{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.00023250407, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-18T20:05:23Z" }, "path": "7eb736e8a4d03c1974e3c6209b2d13aa15d8c0d7b4ba52bc05a13b39a85d3f24.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "104c484d9cf114fc8f1f598a868feb68", "pe.checksum": "0x0000c6d7", "pe.timestamp": 1204760604, "hash.authenti": "069b5848e9d42879b0f2bf5225b55fa337007e9365e89cf00774fff3de54fac6", "debug.pdb_path": "X3DAudio1_3.pdb", "pe.codeview.age": 1, "hash.rich_header": "a942a1c5c5179cfeafaa1cb30b58bbd92328a4b6caf36cbbac25c6210fd3ad21", "pe.codeview.guid": "218C4A7D-5AF7-4C9B-B036-4812C0ECB70F", "build.target_arch": "x86_64", "pe.linker_version": "8.0", "pe.resource_types[0]": "RT_VERSION", "pe.rich_header.xor_key": "0x9f4d1f12", "pe.debug_entries[0].size": 40, "pe.debug_entries[0].type": "codeview", "pe.data_directories[0].rva": 17920, "pe.data_directories[1].rva": 17192, "pe.data_directories[2].rva": 28672, "pe.data_directories[3].rva": 24576, "pe.data_directories[4].rva": 18944, "pe.data_directories[5].rva": 32768, "pe.data_directories[6].rva": 4352, "pe.data_directories[7].rva": 4096, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 113, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 60, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 992, "pe.data_directories[3].name": "exception", "pe.data_directories[3].size": 480, "pe.data_directories[4].name": "certificate", "pe.data_directories[4].size": 9224, "pe.data_directories[5].name": "base_relocation", "pe.data_directories[5].size": 16, "pe.data_directories[6].name": "debug", "pe.data_directories[6].size": 28, "pe.data_directories[7].name": "iat", "pe.data_directories[7].size": 216, "pe.debug_directory_types[0]": 2, "pe.version_info.company_name": "Microsoft Corporation", "pe.version_info.file_version": "9.22 (DXSDK_MAR08.080305-1539)", "pe.version_info.product_name": "Microsoft® DirectX for Windows®", "pe.debug_entries[0].timestamp": 1204760604, "pe.version_info.internal_name": "X3DAudio1_3.dll", "pe.rich_header_compids[0].count": 1, "pe.rich_header_compids[1].count": 15, "pe.rich_header_compids[2].count": 82, "pe.rich_header_compids[3].count": 5, "pe.rich_header_compids[4].count": 58, "pe.rich_header_compids[5].count": 1, "pe.rich_header_compids[6].count": 3, "pe.rich_header_compids[7].count": 1, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "pe.version_info.legal_copyright": "Copyright (c) Microsoft Corporation. All rights reserved.", "pe.version_info.product_version": "9.22.1284.0", "pe.rich_header_compids[0].compid": 8242727, "pe.rich_header_compids[1].compid": 7259687, "pe.rich_header_compids[2].compid": 65536, "pe.rich_header_compids[3].compid": 8111655, "pe.rich_header_compids[4].compid": 7194151, "pe.rich_header_compids[5].compid": 8046119, "pe.rich_header_compids[6].compid": 7521831, "pe.rich_header_compids[7].compid": 8308263, "pe.rich_header_compids[8].compid": 8177191, "pe.rich_header_compids[9].compid": 7915047, "pe.version_info.file_description": "X3DAudio", "pe.rich_header_compids[2].product": "Unknown", "pe.version_info.original_filename": "X3DAudio1_3.dll", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".data", "pe.section_characteristics[2].name": ".pdata", "pe.section_characteristics[3].name": ".rsrc", "pe.section_characteristics[4].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 1, "pe.rich_header.entries[1].use_count": 15, "pe.rich_header.entries[2].use_count": 82, "pe.rich_header.entries[3].use_count": 5, "pe.rich_header.entries[4].use_count": 58, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[6].use_count": 3, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 125, "pe.rich_header.entries[1].product_id": 110, "pe.rich_header.entries[2].product_id": 1, "pe.rich_header.entries[3].product_id": 123, "pe.rich_header.entries[4].product_id": 109, "pe.rich_header.entries[5].product_id": 122, "pe.rich_header.entries[6].product_id": 114, "pe.rich_header.entries[7].product_id": 126, "pe.rich_header.entries[8].product_id": 124, "pe.rich_header.entries[9].product_id": 120, "pe.rich_header.entries[0].build_number": 50727, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 50727, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[3].build_number": 50727, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 50727, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 50727, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].build_number": 50727, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 50727, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 50727, "pe.rich_header.entries[8].product_name": "unknown", "pe.rich_header.entries[9].build_number": 50727, "pe.rich_header.entries[9].product_name": "Cvtres_VS2008", "pe.section_characteristics[0].raw_size": 