{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9961137771606445, "class": 1 }, { "id": 1, "prob": 0.9770103693008423, "class": 0 } ], "prob": 0.9961138, "class": 1, "oprob": 0.9794144, "models": [ { "m": "az", "prob": 0.9794144, "class": 0 }, { "m": "az/archive", "prob": 0.9683483, "class": 0 }, { "m": "az/zip", "prob": 0.7675482, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T18:08:34Z" }, "path": "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277.zip", "raw": { "v": "4", "fs": [ { "f": "KO₉(As₃I₅AlC₅CaCo₂Er₂PS₂)H₇(DsOs₃Po₄Cm₄CrDb₂Mg)Md₆(Bi₆SiBkHePa₂Pt)", "k": { "jar.entry_count": 1 }, "x": 85, "id": 0, "ms": { "file": { "size": 1504821.0 } }, "sz": 1504821, "ts": [ { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8999999761581421, "d": "Average function size over 50KB", "e": [ "binary.avg_func_size = 56772.33" ], "i": "metadata/binary/metrics/pe-details::extremely-large-avg-function", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Modbus write single register frame", "e": [ "00 01", "f7 75", "f4 fb", "00 00", "6a 78", "04 00", "62 37" ], "i": "micro-behaviors/communications/modbus::write-single-register", "l": 1 }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509" ], "i": "micro-behaviors/crypto/certificate/usage::x509-string", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "c": 0.949999988079071, "d": "links kernel32.dll (WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, ... +35 more)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8399999737739563, "d": "Large binary with few imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "golang.org/x/sys/windows/svc/mgr.Connect", "golang.org/x/sys/windows/svc/mgr.ConnectRemote", "internal/cpu.Initializeinternal/cpu.processOptionsinternal/cpu.indexByteinternal/cpu.doinitinternal/cpu.isSetinternal/cpu.c" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012" }, { "a": "T1055", "c": 0.949999988079071, "d": "SetThreadContext API reference", "e": [ "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/call::set-thread-context-dup", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.17" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.949999988079071, "d": "Dense embedded domain list", "e": [ "fs.FileMode", "flag.Value", "sync.entry", "big.divisor", "os.dirEntry", "log.Logger", "regexp.job", "sync.eface", "os.fileStat", "os.dirInfo", "rand.Source", "fmt.buffer", "cpu.option", "md5.digest", "abi.RegArgs", "sync.Mutex" ], "i": "metadata/package/quality::dense-domain-list", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8799999952316284, "d": "Go PE retains .symtab section", "e": [ ".symtab" ], "i": "metadata/lang/compiler/systems::go-pe-symtab", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.800000011920929, "d": "Set context plus resume", "e": [ "SetThreadContext", "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-set-resume", "l": 1 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Signal application directory", "e": [ "signal/" ], "i": "objectives/supply-chain/trojanized/app/asar::signal-app-path", "l": 1, "m": "E1478" }, { "c": 0.800000011920929, "d": "Suspend plus set context", "e": [ "SuspendThread", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-suspend-set", "l": 1 }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1485", "c": 1.0, "d": "Go filepath.WalkDir", "e": [ "…path/filepath.Joinpath/filepath.WalkDirpath/filepath.(*statDir…", "path/filepath.WalkDir" ], "i": "objectives/impact/wipe/disk/overwrite::go-filepath-walkdir", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "Go base64 decoding", "e": [ ".Decode" ], "i": "micro-behaviors/data/encode/base64::go-base64-decode", "l": 2 }, { "d": "Regex component marker", "e": [ "runtime.goexit", "runtime.main" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-2", "l": 1 }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "*map[crypto.Hash]asn1.RawValue", "crypto/rsa", "crypto/sha1", "*[]crypto.Hash", "crypto/sha512", "*map.bucket[crypto.Hash][]uint8", "crypto/ed25519/internal/edwards25519", "crypto/x509/pkix", "*[8]crypto.Hash", "crypto/sha256", "*map[crypto.Hash][]uint8", "crypto", "crypto/md5", "crypto/rand", "crypto/x509", "*map.bucket[crypto.Hash]asn1.RawValue" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-5", "l": 1, "m": "B0040" }, { "a": "T1055", "c": 0.8999999761581421, "d": "ResumeThread API reference", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/call::resume-thread-dup", "l": 2 }, { "a": "T1027.007", "c": 0.9399999976158142, "d": "Go x/sys/windows LazyProc call", "e": [ "golang.org/x/sys/windows.(*LazyProc).Call" ], "i": "micro-behaviors/os/api-resolution/manual::xsys-windows-lazyproc-call", "l": 3 }, { "d": "Regex component marker", "e": [ "runtime.goexit", "runtime.main.", "runtime.main" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-1", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt" ], "i": "micro-behaviors/crypto/library/keyword::encrypt-fn", "l": 3 }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 5550.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8799999952316284, "d": "Suspend set resume thread context", "e": [ "SuspendThread", "ResumeThread", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-get", "l": 1 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 5550.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "RtlGenRandom export-ordinal alias (SystemFunction036)", "e": [ "SystemFunction036" ], "i": "micro-behaviors/os/random/generator::system-function-036", "l": 3 }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cnil\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "*map[string]int", "newString", "fmtString", "*fmt.GoStringer", "*func(string)", "padString", "writeString", "*map[string]bool", "leadingString", "*func() string", "truncateString", "strings", "stringType", "WriteString", "string", "*chan string" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Create and arm waitable timer", "e": [ "SetWaitableTimer", "CreateWaitableTimerExW" ], "i": "micro-behaviors/time/schedule/waitable::create-and-set-waitable-timer", "l": 1 }, { "c": 0.8600000143051147, "d": "Extremely large average function size", "e": [ "binary.avg_func_size = 56772.33" ], "i": "metadata/binary/metrics/structural::giant-average-function", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.53" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Go RSA OAEP encryption", "e": [ "…encryptmath/big.NewIntcrypto/rsa.EncryptOAEPcrypto/rsa.checkPubio.…", "crypto/rsa.EncryptOAEP" ], "i": "objectives/impact/ransom/encrypt/filesystem::go-rsa-encrypt-oaep", "l": 4 }, { "a": "T1562.001", "c": 0.8999999761581421, "d": "SafeBoot cleanup targets major EDR vendor", "e": [ "eset", "eSet" ], "i": "objectives/impact/degrade/edr/teardown::safeboot-edr-vendor--rx-3", "l": 1 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1204.002", "c": 0.8500000238418579, "d": "PowerShell archive file extension marker", "e": [ ".zip" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.6600000262260437, "d": "Read files (Go)", "e": [ "os.