{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.23529412, "class": 0 }, { "m": "az/pe", "prob": 0.0041841003, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T14:09:42Z" }, "path": "7dfb4b61051b3f3d37c000a465752ccf53cfe8be16466ef1c8f4e4c73a473775.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 6, "ff": { "i": [ [ "kernel32", "GetEnvironmentVariableW" ], [ "kernel32", "CreateDirectoryW" ], [ "kernel32", "WriteFile" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapFree" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "WideCharToMultiByte" ] ], "m": { "pe": { "checksum": 120095.0, "icon_count": 2.0, "checksum_valid": 1.0, "resource_count": 3.0, "has_version_info": 1.0, "computed_checksum": 120095.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 74624.0, "entropy": 6.45, "size_bytes": 74624.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.34, "data_entropy": 4.94, "overlay_size": 10624.0, "string_count": 3564.0, "overlay_ratio": 0.14, "overlay_entropy": 7.64, "entropy_variance": 1.04, "avg_string_length": 6.8, "max_string_length": 160.0, "code_to_data_ratio": 0.92, "string_length_stddev": 4.79, "largest_section_ratio": 0.58, "sentence_string_count": 15.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 12.0 }, "sections": { "count": 5.0, "code_size": 11776.0, "entropy_max": 7.29, "entropy_mean": 5.37, "name_entropy": 3.17, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 1.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 392, "u8", ".text" ], [ 471, "u8", "@.rdata" ], [ 511, "u8", "@.data" ], [ 552, "u8", ".rsrc" ], [ 7584, "stack", "KpZKZ" ], [ 10409, "stack", "ojdkvw6ohOhd;X" ], [ 11058, "stack", "I?2_" ], [ 12803, "u8", "HK8E" ], [ 12877, "u8", "52286" ], [ 12920, "u8", "E5JJ" ], [ 13017, "u8", "K63I" ], [ 13148, "u8", "BI95" ], [ 13322, "u8", "I28H" ], [ 13374, "u8", "H24EE92" ], [ 13538, "u8", "3E2\u003e\u003c" ], [ 13544, "u8", "85?\u003c=BBI\u003c:A" ], [ 13697, "u8", "AEH53" ], [ 13748, "u8", "H9AK" ], [ 13825, "u8", "9KI6I" ], [ 13994, "u8", "3275" ], [ 14048, "u8", "J964" ], [ 14231, "u8", "K5\u003c\u003c;26743" ], [ 14334, "u8", "I85334K" ], [ 14448, "u8", "EB7\u003c786;9897E6K:7D" ], [ 14501, "u8", "E8JKB" ], [ 14666, "u8", "29IKA" ], [ 14728, "u8", "A4B2I" ], [ 14742, "u8", "H379" ], [ 14812, "u8", "5K9EEK" ], [ 14819, "u8", "HJ5K" ], [ 14893, "u8", "62\u003e7=" ], [ 14994, "u8", "5278" ], [ 15257, "u8", "JK4D" ], [ 15400, "u8", "J3EK" ], [ 15410, "u8", "8K2\u003eK28\u003eH8B=3A\u003e" ], [ 15544, "u8", "A55J" ], [ 15772, "u8", "KD66" ], [ 15950, "u8", "HB2J4" ], [ 16004, "u8", "997E" ], [ 16196, "u8", "849A" ], [ 16279, "u8", "67H3E" ], [ 16295, "u8", "42\u003e84;I" ], [ 16539, "u8", "D7249D" ], [ 16563, "u8", "K9D2K" ], [ 16694, "u8", "B7KE8" ], [ 16708, "u8", "7JAHEI" ], [ 16760, "u8", "3:?A::4E5I2" ], [ 16772, "u8", "8389" ], [ 16778, "u8", "EH669EA" ], [ 16799, "u8", "8BHA" ], [ 16834, "u8", "DA54AJK" ], [ 17088, "u8", "JBJD" ], [ 17288, "u8", "DJA765AJB" ], [ 17345, "u8", "AAAI83" ], [ 17586, "u8", "878HB64" ], [ 17823, "u8", "DKE3" ], [ 17959, "u8", "JE8J4;:6629I" ], [ 18024, "u8", "9KDK" ], [ 18094, "u8", "A;44===?;??I" ], [ 18143, "u8", "A2:E32A44" ], [ 18409, "u8", "E8D636" ], [ 18564, "u8", "2\u003e=935" ], [ 18622, "u8", "AJA2" ], [ 19052, "u8", "89IJE" ], [ 19236, "u8", "2\u003c\u003c\u003e2\u003c2" ], [ 19267, "u8", "EBHE" ], [ 19341, "u8", "IH89" ], [ 19421, "u8", "95394H" ], [ 19541, "u8", "5J2I" ], [ 19667, "u8", "H722" ], [ 19679, "u8", "274B" ], [ 19738, "u8", "BA73I" ], [ 19906, "u8", "92BH" ], [ 