{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.0021164021, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T23:36:19Z" }, "path": "VirusShare_8e19d8f74d4f9a31b18ab208b1adfce7", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "0fbf32532db2d14e7ac3ea5fae7eb05b", "pe.timestamp": 1551270494, "hash.authenti": "71ed378630a64620c1bc52d073180222bb6ec5ae93d10c4e50efbd09ad116ab8", "debug.pdb_path": "D:\\DG\\_Develop\\__UNITY3_CLASSES\\_Holoville\\__DOTween\\_DOTween.Assembly\\DOTween\\obj\\Release\\DOTween.pdb", "pe.codeview.age": 350, "pe.codeview.guid": "7CDB261F-EF95-46CE-BD60-9AE57E03B199", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.resource_types[0]": "RT_VERSION", "pe.debug_entries[0].size": 127, "pe.debug_entries[0].type": "codeview", "pe.data_directories[0].rva": 130312, "pe.data_directories[1].rva": 139264, "pe.data_directories[2].rva": 131072, "pe.data_directories[3].rva": 64664, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 848, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.debug_directory_types[0]": 2, "pe.version_info.company_name": "Demigiant", "pe.version_info.file_version": "1.0.0.0", "pe.version_info.product_name": "DOTween", "pe.debug_entries[0].timestamp": 1551270494, "pe.dll_characteristics.no_seh": true, "pe.version_info.internal_name": "DOTween.dll", "pe.version_info.legal_copyright": "Copyright © Daniele Giardini, 2014", "pe.version_info.product_version": "1.0.0.0", "pe.version_info.file_description": "DOTween", "pe.version_info.original_filename": "DOTween.dll", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".reloc", "pe.section_characteristics[2].name": ".rsrc", "pe.section_characteristics[0].raw_size": 122368, "pe.section_characteristics[1].raw_size": 512, "pe.section_characteristics[2].raw_size": 1024, "pe.section_characteristics[0].virtual_size": 122216, "pe.section_characteristics[1].virtual_size": 12, "pe.section_characteristics[2].virtual_size": 848, "pe.section_characteristics[0].virtual_address": 8192, "pe.section_characteristics[1].virtual_address": 131072, "pe.section_characteristics[2].virtual_address": 139264, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "42000040", "pe.section_characteristics[2].characteristics_hex": "40000040" }, "x": 5, "id": 0, "is": [ "CorDllMain" ], "ms": { "pe": { "entry": 130402.0, "machine": 332.0, "checksum": 0.0, "pdb_path": "D:\\DG\\_Develop\\__UNITY3_CLASSES\\_Holoville\\__DOTween\\_DOTween.Assembly\\DOTween\\obj\\Release\\DOTween.pdb", "is_dotnet": true, "rsrc_size": 1024.0, "subsystem": 3.0, "timestamp": 1551270494.0, "image_base": 4194304.0, "clr_version": "2.5", "codeview_age": 350.0, "rsrc_entropy": 2.72, "codeview_guid": "7CDB261F-EF95-46CE-BD60-9AE57E03B199", "entry_section": ".text", "size_of_image": 147456.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 8462.0, "size_of_headers": 512.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 1.0, "computed_checksum": 187358.0, "section_alignment": 8192.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1551270494.0, "debug_timestamp_min": 1551270494.0, "dll_characteristics": 1024.0, "has_export_timestamp": false, "linker_major_version": 6.0, "debug_directory_types": [ 2.0 ], "has_resource_timestamp": false, "debug_directory_entries": 1.