(*File).Read" ], "i": "micro-behaviors/fs/file/read::read-go", "l": 2 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Open service control manager", "e": [ ".OpenSCManager" ], "i": "micro-behaviors/os/service/control::open-sc-manager", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-sleep-command-token", "l": 1, "m": "B0025" }, { "a": "T1005", "c": 0.6000000238418579, "d": "Signal app directory token", "e": [ "/signal/" ], "i": "objectives/collection/messaging/app::signal-app-dir", "l": 1 }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher" ], "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/aes import", "e": [ "…ocrypto/aes/aes_gcm.gocrypto/aes/cipher_asm.gocrypto/el…", "…gocrypto/cipher/gcm.gocrypto/aes/aes_gcm.gocrypto/aes/c…", "…initcrypto/cipher.initcrypto/aes.initcrypto/elliptic/in…", "crypto/aes/aes_gcm.go", "crypto/aes.init", "crypto/aes/cipher_asm.go" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-aes", "l": 1 }, { "c": 1.0, "d": ".crypto extension", "e": [ "type..eq.crypto/sha256.digest", "…to/sha256.blocktype..eq.crypto/sha256.digestcrypto/ds…", "…/sha1.blockAVX2type..eq.crypto/sha1.digestcrypto/x509…", "type..eq.crypto/sha1.digest" ], "i": "objectives/impact/ransom/encrypt/threat-text::ext-crypto", "l": 1 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.800000011920929, "d": "Suspend plus get context", "e": [ "SuspendThread", "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-suspend-get", "l": 1 }, { "c": 0.9200000166893005, "d": "Large binary with few functions", "e": [ "binary.func_count = 3.00" ], "i": "metadata/package/metrics::recovered-function-count-under-10", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.17" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 5550.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Java DPAPI unprotect call", "e": [ "UnprotectData" ], "i": "objectives/credential-access/discord/token::java-crypt-unprotect-data", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "input/output error", "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "SuspendThread API reference", "e": [ "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime/call::suspend-thread", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "crypto/rsa.EncryptOAEP", "crypto/rsa", "*[8]crypto.Hash", "crypto/elliptic/internal/fiat.p521ToBytes", "*[]crypto.Hash", "crypto/sha256.init.0", "crypto.Hash.Size", "crypto/cipher.init", "type..eq.crypto/sha256.digest", "crypto/aes.init", "crypto/sha1", "crypto/sha256.(*digest).Reset", "*map.bucket[crypto.Hash]asn1.RawValue", "crypto/sha256.New224", "crypto/x509", "crypto/md5" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr", "l": 1 }, { "a": "T1486", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "internal/cpu/cpu.gointernal/cpu/cpu_x86.gointernal/cpu/cpu_x86.s\u003cautogenerated\u003eruntime/internal/sys/intrinsics_common.goint", "crypto/rsa/rsa.go", "crypto/rsa/pkcs1v15.go" ], "i": "objectives/impact/ransom/encrypt/hybrid::encrypted-trailer-layout-cond-1--inline-9320", "l": 1, "m": "B0040" }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_func_size = 56772.33" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "v0.0" ], "i": "metadata/package/help::version-text", "l": 2 }, { "c": 0.8799999952316284, "d": "Suspend get resume thread context", "e": [ "ResumeThread", "GetThreadContext", "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-set", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Go x/sys TerminateProcess wrapper", "e": [ "golang.org/x/sys/windows.TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::go-xsys-terminate-process", "l": 3, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Create extended waitable timer", "e": [ "CreateWaitableTimerExW" ], "i": "micro-behaviors/time/schedule/waitable::create-waitable-timer-ex", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "magic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-7", "l": 1, "m": "C0027" }, { "a": "T1567.002", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "*sync.readOnly", "*[8]*sync.entry", "*[]*sync.entry", "baselevel 2 not synchronizedlink", "*sync.eface", "*[]sync.eface", "*sync.WaitGroup", "*sync.noCopy", "*sync.poolLocal", "asyncSafePoint", "*sync.poolChainElt", "*sync.Mutex", "*sync.poolLocalInternal", "*sync.poolChain", "runtime.wantAsyncPreempt", "*sync.entry" ], "i": "well-known/tool/dual-use/megacmd::megacmd-binary-name--rx-5", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP endpoint state error", "e": [ "transport endpoint is not connected", "transport endpoint is already connected" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "GetThreadContext API reference", "e": [ "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/call::get-thread-context-dup", "l": 2 }, { "c": 0.6000000238418579, "d": "System32 substring reference", "e": [ "golang.org/x/sys/windows.canDoSearchSystem32", "…/sys/windows.canDoSearchSystem32golang.org/x/sys/window…", "golang.org/x/sys/windows.initCanDoSearchSystem32", "…/windows.initCanDoSearchSystem32golang.org/x/sys/window…" ], "i": "micro-behaviors/fs/path/system::system32-substr", "l": 2 }, { "c": 0.800000011920929, "d": "Suspend plus resume thread", "e": [ "SuspendThread", "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-suspend-resume", "l": 1 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "00 02 0e c0", "0c 01 03 01", "ad 05 16 b0", "9b 05 16 9e", "97 01 02 13", "b3 05 16 b6", "8f 05 16 92", "bf 05 16 c2", "b9 05 16 bc", "a1 05 16 a4", "89 05 16 8c", "83 05 16 86", "95 05 16 98", "04 03 26 04", "a7 05 16 aa", "c5 05 16 c8" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c8" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "golang.org/x/sys/windows.CreateProcess", "…olang.org/x/sys/windows.CreateProcessgolang.org/x/sys/window…" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Get context plus resume", "e": [ "GetThreadContext", "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-resume", "l": 1 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Go LazyProc API resolution", "e": [ "golang.org/x/sys/windows.LoadDLL", "GetProcAddress", "golang.org/x/sys/windows.(*LazyProc).Call" ], "i": "micro-behaviors/os/api-resolution/manual::go-lazyproc-resolution", "l": 3 }, { "a": "T1552.004", "d": "Generic key extension", "e": [ ".key" ], "i": "objectives/collection/file-targeting/filter::key-extension", "l": 1, "m": "B0024" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "cacheZone", "mcache", "goidcache", "cache", "cacheStart", "sudogcache", "stackcache", "refillAllocCache", "goidcacheend", "pcache", "mspancache", "*runtime.pageCache", "runtime.(*mcache).nextFree", "allocCache", "*runtime.mcache", "cacheEnd" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 1.0, "d": "go/rs language suffix", "e": [ "runtime.rt0_go" ], "i": "micro-behaviors/data/text/malware/terms::malware-lang-suffix", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 40.