{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.000009566545486450195 } ], "prob": 0.0000095665455, "models": [ { "m": "az", "raw": 0.0000095665455, "prob": 0.0000095665455, "class": 0 }, { "m": "az/source", "raw": 0.000003874302, "prob": 0.000003874302, "class": 0 }, { "m": "az/c", "raw": 0.000005155802, "prob": 0.000005155802, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T16:11:45Z" }, "path": "wininet.cpp", "raw": { "v": "6", "fs": [ { "f": "H(Ds)", "x": 2, "ff": { "i": [ [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "WDEBUG1" ], [ "", "isc" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "WDEBUG1" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "CWA" ], [ "", "reallocEx" ], [ "", "free" ], [ "", "free" ], [ "", "alloc" ], [ "", "free" ], [ "", "removeFile" ], [ "", "parseUrl" ], [ "", "Connect" ], [ "", "SendRequest" ], [ "", "DownloadDataToFile" ], [ "", "DownloadData" ], [ "", "CloseConnection" ], [ "", "freeUrlData" ], [ "", "fnc" ], [ "", "CopyExA" ], [ "", "GetIEUserAgent" ], [ "", "CallURL" ], [ "", "free" ], [ "", "alloc" ], [ "", "free" ], [ "", "alloc" ], [ "", "free" ], [ "", "alloc" ], [ "", "free" ], [ "", "\u003cwindows.h\u003e" ], [ "", "\u003cwininet.h\u003e" ], [ "", "fs.h" ], [ "", "httptools.h" ], [ "", "wininet.h" ] ], "m": { "ast": { "op.eq": 24.0, "op.gt": 8.0, "op.lt": 3.0, "op.ne": 17.0, "op.add": 4.0, "op.bor": 14.0, "op.div": 1.0, "op.lor": 3.0, "op.mul": 15.0, "op.sub": 4.0, "op.band": 27.0, "op.bnot": 2.0, "op.land": 14.0, "op.lnot": 5.0, "max_depth": 20.0, "op.concat": 20.0, "bind_count": 41.0, "call_count": 107.0, "node_count": 3416.0, "member_count": 31.0, "op_density.eq": 0.01, "op_density.gt": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.bor": 0.0, "op_density.div": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.01, "op_density.bnot": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 204.0, "member_depth_max": 2.0, "op_density.concat": 0.01, "infinite_loop_count": 3.0, "string_literal_count": 12.0, "array_literal_max_length": 9.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 13337.0, "entropy": 5.33, "size_bytes": 13337.0 }, "text": { "digit_ratio": 0.01, "space_count": 2370.0, "total_lines": 413.0, "char_entropy": 5.33, "unique_chars": 91.0, "string_density": 0.03, "avg_line_length": 30.36, "max_line_length": 194.0, "empty_line_ratio": 0.17, "last_line_length": 1.0, "whitespace_ratio": 0.24, "most_common_ratio": 0.06, "identifier_density": 1.82, "line_length_stddev": 38.69, "normalized_string_count": 0.59, "repeated_char_sequences": 25.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 20.0, "trailing_whitespace_lines": 16.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 23.48 }, "binds": { "count": 41.0 }, "calls": { "count": 107.0 }, "binary": { "overall_entropy": 5.33 }, "source": { "function_count": 15.0 }, "imports": { "count": 5.0, "unique_modules": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "members": { "count": 31.0 }, "strings": { "total": 12.0, "avg_length": 12.42, "max_length": 40.0, "avg_entropy": 2.72, "total_bytes": 149.0, "entropy_stddev": 0.89 }, "comments": { "chars": 1123.0, "lines": 27.0, "total": 27.0, "to_code_ratio": 0.07 }, "functions": { "count": 15.0 }, "identifiers": { "count": 204.0, "total": 751.0, "avg_length": 12.19, "max_length": 38.0, "min_length": 1.0, "avg_entropy": 2.79, "reuse_ratio": 0.27, "unique_count": 204.0, "length_stddev": 8.0, "has_digit_ratio": 0.01, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.01, "high_entropy_count": 42.0, "high_entropy_ratio": 