": "lzma compression reference", "e": [ "LZMA" ], "i": "micro-behaviors/dylib/library::lzma-ref", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.61)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "a": "T1005", "c": 0.550000011920929, "d": "Generic database extension", "e": [ ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db", ".db" ], "i": "objectives/collection/file-targeting/filter::db-extension", "l": 1, "m": "B0024" }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://syncerjpi.com/", "http://syncerjpi.com/", "http://safesaver.net/" ], "i": "objectives/command-and-control/infrastructure/domain::http-url-binary", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Set file attributes (Unicode)", "e": [ "SetFileAttributesW" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-w", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1290097655.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.4000000059604645, "d": "HKLM registry hive reference", "e": [ "HKLM" ], "i": "micro-behaviors/os/registry/access::hklm-hive", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 423699.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.75" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1218.010", "c": 0.800000011920929, "d": "Executes regsvr32.exe", "e": [ "regsvr32.exe" ], "i": "micro-behaviors/process/create/tool::regsvr32", "l": 3, "m": "E1218.010" }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableA" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "SetCurrentDirectoryA", "MultiByteToWideChar", "WideCharToMultiByte", "GetModuleFileNameA", "GetModuleFileNameW", "GetWindowsDirectoryA", "GetCurrentDirectoryA", "InitializeCriticalSection", "SetUnhandledExceptionFilter", "GetEnvironmentVariableA", "UnhandledExceptionFilter", "InterlockedDecrement", "InterlockedIncrement", "GenuineIntelAuthenticAMDCentaurHauls" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 224.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "….working=1,this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",a,!…" ], "i": "micro-behaviors/communications/http/request::xmlhttprequest-word", "l": 3 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1207.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.8500000238418579, "d": "PE contains 2+ embedded PE binaries", "e": [ "binary.embedded_binary_count = 2.00" ], "i": "metadata/binary/metrics::embedded-pe-multi", "l": 3 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 423699.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "c": 1.0, "d": "Compatibility alias", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex-a", "l": 1 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "e4 b1 41 00", "b0 b0 41 00", "1c b1 41 00", "20 b1 41 00", "30 b1 41 00", "b0 b0 41 00", "6c b0 41 00", "24 b0 41 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{924C3DC2-8E4E-432E-F973-9A2174A39774}", "{D3922CA7-1E0D-9F51-AAA1-47FC43EEE0CF}", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "15.23.35.193:105" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "NetUserEnum remote user enumeration", "e": [ "NetUserEnum" ], "i": "micro-behaviors/os/service/remote::net-user-enum-source", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links USER32.dll (SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, ... +15 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, ... +94 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 9, ORDINAL 2)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteExA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "a": "T1057", "c": 0.8799999952316284, "d": "Dynamic PSAPI API resolution strings", "e": [ "PSAPI", "GetProcessImageFileNameA", "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dynamic-resolve", "l": 3 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 122.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindNextFileA", "FindFirstFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "a": "T1070.006", "c": 0.8500000238418579, "d": "File timestamp modification with file operations", "e": [ "GetModuleFileNameA", "CreateFileW", "CreateFileA", "FindFirstFileW", "SetFileTime", "WriteFile", "GetModuleFileNameW" ], "i": "objectives/evasion/indicator-removal/timestamps::timestomp-with-file-copy", "l": 2, "m": "F0006" }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathA", "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileW", "CreateFileA", "GetFileSize", "ReadFile", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "ProductVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.9800000190734863, "d": "7-Zip self-extracting archive profile", "e": [ "BCJ2", "LZMA2" ], "i": "metadata/binary/installer/sfx::7zip-sfx-archive-profile", "l": 3 }, { "d": "SQL statement keywords", "e": [ "SELECT * FROM", "delete from", "CREATE TABLE", "SELECT url,scode,epoch FROM", "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "GetModuleFileNameA", "GetModuleFileNameW", "DeleteFileW", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1548.002", "c": 0.8500000238418579, "d": "Admin manifest with network activity", "e": [ "\u003crequestedExecutionLevel level=\"highestAvailable", "….working=1,this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",a,!…" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass/manifest::admin-manifest-network", "l": 2 }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegOpenKeyExA", "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "CreateFileA", "GetFileSize", "binary.has_overlay = 1.00", "CreateFileW", "GetModuleFileNameA", "ReadFile" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "}},syncer={url:\"http://syncjpionline.co. \u003curl\u003e", "domWindow.eval('gBrowser.selectedTab = g \u003curl\u003e", "c.readyState?c.onreadystatechange=functi \u003curl\u003e", "UninstallCommands=\"IE.Uninstall;LaunchBr \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3 } ], "sha": "7d409903de504884a7d9ebd446dbbd493e440fd7bc5374284e33e32877e677b4", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/89209", "type": "pe" }, { "f": "KO₇(C₄Er₆AlAs₉IP₂S)H₅(FPo₂Cm₄DbDs)Md₂(Bi₂)", "x": 52, "dp": 1, "id": 1, "is": [ "DisableThreadLibraryCalls", "DeleteCriticalSection", "RaiseException", "InitializeCriticalSection", "InterlockedIncrement", "InterlockedDecrement", "EnterCriticalSection", "LeaveCriticalSection", "LockResource", "FindResourceExW", "MoveFileExW", "DeleteFileW", "HeapFree", "GetProcessHeap", "HeapAlloc", "HeapReAlloc", "GetPrivateProfileStringW", "GetPrivateProfileIntW", "LoadLibraryW", "CreateDirectoryW", "CloseHandle", "GetProcAddress", "OpenMutexW", "SetEndOfFile", "SetFilePointer", "CreateFileW", "FlushFileBuffers", "WriteFile", "GetSystemTimeAsFileTime", "WaitForSingleObject", "ReleaseMutex", "UnmapViewOfFile", "MapViewOfFile", "OpenFileMappingW", "GetCurrentProcessId", "WritePrivateProfileSectionW", "WritePrivateProfileStringW", "CreateFileA", "WriteConsoleW", "lstrcmpiW", "LoadLibraryExW", "FindResourceW", "LoadResource", "SizeofResource", "MultiByteToWideChar", "FreeLibrary", "GetLastError", "lstrlenW", "GetModuleFileNameW", "CreateMutexW", "GetModuleHandleW", "GetConsoleOutputCP", "WriteConsoleA", "SetStdHandle", "LCMapStringW", "LCMapStringA", "GetStringTypeW", "GetStringTypeA", "GetConsoleMode", "GetConsoleCP", "GetLocaleInfoA", "LoadLibraryA", "InitializeCriticalSectionAndSpinCount", "IsValidCodePage", "GetOEMCP", "GetACP", "GetCPInfo", "GetTickCount", "QueryPerformanceCounter", "GetEnvironmentStringsW", "WideCharToMultiByte", "FreeEnvironmentStringsW", "HeapDestroy", "HeapSize", "RtlUnwind", "GetCurrentThreadId", "GetCommandLineA", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "TlsGetValue", "TlsAlloc", "TlsSetValue", "TlsFree", "SetLastError", "HeapCreate", "VirtualFree", "VirtualAlloc", "GetStdHandle", "GetModuleFileNameA", "Sleep", "ExitProcess", "SetHandleCount", "GetFileType", "GetStartupInfoA", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "CharNextW", "TranslateMessage", "GetMessageW", "DispatchMessageW", "InitializeSecurityDescriptor", "SetSecurityDescriptorDacl", "RegQueryInfoKeyW", "RegSetValueExW", "RegEnumKeyExW", "RegOpenKeyExW", "RegCreateKeyExW", "RegCloseKey", "RegDeleteValueW", "RegDeleteKeyW", "IsTextUnicode", "CoTaskMemRealloc", "CoTaskMemAlloc", "CoTaskMemFree", "StringFromGUID2", "CreateBindCtx", "CoCreateInstance", "CLSIDFromString", "ORDINAL 