20128, "u8", "DB;958JI2?736\u003eE3" ], [ 20224, "u8", "5637" ], [ 20236, "u8", ":\u003e;2=5HDJ4AJEKJ" ], [ 20398, "u8", "A\u003c\u003c64?3=KK9K" ], [ 20448, "u8", "AKD=A?83B8AI\u003e3H7" ], [ 20524, "u8", "AI\u003cAH5K4\t278" ], [ 20669, "u8", "AEHJ4D" ], [ 21379, "u8", "E::7=A" ], [ 21557, "u8", "94DI" ], [ 21607, "u8", "E9EJ" ], [ 21676, "u8", "=6EI9AAB\u003c\u003c?;" ], [ 21705, "u8", "\u003eAIEID3\u003eE3HIIK" ], [ 21972, "u8", "52\u003e4" ], [ 22021, "u8", "EJH2\u003eJH" ], [ 22034, "u8", "4\u003c\u003c4J8=" ], [ 22168, "u8", "82486" ], [ 22240, "u8", "H58K4" ], [ 22309, "u8", "5722" ], [ 22436, "u8", "BHH6B" ], [ 22461, "u8", "A37IH" ], [ 22797, "u8", "39BH8JIE" ], [ 23003, "u8", "34E626A" ], [ 23282, "u8", "4DEBD" ], [ 23648, "u8", "8J5AE" ], [ 23690, "u8", "HK2IJ" ], [ 23782, "u8", "8:69:256\u003eD" ], [ 23905, "u8", "J355" ], [ 23928, "u8", "ID3B5" ], [ 24005, "u8", "D\u003c\u003cE4E23;IB8" ], [ 24059, "u8", "?2\u003e9E3?" ], [ 24072, "u8", "7::3HD3" ], [ 24217, "u8", "\u003c\u003c\u003e296" ], [ 24224, "u8", "HAHK6J382" ], [ 24609, "u8", "AHA8" ], [ 24847, "u8", "JKD3" ], [ 24942, "u8", "BD968" ], [ 25049, "u8", "65HE" ], [ 25192, "u8", "B6H29" ], [ 25248, "u8", "J\u003c\u003cDE66:6AEHD" ], [ 25295, "u8", "74JB" ], [ 25417, "u8", "E2973HD7" ], [ 25490, "u8", "7DHJA" ], [ 25596, "u8", "E6687" ], [ 25881, "u8", "I5KK" ], [ 26171, "u8", "J2\u003eE6" ], [ 26236, "u8", "BI9978444\u003c9?9=96A" ], [ 26322, "u8", "4;2A::" ], [ 26338, "u8", "5A8E" ], [ 26368, "u8", "H7DIE" ], [ 26392, "u8", "KE\u003eB\u003c435DJD5HI88" ], [ 26628, "u8", "6724" ], [ 27018, "u8", "6JA6\u003e\u003e26AKIDD" ], [ 27072, "u8", "J283IA\u003c49HB;" ], [ 27128, "u8", "H49JB" ], [ 27134, "u8", "JDH2" ], [ 27150, "u8", "J346" ], [ 27309, "u8", "BKDA8J8" ], [ 27337, "u8", "67KHJ" ], [ 27413, "u8", "28644" ], [ 27552, "u8", "A?J\u003c\u003c9" ], [ 27559, "u8", "J79E" ], [ 27656, "u8", "3336" ], [ 27764, "u8", "5569" ], [ 27773, "u8", "27JB" ], [ 27871, "u8", "HD7K2" ], [ 27951, "u8", "73DB" ], [ 27978, "u8", "H2KJ" ], [ 27992, "u8", "I2DH" ], [ 28084, "u8", "7648" ], [ 28099, "u8", "KD25" ], [ 28141, "u8", "6982" ], [ 28308, "u8", "35H24K" ], [ 28316, "u8", "D37H" ], [ 28329, "u8", "8DIK" ], [ 28367, "u8", "HI7J" ], [ 28386, "u8", "KI54" ], [ 28453, "u8", "DB5J" ], [ 28475, "u8", "A\u003c\u003cBJ" ], [ 28520, "u8", "3BKD" ], [ 28600, "u8", "J8ID" ], [ 28613, "u8", ";D3J\u003e2\u003eJE6" ], [ 28671, "u8", "H53I" ], [ 28682, "u8", "72\u003eK;\u003e" ], [ 28721, "u8", "I996" ], [ 28777, "u8", "B8JJH" ], [ 28809, "u8", "E4IK237" ], [ 28865, "u8", "276BIA638E" ], [ 28885, "u8", "JKA4" ], [ 28936, "u8", "8BHK" ], [ 28990, "u8", "J5A57" ], [ 29112, "u8", "KBBK" ], [ 29135, "u8", "D277" ], [ 29154, "u8", "B869" ], [ 29270, "u8", "I8BI" ], [ 29303, "u8", "4E984K" ], [ 29319, "u8", "86K27HJH494I9" ], [ 29333, "u8", "D6K8" ], [ 29338, "u8", "348EIJE" ], [ 29393, "u8", "B69J" ], [ 29459, "u8", "J7629" ], [ 29569, "u8", "AD68H" ], [ 29608, "u8", "BAH8D" ], [ 29711, "u8", "5;I;7??7B85\u003c\u003c" ], [ 29732, "u8", "E7868B" ], [ 29753, "u8", "HAHJ32" ], [ 29800, "u8", "2E5I" ], [ 29805, "u8", "I=;KI;2\u003e6:" ], [ 29835, "u8", "477J" ], [ 29841, "u8", "EIK48BDEID\u003eB" ], [ 29863, "u8", "3E;B\u003c\u003c" ], [ 30029, "u8", "KE745" ], [ 30278, "u8", "D88J" ], [ 30329, "u8", "2\u003e=\u003e\u003eH;H3;D" ], [ 30412, "u8", "2KKD" ], [ 30457, "u8", "K79A" ], [ 30488, "u8", "JHID" ], [ 30493, "u8", "8K88A" ], [ 30512, "u8", "3835" ], [ 30562, "u8", "D56E" ], [ 30593, "u8", "A82B" ], [ 30696, "u8", "46838E" ], [ 30737, "u8", "K9BB" ], [ 30746, "u8", "B86469" ], [ 30814, "u8", "5B64K" ], [ 30824, "u8", "7355" ], [ 30900, "u8", "4H\u003c\u003cK:J" ], [ 30957, "u8", "H78K" ], [ 30980, "u8", "7I9J" ], [ 31081, "u8", "H684" ], [ 31106, "u8", "5KD9J" ], [ 31438, "u8", "D\u003eEI2EJ3BBE" ], [ 31450, "u8", "E5KD6" ], [ 31571, "u8", "39KJD" ], [ 31642, "u8", ":D43B?