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-w", "l": 3 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 0.800000011920929, "d": "Go crypto/cipher import", "e": [ "…d64.scrypto/dsa/dsa.gocrypto/cipher/gcm.gocrypto/aes/aes_g…", "….digestcrypto/dsa.initcrypto/cipher.initcrypto/aes.initcr…", "crypto/cipher/gcm.go", "crypto/cipher.init" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-cipher", "l": 1 }, { "a": "T1105", "c": 0.8600000143051147, "d": "RAT screen capture command", "e": [ "record" ], "i": "objectives/command-and-control/remote-command/tasking::rat-screen-capture-command", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Giant embedded string blob metric", "e": [ "binary.max_string_length = 81872.00" ], "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "saveInfoFromPath", "io/fs.(*PathError).Error", "runtime.name.pkgPath", "reflect.(*rtype).PkgPath", "reflect.name.pkgPath", "*fs.PathError", "reflect.(*funcType).PkgPath", "appendNameToPath", "syscall.FullPath", "os.IsPathSeparator", "reflect.(*ptrType).PkgPath", "type..eq.io/fs.PathError", "internal/reflectlite.(*rtype).PkgPath", "runtime.initLongPathSupport", "syscall.GetFullPathName", "pkgPath" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PE with heavy stack string obfuscation", "e": [ "SystemFunction036", "runtime error: ", "ntdll.dl", "AddDllDirectory", "l32.dll", "NtWaitForSingleObject", "timeBeginPeriod", "winmm.dl", "kernel32.dll", "advapi32.dll", "LoadLibraryExW", "LoadLibraryExA", "AddVectoredContinueHandler", "binary.func_count = 3.00", "RtlGetCurrentPeb", "RtlGetNtVersionNumbers" ], "i": "objectives/anti-static/obfuscation/string/anomaly::stack-string-obfuscated-pe", "l": 4, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "attempting to link in too many shared libraries", "shared", "can not access a needed shared library", "cannot exec a shared library directly", "accessing a corrupted shared library", "pointer attempting to link in too many shared" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-6", "l": 1, "m": "C0027" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "runtime.publicationBarrier", "crypto/x509.ParsePKCS1PublicKey", "internal/cpu.Initializeinternal/cpu.processOptionsinternal/cpu.indexByteinternal/cpu.doinitinternal/cpu.isSetinternal/cpu.c", "crypto/rsa.(*PublicKey).Size" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "d": "overflow keyword", "e": [ "setoverflow", "runtime.panicoverflow", "integer overflow", "runtime.(*hmap).newoverflow", "newoverflow", "overflowmissing closing )missing", "incrnoverflow", "overflow", "…anicdivideruntime.panicoverflowruntime.deferprocStack…", "…flowruntime.(*hmap).newoverflowruntime.(*bmap).overflo…", "…flowruntime.(*bmap).setoverflowruntime.(*hmap).createO…", "oldoverflow", "noverflow", "runtime.(*bmap).overflow", "runtime.(*bmap).setoverflow", "…apruntime.(*hmap).incrnoverflowruntime.(*hmap).newover…" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext exec command token", "e": [ "exec" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-exec-command-token", "l": 1, "m": "B0025" }, { "a": "T1027.007", "c": 0.8799999952316284, "d": "Go x/sys/windows DLL loader", "e": [ "golang.org/x/sys/windows.LoadDLL" ], "i": "micro-behaviors/os/api-resolution/manual::xsys-windows-load-dll", "l": 3 }, { "a": "T1485", "c": 1.0, "d": "Go math/rand package", "e": [ "math/rand" ], "i": "objectives/impact/wipe/disk/overwrite::go-math-rand", "l": 1 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/rsa import", "e": [ "crypto/rsa.init", "…ath/big.(*Int).SetBytescrypto/rsa.initcrypto/sha512.init…", "…il.gocrypto/rsa/rsa.gocrypto/rsa/pkcs1v15.gocrypto/sha5…", "crypto/rsa.encrypt", "…initcrypto/rsa.mgf1XORcrypto/rsa.incCountercrypto/rsa.e…", "crypto/rsa/rsa.go", "…encryptmath/big.NewIntcrypto/rsa.EncryptOAEPcrypto/rsa.…", "…lErrorcrypto/rand.initcrypto/rsa.mgf1XORcrypto/rsa.incC…", "crypto/rsa.(*PublicKey).Size", "crypto/rsa.incCounter", "…crypto/rsa.EncryptOAEPcrypto/rsa.checkPubio.ReadFullcr…", "crypto/rsa.EncryptOAEP", "crypto/rsa/pkcs1v15.go", "…Rcrypto/rsa.incCountercrypto/rsa.encryptmath/big.NewInt…", "….gocrypto/rand/util.gocrypto/rsa/rsa.gocrypto/rsa/pkcs1…", "crypto/rsa" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-rsa", "l": 1 }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugFlags info class (mov edx, 0x1F)", "e": [ "BA 1F 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-flags-info-class", "l": 1, "m": "B0001" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 3.33" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8799999952316284, "d": "Get set resume thread context", "e": [ "GetThreadContext", "ResumeThread", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-suspend", "l": 1 }, { "d": "encoding/base64 package import", "e": [ "…ding/base64.NewEncodingencoding/base64.(*Encoding).Encodeenco…", "…enencoding/base64.initencoding/base64.Encoding.WithPaddingty…", "type..eq.encoding/base64.Encoding", "encoding/base64.init", "encoding/base64.(*Encoding).EncodedLen", "encoding/base64/base64.go", "encoding/base64.(*Encoding).Encode", "encoding/base64.(*Encoding).EncodeToString", "…coding/binary/varint.goencoding/base64/base64.go??crypto/cry…", "…ntencoding/binary.initencoding/base64.NewEncodingencoding/ba…", "…se64.(*Encoding).Encodeencoding/base64.(*Encoding).EncodeToStr…", "…ncoding).EncodeToStringencoding/base64.(*Encoding).EncodedLen…", "…ng.WithPaddingtype..eq.encoding/base64.EncodingABRt1oby.(*Qra…", "….(*Encoding).EncodedLenencoding/base64.initencoding/base64.En…", "encoding/base64.Encoding.WithPadding", "encoding/base64" ], "i": "objectives/command-and-control/beacon/poll::encoding-base64-import", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-word", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Many stack-constructed strings detected", "e": [ "runtime error: ", "SystemFunction036", "RtlGetNtVersionNumbers", "LoadLibraryExW", "timeEndPeriod", "ntdll.dl", "LoadLibraryExA", "RtlGetCurrentPeb", "kernel32.dll", "NtWaitForSingleObject", "winmm.dl", "AddVectoredContinueHandler", "l32.dll", "AddDllDirectory", "advapi32.dll", "timeBeginPeriod" ], "i": "objectives/anti-static/obfuscation/string/anomaly::many-stack-strings", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Register vectored exception handler", "e": [ "AddVectoredExceptionHandler" ], "i": "micro-behaviors/os/exception/error-handling::add-vectored-exception-handler", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 33120.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 0.6600000262260437, "d": "List directory contents (Go)", "e": [ ".ReadDir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-go", "l": 2 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.07" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.699999988079071, "d": "Go base64 encoding", "e": [ ".EncodedLen", ".EncodeToString", ".Encode" ], "i": "micro-behaviors/data/encode/base64::go-base64-encode", "l": 2 }, { "a": "T1059", "c": 0.8500000238418579, "d": "Go binary uses os/exec", "e": [ "…os/types.goos/error.goos/exec_windows.goos/executabl…", "os/exec.go", "os/executable_windows.go", "…ows.goos/executable.goos/executable_windows.goos/fil…", "…t.goos/stat_windows.goos/exec.goos/tempfile.gofmt/e…", "os/exec_windows.go", "…r.goos/exec_windows.goos/executable.goos/executable_…", "os/executable.go" ], "i": "micro-behaviors/process/create/system::go-os-exec-pclntab", "l": 2, "m": "E1059" }, { "d": "Regex component marker", "e": [ "runtime.mstart" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-3", "l": 1 }, { "c": 1.0, "d": "Makefile all target", "e": [ "syscall: string with NUL passed to StringToUTF16" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "os.commandLineToArgv", "flag.commandLineUsage", "…Argos.appendBSBytesos.commandLineToArgvos.Executable…", "….Parseflag.init.0flag.commandLineUsageflag.glob..fun…" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 1 }, { "c": 0.699999988079071, "d": "Reference to tempfile module", "e": [ "os/tempfile.go", "…indows.goos/exec.goos/tempfile.gofmt/errors.gofmt/fo…" ], "i": "micro-behaviors/fs/temp/reference::tempfile-ref", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 3.