162", "ORDINAL 6", "ORDINAL 277", "ORDINAL 2", "ORDINAL 7", "ORDINAL 161", "ORDINAL 163", "ORDINAL 4", "ORDINAL 146", "ORDINAL 8", "ORDINAL 9", "ORDINAL 149", "ORDINAL 150", "ORDINAL 186", "PathRenameExtensionW", "PathRemoveFileSpecW", "PathFileExistsW", "PathCombineW", "CreateURLMoniker" ], "ms": { "pe": { "machine": 332.0, "checksum": 236730.0, "rsrc_size": 3072.0, "subsystem": 2.0, "timestamp": 1375778411.0, "image_base": 268435456.0, "rsrc_entropy": 5.32, "entry_section": ".text", "size_of_image": 204800.0, "timestamp_day": 6.0, "file_alignment": 512.0, "resource_count": 4.0, "timestamp_year": 2013.0, "characteristics": 8450.0, "entry_point_rva": 79650.0, "size_of_headers": 1024.0, "timestamp_month": 8.0, "checksum_present": true, "export_timestamp": 1375778411.0, "import_dll_count": 7.0, "manifest_present": true, "checksum_mismatch": true, "computed_checksum": 242189.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 6.0, "linker_major_version": 9.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 8.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 135680.0, "file_size": 204800.0, "entry_point": 79650.0, "has_overlay": true, "code_entropy": 6.36, "data_entropy": 4.32, "export_count": 6.0, "import_count": 140.0, "overlay_size": 20480.0, "string_count": 607.0, "overlay_ratio": 0.1, "section_count": 5.0, "avg_complexity": 5.03, "function_count": 818.0, "import_density": 1.06, "max_complexity": 384.0, "string_density": 4.58, "overall_entropy": 5.07, "overlay_entropy": 6.28, "avg_basic_blocks": 7.56, "avg_section_size": 36659.2, "dependency_count": 7.0, "entropy_variance": 0.83, "function_density": 6.17, "avg_function_size": 155.23, "avg_string_length": 20.88, "complexity_per_kb": 0.04, "max_string_length": 481.0, "wide_string_count": 51.0, "writable_sections": 1.0, "avg_string_entropy": 3.24, "code_to_data_ratio": 2.85, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.66, "total_basic_blocks": 6184.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 28.63, "largest_section_ratio": 0.66, "sentence_string_count": 93.0, "sentence_string_ratio": 0.15, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "high_complexity_functions": 8.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 215, "kRichMp" ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".rsrc" ], [ 647, "@.reloc" ], [ 1297, "Rjfh" ], [ 1694, "u1jz" ], [ 3396, "4SVW" ], [ 4322, "SVWP" ], [ 65863, "QSVW" ], [ 74257, "SVW3" ], [ 74430, "f99t" ], [ 79581, "YYPV" ], [ 87786, "UVWS" ], [ 94211, "RPSW" ], [ 100421, "UQPXY]Y[" ], [ 112054, "WWWWV" ], [ 137468, "ForceRemove" ], [ 137496, "NoRemove" ], [ 137520, "wide", "Delete" ], [ 137552, "CLSID" ], [ 137564, "Component Categories" ], [ 137608, "wide", "FileType" ], [ 137628, "wide", "Interface" ], [ 137648, "Hardware" ], [ 137668, "wide", "Mime" ], [ 137688, "wide", "SECURITY" ], [ 137708, "SYSTEM" ], [ 137724, "wide", "Software" ], [ 137744, "wide", "TypeLib" ], [ 137772, "res://%s/BOOTSTRAP/BODY" ], [ 137820, "bad allocation" ], [ 137836, "wide", "settings.ini" ], [ 137924, "wide", "LULU" ], [ 137936, "wide", "LALA" ], [ 137948, "REGISTRY" ], [ 137968, "Module_Raw" ], [ 137992, "Module" ], [ 138060, "204.53.2.16:128" ], [ 138116, "104.54.2.16:128" ], [ 138152, "HKCR" ], [ 138164, "wide", "HKCU" ], [ 138176, "wide", "HKLM" ], [ 138196, "HKPD" ], [ 138232, "wide", "HKEY_CLASSES_ROOT" ], [ 138268, "wide", "HKEY_CURRENT_USER" ], [ 138304, "HKEY_LOCAL_MACHINE" ], [ 138344, "HKEY_USERS" ], [ 138368, "wide", "HKEY_PERFORMANCE_DATA" ], [ 138412, "wide", "HKEY_DYN_DATA" ], [ 138440, "wide", "HKEY_CURRENT_CONFIG" ], [ 138568, "RegDeleteKeyExW" ], [ 138582, "wide", "WAdvapi32.dll" ], [ 138584, "Advapi32.dll" ], [ 138980, "wide", "APPID" ], [ 139044, "ForceRemove" ], [ 139072, "NoRemove" ], [ 139096, "Delete" ], [ 139128, "CLSID" ], [ 139140, "Component Categories" ], [ 139184, "FileType" ], [ 139204, "Interface" ], [ 139224, "Hardware" ], [ 139244, "Mime" ], [ 139264, "SECURITY" ], [ 139284, "SYSTEM" ], [ 139300, "Software" ], [ 139320, "TypeLib" ], [ 139348, "res://%s/BOOTSTRAP/BODY" ], [ 139396, "settings.ini" ], [ 139424, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 139504, "wide", "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 139580, "bad allocation" ], [ 139608, "wide", ".tlb" ], [ 139620, "wide", "\\Implemented Categories" ], [ 139668, "wide", "\\Required Categories" ], [ 139743, "FRegisterTypeLibForUser" ], [ 139768, "OLEAUT32.DLL" ], [ 139796, ".tlb" ], [ 139808, "UnRegisterTypeLibForUser" ], [ 139884, "ForceRemove" ], [ 139912, "NoRemove" ], [ 139936, "Delete" ], [ 139968, "CLSID" ], [ 139980, "Component Categories" ], [ 140024, "FileType" ], [ 140044, "Interface" ], [ 140064, "Hardware" ], [ 140084, "Mime" ], [ 140104, "SECURITY" ], [ 140124, "SYSTEM" ], [ 140140, "Software" ], [ 140160, "TypeLib" ], [ 140188, "res://%s/BOOTSTRAP/BODY" ], [ 140236, "settings.ini" ], [ 140264, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 140344, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 140420, "bad allocation" ], [ 140448, "wide", "IEPlugin" ], [ 140468, "IEPlugin" ], [ 140488, "ieframe.dll" ], [ 140512, "IEIsProtectedModeProcess" ], [ 140540, "wide", "data" ], [ 140552, "wide", "CIEPluginConfig::GetDataDirHost IE process is running in protected mode" ], [ 140696, "wide", "shell32.dll" ], [ 140720, "SHGetKnownFolderPath" ], [ 140796, "ForceRemove" ], [ 140824, "NoRemove" ], [ 140848, "Delete" ], [ 140880, "CLSID" ], [ 140892, "Component Categories" ], [ 140936, "FileType" ], [ 140956, "Interface" ], [ 140976, "Hardware" ], [ 140996, "Mime" ], [ 141016, "SECURITY" ], [ 141036, "SYSTEM" ], [ 141052, "Software" ], [ 141072, "TypeLib" ], [ 141100, "res://%s/BOOTSTRAP/BODY" ], [ 141148, "wide", "%s%s%s%s" ], [ 141168, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 141248, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 141324, "bad allocation" ], [ 141392, "CEventLogger::LogEventV: vsprintf error %d with pszFormat='%s'" ], [ 141520, "wide", "%s:%s:%d:%08x: %.512s" ], [ 141576, "settings.ini" ], [ 141616, "JPICONFDATA" ], [ 141646, "OCIEPluginMain::Invoke[0x%08x] called" ], [ 141724, "log.txt" ], [ 141732, "LogSourceBHO" ], [ 141748, "QA-before-release" ], [ 141784, "BHO v%d.%d.