\u003c\u003cJ" ], [ 31666, "u8", "HJ48;K447?;3IBIJ" ], [ 31697, "u8", "55J32\u003e=\u003c" ], [ 31956, "u8", "477K" ], [ 32075, "u8", "57EI" ], [ 32216, "u8", "2E8B" ], [ 32385, "u8", "H62H" ], [ 32398, "u8", "D2KD" ], [ 32596, "u8", "B89B" ], [ 32784, "u8", "6AJJK" ], [ 32829, "u8", "A;A::9" ], [ 33197, "u8", "I2IHJ" ], [ 33218, "u8", "JB4H52IKDJ" ], [ 33425, "u8", "23AED" ], [ 33733, "u8", "993H" ], [ 33881, "u8", "36D7674D886=" ], [ 34180, "u8", "DBDA4DK" ], [ 34310, "u8", "E95J2" ], [ 34617, "u8", "KAB9" ], [ 34694, "u8", "J5K9J" ], [ 34903, "u8", "KJ6BH" ], [ 34923, "u8", "2DAA6D" ], [ 35018, "u8", "6258E" ], [ 35032, "u8", "DH69" ], [ 35171, "u8", "J959DHH" ], [ 35270, "u8", "8A933A" ], [ 35292, "u8", "9543A" ], [ 35298, "u8", "KAIHJ4:J5\u003c6EI3B" ], [ 35424, "u8", "6HH2D" ], [ 35476, "u8", "65KA" ], [ 35541, "u8", "K6EJ" ], [ 35705, "u8", "9394" ], [ 35773, "u8", "6\u003c\u003c6" ], [ 35820, "u8", "BEAJ9KK" ], [ 35934, "u8", "HBED5" ], [ 35944, "u8", ":I2\u003e5\u003c6H" ], [ 35965, "u8", "JJD3885" ], [ 36094, "u8", "A792A" ], [ 36214, "u8", "BI9H" ], [ 36308, "u8", "29DI" ], [ 36450, "u8", "E7729" ], [ 36697, "u8", "45DD" ], [ 36736, "u8", "J4II" ], [ 36909, "u8", "I8B64" ], [ 37391, "u8", "A55JE" ], [ 37425, "u8", "89HD" ], [ 37460, "u8", "::E4" ], [ 37466, "u8", "KK35" ], [ 37471, "u8", "DK73" ] ], "v": { "file.stem": "7dfb4b61051b3f3d37c000a465752ccf53cfe8be16466ef1c8f4e4c73a473775", "pe.imphash": "12fc63af9037e8a4625f05901e079fc9", "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "pe.timestamp": 1738574151, "file.basename": "7dfb4b61051b3f3d37c000a465752ccf53cfe8be16466ef1c8f4e4c73a473775.exe", "pe.image_base": 5368709120, "pe.image_size": 77824, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.version.os": "windows_nt_windows32", "pe.entry_point": 13456, "pe.headers_size": 1024, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 10624, "pe.image_hash.sha1": "8c1f19a2dbb54cfc534fbbcd1bf0a085777f0bf7", "pe.version.company": "BasicSolutions", "pe.image_hash.sha256": "2c57e23cec1ca40c6d2ffb53c6328a904e75d6a8408f62278e17add46ce1eca3", "pe.image_hash.sha384": "e3d17323fbfa4f81d1676788996cc5acf079e0997aae12cf740fa51412fc70f3642b2babd0576b2c468916efa6e9c661", "pe.image_hash.sha512": "b4dbd0cf11fb533ccc6b3f9c38f65863018e8e7d88bd1173ddec4f6c43e3089e09c1fd3071bf6458b312ca23ee9561e38aee12ead0d345e1265511b3fd367a68", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.version.copyright": "BasicSolutions (C) 2025", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.version.description": "Install new features", "pe.linker_major_version": 14, "pe.linker_minor_version": 39, "pe.signatures[0].issuer": "CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\\, Inc.,C=US", "pe.signatures[0].serial": "00c25308e33ee5e814d2e3054026033f4c", "pe.version.file_version": "1.3.0.4", "pe.version.product_name": "MeetUpdate", "pe.signatures[0].subject": "CN=NEXTGENSOFTWARE COMPANY LIMITED,SERIALNUMBER=0318797820,BUSINESSCATEGORY=Private Organization,O=NEXTGENSOFTWARE COMPANY LIMITED,1.3.6.1.4.1.311.60.2.1.3=#1302564e,L=Hồ Chí Minh,C=VN", "pe.version.internal_name": "MeetUpdate.exe", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 