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Suspend get set thread context", "e": [ "GetThreadContext", "SetThreadContext", "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-resume", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Get and set context", "e": [ "GetThreadContext", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-set", "l": 1 }, { "c": 0.75, "d": "Go time.Sleep delay call", "e": [ "time.Sleep" ], "i": "micro-behaviors/time/sleep/interval::go-time-sleep", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 5550.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dl" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "can not access a needed shared library", "pointer attempting to link in too many shared", "cannot exec a shared library directly", "attempting to link in too many shared libraries", "shared", "accessing a corrupted shared library" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-5", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "transport endpoint is already connected", "transport endpoint is not connected" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-13", "l": 1 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 } ], "sha": "7eb9eb6fa6bd7ec5c0d09eb4a526db80b72d04701a96ebbb427490c007136c25", "path": "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277.zip", "type": "zip" }, { "f": "KO₉(As₃I₅AlC₅CaCo₂Er₂PS₂)H₇(DsOs₃Po₄Cm₄CrDb₂Mg)Md₆(Bi₆SiBkHePa₂Pt)", "x": 85, "dp": 1, "id": 1, "is": [ "WriteFile", "WriteConsoleW", "WaitForMultipleObjects", "WaitForSingleObject", "VirtualQuery", "VirtualFree", "VirtualAlloc", "SwitchToThread", "SuspendThread", "Sleep", "SetWaitableTimer", "SetUnhandledExceptionFilter", "SetProcessPriorityBoost", "SetEvent", "SetErrorMode", "SetConsoleCtrlHandler", "ResumeThread", "PostQueuedCompletionStatus", "LoadLibraryA", "LoadLibraryW", "SetThreadContext", "GetThreadContext", "GetSystemInfo", "GetSystemDirectoryA", "GetStdHandle", "GetQueuedCompletionStatusEx", "GetProcessAffinityMask", "GetProcAddress", "GetEnvironmentStringsW", "GetConsoleMode", "FreeEnvironmentStringsW", "ExitProcess", "DuplicateHandle", "CreateWaitableTimerExW", "CreateThread", "CreateIoCompletionPort", "CreateFileA", "CreateEventA", "CloseHandle", "AddVectoredExceptionHandler" ], "ms": { "pe": { "machine": 34404.0, "checksum": 0.0, "subsystem": 2.0, "image_base": 4194304.0, "entry_section": ".text", "size_of_image": 4448256.0, "file_alignment": 512.0, "characteristics": 546.0, "entry_point_rva": 348960.0, "size_of_headers": 1536.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 1.0, "computed_checksum": 4094620.0, "section_alignment": 4096.0, "timestamp_anomaly": true, "timestamp_is_zero": true, "number_of_sections": 6.0, "resource_timestamp": 0.0, "dll_characteristics": 33120.0, "linker_major_version": 3.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 4052480.0 }, "binary": { "code_size": 2600448.0, "func_count": 3.0, "entry_point": 348960.0, "code_entropy": 5.99, "data_entropy": 4.52, "func_density": 0.0, "import_count": 40.0, "string_count": 5550.0, "avg_func_size": 56772.33, "section_count": 6.0, "avg_complexity": 3.33, "import_density": 0.02, "max_complexity": 7.0, "string_density": 2.19, "overall_entropy": 4.17, "avg_basic_blocks": 6.33, "avg_section_size": 675157.31, "dependency_count": 1.0, "entropy_variance": 2.01, "avg_string_length": 36.41, "complexity_per_kb": 0.0, "max_string_length": 81872.0, "wide_string_count": 2.0, "writable_sections": 2.0, "avg_string_entropy": 3.53, "code_to_data_ratio": 1.79, "data_to_file_ratio": 0.03, "entry_point_is_rva": true, "text_to_file_ratio": 0.64, "total_basic_blocks": 19.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_strings": 1.0, "string_length_stddev": 1102.62, "largest_section_ratio": 0.64, "sentence_string_count": 406.0, "sentence_string_ratio": 0.07, "behavioral_import_ratio": 0.1, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 392, ".text" ], [ 471, "@.data" ], [ 512, ".idata" ], [ 552, ".reloc" ], [ 591, "B.symtab" ], [ 28349, "stack", "runtime error: " ], [ 168115, "stack", "kernel32.dll" ], [ 168147, "stack", "l32.dll" ], [ 168216, "stack", "AddDllDirectory" ], [ 168303, "stack", "AddVectoredContinueHandler" ], [ 168431, "stack", "LoadLibraryExA" ], [ 168527, "stack", "LoadLibraryExW" ], [ 168654, "stack", "advapi32.dll" ], [ 168711, "stack", "SystemFunction036" ], [ 168816, "stack", "ntdll.dl" ], [ 168870, "stack", "NtWaitForSingleObject" ], [ 168975, "stack", "RtlGetCurrentPeb" ], [ 169085, "stack", "RtlGetNtVersionNumbers" ], [ 169199, "stack", "winmm.dl" ], [ 169253, "stack", "timeBeginPeriod" ], [ 169340, "stack", "timeEndPeriod" ], [ 169446, "stack", "ws2_32.dll" ], [ 169503, "stack", "WSAGetOverlappedResult" ], [ 169620, "stack", "wine_get_version" ], [ 169904, "stack", "powrprof.dll" ], [ 169961, "stack", "PowerRegisterSuspendResumeNotification" ], [ 172341, "stack", "GetSystemTimeAsFileTime" ], [ 172443, "stack", "QueryPerformanceCounter" ], [ 172541, "stack", "QueryPerformanceFrequency" ], [ 541267, "stack", "time.Dat" ], [ 541466, "stack", ", time." ], [ 542604, "stack", "time.Loc" ], [ 542703, "stack", "time.Location(" ], [ 543068, "stack", "time.UTC" ], [ 646857, "stack", "\u003cnil\u003e" ], [ 647702, "stack", "\u003cnil\u003e" ], [ 650653, "stack", "(nil)" ], [ 653366, "stack", "\u003cnil\u003e" ], [ 653705, "stack", "(PANIC=" ], [ 654009, "stack", " method: " ], [ 659123, "stack", "map[" ], [ 659747, "stack", "(nil)" ], [ 659928, "stack", "\u003cnil\u003e" ], [ 660323, "stack", "(nil)" ], [ 661327, "stack", "(nil)" ], [ 662744, "stack", "\u003cnil\u003e" ], [ 667556, "stack", "(BADINDE" ], [ 667876, "stack", "(MISSING)" ], [ 668921, "stack", "%!(BADWIDTH)" ], [ 669416, "stack", "%!(BADPREC)" ], [ 670306, "stack", "%!(EXTRA " ], [ 670840, "stack", "\u003cnil\u003e" ], [ 671669, "stack", "%!