%d %s" ], [ 141824, "wide", "CIEPluginMain::OnBeforeNavigate2[0x%08x]: m_nPageCounter=%d" ], [ 141944, "wide", "CIEPluginMain::OnNavigateComplete2[0x%08x]: m_nPageCounter=%d (%d)" ], [ 142080, "CIEPluginMain::OnDocumentComplete[0x%08x]: Calling ExecContentScript" ], [ 142224, "CIEPluginMain::OnDownloadBegin[0x%08x]: m_bRefresh=%d m_nObjCounter=%d m_nPageCounter=%d" ], [ 142408, "wide", "CIEPluginMain::OnDownloadComplete[0x%08x]: m_bRefresh=%d m_nObjCounter=%d {%d}" ], [ 142568, "wide", "CIEPluginMain::OnDownloadComplete[0x%08x]: Calling ExecContentScript" ], [ 142708, "wide", "bgscript" ], [ 142732, "wide", "BgScript" ], [ 142752, "wide", "LocalStorage" ], [ 142780, "res://%s/BOOTSTRAP/BODY" ], [ 142828, "contentscript" ], [ 142860, "javascript" ], [ 142896, "(null)" ], [ 143036, "ForceRemove" ], [ 143064, "NoRemove" ], [ 143088, "Delete" ], [ 143120, "CLSID" ], [ 143132, "Component Categories" ], [ 143176, "FileType" ], [ 143196, "Interface" ], [ 143216, "Hardware" ], [ 143236, "Mime" ], [ 143256, "SECURITY" ], [ 143276, "SYSTEM" ], [ 143292, "Software" ], [ 143312, "TypeLib" ], [ 143340, "res://%s/BOOTSTRAP/BODY" ], [ 143388, "settings.ini" ], [ 143416, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 143496, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 143572, "bad allocation" ], [ 143604, "wide", "modulename" ], [ 143632, "shortname" ], [ 143656, "version" ], [ 143676, "progid" ], [ 143712, "typelib" ], [ 143728, "wide", ".dat" ], [ 143740, "wide", "storage" ], [ 143756, "debugmode" ], [ 143776, "CIEPluginModule::AddCommonRGSReplacements: PluginShortName='%s'" ], [ 143904, "wide", "CIEPluginModule::AddCommonRGSReplacements: ProgID='%s'" ], [ 144016, "CIEPluginModule::AddCommonRGSReplacements: CLSID='%s'" ], [ 144124, "PLUGIN_NAME" ], [ 144148, "wide", "PLUGIN_PROGID" ], [ 144176, "wide", "PLUGIN_CLSID" ], [ 144204, "wide", "PLUGIN_VERSION" ], [ 144236, "wide", "Browser Helper Objects" ], [ 144284, "wide", "PLUGIN_REGKEY" ], [ 144356, "ForceRemove" ], [ 144384, "NoRemove" ], [ 144408, "Delete" ], [ 144440, "CLSID" ], [ 144452, "Component Categories" ], [ 144496, "FileType" ], [ 144516, "Interface" ], [ 144536, "Hardware" ], [ 144556, "Mime" ], [ 144576, "SECURITY" ], [ 144596, "SYSTEM" ], [ 144612, "Software" ], [ 144632, "TypeLib" ], [ 144660, "res://%s/BOOTSTRAP/BODY" ], [ 144708, "bad allocation" ], [ 144728, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 144808, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 144884, "settings.ini" ], [ 144924, "data" ], [ 144940, "size" ], [ 144984, "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/" ], [ 145056, "getItem" ], [ 145072, "wide", "setItem" ], [ 145088, "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/" ], [ 145160, "wide", "removeItem" ], [ 145392, "ForceRemove" ], [ 145420, "NoRemove" ], [ 145444, "Delete" ], [ 145476, "CLSID" ], [ 145488, "Component Categories" ], [ 145532, "FileType" ], [ 145552, "Interface" ], [ 145572, "Hardware" ], [ 145592, "Mime" ], [ 145612, "SECURITY" ], [ 145632, "SYSTEM" ], [ 145648, "Software" ], [ 145668, "TypeLib" ], [ 145696, "res://%s/BOOTSTRAP/BODY" ], [ 146012, "bad allocation" ], [ 146108, "bad exception" ], [ 146124, "EncodePointer" ], [ 146140, "wide", "KERNEL32.DLL" ], [ 146168, "DecodePointer" ], [ 146184, "FlsFree" ], [ 146192, "FlsSetValue" ], [ 146204, "FlsGetValue" ], [ 146216, "FlsAlloc" ], [ 146240, "Unknown exception" ], [ 146260, "runtime error " ], [ 146280, "TLOSS error" ], [ 146296, "SING error" ], [ 146312, "DOMAIN error\r\n" ], [ 146328, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 146335, "An application has made an attempt to load the C runtime library incorrectly." ], [ 146413, "Please contact the application's support team for more information." ], [ 146488, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 146495, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 146575, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 146736, "R6032\r\n- not enough space for locale information\r\n" ], [ 146743, "- not enough space for locale information" ], [ 146792, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application.\r\n" ], [ 146799, "- Attempt to initialize the CRT more than once." ], [ 146847, "This indicates a bug in your application." ], [ 146892, "R6030\r\n- CRT not initialized\r\n" ], [ 146899, "- CRT not initialized" ], [ 146924, "R6028\r\n- unable to initialize heap\r\n" ], [ 146931, "- unable to initialize heap" ], [ 146964, "R6027\r\n- not enough space for lowio initialization\r\n" ], [ 146971, "- not enough space for lowio initialization" ], [ 147020, "R6026\r\n- not enough space for stdio initialization\r\n" ], [ 147027, "- not enough space for stdio initialization" ], [ 147076, "R6025\r\n- pure virtual function call\r\n" ], [ 147083, "- pure virtual function call" ] ], "sz": 204800, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 6.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry", "e": [ "FindResourceW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 607.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 818.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.949999988079071, "d": "COM unregistration export", "e": [ "DllUnregisterServer" ], "i": "metadata/binary/symbols::export-dll-unregister-server", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-create-key-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyExW" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "l": 2 }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Locate PE resource entry with language", "e": [ "FindResourceExW" ], "i": "micro-behaviors/data/embedded/payload::find-resource-ex-w", "l": 2 }, { "c": 0.8799999952316284, "d": "ATL module RTTI markers", "e": [ "CAtlException@ATL@@", "CComModule@ATL@@", "CComModule@ATL@@", "CAtlModule@ATL@@" ], "i": "metadata/binary/framework::atl-module-rtti", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 2", "e": [ "ORDINAL 2" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-2", "l": 1, "m": "B0025" }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "InprocServer32 registry word", "e": [ "InprocServer32" ], "i": "objectives/persistence/system/registry/com::inprocserver32-word", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll", "Advapi32.dll", "WAdvapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 3072.