0.21, "all_lowercase_ratio": 0.17, "all_uppercase_ratio": 0.34, "numeric_suffix_count": 3.0, "underscore_prefix_count": 16.0 } }, "s": [ [ 9, "u8", "\u003cwindows.h\u003e" ], [ 31, "u8", "\u003cwininet.h\u003e" ], [ 55, "u8", "wininet.h" ], [ 56, "u8", "wininet.h" ], [ 77, "u8", "fs.h" ], [ 78, "u8", "fs.h" ], [ 94, "u8", "httptools.h" ], [ 95, "u8", "httptools.h" ], [ 398, "u8", "*/*" ], [ 399, "u8", "*/*" ], [ 722, "10", "1" ], [ 726, "10", "60" ], [ 731, "10", "1000" ], [ 1247, "10", "1" ], [ 1251, "10", "60" ], [ 1256, "10", "1000" ], [ 1410, "10", "1" ], [ 1414, "10", "60" ], [ 1419, "10", "1000" ], [ 1935, "10", "0" ], [ 2018, "10", "0" ], [ 2374, "10", "0" ], [ 2899, "10", "0" ], [ 2950, "u8", "Opps! Parent no founded for hConnection!" ], [ 2951, "u8", "Opps! Parent no founded for hConnection!" ], [ 3975, "u8", "Calling 0x%p." ], [ 3976, "u8", "Calling 0x%p." ], [ 5041, "u8", "pstrURI=%S" ], [ 5042, "u8", "pstrURI=%S" ], [ 5193, "u8", "POST" ], [ 5194, "u8", "POST" ], [ 5202, "u8", "GET" ], [ 5203, "u8", "GET" ], [ 5491, "10", "0" ], [ 5539, "u8", "Connection: close\\r\\n" ], [ 5540, "u8", "Connection: close" ], [ 5585, "10", "19" ], [ 5728, "10", "0" ], [ 6123, "10", "0" ], [ 6229, "10", "0" ], [ 6357, "10", "0" ], [ 6689, "10", "0" ], [ 7453, "10", "0" ], [ 7581, "10", "0" ], [ 7778, "10", "0" ], [ 8661, "10", "0" ], [ 8729, "10", "0" ], [ 9053, "10", "1" ], [ 9188, "10", "0" ], [ 9235, "10", "1" ], [ 10298, "u8", "urlmon.dll" ], [ 10299, "u8", "urlmon.dll" ], [ 10434, "u8", "ObtainUserAgentString" ], [ 10435, "u8", "ObtainUserAgentString" ], [ 10509, "10", "1024" ], [ 10548, "10", "1" ], [ 10561, "10", "0" ], [ 10566, "10", "0" ], [ 10591, "10", "0" ], [ 10754, "10", "1" ], [ 10775, "10", "1" ], [ 10797, "10", "0" ], [ 11114, "10", "1" ], [ 11153, "10", "0" ], [ 11335, "10", "0" ], [ 11458, "10", "0" ], [ 11551, "10", "512" ], [ 11557, "10", "1024" ], [ 11732, "10", "0" ], [ 11903, "10", "0" ], [ 12005, "10", "0" ], [ 12391, "10", "0" ], [ 12493, "10", "0" ], [ 12882, "10", "1" ], [ 12913, "10", "0" ], [ 12964, "10", "0" ], [ 11909, "base64", "Ԕ\u0014R\u0002 CS" ], [ 12397, "base64", "Ԕ\u0014R\u0002 CS" ], [ 12970, "base64", "Ԕ\u0014R\u0002 CS" ] ], "v": { "file.stem": "wininet", "file.basename": "wininet.cpp", "source.language": "c", "source.imports[0]": "\u003cwindows.h\u003e", "source.imports[1]": "\u003cwininet.h\u003e", "source.imports[2]": "CWA", "source.imports[3]": "CallURL", "source.imports[4]": "CloseConnection", "source.imports[5]": "Connect", "source.imports[6]": "CopyExA", "source.imports[7]": "DownloadData", "source.imports[8]": "DownloadDataToFile", "source.imports[9]": "GetIEUserAgent", "source.strings[0]": "\u003cwindows.h\u003e", "source.strings[1]": "\u003cwininet.h\u003e", "source.strings[2]": "Calling 0x%p.", "source.strings[3]": "Connection: close", "source.strings[4]": "Connection: close\\r\\n", "source.strings[5]": "ObtainUserAgentString", "source.strings[6]": "Opps! Parent no founded for hConnection!", "source.strings[7]": "httptools.h", "source.strings[8]": "pstrURI=%S", "source.strings[9]": "urlmon.dll", "source.has_imports": true, "source.imports[10]": "SendRequest", "source.imports[11]": "WDEBUG1", "source.imports[12]": "alloc", "source.imports[13]": "fnc", "source.imports[14]": "free", "source.imports[15]": "freeUrlData", "source.imports[16]": "fs.h", "source.imports[17]": "httptools.h", "source.imports[18]": "isc", "source.imports[19]": "parseUrl", "source.imports[20]": "reallocEx", "source.imports[21]": "removeFile", "source.imports[22]": "wininet.h", "source.strings[10]": "wininet.h", "source.strings[11]": "Ԕ\u0014R\u0002 