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 124416.0 }, "binary": { "code_size": 122368.0, "code_entropy": 5.98, "import_count": 1.0, "string_count": 1167.0, "section_count": 3.0, "import_density": 0.01, "string_density": 9.77, "overall_entropy": 2.94, "avg_section_size": 41301.33, "dependency_count": 1.0, "entropy_variance": 2.4, "avg_string_length": 14.83, "max_string_length": 136.0, "wide_string_count": 20.0, "avg_string_entropy": 3.22, "code_to_data_ratio": 79.67, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.98, "string_length_stddev": 9.99, "debug_reference_count": 1.0, "largest_section_ratio": 0.98, "sentence_string_count": 19.0, "sentence_string_ratio": 0.02 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 455, "B.rsrc" ], [ 56740, "wide", "ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz1234567890ABCDEFGHIJKLMNOPQRSTUVXYZ" ], [ 56912, "wide", "abcdefghijklmnopqrstuvxyz" ], [ 57012, "RSDS" ], [ 57036, "D:\\DG\\_Develop\\__UNITY3_CLASSES\\_Holoville\\__DOTween\\_DOTween.Assembly\\DOTween\\obj\\Release\\DOTween.pdb" ], [ 57140, "BSJB" ], [ 91917, "DOTween" ], [ 91925, "DOTween.dll" ], [ 91937, "mscorlib" ], [ 91946, "UnityEngine" ], [ 91958, "System" ], [ 91965, "System.Core" ], [ 91977, "Activator" ], [ 91987, "Array" ], [ 91993, "AsyncCallback" ], [ 92007, "Boolean" ], [ 92015, "Char" ], [ 92020, "Dictionary`2" ], [ 92033, "System.Collections.Generic" ], [ 92060, "IEnumerator`1" ], [ 92089, "IEnumerator" ], [ 92101, "System.Collections" ], [ 92120, "Comparison`1" ], [ 92133, "Decimal" ], [ 92141, "DebuggableAttribute" ], [ 92161, "System.Diagnostics" ], [ 92180, "DebuggingModes" ], [ 92195, "DebuggerHiddenAttribute" ], [ 92219, "Double" ], [ 92226, "Enum" ], [ 92231, "Exception" ], [ 92241, "FlagsAttribute" ], [ 92256, "IAsyncResult" ], [ 92269, "IDisposable" ], [ 92300, "Math" ], [ 92305, "MulticastDelegate" ], [ 92323, "NotSupportedException" ], [ 92356, "Object" ], [ 92363, "AssemblyCompanyAttribute" ], [ 92388, "System.Reflection" ], [ 92406, "AssemblyConfigurationAttribute" ], [ 92437, "AssemblyCopyrightAttribute" ], [ 92464, "AssemblyCultureAttribute" ], [ 92489, "AssemblyDescriptionAttribute" ], [ 92518, "AssemblyFileVersionAttribute" ], [ 92547, "AssemblyProductAttribute" ], [ 92572, "AssemblyTitleAttribute" ], [ 92595, "AssemblyTrademarkAttribute" ], [ 92622, "AssemblyVersionAttribute" ], [ 92647, "CompilationRelaxationsAttribute" ], [ 92679, "System.Runtime.CompilerServices" ], [ 92711, "CompilerGeneratedAttribute" ], [ 92738, "ExtensionAttribute" ], [ 92757, "InternalsVisibleToAttribute" ], [ 92785, "RuntimeCompatibilityAttribute" ], [ 92815, "RuntimeHelpers" ], [ 92830, "ComVisibleAttribute" ], [ 92850, "System.Runtime.InteropServices" ], [ 92881, "GuidAttribute" ], [ 92895, "LayoutKind" ], [ 92906, "StructLayoutAttribute" ], [ 92928, "RuntimeFieldHandle" ], [ 92947, "RuntimeTypeHandle" ], [ 92965, "SerializableAttribute" ], [ 92987, "Single" ], [ 92994, "String" ], [ 93001, "Capture" ], [ 93009, "System.Text.RegularExpressions" ], [ 93040, "Group" ], [ 93046, "GroupCollection" ], [ 93062, "Match" ], [ 93068, "Regex" ], [ 93074, "StringBuilder" ], [ 93088, "System.Text" ], [ 93100, "Type" ], [ 93119, "ValueType" ], [ 93129, "Void" ], [ 93134, "AddComponentMenu" ], [ 93151, "AnimationCurve" ], [ 93166, "Application" ], [ 93178, "AudioSource" ], [ 93190, "Camera" ], [ 93197, "Color" ], [ 93203, "Component" ], [ 93213, "Coroutine" ], [ 