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.75, "d": "Write INI section", "e": [ "WritePrivateProfileSectionW" ], "i": "micro-behaviors/fs/config/system::write-profile-section", "l": 3 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 6144)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.75, "d": "Write to INI config file", "e": [ "WritePrivateProfileStringW" ], "i": "micro-behaviors/fs/config/system::write-private-profile", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "UnmapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.699999988079071, "d": "Move to next character", "e": [ "CharNextW" ], "i": "micro-behaviors/ui/window/manage::char-next", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "urlmon library reference", "e": [ "urlmon.dll" ], "i": "micro-behaviors/communications/http/get::urlmon-dll-reference", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.03" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexW" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.24" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.949999988079071, "d": "COM class factory export", "e": [ "DllGetClassObject" ], "i": "metadata/binary/symbols::export-dll-get-class-object", "l": 1 }, { "c": 0.699999988079071, "d": "Dispatch window message", "e": [ "DispatchMessageW" ], "i": "micro-behaviors/ui/window/manage::dispatch-message", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SECURITY", "REGISTRY", "SECURITY", "SECURITY", "SECURITY", "JPICONFDATA", "SECURITY", "SECURITY", "SECURITY", "BOOTSTRAP" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.07" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 150", "e": [ "ORDINAL 150" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-150", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8399999737739563, "d": "ATL ForceRemove registry directive", "e": [ "ForceRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-forceremove-directive", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 204800.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "FbiRat keylogger output filename", "e": [ "log.txt" ], "i": "well-known/malware/rat/fbirat::keylog-output-file", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "c": 0.8500000238418579, "d": "OpenMutex API call", "e": [ "OpenMutexW" ], "i": "micro-behaviors/process/sync/mutex::open-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/operations::get-console-output-cp", "l": 2 }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Check file existence via SHLWAPI", "e": [ "PathFileExistsW" ], "i": "micro-behaviors/fs/path/check::path-file-exists", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.949999988079071, "d": "COM registration export", "e": [ "DllRegisterServer" ], "i": "metadata/binary/symbols::export-dll-register-server", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48", "46", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 6184.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.949999988079071, "d": "COM unload export present", "e": [ "DllCanUnloadNow" ], "i": "metadata/binary/symbols::export-dll-can-unload-now", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "COM ThreadingModel registry value", "e": [ "ThreadingModel" ], "i": "objectives/persistence/system/registry/com::threadingmodel-word", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 204800.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8399999737739563, "d": "ATL NoRemove registry directive", "e": [ "NoRemove" ], "i": "well-known/malware/trojan/shellobject/padodor::atl-noremove-directive", "l": 1 }, { "c": 0.8999999761581421, "d": "Modbus write single register frame", "e": [ "00 08" ], "i": "micro-behaviors/communications/modbus::write-single-register", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8799999952316284, "d": "Delete registry value", "e": [ "RegDeleteValueW" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExW" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.9800000190734863, "d": "zycript custom alphabet", "e": [ "abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/" ], "i": "well-known/malware/trojan/elex/dropper::zycript-custom-alphabet", "l": 4 }, { "c": 0.8500000238418579, "d": "Open named file mapping (Unicode)", "e": [ "OpenFileMappingW" ], "i": "micro-behaviors/communications/ipc/file-mapping::open-file-mapping-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 4 (connect)", "e": [ "ORDINAL 4" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API)", "e": [ "DeleteFileW" ], "i": "micro-behaviors/fs/file/delete::deletefile-w", "l": 2 }, { "c": 0.699999988079071, "d": "Read INI integer value", "e": [ "GetPrivateProfileIntW" ], "i": "micro-behaviors/fs/config/system::read-private-profile-int", "l": 2 }, { "c": 0.7599999904632568, "d": "Convert GUID to string", "e": [ "StringFromGUID2" ], "i": "micro-behaviors/os/com/invoke::string-from-guid2", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (Unicode)", "e": [ "GetMessageW" ], "i": "micro-behaviors/os/message/queue::get-message-w", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Strip filename from path", "e": [ "PathRemoveFileSpecW" ], "i": "micro-behaviors/fs/path/check::path-remove-file-spec", "l": 2 }, { "c": 0.7799999713897705, "d": "Combine filesystem paths via Shlwapi", "e": [ "PathCombineW" ], "i": "micro-behaviors/fs/path/construct::path-combine", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.36)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 818.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8799999952316284, "d": "Resolve CLSID from string", "e": [ "CLSIDFromString" ], "i": "micro-behaviors/os/com/invoke::clsid-from-string", "l": 2 }, { "c": 0.6499999761581421, "d": "Read from INI config file", "e": [ "GetPrivateProfileStringW" ], "i": "micro-behaviors/fs/config/system::read-private-profile", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 818.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1375778411.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.4000000059604645, "d": "HKLM registry hive reference", "e": [ "HKLM" ], "i": "micro-behaviors/os/registry/access::hklm-hive", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI", "e": [ "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1070.004", "c": 0.9200000166893005, "d": "Registry blob wipe API", "e": [ "RegDeleteValueW" ], "i": "objectives/evasion/self-delete/cleanup/heartbeat::reg-delete-value-wide", "l": 3, "m": "F0007" }, { "c": 0.949999988079071, "d": "ANSI GUI probe API cluster", "e": [ "GetLastActivePopup", "GetActiveWindow", "MessageBoxA" ], "i": "well-known/malware/trojan/elex/test-loader::ansi-gui-probe-cluster", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AddCommonRGSReplacements", "AddCommonRGSReplacements", "AddCommonRGSReplacements", "GetProcessWindowStation", "GetUserObjectInformationA", "SunMonTueWedThuFriSat", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetModuleFileNameW", "MultiByteToWideChar", "DisableThreadLibraryCalls", "InitializeCriticalSection", "InterlockedIncrement", "InterlockedDecrement", "GetPrivateProfileStringW", "GetPrivateProfileIntW", "GetSystemTimeAsFileTime" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 818.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz", "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "ec 30 02 10", "ec 30 02 10", "e8 30 02 10", "e8 30 02 10", "e8 30 02 10", "e8 30 02 10", "e8 30 02 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "204.53.2.16:128", "104.54.2.16:128" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.66" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "204.53.2.16:128", "104.54.2.16:128" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 818.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoTaskMemRealloc, CoTaskMemAlloc, CoTaskMemFree, StringFromGUID2, CreateBindCtx, ... +2 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 162, ORDINAL 6, ORDINAL 277, ORDINAL 2, ORDINAL 7, ... +9 more)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathRenameExtensionW, PathRemoveFileSpecW, PathFileExistsW, PathCombineW)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links urlmon.dll (CreateURLMoniker)", "e": [ "urlmon.dll" ], "i": "metadata/dylib::urlmon/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CharNextW, TranslateMessage, GetMessageW, DispatchMessageW)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (DisableThreadLibraryCalls, DeleteCriticalSection, RaiseException, InitializeCriticalSection, InterlockedIncrement, ... +94 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegQueryInfoKeyW, RegSetValueExW, RegEnumKeyExW, ... +6 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 140.