(NOVER" ], [ 894210, "invalid " ], [ 894225, "d length" ], [ 895198, "key mism" ], [ 982786, "NetApiBufferFree" ], [ 1034849, "stack", "Xfffffffffffffffffffffffffffffff" ], [ 1070936, "stack", "^t+T" ], [ 1497107, "stack", "=G(`" ], [ 1513596, "stack", "s|`V" ], [ 1518050, "stack", "UEL6" ], [ 1526975, "stack", "!130" ], [ 1533753, "stack", ":YaD" ], [ 1637910, "stack", "X@b]" ], [ 1665151, "stack", "xMmC" ], [ 1698737, "stack", "_Z:*" ], [ 1758545, "stack", "Hzs3" ], [ 1769076, "stack", "X{rC" ], [ 1792755, "stack", "d/f$" ], [ 1801783, "stack", "NH\u0026Q" ], [ 1812435, "stack", "\\%:L" ], [ 1902021, "stack", "Mtb`" ], [ 1918079, "stack", ",KDl" ], [ 1983561, "stack", "FJGA" ], [ 1999161, "stack", ",5;d" ], [ 2180505, "stack", " SMv" ], [ 2200112, "stack", "T.16" ], [ 2257745, "stack", "lo]P" ], [ 2259277, "stack", "d5E%" ], [ 2273183, "stack", "/-aZ" ], [ 2275743, "stack", "+Zmj" ], [ 2424995, "stack", "{txr" ], [ 2427984, "To decrypt all t" ], [ 2428014, " the data and to prevent exfiltrated files to be disclos" ], [ 2443862, "stack", "QK_'" ], [ 2456526, " hire a recovery company. They can't decrypt without the" ], [ 2465023, "stack", "Hbl|" ], [ 2466801, "pt %s %s" ], [ 2466946, "Erasing " ], [ 2466961, "sing key" ], [ 2467842, "Exportin" ], [ 2467857, "ting key" ], [ 2467988, ".key" ], [ 2472083, "stack", "WS]L" ], [ 2474434, "net.exe " ], [ 2476310, "stack", "V]O\\" ], [ 2477165, "stack", "EJ,W" ], [ 2478411, "stack", ".SPP" ], [ 2480083, "3Xwk\"TLWHkyWBXK[" ], [ 2548226, "stack", "win4" ], [ 2549986, "stack", "h\"qq" ], [ 2551544, "stack", "s}m+" ], [ 2562449, "stack", "ceSc" ], [ 2562545, "stack", "wenj" ], [ 2580354, "wevtutil.exe cl " ], [ 2580384, "e cl application" ], [ 2582690, "bcdedit.exe /set" ], [ 2582720, "set {default} recoveryenabled no" ], [ 2590594, "Killing " ], [ 2590609, "illing processes" ], [ 2602898, "main" ], [ 2602916, "time" ], [ 2603276, "Zone" ], [ 2603300, "base" ], [ 2603330, "code" ], [ 2603354, "data" ], [ 2603360, "date" ], [ 2603384, "elem" ], [ 2603402, "feed" ], [ 2603408, "file" ], [ 2603432, "free" ], [ 2603456, "goid" ], [ 2603480, "head" ], [ 2603486, "heap" ], [ 2603492, "info" ], [ 2603498, "init" ], [ 2603510, "ireg" ], [ 2603516, "itoa" ], [ 2603552, "line" ], [ 2603570, "load" ], [ 2603582, "make" ], [ 2603606, "mode" ], [ 2603618, "mono" ], [ 2603624, "name" ], [ 2603648, "node" ], [ 2603696, "path" ], [ 2603720, "pool" ], [ 2603774, "read" ], [ 2603816, "seed" ], [ 2603822, "seek" ], [ 2603834, "sema" ], [ 2603852, "size" ], [ 2603870, "tail" ], [ 2603876, "text" ], [ 2603888, "used" ], [ 2603894, "user" ], [ 2603918, "wait" ], [ 2603948, "zero" ], [ 2603954, "zone" ], [ 2604312, "Write" ], [ 2604340, "align" ], [ 2604347, "alloc" ], [ 2604375, "cache" ], [ 2604403, "clear" ], [ 2604410, "close" ], [ 2604417, "count" ], [ 2604424, "csema" ], [ 2604431, "cutab" ], [ 2604438, "datap" ], [ 2604445, "dense" ], [ 2604459, "edata" ], [ 2604466, "elems" ], [ 2604487, "equal" ], [ 2604494, "errno" ], [ 2604501, "etext" ], [ 2604508, "everr" ], [ 2604515, "evict" ], [ 2604536, "extra" ], [ 2604543, "failf" ], [ 2604550, "files" ], [ 2604634, "group" ], [ 2604641, "hash0" ], [ 2604648, "idxhi" ], [ 2604655, "idxlo" ], [ 2604662, "incgo" ], [ 2604669, "index" ], [ 2604676, "inter" ], [ 2604683, "iregs" ], [ 2604690, "is224" ], [ 2604704, "isdir" ], [ 2604718, "isutc" ], [ 2604725, "limit" ], [ 2604732, "local" ], [ 2604746, "magic" ], [ 2604781, "minus" ], [ 2604788, "mpool" ], [ 2604795, "mutex" ], [ 2604823, "param" ], [ 2604851, "pread" ], [ 2604879, "reset" ], [ 2604886, "reuse" ], [ 2604893, "rsema" ], [ 2604907, "runes" ], [ 2604949, "space" ], [ 2604970, "state" ], [ 2604991, "timer" ], [ 2605019, "valid" ], [ 2605026, "value" ], [ 2605040, "wbuf1" ], [ 2605047, "wbuf2" ], [ 2605054, "write" ], [ 2605061, "wsema" ], [ 2605658, "crypto" ], [ 2605666, "errors" ], [ 2605674, "regexp" ], [ 2605682, "unsafe" ], [ 2606242, "Writev" ], [ 2606250, "_defer" ], [ 2606258, "_panic" ], [ 2606274, "actual" ], [ 2606314, "append" ], [ 2606338, "bucket" ], [ 2606346, "closed" ], [ 2606354, "common" ], [ 2606362, "concat" ], [ 2606370, "decref" ], [ 2606378, "delete" ], [ 2606394, "divmod" ], [ 2606402, "encode" ], [ 2606410, "etypes" ], [ 2606418, "expand" ], [ 2606426, "extend" ], [ 2606434, "factor" ], [ 2606450, "formal" ], [ 2606458, "frames" ], [ 2606482, "gcdata" ], [ 2606490, "goexit" ], [ 2606498, "handle" ], [ 2606506, "hasher" ], [ 2606522, "incref" ], [ 2606530, "inputs" ], [ 2606538, "insert" ], [ 2606546, "int31n" ], [ 2606554, "intbuf" ], [ 2606578, "labels" ], [ 2606586, "layout" ], [ 2606594, "length" ], [ 2606602, "locabs" ], [ 2606610, "lookup" ], [ 2606626, "mcache" ], [ 2606634, "mcount" ], [ 2606642, "method" ], [ 2606658, "nelems" ], [ 2606666, "nfiles" ], [ 2606682, "noscan" ], [ 2606690, "npages" ], [ 2606706, "offset" ], [ 2606714, "opaque" ], [ 2606722, "output" ], [ 2606730, "palloc" ], [ 2606738, "parent" ], [ 2606746, "parsed" ], [ 2606754, "pcache" ], [ 2606762, "pcfile" ] ], "sz": 4052480, "ts": [ { "c": 0.699999988079071, "d": "Reference to tempfile module", "e": [ "os/tempfile.go", "…indows.goos/exec.goos/tempfile.gofmt/errors.gofmt/fo…" ], "i": "micro-behaviors/fs/temp/reference::tempfile-ref", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d", "e": [ "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "Go binary uses os/exec", "e": [ "…t.goos/stat_windows.goos/exec.goos/tempfile.gofmt/e…", "os/exec.go", "…os/types.goos/error.goos/exec_windows.goos/executabl…", "…r.goos/exec_windows.goos/executable.goos/executable_…", "os/executable_windows.go", "os/exec_windows.go", "os/executable.go", "…ows.goos/executable.goos/executable_windows.goos/fil…" ], "i": "micro-behaviors/process/create/system::go-os-exec-pclntab", "l": 2, "m": "E1059" }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dl" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1027.007", "c": 0.8799999952316284, "d": "Go x/sys/windows DLL loader", "e": [ "golang.org/x/sys/windows.LoadDLL" ], "i": "micro-behaviors/os/api-resolution/manual::xsys-windows-load-dll", "l": 3 }, { "c": 0.8399999737739563, "d": "Large binary with few imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext exec command token", "e": [ "exec" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-exec-command-token", "l": 1, "m": "B0025" }, { "c": 1.0, "d": ".crypto extension", "e": [ "type..eq.crypto/sha256.digest", "type..eq.crypto/sha1.digest", "…to/sha256.blocktype..eq.crypto/sha256.digestcrypto/ds…", "…/sha1.blockAVX2type..eq.crypto/sha1.digestcrypto/x509…" ], "i": "objectives/impact/ransom/encrypt/threat-text::ext-crypto", "l": 1 }, { "a": "T1485", "c": 1.0, "d": "Go filepath.WalkDir", "e": [ "…path/filepath.Joinpath/filepath.WalkDirpath/filepath.(*statDir…", "path/filepath.WalkDir" ], "i": "objectives/impact/wipe/disk/overwrite::go-filepath-walkdir", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 5550.