93223, "Debug" ], [ 93229, "GameObject" ], [ 93240, "Gizmos" ], [ 93247, "Keyframe" ], [ 93256, "Material" ], [ 93265, "Mathf" ], [ 93271, "MonoBehaviour" ], [ 93285, "Quaternion" ], [ 93296, "Random" ], [ 93303, "Rect" ], [ 93308, "RectOffset" ], [ 93319, "Resources" ], [ 93329, "Rigidbody" ], [ 93339, "ScriptableObject" ], [ 93356, "SerializeField" ], [ 93371, "Time" ], [ 93376, "TrailRenderer" ], [ 93390, "Transform" ], [ 93400, "Vector2" ], [ 93408, "Vector3" ], [ 93416, "Vector4" ], [ 93424, "YieldInstruction" ], [ 93441, "\u003cModule\u003e" ], [ 93450, "\u003cPrivateImplementationDetails\u003e{3A03ABBD-A5D9-4DF5-A1B3-BBFE91D14EDD}" ], [ 93519, "__StaticArrayInitTypeSize=120" ], [ 93549, "__StaticArrayInitTypeSize=20" ], [ 93578, "__StaticArrayInitTypeSize=50" ], [ 93607, "AutoPlay" ], [ 93616, "DG.Tweening" ], [ 93628, "AxisConstraint" ], [ 93650, "ABSSequentiable" ], [ 93666, "DG.Tweening.Core" ], [ 93683, "Debugger" ], [ 93714, "DOTweenComponent" ], [ 93731, "\u003cWaitForCompletion\u003ed__0" ], [ 93860, "DOTweenSettings" ], [ 93876, "SettingsLocation" ], [ 93893, "Bounce" ], [ 93900, "DG.Tweening.Core.Easing" ], [ 93924, "EaseCurve" ], [ 93934, "EaseManager" ], [ 93946, "FilterType" ], [ 93957, "DG.Tweening.Core.Enums" ], [ 93980, "OperationType" ], [ 93994, "SpecialStartupMode" ], [ 94013, "UpdateMode" ], [ 94024, "UpdateNotice" ], [ 94037, "Extensions" ], [ 94048, "SequenceCallback" ], [ 94065, "TweenerCore`3" ], [ 94079, "TweenManager" ], [ 94092, "CapacityIncreaseMode" ], [ 94113, "Utils" ], [ 94119, "\u003c\u003ec__DisplayClass2" ], [ 94138, "DOVirtual" ], [ 94148, "\u003c\u003ec__DisplayClass3" ], [ 94167, "Ease" ], [ 94172, "EaseFunction" ], [ 94185, "IDOTweenInit" ], [ 94198, "LogBehaviour" ], [ 94211, "LoopType" ], [ 94220, "PathMode" ], [ 94229, "PathType" ], [ 94238, "Color2Plugin" ], [ 94251, "DG.Tweening.Plugins" ], [ 94271, "ColorPlugin" ], [ 94283, "ABSTweenPlugin`3" ], [ 94300, "DG.Tweening.Plugins.Core" ], [ 94325, "ITweenPlugin" ], [ 94338, "ABSPathDecoder" ], [ 94353, "DG.Tweening.Plugins.Core.PathCore" ], [ 94387, "CatmullRomDecoder" ], [ 94405, "ControlPoint" ], [ 94418, "LinearDecoder" ], [ 94432, "Path" ], [ 94437, "PluginsManager" ], [ 94452, "SpecialPluginsUtils" ], [ 94472, "FloatPlugin" ], [ 94484, "IntPlugin" ], [ 94494, "LongPlugin" ], [ 94505, "ColorOptions" ], [ 94518, "DG.Tweening.Plugins.Options" ], [ 94546, "FloatOptions" ], [ 94559, "NoOptions" ], [ 94569, "OrientType" ], [ 94580, "PathOptions" ], [ 94592, "QuaternionOptions" ], [ 94610, "RectOptions" ], [ 94622, "StringOptions" ], [ 94636, "Vector3ArrayOptions" ], [ 94656, "VectorOptions" ], [ 94670, "PathPlugin" ], [ 94681, "QuaternionPlugin" ], [ 94698, "RectOffsetPlugin" ], [ 94715, "RectPlugin" ], [ 94726, "StringPlugin" ], [ 94739, "StringPluginExtensions" ], [ 94762, "UintPlugin" ], [ 94773, "UlongPlugin" ], [ 94785, "Vector2Plugin" ], [ 94799, "Vector3ArrayPlugin" ], [ 94818, "Vector3Plugin" ], [ 94832, "Vector4Plugin" ], [ 94846, "RotateMode" ], [ 94857, "ScrambleMode" ], [ 94870, "Sequence" ], [ 94879, "ShortcutExtensions" ], [ 94898, "\u003c\u003ec__DisplayClass104" ], [ 94919, "\u003c\u003ec__DisplayClass108" ], [ 94940, "\u003c\u003ec__DisplayClass10c" ], [ 94961, "\u003c\u003ec__DisplayClass11c" ], [ 94982, "\u003c\u003ec__DisplayClass12" ], [ 95002, "\u003c\u003ec__DisplayClass120" ], [ 