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "ec 30 02 10", "GetTickCount", "e8 30 02 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.800000011920929, "d": "Reads and writes to INI configuration files", "e": [ "WritePrivateProfileStringW", "GetPrivateProfileStringW" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle", "l": 3 }, { "c": 0.800000011920929, "d": "Reads INI integers and writes config", "e": [ "WritePrivateProfileStringW", "GetPrivateProfileIntW" ], "i": "micro-behaviors/fs/config/system::ini-read-int-write-cycle", "l": 3 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "CreateMutexW", "OpenMutexW", "ExitProcess" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceW", "FindResourceExW", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileW", "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "FindResourceW", "SizeofResource", "FindResourceExW", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExW", "RegOpenKeyExW", "RegSetValueExW" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "IsDebuggerPresent", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "c": 0.949999988079071, "d": "Standard COM server export set", "e": [ "DllRegisterServer", "DllGetClassObject", "DllCanUnloadNow", "DllUnregisterServer" ], "i": "metadata/binary/symbols::standard-com-server-exports", "l": 2 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "CreateMutexW", "OpenMutexW", "SECURITY", "JPICONFDATA", "BOOTSTRAP", "REGISTRY" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "f576de09eece92ef1d3fcbbfad8b94c1c6847ee6fa3e40ad3327357dff454e7b", "path": "89209!!embedded:pe@0x2942a", "type": "pe" }, { "f": "KO₉(Er₈As₁₀I₃PrAl₂C₃PSXe)H₇(F₃Os₃Po₇UCmDbDs)Md₃(Bi₄Bk)", "x": 58, "dp": 1, "id": 2, "is": [ "GetFileVersionInfoA", "GetFileVersionInfoSizeA", "VerQueryValueA", "PathRemoveFileSpecA", "LocalFree", "lstrcpyA", "HeapReAlloc", "MoveFileExA", "SetEndOfFile", "HeapAlloc", "SystemTimeToFileTime", "HeapFree", "GetProcessHeap", "GetSystemTimeAsFileTime", "ExpandEnvironmentStringsA", "SetFileTime", "GetFileAttributesA", "GetEnvironmentVariableA", "CreateDirectoryA", "FindFirstFileA", "GetLastError", "SetLastError", "GetProcAddress", "RemoveDirectoryA", "CopyFileA", "FindClose", "LoadLibraryA", "MoveFileA", "FindNextFileA", "GetSystemTime", "DeleteFileA", "SetFilePointer", "WaitForSingleObject", "FlushFileBuffers", "DisableThreadLibraryCalls", "OpenMutexA", "CreateMutexA", "ReleaseMutex", "CreateProcessA", "GetPrivateProfileIntA", "CloseHandle", "FreeLibrary", "GetCurrentProcess", "OpenProcess", "TerminateProcess", "GetShortPathNameA", "GetLongPathNameA", "WritePrivateProfileStringA", "GetModuleFileNameA", "GetModuleHandleA", "GetCurrentDirectoryA", "GetVersionExA", "GetCurrentProcessId", "InterlockedIncrement", "InterlockedDecrement", "InterlockedCompareExchange", "Sleep", "GetModuleHandleExW", "GetTickCount", "SetStdHandle", "GetConsoleCP", "LoadLibraryW", "EnterCriticalSection", "LocalAlloc", "lstrcmpiA", "MultiByteToWideChar", "lstrcatA", "ReadFile", "WideCharToMultiByte", "WriteFile", "lstrlenA", "lstrcmpA", "GetFileSize", "CreateFileA", "GetConsoleMode", "RaiseException", "WriteConsoleW", "CreateFileW", "InitializeCriticalSection", "GetPrivateProfileStringA", "LeaveCriticalSection", "GetStringTypeW", "GetModuleFileNameW", "LCMapStringW", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "GetCurrentThreadId", "GetCommandLineA", "RtlUnwind", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "GetModuleHandleW", "IsProcessorFeaturePresent", "HeapSize", "ExitProcess", "SetHandleCount", "GetStdHandle", "InitializeCriticalSectionAndSpinCount", "GetFileType", "GetStartupInfoW", "DeleteCriticalSection", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "HeapCreate", "HeapDestroy", "QueryPerformanceCounter", "GetParent", "EnumWindows", "MessageBoxA", "GetDesktopWindow", "PostMessageA", "GetWindowThreadProcessId", "ExitWindowsEx", "AdjustTokenPrivileges", "LookupPrivilegeValueA", "OpenProcessToken", "RegDeleteValueA", "SetSecurityDescriptorDacl", "InitializeSecurityDescriptor", "RegCloseKey", "FreeSid", "IsValidSid", "RegOpenKeyExA", "RegCreateKeyExA", "LookupAccountNameW", "RegEnumKeyExA", "RegDeleteKeyA", "RegQueryValueExA", "RegSetValueExA", "ShellExecuteExA", "NetUserEnum", "NetApiBufferFree", "NetUserGetInfo" ], "ms": { "pe": { "machine": 332.0, "checksum": 254805.0, "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1375778368.0, "image_base": 268435456.0, "rsrc_entropy": 4.59, "entry_section": ".text", "size_of_image": 241664.0, "timestamp_day": 6.0, "file_alignment": 512.0, "resource_count": 2.0, "timestamp_year": 2013.0, "characteristics": 8450.0, "entry_point_rva": 116023.0, "size_of_headers": 1024.0, "timestamp_month": 8.0, "checksum_present": true, "export_timestamp": 1375778366.0, "import_dll_count": 7.0, "manifest_present": true, "checksum_mismatch": true, "computed_checksum": 234927.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 6.0, "linker_major_version": 10.0, "version_info_present": true, "export_timestamp_year": 2013.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 8.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 141312.0, "file_size": 211689.0, "entry_point": 116023.0, "has_overlay": true, "code_entropy": 6.44, "data_entropy": 6.08, "export_count": 3.0, "import_count": 140.0, "overlay_size": 3817.0, "string_count": 663.0, "overlay_ratio": 0.02, "section_count": 5.0, "avg_complexity": 8.87, "function_count": 456.0, "import_density": 1.01, "max_complexity": 88.0, "string_density": 4.8, "overall_entropy": 5.68, "overlay_entropy": 5.24, "avg_basic_blocks": 14.54, "avg_section_size": 41369.6, "dependency_count": 7.0, "entropy_variance": 0.78, "function_density": 3.3, "avg_function_size": 324.62, "avg_string_length": 29.07, "complexity_per_kb": 0.06, "max_string_length": 353.0, "wide_string_count": 23.0, "writable_sections": 1.0, "avg_string_entropy": 3.46, "code_to_data_ratio": 2.16, "data_to_file_ratio": 0.1, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.67, "total_basic_blocks": 6628.0, "executable_sections": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 28.69, "largest_section_ratio": 0.67, "sentence_string_count": 191.0, "sentence_string_ratio": 0.29, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "high_complexity_functions": 6.