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "Go base64 decoding", "e": [ ".Decode" ], "i": "micro-behaviors/data/encode/base64::go-base64-decode", "l": 2 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "a7 05 16 aa", "04 03 26 04", "b9 05 16 bc", "b3 05 16 b6", "c5 05 16 c8", "8f 05 16 92", "0c 01 03 01", "ad 05 16 b0", "83 05 16 86", "89 05 16 8c", "95 05 16 98", "9b 05 16 9e", "a1 05 16 a4", "00 02 0e c0", "bf 05 16 c2", "97 01 02 13" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1567.002", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "*sync.poolChain", "baselevel 2 not synchronizedlink", "asyncSafePoint", "*sync.WaitGroup", "*sync.poolLocal", "*sync.poolChainElt", "*sync.poolLocalInternal", "*sync.Mutex", "*[]*sync.entry", "*sync.eface", "*[]sync.eface", "*[8]*sync.entry", "*sync.readOnly", "*sync.noCopy", "*sync.entry", "runtime.wantAsyncPreempt" ], "i": "well-known/tool/dual-use/megacmd::megacmd-binary-name--rx-5", "l": 1, "m": "B0030" }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)", "e": [ "BA 1E 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class", "l": 1, "m": "B0001" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)", "e": [ "b9", "b8" ], "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "l": 1 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher" ], "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "cacheStart", "goidcacheend", "cacheEnd", "runtime.(*mcache).nextFree", "refillAllocCache", "cacheZone", "pcache", "*runtime.pageCache", "allocCache", "sudogcache", "mspancache", "*runtime.mcache", "goidcache", "cache", "stackcache", "mcache" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "RtlGenRandom export-ordinal alias (SystemFunction036)", "e": [ "SystemFunction036" ], "i": "micro-behaviors/os/random/generator::system-function-036", "l": 3 }, { "c": 0.8999999761581421, "d": "Average function size over 50KB", "e": [ "binary.avg_func_size = 56772.33" ], "i": "metadata/binary/metrics/pe-details::extremely-large-avg-function", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Go x/sys TerminateProcess wrapper", "e": [ "golang.org/x/sys/windows.TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::go-xsys-terminate-process", "l": 3, "m": "B0033" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.17" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "….Parseflag.init.0flag.commandLineUsageflag.glob..fun…", "os.commandLineToArgv", "flag.commandLineUsage", "…Argos.appendBSBytesos.commandLineToArgvos.Executable…" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "magic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-7", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_func_size = 56772.33" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 5550.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.17" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1485", "c": 1.0, "d": "Go math/rand package", "e": [ "math/rand" ], "i": "objectives/impact/wipe/disk/overwrite::go-math-rand", "l": 1 }, { "c": 0.8799999952316284, "d": "Go PE retains .symtab section", "e": [ ".symtab" ], "i": "metadata/lang/compiler/systems::go-pe-symtab", "l": 2 }, { "a": "T1622", "c": 0.9200000166893005, "d": "ProcessDebugFlags info class (mov edx, 0x1F)", "e": [ "BA 1F 00 00 00" ], "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-flags-info-class", "l": 1, "m": "B0001" }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "a": "T1195.002", "c": 0.699999988079071, "d": "Signal application directory", "e": [ "signal/" ], "i": "objectives/supply-chain/trojanized/app/asar::signal-app-path", "l": 1, "m": "E1478" }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "c": 1.0, "d": "go/rs language suffix", "e": [ "runtime.rt0_go" ], "i": "micro-behaviors/data/text/malware/terms::malware-lang-suffix", "l": 1 }, { "c": 0.949999988079071, "d": "Dense embedded domain list", "e": [ "regexp.job", "cpu.option", "md5.digest", "sync.eface", "fs.FileMode", "os.dirInfo", "log.Logger", "os.fileStat", "abi.RegArgs", "os.dirEntry", "fmt.buffer", "flag.Value", "sync.entry", "big.divisor", "sync.Mutex", "rand.Source" ], "i": "metadata/package/quality::dense-domain-list", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "a": "T1486", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crypto/rsa/pkcs1v15.go", "crypto/rsa/rsa.go", "internal/cpu/cpu.gointernal/cpu/cpu_x86.gointernal/cpu/cpu_x86.s\u003cautogenerated\u003eruntime/internal/sys/intrinsics_common.goint" ], "i": "objectives/impact/ransom/encrypt/hybrid::encrypted-trailer-layout-cond-1--inline-9320", "l": 1, "m": "B0040" }, { "c": 0.8999999761581421, "d": "Go RSA OAEP encryption", "e": [ "…encryptmath/big.NewIntcrypto/rsa.EncryptOAEPcrypto/rsa.checkPubio.…", "crypto/rsa.EncryptOAEP" ], "i": "objectives/impact/ransom/encrypt/filesystem::go-rsa-encrypt-oaep", "l": 4 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 3.33" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "d": "encoding/base64 package import", "e": [ "encoding/base64.(*Encoding).EncodedLen", "encoding/base64.init", "encoding/base64.Encoding.WithPadding", "encoding/base64/base64.go", "type..eq.encoding/base64.Encoding", "encoding/base64.(*Encoding).EncodeToString", "…enencoding/base64.initencoding/base64.Encoding.WithPaddingty…", "….(*Encoding).EncodedLenencoding/base64.initencoding/base64.En…", "…ng.WithPaddingtype..eq.encoding/base64.EncodingABRt1oby.(*Qra…", "…coding/binary/varint.goencoding/base64/base64.go??crypto/cry…", "…ding/base64.NewEncodingencoding/base64.(*Encoding).Encodeenco…", "…se64.(*Encoding).Encodeencoding/base64.(*Encoding).EncodeToStr…", "encoding/base64", "…ntencoding/binary.initencoding/base64.NewEncodingencoding/ba…", "encoding/base64.(*Encoding).Encode", "…ncoding).EncodeToStringencoding/base64.(*Encoding).EncodedLen…" ], "i": "objectives/command-and-control/beacon/poll::encoding-base64-import", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.07" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Java DPAPI unprotect call", "e": [ "UnprotectData" ], "i": "objectives/credential-access/discord/token::java-crypt-unprotect-data", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "transport endpoint is not connected", "transport endpoint is already connected" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-13", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.6000000238418579, "d": "System32 substring reference", "e": [ "…/windows.initCanDoSearchSystem32golang.org/x/sys/window…", "golang.org/x/sys/windows.canDoSearchSystem32", "…/sys/windows.canDoSearchSystem32golang.org/x/sys/window…", "golang.org/x/sys/windows.initCanDoSearchSystem32" ], "i": "micro-behaviors/fs/path/system::system32-substr", "l": 2 }, { "a": "T1005", "c": 0.6000000238418579, "d": "Signal app directory token", "e": [ "/signal/" ], "i": "objectives/collection/messaging/app::signal-app-dir", "l": 1 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-word", "l": 1 }, { "a": "T1562.001", "c": 0.8999999761581421, "d": "SafeBoot cleanup targets major EDR vendor", "e": [ "eSet", "eset" ], "i": "objectives/impact/degrade/edr/teardown::safeboot-edr-vendor--rx-3", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1204.002", "c": 0.8500000238418579, "d": "PowerShell archive file extension marker", "e": [ ".zip" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extension", "l": 1 }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "crypto/sha256", "crypto/rand", "*map[crypto.Hash]asn1.RawValue", "*map[crypto.Hash][]uint8", "crypto/ed25519/internal/edwards25519", "crypto", "*map.bucket[crypto.Hash][]uint8", "crypto/x509/pkix", "*[]crypto.Hash", "crypto/rsa", "crypto/md5", "crypto/x509", "*map.bucket[crypto.Hash]asn1.RawValue", "crypto/sha1", "*[8]crypto.Hash", "crypto/sha512" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-5", "l": 1, "m": "B0040" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "runtime.publicationBarrier", "crypto/x509.ParsePKCS1PublicKey", "internal/cpu.Initializeinternal/cpu.processOptionsinternal/cpu.indexByteinternal/cpu.doinitinternal/cpu.isSetinternal/cpu.c", "crypto/rsa.