CS", "source.functions[0]": "*Wininet::_queryOptionExA(HINTERNET internet, DWORD option, LPDWORD lenght)", "source.functions[1]": "*Wininet::_queryOptionExW(HINTERNET internet, DWORD option, LPDWORD lenght)", "source.functions[2]": "Init(void)", "source.functions[3]": "Uninit(void)", "source.functions[4]": "_CallURL(CALLURLDATA *pcud, MEMDATA *pBuf)", "source.functions[5]": "_CloseConnection(HINTERNET hConnect)", "source.functions[6]": "_Connect(LPSTR pstrUserAgent, LPSTR pstrHost, WORD wPort, DWORD dwFlags)", "source.functions[7]": "_DownloadData(HINTERNET hRequest, MEMDATA *pBuf, DWORD dwSizeLimit, HANDLE hStopEvent)", "source.functions[8]": "_DownloadDataToFile(HINTERNET hRequest, LPWSTR pstrFileName, DWORD dwSizeLimit, HANDLE hStopEvent)", "source.functions[9]": "_GetIEUserAgent(void)", "source.functions[10]": "_SendRequest(HINTERNET hConnect, LPSTR pstrURI, LPSTR pstrReferer, void *pPostData, DWORD dwPostDataSize, DWORD dwFlags)", "source.functions[11]": "_closeWithParents(HINTERNET handle)", "source.functions[12]": "_queryInfoExA(HINTERNET request, DWORD infoLevel, LPDWORD lenght, LPDWORD index)", "source.functions[13]": "_testDownloadDelay(LPSTR url, HANDLE stopEvent)", "source.functions[14]": "callCallback(HINTERNET handle, DWORD_PTR context, DWORD internetStatus, LPVOID statusInformation, DWORD statusInformationLength)" }, "ct": [ "CWA", "CWA()", "WDEBUG1", "_CallURL", "_CloseConnection", "_Connect", "_CopyExA", "_DownloadData", "_DownloadDataToFile", "_GetIEUserAgent", "_SendRequest", "_freeUrlData", "_parseUrl", "_removeFile", "alloc", "fnc", "free", "isc", "reallocEx" ], "id": "c", "mc": [ "cud.Connect_dwFlags", "cud.DownloadData_dwSizeLimit", "cud.DownloadData_pstrFileName", "cud.SendRequest_dwFlags", "cud.SendRequest_dwPostDataSize", "cud.SendRequest_pPostData", "cud.SendRequest_pstrReferer", "cud.bAutoProxy", "cud.bTryCount", "cud.dwRetryDelay", "cud.hStopEvent", "cud.pstrURL", "cud.pstrUserAgent", "pBuf.data", "pBuf.size", "pcud.Connect_dwFlags", "pcud.DownloadData_dwSizeLimit", "pcud.DownloadData_pstrFileName", "pcud.SendRequest_dwFlags", "pcud.SendRequest_dwPostDataSize", "pcud.SendRequest_pPostData", "pcud.bAutoProxy", "pcud.bTryCount", "pcud.dwRetryDelay", "pcud.hStopEvent", "pcud.pstrURL", "pcud.pstrUserAgent", "ud.host", "ud.port", "ud.scheme", "ud.uri" ] }, "id": 0, "sz": 13337, "ts": [ { "a": "T1574.002", "c": 0.949999988079071, "d": "LoadLibraryA call in source", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/source::load-library-a-source", "l": 3 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "Infinite loop structure (e.g. for(;;) or while(1))", "e": [ "for(;;)" ], "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "l": 2 }, { "a": "T1552", "c": 0.8500000238418579, "d": "Regex for database secrets", "e": [ "Connection:" ], "i": "objectives/collection/database/credentials::database-credential-patterns-secret", "l": 1, "el": [ "15a3" ] }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Windows GetProcAddress in source", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-source", "l": 2 }, { "a": "T1071.001", "c": 0.9399999976158142, "d": "HTTP 200 kill switch logic", "e": [ "HTTP_STATUS_OK" ], "i": "objectives/command-and-control/channel/http/png-stego::ok-status-kill-switch", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 } ], "sha": "80c9e06eab905e91a98f8fdd0b1de177f2bf2ee0c31e257959f38bcfbef83d4a", "path": "wininet.cpp", "type": "c" } ], "tv": "8e9ac" } }