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 240, "Rich" ], [ 512, ".text" ], [ 591, "@.data" ], [ 632, ".rsrc" ], [ 671, "@.reloc" ], [ 1888, "SVW3" ], [ 2115, "QSW3" ], [ 2209, "PQWV" ], [ 3305, "RSVP" ], [ 3337, "QWRP" ], [ 3399, "teh4g" ], [ 3669, "WPVRS" ], [ 3822, "4h4g" ], [ 5467, "QVRS" ], [ 5916, "AQRP" ], [ 6143, "BRQP" ], [ 7521, "Phxj" ], [ 9835, "VWRP" ], [ 10401, "Phhn" ], [ 11720, "BRSP" ], [ 13194, "BRPQ" ], [ 17095, "AQRV" ], [ 17212, "AQVR" ], [ 17322, "BRPV" ], [ 17601, "BRVP" ], [ 18059, "S0AQVR" ], [ 20103, "BRPW" ], [ 20799, "V8SAQRP" ], [ 30333, "ITPQ" ], [ 31063, "VW9C" ], [ 34470, "Qhxw" ], [ 37589, "XSVW" ], [ 38385, "Ph x" ], [ 39349, "Vhpz" ], [ 39744, "7BRPQ" ], [ 40243, "F0AQRP" ], [ 43700, "QRVP" ], [ 43812, "RPVQ" ], [ 43919, "VW9E" ], [ 44056, "u2jpj" ], [ 52781, "KXBRPQ" ], [ 53798, "u0jpj" ], [ 77904, "QSVW" ], [ 80079, "GHBRSP" ], [ 80123, "u4jpj" ], [ 82184, "RPQW" ], [ 83070, "SVWP" ], [ 84836, "RVPW" ], [ 84853, "QVSP" ], [ 90320, "VWSRU" ], [ 124027, "f90u" ], [ 127961, "YYPV" ], [ 133362, "UVWS" ], [ 137769, "UQPXY]Y[" ], [ 143056, "bad allocation" ], [ 144236, "Unknown exception" ], [ 144284, "dddd, MMMM dd, yyyy" ], [ 144324, "wide", "MM/dd/yy" ], [ 144360, "December" ], [ 144380, "November" ], [ 144400, "October" ], [ 144416, "September" ], [ 144436, "wide", "August" ], [ 144452, "July" ], [ 144464, "wide", "June" ], [ 144476, "April" ], [ 144488, "March" ], [ 144500, "February" ], [ 144520, "wide", "January" ], [ 144632, "wide", "Saturday" ], [ 144652, "wide", "Friday" ], [ 144668, "wide", "Thursday" ], [ 144688, "Wednesday" ], [ 144708, "Tuesday" ], [ 144724, "wide", "Monday" ], [ 144740, "wide", "Sunday" ], [ 144824, "dddd, MMMM dd, yyyy" ], [ 144844, "MM/dd/yy" ], [ 144864, "December" ], [ 144876, "November" ], [ 144888, "October" ], [ 144896, "September" ], [ 144908, "August" ], [ 144916, "July" ], [ 144924, "June" ], [ 144932, "April" ], [ 144940, "March" ], [ 144948, "February" ], [ 144960, "January" ], [ 145016, "Saturday" ], [ 145028, "Friday" ], [ 145036, "Thursday" ], [ 145048, "Wednesday" ], [ 145060, "Tuesday" ], [ 145068, "Monday" ], [ 145076, "Sunday" ], [ 145110, "nKERNEL32.DLL" ], [ 145140, "FlsFree" ], [ 145148, "FlsSetValue" ], [ 145160, "FlsGetValue" ], [ 145172, "FlsAlloc" ], [ 145215, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 145312, "CorExitProcess" ], [ 145328, "wide", "mscoree.dll" ], [ 145512, "runtime error " ], [ 145552, "wide", "TLOSS error" ], [ 145580, "wide", "SING error" ], [ 145608, "DOMAIN error\r\n" ], [ 145640, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 146136, "R6032\r\n- not enough space for locale information\r\n" ], [ 146240, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application.\r\n" ], [ 146440, "R6030\r\n- CRT not initialized\r\n" ], [ 146504, "R6028\r\n- unable to initialize heap\r\n" ], [ 146584, "R6027\r\n- not enough space for lowio initialization\r\n" ], [ 146696, "R6026\r\n- not enough space for stdio initialization\r\n" ], [ 146808, "R6025\r\n- pure virtual function call\r\n" ], [ 146888, "R6024\r\n- not enough space for _onexit/atexit table\r\n" ], [ 147000, "R6019\r\n- unable to open console device\r\n" ], [ 147088, "R6018\r\n- unexpected heap error\r\n" ], [ 147160, "R6017\r\n- unexpected multithread lock error\r\n" ], [ 147256, "R6016\r\n- not enough space for thread data\r\n" ], [ 147344, "R6010\r\n- abort() has been called\r\n" ], [ 147416, "R6009\r\n- not enough space for environment\r\n" ], [ 147504, "R6008\r\n- not enough space for arguments\r\n" ], [ 147592, "R6002\r\n- floating point support not loaded\r\n" ], [ 147864, "Microsoft Visual C++ Runtime Library" ], [ 147956, "\u003cprogram name unknown\u003e" ], [ 148004, "Runtime Error!\n\nProgram: " ], [ 148056, "wide", "(null)" ], [ 148113, "700WP" ], [ 148129, "`h````" ], [ 148214, "700PP" ], [ 148276, "bad exception" ], [ 149066, " h(((( H" ], [ 149744, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 150128, " !\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 150352, " Complete Object Locator'" ], [ 150380, " Class Hierarchy Descriptor'" ], [ 150412, " Base Class Array'" ], [ 150432, " Base Class Descriptor at (" ], [ 150460, " Type Descriptor'" ], [ 150480, "`local static thread guard'" ], [ 150508, "`managed vector copy constructor iterator'" ], [ 150552, "`vector vbase copy constructor iterator'" ], [ 150596, "`vector copy constructor iterator'" ], [ 150632, "`dynamic atexit destructor for '" ], [ 150668, "`dynamic initializer for '" ], [ 150696, "`eh vector vbase copy constructor iterator'" ], [ 150740, "`eh vector copy constructor iterator'" ], [ 150780, "`managed vector destructor iterator'" ], [ 150820, "`managed vector constructor iterator'" ], [ 150860, "`placement delete[] closure'" ], [ 150892, "`placement delete closure'" ], [ 150920, "`omni callsig'" ], [ 150936, "delete[]" ], [ 150956, "`local vftable constructor closure'" ], [ 150992, "`local vftable'" ], [ 151020, "`udt returning'" ], [ 151036, "`copy constructor closure'" ], [ 151064, "`eh vector vbase constructor iterator'" ], [ 151104, "`eh vector destructor iterator'" ], [ 151136, "`eh vector constructor iterator'" ], [ 151172, "`virtual displacement map'" ], [ 151200, "`vector vbase constructor iterator'" ], [ 151236, "`vector destructor iterator'" ], [ 151268, "`vector constructor iterator'" ], [ 151300, "`scalar deleting destructor'" ], [ 151332, "`default constructor closure'" ], [ 151364, "`vector deleting destructor'" ], [ 151396, "`vbase destructor'" ], [ 151428, "`local static guard'" ], [ 151604, "operator" ], [ 151640, "delete" ], [ 151656, "__unaligned" ], [ 151668, "__restrict" ], [ 151688, "__eabi" ], [ 151696, "__clrcall" ], [ 151708, "__fastcall" ], [ 151720, "__thiscall" ], [ 151732, "__stdcall" ], [ 151744, "__pascal" ], [ 151756, "__cdecl" ], [ 152164, "GetProcessWindowStation" ], [ 152188, "GetUserObjectInformationW" ], [ 152216, "GetLastActivePopup" ], [ 152236, "GetActiveWindow" ], [ 152252, "MessageBoxW" ], [ 152262, "wide", "WUSER32.DLL" ], [ 152264, "USER32.DLL" ], [ 152412, "0123456789abcdefghijklmnopqrstuvwxyz" ], [ 152452, "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 152492, "(null)" ], [ 152504, "CFileUtils::DeleteFileRecursive: : '%s' has no files (mask='%s')" ], [ 152576, "CFileUtils::DeleteFileRecursive: : source is a folder, FindNextFile E:%d" ], [ 152652, "CFileUtils::DeleteFileRecursive: : DeleteDirectory('%s') OK" ], [ 152712, "CFileUtils::DeleteFileRecursive: DeleteDirectory('%s') E:%d" ], [ 152772, "CFileUtils::DeleteFileRecursive: RemoveFileTree('%s') OK" ], [ 152832, "CFileUtils::DeleteFileRecursive: RemoveFileTree('%s') E:%d" ], [ 152892, "CFileUtils::DeleteFileLogged: DeleteFile('%s') OK (not exist)" ], [ 152956, "CFileUtils::DeleteFileLogged: DeleteFile('%s') E1:%d;E2:%d" ], [ 153016, "CFileUtils::DeleteFileLogged: DeleteFile('%s') OK (scheduled; immediate E:%d)" ], [ 153096, "CFileUtils::DeleteFileLogged: DeleteFile('%s') OK" ], [ 153148, "CFileUtils::CopyFileViaBuffer: : OK (dwAfterbufDataSize=%d)" ], [ 153208, "CFileUtils::CopyFileViaBuffer: : E:%d (dwAfterbufDataSize=%d)" ], [ 153272, "CFileUtils::CopyFileLogged: CopyFileLogged('%s'-\u003e'%s') OK" ], [ 153332, "CFileUtils::CopyFileLogged: CopyFileLogged('%s'-\u003e'%s') E:%d" ], [ 153396, "CFileUtils::CreateDirectoryLogged('%s'): OK" ], [ 153440, "CFileUtils::CreateDirectoryLogged(%s): E:%d" ], [ 153484, "CFileUtils::GetFolderFiles: : folder '%s' does not exist" ], [ 153544, "CFileUtils::GetFolderFiles: : no files found (mask='%s')" ], [ 153608, "CFileUtils::GetFolderFiles: : source is a folder, FindNextFile E:%d" ], [ 153676, "CFileUtils::CopyFileRecursive: CopyFolder(%s,%s)" ], [ 153728, "CFileUtils::CopyFileRecursive: : dest folder exists, E:bFailIfExists=true" ], [ 153808, "CFileUtils::CopyFileRecursive: : source is a folder, E