(*PublicKey).Size" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "writeString", "truncateString", "*map[string]bool", "*func(string)", "stringType", "*func() string", "WriteString", "newString", "fmtString", "*fmt.GoStringer", "padString", "*chan string", "strings", "leadingString", "string", "*map[string]int" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "a": "T1055", "c": 0.699999988079071, "d": "Load PAGE_READWRITE (0x04) into r8d/r9d", "e": [ "b8", "b9" ], "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "crypto/sha256.init.0", "crypto/aes.init", "crypto/rsa.EncryptOAEP", "crypto.Hash.Size", "crypto/md5", "crypto/rsa", "*[8]crypto.Hash", "crypto/sha256.(*digest).Reset", "crypto/sha256.New224", "crypto/sha1", "*map.bucket[crypto.Hash]asn1.RawValue", "crypto/cipher.init", "type..eq.crypto/sha256.digest", "crypto/elliptic/internal/fiat.p521ToBytes", "*[]crypto.Hash", "crypto/x509" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr", "l": 1 }, { "c": 0.6600000262260437, "d": "List directory contents (Go)", "e": [ ".ReadDir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-go", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/aes import", "e": [ "…gocrypto/cipher/gcm.gocrypto/aes/aes_gcm.gocrypto/aes/c…", "crypto/aes.init", "…initcrypto/cipher.initcrypto/aes.initcrypto/elliptic/in…", "crypto/aes/cipher_asm.go", "crypto/aes/aes_gcm.go", "…ocrypto/aes/aes_gcm.gocrypto/aes/cipher_asm.gocrypto/el…" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-aes", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 5550.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "d": "Regex component marker", "e": [ "runtime.mstart" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-3", "l": 1 }, { "a": "T1027.007", "c": 0.9399999976158142, "d": "Go x/sys/windows LazyProc call", "e": [ "golang.org/x/sys/windows.(*LazyProc).Call" ], "i": "micro-behaviors/os/api-resolution/manual::xsys-windows-lazyproc-call", "l": 3 }, { "c": 0.8999999761581421, "d": "Modbus write single register frame", "e": [ "04 00", "00 01", "f4 fb", "6a 78", "62 37", "f7 75", "00 00" ], "i": "micro-behaviors/communications/modbus::write-single-register", "l": 1 }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509" ], "i": "micro-behaviors/crypto/certificate/usage::x509-string", "l": 2 }, { "c": 0.8600000143051147, "d": "Extremely large average function size", "e": [ "binary.avg_func_size = 56772.33" ], "i": "metadata/binary/metrics/structural::giant-average-function", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output", "input/output error" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.75, "d": "Go time.Sleep delay call", "e": [ "time.Sleep" ], "i": "micro-behaviors/time/sleep/interval::go-time-sleep", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP endpoint state error", "e": [ "transport endpoint is not connected", "transport endpoint is already connected" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "d": "Regex component marker", "e": [ "runtime.main.", "runtime.goexit", "runtime.main" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-1", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "Makefile all target", "e": [ "syscall: string with NUL passed to StringToUTF16" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Go base64 encoding", "e": [ ".Encode", ".EncodeToString", ".EncodedLen" ], "i": "micro-behaviors/data/encode/base64::go-base64-encode", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.53" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/cipher import", "e": [ "…d64.scrypto/dsa/dsa.gocrypto/cipher/gcm.gocrypto/aes/aes_g…", "crypto/cipher/gcm.go", "….digestcrypto/dsa.initcrypto/cipher.initcrypto/aes.initcr…", "crypto/cipher.init" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-cipher", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1105", "c": 0.8600000143051147, "d": "RAT screen capture command", "e": [ "record" ], "i": "objectives/command-and-control/remote-command/tasking::rat-screen-capture-command", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 3.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Giant embedded string blob metric", "e": [ "binary.max_string_length = 81872.00" ], "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric", "l": 1 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-sleep-command-token", "l": 1, "m": "B0025" }, { "a": "T1552.004", "d": "Generic key extension", "e": [ ".key" ], "i": "objectives/collection/file-targeting/filter::key-extension", "l": 1, "m": "B0024" }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "golang.org/x/sys/windows.CreateProcess", "…olang.org/x/sys/windows.CreateProcessgolang.org/x/sys/window…" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8500000238418579, "d": "Wait on multiple object handles", "e": [ "WaitForMultipleObjects" ], "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects", "l": 2, "m": "C0042" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 40.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.6600000262260437, "d": "Read files (Go)", "e": [ "os.(*File).Read" ], "i": "micro-behaviors/fs/file/read::read-go", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "v0.0" ], "i": "metadata/package/help::version-text", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/rsa import", "e": [ "crypto/rsa.encrypt", "…initcrypto/rsa.mgf1XORcrypto/rsa.incCountercrypto/rsa.e…", "…lErrorcrypto/rand.initcrypto/rsa.mgf1XORcrypto/rsa.incC…", "crypto/rsa/rsa.go", "…Rcrypto/rsa.incCountercrypto/rsa.encryptmath/big.NewInt…", "crypto/rsa.incCounter", "…crypto/rsa.EncryptOAEPcrypto/rsa.checkPubio.ReadFullcr…", "crypto/rsa", "crypto/rsa.EncryptOAEP", "crypto/rsa.init", "….gocrypto/rand/util.gocrypto/rsa/rsa.gocrypto/rsa/pkcs1…", "…ath/big.(*Int).SetBytescrypto/rsa.initcrypto/sha512.init…", "…encryptmath/big.NewIntcrypto/rsa.EncryptOAEPcrypto/rsa.…", "crypto/rsa/pkcs1v15.go", "crypto/rsa.(*PublicKey).Size", "…il.gocrypto/rsa/rsa.gocrypto/rsa/pkcs1v15.gocrypto/sha5…" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-rsa", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 40.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.9200000166893005, "d": "Large binary with few functions", "e": [ "binary.func_count = 3.00" ], "i": "metadata/package/metrics::recovered-function-count-under-10", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cnil\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "saveInfoFromPath", "syscall.GetFullPathName", "syscall.FullPath", "reflect.(*ptrType).PkgPath", "runtime.name.pkgPath", "internal/reflectlite.(*rtype).PkgPath", "pkgPath", "reflect.(*rtype).PkgPath", "appendNameToPath", "io/fs.(*PathError).Error", "*fs.PathError", "reflect.name.pkgPath", "reflect.