62448, "pe.data_directories[1].rva": 69632, "pe.data_directories[2].rva": 61544, "pe.data_directories[3].rva": 64000, "pe.data_directories[4].rva": 61440, "pe.dll_characteristics_raw": 33120, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2026-01-20T09:19:17Z", "pe.version.product_version": "1.3.0.4", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 5592, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 372, "pe.data_directories[3].name": "certificate", "pe.data_directories[3].size": 10624, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 104, "pe.signatures[0].not_before": "2025-01-20T09:19:18Z", "pe.version.original_filename": "MeetUpdate.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].thumbprint_sha1": "2b301191aa9e1d2c8e3eefd38b6eb1952b1fce88", "pe.signatures[0].cert_chain_depth": 2, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "2c57e23cec1ca40c6d2ffb53c6328a904e75d6a8408f62278e17add46ce1eca3", "pe.signatures[0].thumbprint_sha256": "c2e68e209accaba0aa669eb5f04c149e4ab36a01ead691e46c663cb5e8df0520", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 1024, 11776, 5.34, "r-x" ], [ ".secenc", 12800, 43008, 5.02, "r--" ], [ ".rdata", 55808, 1536, 4.27, "r--" ], [ ".data", 57344, 1024, 4.94, "rw-" ], [ ".rsrc", 58368, 5632, 7.29, "r--" ] ] }, "id": 0, "sz": 74624, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: NEXTGENSOFTWARE COMPANY LIMITED", "e": [ "NEXTGENSOFTWARE COMPANY LIMITED" ], "i": "metadata/signed/unknown::nextgensoftware-company-limited", "l": 2 }, { "c": 1.0, "d": "Signed by NEXTGENSOFTWARE COMPANY LIMITED", "e": [ "NEXTGENSOFTWARE COMPANY LIMITED" ], "i": "metadata/signed/leaf::nextgensoftware-company-limited", "l": 3 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 3564.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0xf7ce" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1622", "c": 0.8999999761581421, "d": "PEB getter helper (mov rax gs:0x60; ret)", "e": [ "65 48 8b 04 25 60 00 00 00 c3" ], "i": "objectives/anti-analysis/debugger-detect/check::peb-helper-getter", "l": 1, "m": "B0001", "el": [ "0x9c0" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 3564.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.3.0.4" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 1024)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1, "el": [ "0x17ac" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "0xdf02" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.3.0.4" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0xf020" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0xf6f6" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0xf028" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0xdf2c" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Install new features" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "0xf040" ] }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1, "el": [ "0x19a5" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0xf048" ] }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0xe58b" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0xf8e6" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "0xf040" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0xdebc" ] }, { "c": 1.0, "d": "GetEnvironmentVariableW import", "e": [ "GetEnvironmentVariableW" ], "i": "well-known/malware/trojan/hijack-gen::get-environment-variable-w-import", "l": 1, "el": [ "0xf000" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0xf86c" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0xf038" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0xf030" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0xf78e" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.3.0.4" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "7dfb4b61051b3f3d37c000a465752ccf53cfe8be16466ef1c8f4e4c73a473775.