create dest folder" ], [ 153888, "CFileUtils::CopyFileRecursive: : source is folder with no files (mask='%s')" ], [ 153968, "CFileUtils::CopyFileRecursive: : source is a folder, FindNextFile E:%d" ], [ 154040, "shell32.dll" ], [ 154052, "SHGetKnownFolderPath" ], [ 154076, "SHGetFolderPathW" ], [ 154096, "url", "CFileUtils::GetFolderPath: : E both SHGetKnownFolderPath (p=0x\bx,E:0x\bx) and SHGetFolderPath (p=0x\bx,E:0x\bx)" ], [ 154216, "CFileUtils::GetFolderPath: : E:0x%x LoadLibrary(shell32.dll)" ], [ 154280, "CFileUtils::GetSid: The SID for %s is invalid." ], [ 154328, "CFileUtils::GetSid: The SID buffer was too small. It will be reallocated." ], [ 154408, "CFileUtils::GetSid: The domain name buffer was too small. It will be reallocated." ], [ 154496, "CFileUtils::GetSid: LookupAccountNameW failed. GetLastError returned: %d" ], [ 154572, "ALLUSERSPROFILE" ], [ 154588, "C:\\Documents and Settings\\All Users" ], [ 154624, "AppData\\Local" ], [ 154640, "Local Settings\\Application Data" ], [ 154672, "CFileUtils::GetUserHomeDir: (%s): entry" ], [ 154712, "CFileUtils::GetUserHomeDir: : NetUserGetInfo(%s) successful, ='%s'" ], [ 154784, "CFileUtils::GetUserHomeDir: : E:%d NetUserGetInfo(%s) pBuf=0x%x; attempt registry" ], [ 154872, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList" ], [ 154932, "ProfileImagePath" ], [ 154952, "CFileUtils::GetUserHomeDir: : E:%d GetSid(%s) sSid='%s'; attempt default" ], [ 155028, "CFileUtils::GetUserAppDataFolderPath: (%s): entry" ], [ 155080, "\\AppData\\Roaming" ], [ 155100, "\\AppData\\Local" ], [ 155116, "CFileUtils::GetUserAppDataFolderPath: : all users home %s" ], [ 155176, "CFileUtils::GetUserAppDataFolderPath: : user's home %s" ], [ 155232, "CFileUtils::GetUserAppDataFolderPath: : appdata suffix %s" ], [ 155292, "CFileUtils::GetUserAppDataFolderPath: : returns %d/'%s'" ], [ 155348, "CFileUtils::GetCurrentUserAppDataFolderPath: : entry" ], [ 155404, "CFileUtils::GetCurrentUserAppDataFolderPath: : exit: C:%d" ], [ 155464, "USERPROFILE" ], [ 155476, "USERNAME" ], [ 155488, "C:\\Users" ], [ 155500, "C:\\Documents and Settings" ], [ 155528, "Default User" ], [ 155544, "AppData\\Roaming" ], [ 155560, "Program Files" ], [ 155576, "Program Files (x86)" ], [ 155596, "ProgramFiles" ], [ 155612, "SystemDrive" ], [ 155628, "COSUsers::GetAllUsersE:%d in NetUserEnum" ] ], "sz": 211689, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "Resolve account name to SID", "e": [ "LookupAccountNameW" ], "i": "micro-behaviors/os/user/lookup::lookup-account-name", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 663.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "d": "Lowercase alphanumeric character set (digits first)", "e": [ "0123456789abcdefghijklmnopqrstuvwxyz" ], "i": "micro-behaviors/data/encode/charset::lowercase-digits-alphabet", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 456.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "CGlobalContext::ExecuteCommands: %d commands to execute", "Unknown command '%s'", "CGlobalContext::ExecuteCommands: no commands to execute (%d)", "CGlobalContext::OnQuestion: Execution command-list '%s' not-found or empty", "CExecuteProgram::Start: empty command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.29" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.949999988079071, "d": "COM unregistration export", "e": [ "DllUnregisterServer" ], "i": "metadata/binary/symbols::export-dll-unregister-server", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "GetFileVersionInfoSizeA import", "e": [ "GetFileVersionInfoSizeA" ], "i": "well-known/malware/trojan/hijack-gen::padodor-get-file-version-info-size-a-import", "l": 1 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.7200000286102295, "d": "Write INI string value", "e": [ "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::write-private-profile-ansi", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Unfilled TODO product name in version resource", "e": [ "TODO: \u003cProduct name\u003e" ], "i": "objectives/evasion/masquerade/version-resource::todo-product-name-placeholder", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllRegisterServer export string", "e": [ "DllRegisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetModuleFileNameExA dynamic resolve", "e": [ "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::get-module-filename-ex-string", "l": 1 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 1.0, "d": "Makefile all target", "e": [ "DllInstall: : exit: C:%d" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "d": "USERNAME environment variable", "e": [ "USERNAME" ], "i": "micro-behaviors/os/env/vars/user-info::username-var", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.75, "d": "Open process access token", "e": [ "OpenProcessToken" ], "i": "micro-behaviors/os/privilege/token::open-process-token", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry subkeys via import", "e": [ "RegEnumKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-enum-key-ex-a-symbol", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 0.6600000262260437, "d": "Copy files (Windows API ANSI)", "e": [ "CopyFileA" ], "i": "micro-behaviors/fs/file/copy::copyfile-a", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/binary-metrics::repeated-padding-marker", "l": 1, "m": "B0032" }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.87" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 1.0, "d": ".js extension", "e": [ "\"content.js\"" ], "i": "objectives/command-and-control/dropper/builder::js-ext", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "crxdrop.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.46" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "USERPROFILE", "USERNAME" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.68" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 241664.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileA" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "50 40 02 10", "7c 40 02 10", "e4 40 02 10", "7c 40 02 10" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "c": 0.8500000238418579, "d": "OpenMutex API call", "e": [ "OpenMutexA" ], "i": "micro-behaviors/process/sync/mutex::open-mutex", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "a": "T1059.003", "c": 0.8999999761581421, "d": "ShellExecuteExA ANSI extended API", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/system::shell-execute-ex-a", "l": 3, "m": "E1059.003" }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage::get-window-thread-process-id", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.949999988079071, "d": "COM registration export", "e": [ "DllRegisterServer" ], "i": "metadata/binary/symbols::export-dll-register-server", "l": 1 }, { "d": "USERPROFILE environment variable", "e": [ "USERPROFILE" ], "i": "micro-behaviors/os/env/vars/user-info::userprofile-var", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4b", "4b", "47", "46", "46", "42", "46", "46", "4b", "46", "4f", "46", "46", "4f", "48", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 6628.