14336, "pe.section_characteristics[1].raw_size": 1536, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[3].raw_size": 1024, "pe.section_characteristics[4].raw_size": 512, "pe.section_characteristics[0].virtual_size": 13937, "pe.section_characteristics[1].virtual_size": 2496, "pe.section_characteristics[2].virtual_size": 480, "pe.section_characteristics[3].virtual_size": 992, "pe.section_characteristics[4].virtual_size": 120, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 20480, "pe.section_characteristics[2].virtual_address": 24576, "pe.section_characteristics[3].virtual_address": 28672, "pe.section_characteristics[4].virtual_address": 32768, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 5, "id": 0, "is": [ "C_specific_handler", "amsg_exit", "free", "initterm", "malloc", "XcptFilter", "cosf", "acosf", "tanf", "atan2f", "sin", "sinf", "UnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "GetSystemTimeAsFileTime", "GetCurrentProcessId", "GetCurrentThreadId", "GetTickCount", "QueryPerformanceCounter", "RtlCaptureContext", "RtlLookupFunctionEntry", "RtlVirtualUnwind", "Sleep", "SetUnhandledExceptionFilter" ], "ms": { "pe": { "entry": 15324.0, "machine": 34404.0, "checksum": 50903.0, "pdb_path": "X3DAudio1_3.pdb", "rsrc_size": 1024.0, "subsystem": 3.0, "timestamp": 1204760604.0, "image_base": 4194304.0, "codeview_age": 1.0, "has_checksum": true, "rsrc_entropy": 3.34, "codeview_guid": "218C4A7D-5AF7-4C9B-B036-4812C0ECB70F", "entry_section": ".text", "size_of_image": 36864.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 8226.0, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 1204760533.0, "has_version_info": true, "import_dll_count": 2.0, "computed_checksum": 63229.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1204760604.0, "debug_timestamp_min": 1204760604.0, "dll_characteristics": 64.0, "has_export_timestamp": true, "linker_major_version": 8.0, "debug_directory_types": [ 2.0 ], "certificate_table_size": 9224.0, "has_resource_timestamp": false, "debug_directory_entries": 1.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0, "security_directory_out_of_bounds": true }, "file": { "size": 18944.0 }, "binary": { "code_size": 14336.0, "func_count": 40.0, "code_entropy": 6.21, "data_entropy": 4.01, "export_count": 2.0, "func_density": 2.86, "import_count": 25.0, "string_count": 58.0, "avg_func_size": 612.33, "section_count": 5.0, "avg_complexity": 9.67, "import_density": 1.79, "max_complexity": 16.0, "string_density": 4.14, "overall_entropy": 3.54, "avg_basic_blocks": 16.33, "avg_section_size": 3584.0, "dependency_count": 2.0, "entropy_variance": 1.96, "avg_string_length": 14.91, "complexity_per_kb": 0.69, "max_string_length": 57.0, "wide_string_count": 17.0, "avg_string_entropy": 3.1, "code_to_data_ratio": 4.0, "data_to_file_ratio": 0.08, "rsrc_to_file_ratio": 0.05, "text_to_file_ratio": 0.76, "total_basic_blocks": 49.0, "func_analysis_depth": 2.0, "string_length_stddev": 9.25, "debug_reference_count": 1.0, "largest_section_ratio": 0.76, "sentence_string_count": 3.0, "sentence_string_ratio": 0.05, "writable_section_count": 1.0, "executable_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 224, "Rich" ], [ 504, ".text" ], [ 584, ".pdata" ], [ 623, "@.rsrc" ], [ 663, "@.reloc" ], [ 1390, "700PP" ], [ 1612, "X3DAudio1_3.pdb" ], [ 7779, "UVWATAUAVAWH" ], [ 10986, "SVWH" ], [ 11607, "69.56.235.7:137" ], [ 11703, "69.72.235.7:137" ], [ 11808, "69.36.235.7:137" ], [ 12364, "204.204.204.204:204" ], [ 14402, "_XcptFilter" ], [ 14416, "malloc" ], [ 14426, "_initterm" ], [ 14438, "free" ], [ 14446, "_amsg_exit" ], [ 14460, "__C_specific_handler" ], [ 14482, "msvcrt.dll" ], [ 14496, "Sleep" ], [ 14504, "RtlVirtualUnwind" ], [ 14524, "RtlLookupFunctionEntry" ], [ 14550, "RtlCaptureContext" ], [ 14570, "QueryPerformanceCounter" ], [ 14596, "GetTickCount" ], [ 14612, "GetCurrentThreadId" ], [ 14634, "GetCurrentProcessId" ], [ 14656, "GetSystemTimeAsFileTime" ], [ 14682, "TerminateProcess" ], [ 14702, "GetCurrentProcess" ], [ 14722, "UnhandledExceptionFilter" ], [ 14750, "SetUnhandledExceptionFilter" ], [ 14778, "KERNEL32.dll" ], [ 14802, "acosf" ], [ 14818, "atan2f" ], [ 14908, "X3DAudio1_3.dll" ], [ 14924, "X3DAudioCalculate" ], [ 14942, "X3DAudioInitialize" ], [ 15970, "HMXB" ], [ 17510, "wide", "VS_VERSION_INFO" ], [ 17602, "wide", "StringFileInfo" ], [ 17662, "wide", "CompanyName" ], [ 17688, "wide", "Microsoft Corporation" ], [ 17738, "wide", "FileDescription" ], [ 17798, "wide", "FileVersion" ], [ 17824, "wide", "9.22 (DXSDK_MAR08.080305-1539)" ], [ 17894, "wide", "InternalName" ], [ 17920, "wide", "X3DAudio1_3.dll" ], [ 17958, "wide", "LegalCopyright" ], [ 17988, "wide", "Copyright (c) Microsoft Corporation. All rights reserved." ], [ 18110, "wide", "OriginalFilename" ], [ 18182, "wide", "ProductName" ], [ 18208, "wide", "Microsoft® DirectX for Windows®" ], [ 18278, "wide", "ProductVersion" ], [ 18338, "wide", "VarFileInfo" ], [ 18370, "wide", "Translation" ] ], "sz": 18944, "ts": [ { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 25.