95023, "\u003c\u003ec__DisplayClass124" ], [ 95044, "\u003c\u003ec__DisplayClass128" ], [ 95065, "\u003c\u003ec__DisplayClass12c" ], [ 95086, "\u003c\u003ec__DisplayClass130" ], [ 95107, "\u003c\u003ec__DisplayClass134" ], [ 95128, "\u003c\u003ec__DisplayClass16" ], [ 95148, "\u003c\u003ec__DisplayClass1a" ], [ 95168, "\u003c\u003ec__DisplayClass1e" ], [ 95188, "\u003c\u003ec__DisplayClass22" ], [ 95208, "\u003c\u003ec__DisplayClass26" ], [ 95228, "\u003c\u003ec__DisplayClass2a" ], [ 95248, "\u003c\u003ec__DisplayClass2e" ], [ 95268, "\u003c\u003ec__DisplayClass32" ], [ 95288, "\u003c\u003ec__DisplayClass36" ], [ 95308, "\u003c\u003ec__DisplayClass4a" ], [ 95328, "\u003c\u003ec__DisplayClass4e" ], [ 95348, "\u003c\u003ec__DisplayClass52" ], [ 95368, "\u003c\u003ec__DisplayClass56" ], [ 95388, "\u003c\u003ec__DisplayClass5a" ], [ 95408, "\u003c\u003ec__DisplayClass5e" ], [ 95428, "\u003c\u003ec__DisplayClass6" ], [ 95447, "\u003c\u003ec__DisplayClass62" ], [ 95467, "\u003c\u003ec__DisplayClass66" ], [ 95487, "\u003c\u003ec__DisplayClass6a" ], [ 95507, "\u003c\u003ec__DisplayClass6e" ], [ 95527, "\u003c\u003ec__DisplayClass71" ], [ 95547, "\u003c\u003ec__DisplayClass74" ], [ 95567, "\u003c\u003ec__DisplayClass77" ], [ 95587, "\u003c\u003ec__DisplayClass7a" ], [ 95607, "\u003c\u003ec__DisplayClass7d" ], [ 95627, "\u003c\u003ec__DisplayClass80" ], [ 95647, "\u003c\u003ec__DisplayClass86" ], [ 95667, "\u003c\u003ec__DisplayClass92" ], [ 95687, "\u003c\u003ec__DisplayClass96" ], [ 95707, "\u003c\u003ec__DisplayClass9a" ], [ 95727, "\u003c\u003ec__DisplayClass9e" ], [ 95747, "\u003c\u003ec__DisplayClassa" ], [ 95766, "\u003c\u003ec__DisplayClassa2" ], [ 95786, "\u003c\u003ec__DisplayClassa6" ], [ 95806, "\u003c\u003ec__DisplayClassaa" ], [ 95826, "\u003c\u003ec__DisplayClassae" ], [ 95846, "\u003c\u003ec__DisplayClassb2" ], [ 95866, "\u003c\u003ec__DisplayClassb6" ], [ 95886, "\u003c\u003ec__DisplayClassba" ], [ 95906, "\u003c\u003ec__DisplayClassbe" ], [ 95926, "\u003c\u003ec__DisplayClassc2" ], [ 95946, "\u003c\u003ec__DisplayClassc6" ], [ 95966, "\u003c\u003ec__DisplayClassca" ], [ 95986, "\u003c\u003ec__DisplayClassce" ], [ 96006, "\u003c\u003ec__DisplayClassd2" ], [ 96026, "\u003c\u003ec__DisplayClassd6" ], [ 96046, "\u003c\u003ec__DisplayClassda" ], [ 96066, "\u003c\u003ec__DisplayClassde" ], [ 96086, "\u003c\u003ec__DisplayClasse" ], [ 96105, "\u003c\u003ec__DisplayClasse2" ], [ 96125, "\u003c\u003ec__DisplayClasse6" ] ], "sz": 124416, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0xdf34" ], "i": "metadata/dotnet/bsjb-signature", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1551270494.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "DOTween" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "DOTween.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "isSpeedBased", "SetSpeedBased", "GetSpeedBasedDuration" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-77", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.550000011920929, "d": ".NET Start method token", "e": [ "Start" ], "i": "micro-behaviors/process/create/spawn::start-method-token-dotnet", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.22" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "d": "Startup directory keyword", "e": [ "Startup" ], "i": "micro-behaviors/os/autorun/keyword::startup-keyword", "l": 2 }, { "c": 0.6600000262260437, "d": "Reflection invoke token", "e": [ "Invoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::invoke-token", "l": 1 }, { "c": 0.8399999737739563, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8462.