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1036.005", "c": 0.8799999952316284, "d": "Two dotted-quad version strings", "e": [ "1.0.0.1", "1.0.0.1" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "GetFolder", "GetFolder", "GetFolder", "GetFolder", "GetFolder", "GetFolder" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "a": "T1204.002", "c": 0.8799999952316284, "d": "DllUnregisterServer export string", "e": [ "DllUnregisterServer" ], "i": "objectives/command-and-control/dropper/execution/clickfix::dllunregisterserver-string", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 211689.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Modbus write single register frame", "e": [ "00 08" ], "i": "micro-behaviors/communications/modbus::write-single-register", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "a": "T1057", "c": 0.8199999928474426, "d": "GetProcessImageFileNameA dynamic resolve", "e": [ "GetProcessImageFileNameA" ], "i": "micro-behaviors/process/enumerate/psapi::get-process-image-filename-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/operations::get-console-mode", "l": 2 }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage::enum-windows", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA", "CExecuteProgram::Start: CreateProcess E:0x%0x" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExA" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 140.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Strip filename from path", "e": [ "PathRemoveFileSpecA" ], "i": "micro-behaviors/fs/path/check::path-remove-file-spec", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "C:\\Development\\extension-setup_2013\\bin\\Release\\crxdrop.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.44)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 456.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 456.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1375778368.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1218.010", "c": 0.800000011920929, "d": "Executes regsvr32.exe", "e": [ "regsvr32.exe" ], "i": "micro-behaviors/process/create/tool::regsvr32", "l": 3, "m": "E1218.010" }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableA" ], "i": "metadata/package/config::get-env-var", "l": 2 }, { "c": 0.949999988079071, "d": "ANSI GUI probe API cluster", "e": [ "GetLastActivePopup", "GetActiveWindow", "MessageBoxA" ], "i": "well-known/malware/trojan/elex/test-loader::ansi-gui-probe-cluster", "l": 3 }, { "c": 0.75, "d": "Lookup privilege name to LUID", "e": [ "LookupPrivilegeValueA" ], "i": "micro-behaviors/os/privilege/token::lookup-privilege-value", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationW", "DeleteFileRecursive", "DeleteFileRecursive", "DeleteFileRecursive", "DeleteFileRecursive", "DeleteFileRecursive", "DeleteFileRecursive", "GetUserAppDataFolderPath", "GetUserAppDataFolderPath", "GetUserAppDataFolderPath", "GetUserAppDataFolderPath", "GetUserAppDataFolderPath", "GetCurrentUserAppDataFolderPath", "GetCurrentUserAppDataFolderPath", "GetUserAppDataFolderPath" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 456.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "c": 0.800000011920929, "d": "Enable/disable privileges in access token", "e": [ "AdjustTokenPrivileges" ], "i": "micro-behaviors/os/privilege/token::adjust-token-privileges", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Delete registry key via import", "e": [ "RegDeleteKeyA" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-key-a-symbol", "l": 3 }, { "a": "T1027", "c": 0.8399999737739563, "d": "High entropy .data section", "e": [ ".data (size: 20480, entropy: 6.71)" ], "i": "objectives/anti-static/obfuscation/payload/section::high-entropy-dot-data-section", "l": 3, "m": "B0032" }, { "c": 1.0, "d": "Compatibility alias", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex-a", "l": 1 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "74 40 02 10", "84 40 02 10", "90 40 02 10", "80 40 02 10", "54 41 02 10", "74 40 02 10", "74 40 02 10", "74 40 02 10", "84 40 02 10", "74 40 02 10", "74 40 02 10", "84 40 02 10", "74 40 02 10", "74 40 02 10", "74 40 02 10", "74 40 02 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "NetUserEnum remote user enumeration", "e": [ "NetUserEnum" ], "i": "micro-behaviors/os/service/remote::net-user-enum-source", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteExA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links NETAPI32.dll (NetUserEnum, NetApiBufferFree, NetUserGetInfo)", "e": [ "NETAPI32.dll" ], "i": "metadata/dylib::netapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathRemoveFileSpecA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetParent, EnumWindows, MessageBoxA, GetDesktopWindow, PostMessageA, ... +2 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (LocalFree, lstrcpyA, HeapReAlloc, MoveFileExA, SetEndOfFile, ... +104 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegDeleteValueA, SetSecurityDescriptorDacl, ... +11 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Version resource with unfilled TODO placeholders", "e": [ "TODO: \u003cProduct name\u003e", "VS_VERSION_INFO" ], "i": "objectives/evasion/masquerade/version-resource::unfilled-template-version-resource", "l": 4 }, { "a": "T1057", "c": 0.8799999952316284, "d": "Dynamic PSAPI API resolution strings", "e": [ "GetProcessImageFileNameA", "PSAPI", "GetModuleFileNameExA" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dynamic-resolve", "l": 3 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 140.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8199999928474426, "d": "Reads and writes INI via ANSI", "e": [ "GetPrivateProfileStringA", "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle-ansi", "l": 3 }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetProcessWindowStation", "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW", "GetModuleHandleA", "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindNextFileA", "FindFirstFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "90 40 02 10", "84 40 02 10", "74 40 02 10", "80 40 02 10", "54 41 02 10", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileA", "GetModuleFileNameA", "CreateFileW", "GetFileSize", "ReadFile" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "CreateMutexA", "OpenMutexA", "ExitProcess", "GetLastError" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyExA", "RegCreateKeyExA", "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegOpenKeyExA", "RegOpenKeyExA", "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "IsDebuggerPresent", "SetUnhandledExceptionFilter" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 1, "m": "B0001" }, { "a": "T1134.001", "c": 0.8799999952316284, "d": "Dynamic token privilege adjustment chain", "e": [ "AdjustTokenPrivileges", "OpenProcessToken", "LookupPrivilegeValueA" ], "i": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1529", "c": 0.9399999976158142, "d": "Privilege-enabled reboot API use", "e": [ "AdjustTokenPrivileges", "ExitWindowsEx", "SeShutdownPrivilege", "LookupPrivilegeValueA" ], "i": "objectives/impact/system/shutdown::shutdown-privilege-reboot-api", "l": 3, "m": "B0029" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "OpenMutexA", "CreateMutexA", "USERNAME", "USERPROFILE" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "c8c8b44a94471cc310d433820fdfc25e884652e9d568a16bb8b4db114e0ed98a", "path": "89209!!embedded:pe@0x5642a", "type": "pe" } ], "tv": "2a0fe" } }