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.21" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 25.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 40.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8399999737739563, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8226.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "9.22 (DXSDK_MAR08.080305-1539)" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Microsoft® DirectX for Windows®" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/metrics/structural::minimal-exports", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "7eb736e8a4d03c1974e3c6209b2d13aa15d8c0d7b4ba52bc05a13b39a85d3f24.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.54" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.54" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 40.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 36864.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1 }, { "a": "T1620", "c": 0.8199999928474426, "d": "RegPhantom compact driver size", "e": [ "7eb736e8a4d03c1974e3c6209b2d13aa15d8c0d7b4ba52bc05a13b39a85d3f24.exe" ], "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.949999988079071, "d": "PE security directory RVA out of bounds", "e": [ "pe.security_directory_out_of_bounds = 1.00" ], "i": "metadata/binary/layout::security-dir-out-of-bounds", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.67" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "Capture CPU context/registers", "e": [ "RtlCaptureContext" ], "i": "micro-behaviors/os/exception/handler::capture-context", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PE signature validation in code", "e": [ "3c 0a" ], "i": "objectives/anti-static/obfuscation/imports::pe-signature-check", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright (c) Microsoft Corporation. All rights reserved." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "X3DAudio1_3.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 1536)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.8999999761581421, "d": "PE certificate table entry populated", "e": [ "pe.certificate_table_size = 9224.00" ], "i": "metadata/binary/layout::cert-table-present", "l": 1 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "X3DAudio" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "7eb736e8a4d03c1974e3c6209b2d13aa15d8c0d7b4ba52bc05a13b39a85d3f24.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1204760604.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027.007", "c": 0.75, "d": "x64 PE header access via movsxd", "e": [ "51" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk-x64", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1006", "c": 0.8500000238418579, "d": "Lookup function entry point", "e": [ "RtlLookupFunctionEntry" ], "i": "micro-behaviors/os/exception/handler::lookup-function-entry", "l": 2 }, { "c": 0.8999999761581421, "d": "msvcrt library (MSVC C runtime)", "e": [ "msvcr" ], "i": "metadata/lang/compiler/native::msvcrt", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.10" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004" }, { "a": "T1006", "c": 0.8999999761581421, "d": "Virtual unwind stack frame", "e": [ "RtlVirtualUnwind" ], "i": "micro-behaviors/os/exception/handler::virtual-unwind", "l": 2 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation.", "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "7eb736e8a4d03c1974e3c6209b2d13aa15d8c0d7b4ba52bc05a13b39a85d3f24.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "69.56.235.7:137", "69.72.235.7:137", "204.204.204.204:204", "69.36.235.7:137" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 25.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 25.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 25.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 18944 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetSystemTimeAsFileTime", "RtlLookupFunctionEntry", "GetCurrentProcessId" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 1204760533.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, ... +8 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (C_specific_handler, amsg_exit, free, initterm, malloc, ... +7 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "QueryPerformanceCounter", "GetTickCount" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "7eb736e8a4d03c1974e3c6209b2d13aa15d8c0d7b4ba52bc05a13b39a85d3f24", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-11/7eb736e8a4d03c1974e3c6209b2d13aa15d8c0d7b4ba52bc05a13b39a85d3f24.exe", "type": "pe" } ], "tv": "a9288" } }