(*funcType).PkgPath", "runtime.initLongPathSupport", "type..eq.io/fs.PathError", "os.IsPathSeparator" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "golang.org/x/sys/windows/svc/mgr.Connect", "internal/cpu.Initializeinternal/cpu.processOptionsinternal/cpu.indexByteinternal/cpu.doinitinternal/cpu.isSetinternal/cpu.c", "golang.org/x/sys/windows/svc/mgr.ConnectRemote" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012" }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "pointer attempting to link in too many shared", "shared", "attempting to link in too many shared libraries", "cannot exec a shared library directly", "can not access a needed shared library", "accessing a corrupted shared library" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-5", "l": 1, "m": "C0027" }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "shared", "cannot exec a shared library directly", "pointer attempting to link in too many shared", "can not access a needed shared library", "attempting to link in too many shared libraries", "accessing a corrupted shared library" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-6", "l": 1, "m": "C0027" }, { "d": "Regex component marker", "e": [ "runtime.main", "runtime.goexit" ], "i": "metadata/lang/compiled::go-runtime-marker--rx-2", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "d": "overflow keyword", "e": [ "runtime.(*hmap).newoverflow", "runtime.(*bmap).setoverflow", "…flowruntime.(*bmap).setoverflowruntime.(*hmap).createO…", "…anicdivideruntime.panicoverflowruntime.deferprocStack…", "integer overflow", "runtime.(*bmap).overflow", "setoverflow", "incrnoverflow", "newoverflow", "overflow", "…apruntime.(*hmap).incrnoverflowruntime.(*hmap).newover…", "…flowruntime.(*hmap).newoverflowruntime.(*bmap).overflo…", "runtime.panicoverflow", "noverflow", "overflowmissing closing )missing", "oldoverflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c8" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1543.003", "c": 0.8500000238418579, "d": "Open service control manager", "e": [ ".OpenSCManager" ], "i": "micro-behaviors/os/service/control::open-sc-manager", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt" ], "i": "micro-behaviors/crypto/library/keyword::encrypt-fn", "l": 3 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "SetThreadContext API reference", "e": [ "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/call::set-thread-context-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 1 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 33120.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Many stack-constructed strings detected", "e": [ "l32.dll", "AddDllDirectory", "winmm.dl", "LoadLibraryExA", "timeEndPeriod", "RtlGetCurrentPeb", "AddVectoredContinueHandler", "RtlGetNtVersionNumbers", "kernel32.dll", "runtime error: ", "advapi32.dll", "LoadLibraryExW", "SystemFunction036", "NtWaitForSingleObject", "timeBeginPeriod", "ntdll.dl" ], "i": "objectives/anti-static/obfuscation/string/anomaly::many-stack-strings", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Register vectored exception handler", "e": [ "AddVectoredExceptionHandler" ], "i": "micro-behaviors/os/exception/error-handling::add-vectored-exception-handler", "l": 2, "m": "B0001" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 5550.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "GetThreadContext API reference", "e": [ "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/call::get-thread-context-dup", "l": 2 }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-w", "l": 3 }, { "c": 0.8999999761581421, "d": "Create extended waitable timer", "e": [ "CreateWaitableTimerExW" ], "i": "micro-behaviors/time/schedule/waitable::create-waitable-timer-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "ResumeThread API reference", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/call::resume-thread-dup", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "SuspendThread API reference", "e": [ "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime/call::suspend-thread", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links kernel32.dll (WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, ... +35 more)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.800000011920929, "d": "Suspend plus resume thread", "e": [ "SuspendThread", "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-suspend-resume", "l": 1 }, { "c": 0.800000011920929, "d": "Get context plus resume", "e": [ "GetThreadContext", "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-resume", "l": 1 }, { "c": 0.800000011920929, "d": "Set context plus resume", "e": [ "SetThreadContext", "ResumeThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-set-resume", "l": 1 }, { "c": 0.8799999952316284, "d": "Get set resume thread context", "e": [ "ResumeThread", "GetThreadContext", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-suspend", "l": 1 }, { "c": 0.8999999761581421, "d": "Create and arm waitable timer", "e": [ "CreateWaitableTimerExW", "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::create-and-set-waitable-timer", "l": 1 }, { "c": 0.8799999952316284, "d": "Suspend set resume thread context", "e": [ "SetThreadContext", "ResumeThread", "SuspendThread" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-get", "l": 1 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 1 }, { "c": 0.800000011920929, "d": "Get and set context", "e": [ "GetThreadContext", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-set", "l": 1 }, { "c": 0.800000011920929, "d": "Suspend plus set context", "e": [ "SuspendThread", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-suspend-set", "l": 1 }, { "a": "T1027.007", "c": 0.949999988079071, "d": "Go LazyProc API resolution", "e": [ "golang.org/x/sys/windows.LoadDLL", "GetProcAddress", "golang.org/x/sys/windows.(*LazyProc).Call" ], "i": "micro-behaviors/os/api-resolution/manual::go-lazyproc-resolution", "l": 3 }, { "c": 0.8799999952316284, "d": "Suspend get set thread context", "e": [ "SuspendThread", "GetThreadContext", "SetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-resume", "l": 1 }, { "c": 0.8799999952316284, "d": "Suspend get resume thread context", "e": [ "ResumeThread", "SuspendThread", "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-set", "l": 1 }, { "c": 0.800000011920929, "d": "Suspend plus get context", "e": [ "SuspendThread", "GetThreadContext" ], "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-suspend-get", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "PE with heavy stack string obfuscation", "e": [ "LoadLibraryExA", "binary.func_count = 3.00", "winmm.dl", "NtWaitForSingleObject", "advapi32.dll", "AddVectoredContinueHandler", "ntdll.dl", "l32.dll", "RtlGetNtVersionNumbers", "RtlGetCurrentPeb", "SystemFunction036", "kernel32.dll", "runtime error: ", "timeBeginPeriod", "LoadLibraryExW", "AddDllDirectory" ], "i": "objectives/anti-static/obfuscation/string/anomaly::stack-string-obfuscated-pe", "l": 4, "m": "B0032" } ], "sha": "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277", "path": "33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277.zip!!33aceb3dc0681a56226d4cfce32eee7a431e66f5c746a4d6dc7506a72b317277", "type": "pe" } ], "tv": "db300" } }