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "40" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014", "el": [ "0x735" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xdf52" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0xf010" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0xf92e" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "MeetUpdate" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.6600000262260437, "d": "Create directories (Windows API Unicode)", "e": [ "CreateDirectoryW" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-w", "l": 2, "el": [ "0xf008" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 3564.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "BasicSolutions (C) 2025" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0xf852" ] }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Direct PEB access (GS segment)", "e": [ "65 48 8b 04 25 60 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-access-x64", "l": 1, "m": "B0032.014", "el": [ "0x92b" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 3564.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0xf752" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "sections.count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "7dfb4b61051b3f3d37c000a465752ccf53cfe8be16466ef1c8f4e4c73a473775.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetEnvironmentVariableW", "GetModuleFileNameW", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xde82", "0xdf02", "0xdf3e" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 3564.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariableW" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001", "el": [ "0xde82" ] }, { "a": "T1105", "c": 0.8199999928474426, "d": "Update.exe persistence filename", "e": [ "MeetUpdate.exe" ], "i": "objectives/command-and-control/dropper/delivery/github::update-exe-string", "l": 1, "m": "B0024", "el": [ "0xf86c" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0xf86c" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "7dfb4b61051b3f3d37c000a465752ccf53cfe8be16466ef1c8f4e4c73a473775.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x302e" ] }, { "c": 0.6000000238418579, "d": "GetEnvironmentVariable method", "e": [ "GetEnvironmentVariableW" ], "i": "metadata/package/config::get-env-var", "l": 2, "el": [ "0xde82" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0xf050" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 12.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 12.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.949999988079071, "d": "links kernel32 (GetEnvironmentVariableW, CreateDirectoryW, WriteFile, CloseHandle, HeapAlloc, ... +7 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "12 symbols" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.3.0.4" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0xf048", "0xf050" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.3.0.4" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] } ], "sha": "7dfb4b61051b3f3d37c000a465752ccf53cfe8be16466ef1c8f4e4c73a473775", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-03/7dfb4b61051b3f3d37c000a465752ccf53cfe8be16466ef1c8f4e4c73a473775.exe", "type": "pe" } ], "tv": "ca5ef" } }