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "d": "Visual Studio build path", "e": [ "D:\\DG\\_Develop\\__UNITY3_CLASSES\\_Holoville\\__DOTween\\_DOTween.Assembly\\DOTween\\obj\\Release\\DOTween.pdb" ], "i": "metadata/binary/debug::pdb-visual-studio", "l": 3 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.94" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Dynamic object instantiation via Activator", "e": [ "Activator" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::activator", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © Daniele Giardini, 2014" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Chromium Extensions directory", "e": [ "Extensions" ], "i": "micro-behaviors/fs/path/sensitive/browser::chromium-extensions-directory", "l": 1 }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2 }, { "c": 0.75, "d": "Text section dominates file", "e": [ "binary.text_to_file_ratio = 0.98" ], "i": "metadata/binary/layout::text-section-dominates-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 147456.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.94" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.98" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1167.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "_stringPlugin", "StringPluginExtensions", "ToString", "StringFileInfo", "StringOptions", "String", "StringBuilder", "StringPlugin", "Substring" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "3A03ABBD-A5D9-4DF5-A1B3-BBFE91D14EDD" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.22" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.699999988079071, "d": "Delegate BeginInvoke token", "e": [ "BeginInvoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::begininvoke-token", "l": 1 }, { "a": "T1140", "c": 0.8399999737739563, "d": "CreateInstance activation token", "e": [ "CreateInstance" ], "i": "objectives/command-and-control/dropper/staging/embedded::createinstance-token", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Reactor PrivateImplementationDetails GUID", "e": [ "3C 50 72 69 76 61 74 65 49 6D 70 6C 65 6D 65 6E 74 61 74 69 6F 6E 44 65 74 61 69 6C 73 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D" ], "i": "objectives/anti-static/obfuscation/tools/managed::reactor-private-implementation-details-guid", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1167.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "snapStartValue", "newStartValue", "pNewValue", "value__", "value", "_TxtCantChangeSequencedValues", "changeValue", "newEndValue", "EasedValue", "endValue", "ValueType", "ChangeValues", "startValue", "ChangeStartValue", "ChangeEndValue", "endValues" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "DOTween" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "D:\\DG\\_Develop\\__UNITY3_CLASSES\\_Holoville\\__DOTween\\_DOTween.Assembly\\DOTween\\obj\\Release\\DOTween.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_8e19d8f74d4f9a31b18ab208b1adfce7" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1546.012", "c": 0.8999999761581421, "d": "IFEO Debugger registry value", "e": [ "Debugger" ], "i": "objectives/persistence/login/ifeo/debugger::ifeo-debugger-value", "l": 1, "m": "F0012" }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": ".NET binary (PE with BSJB metadata)", "e": [ "pe.is_dotnet = 1.00" ], "i": "metadata/binary/metrics/threshold::dotnet-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Delegate EndInvoke token", "e": [ "EndInvoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::endinvoke-token", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "DG.Tweening.Plugins.Core.PathCore", "PathOptions", "Path", "PathGetPoint", "PathPlugin", "LogNonPathTween", "ConvertToConstantPathPerc", "FinalizePath", "DOLocalPath", "PathMode", "\u003cDOPath\u003eb__106", "ABSPathDecoder", "isClosedPath", "\u003cDOPath\u003eb__107", "PathType", "PathLength" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.800000011920929, "d": "GUID-formatted token", "e": [ "{3A03ABBD-A5D9-4DF5-A1B3-BBFE91D14EDD}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 1, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "CS$\u003c\u003e9__CachedAnonymousMethodDelegate2c", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate20", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate23", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate2b", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate26", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate27", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate25", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate2e", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate2f", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate22", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate24", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate2d", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate21", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate28", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate2a", "CS$\u003c\u003e9__CachedAnonymousMethodDelegate29" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 1024.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree.dll (CorDllMain)", "e": [ "mscoree.dll" ], "i": "metadata/dylib::mscoree/dll", "l": 2 }, { "c": 1.0, "d": ".NET Assembly (mscoree.dll)", "e": [ "BSJB", "pe.is_dotnet = 1.00" ], "i": "metadata/binary/framework::dotnet-assembly", "l": 2 }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1 }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1 }, { "c": 0.8500000238418579, "d": "Low entropy .NET text carrier", "e": [ "binary.text_to_file_ratio = 0.98", "binary.string_count = 1167.00", "binary.section_count = 3.00", "pe.is_dotnet = 1.00", "binary.overall_entropy = 2.94", "BSJB" ], "i": "metadata/binary/layout::dotnet-low-entropy-text-carrier", "l": 1 }, { "a": "B0030", "c": 0.9300000071525574, "d": "GUID mutex with crypto and network", "e": [ "StringPluginExtensions", "StringFileInfo", "_stringPlugin", "ToString", "StringOptions", "StringBuilder", "String", "Substring", "{3A03ABBD-A5D9-4DF5-A1B3-BBFE91D14EDD}", "StringPlugin" ], "i": "objectives/command-and-control/beacon/mutex::mutex-guid-crypto-http-coordination", "l": 1 } ], "sha": "8188246a8c3ec81863ec03cb98417974390dcd7e838d28f74248fa80faacf768", "path": "VirusShare_8e19d8f74d4f9a31b18ab208b1adfce7", "type": "pe" } ], "tv": "60127" } }