{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.8905742, "class": 0 }, { "m": "az/pe", "prob": 0.0041841003, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T12:54:05Z" }, "path": "835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 4, "ff": { "i": [ [ "msvbvm60", "ORDINAL 690" ], [ "msvbvm60", "MethCallEngine" ], [ "msvbvm60", "ORDINAL 593" ], [ "msvbvm60", "ORDINAL 703" ], [ "msvbvm60", "ORDINAL 706" ], [ "msvbvm60", "ORDINAL 707" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "ORDINAL 560" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 532" ], [ "msvbvm60", "ORDINAL 534" ], [ "msvbvm60", "ORDINAL 535" ], [ "msvbvm60", "ORDINAL 536" ], [ "msvbvm60", "ORDINAL 539" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "ORDINAL 610" ], [ "msvbvm60", "ORDINAL 611" ], [ "msvbvm60", "ORDINAL 612" ], [ "msvbvm60", "ORDINAL 613" ], [ "msvbvm60", "ORDINAL 540" ], [ "msvbvm60", "ORDINAL 546" ] ], "m": { "pe": { "checksum": 162038.0, "checksum_valid": 1.0, "computed_checksum": 162038.0, "bound_import_count": 1.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 2622450629.0 }, "file": { "size": 114688.0, "entropy": 5.72, "size_bytes": 114688.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.91, "string_count": 1083.0, "entropy_variance": 3.08, "avg_string_length": 8.84, "max_string_length": 123.0, "code_to_data_ratio": 1.0, "string_length_stddev": 6.38, "largest_section_ratio": 0.93, "sentence_string_count": 3.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 24.0 }, "sections": { "count": 3.0, "code_size": 106496.0, "entropy_max": 5.91, "entropy_mean": 4.16, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 152, "u8", "Rich" ], [ 424, "u8", ".text" ], [ 504, "u8", ".rsrc" ], [ 560, "u8", "MSVBVM60.DLL" ], [ 4412, "u8", "Triolefinl" ], [ 4532, "u8", "MARC" ], [ 4541, "u8", "gedeskind" ], [ 4599, "u8", "Frame1" ], [ 4610, "u8", "Nonari" ], [ 4638, "u8", "Check1" ], [ 4649, "u8", "infumeh" ], [ 4678, "u8", "Option4" ], [ 4690, "u8", "SKYT" ], [ 4716, "u8", "Option3" ], [ 4728, "u8", "Kalde" ], [ 4755, "u8", "Option2" ], [ 4767, "u8", "Omst" ], [ 4793, "u8", "Option1" ], [ 4805, "u8", "TENSIONS" ], [ 5008, "u8", "Marle" ], [ 8660, "u8", "CHARC" ], [ 8772, "u8", "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 8916, "u8", "Form" ], [ 8923, "u8", "51.153.102.207:20397" ], [ 9064, "u8", "kernel32" ], [ 9080, "u8", "EnumSystemCodePagesA" ], [ 9160, "u8", "user32" ], [ 9172, "u8", "GetQueueStatus" ], [ 9244, "u8", "SetLayeredWindowAttributes" ], [ 9328, "u8", "msvfw32.dll" ], [ 9344, "u8", "GetOpenFileNamePreview" ], [ 9456, "u8", "shell32.dll" ], [ 9472, "u8", "SHGetFileInfoA" ], [ 9544, "u8", "FileTimeToLocalFileTime" ], [ 9636, "wide", "anabol" ], [ 9656, "wide", "anthoceros" ], [ 9684, "wide", "Parkanlg6" ], [ 9708, "wide", "lpriser" ], [ 9728, "wide", "Sisterise1" ], [ 9820, "wide", "unquotable" ], [ 9848, "wide", "Indiaman" ], [ 9872, "wide", "Epicormic" ], [ 9892, "u8", "VBA6.DLL" ], [ 9916, "wide", "certainest" ], [ 9956, "wide", "counterattractive" ], [ 10004, "wide", "ustadighed" ], [ 10032, "wide", "Reparer6" ], [ 10056, "wide", "Electioneering" ], [ 10092, "wide", "Rutiodon6" ], [ 10116, "wide", "PEBERBFFERNES" ], [ 10148, "wide", "Ekstensiverede" ], [ 10184, "wide", "SERUT" ], [ 10216, "wide", "Antipodes" ], [ 10240, "wide", "Wanky7" ], [ 10260, "wide", "OPSPLITNINGS" ], [ 10292, "wide", "SNOHALE" ], [ 10312, "wide", "opdateret" ], [ 10336, "wide", "FYSIOTERAPEUTEN" ], [ 10372, "wide", "grundformers" ], [ 10404, "wide", "FASTLG" ], [ 10424, "wide", "PREACHES" ], [ 10448, "wide", "Summarizes" ], [ 10476, "wide", "Scenografiske7" ], [ 10512, "wide", "Dulc4" ], [ 10528, "wide", "Unprudently7" ], [ 10560, "wide", "Continuative" ], [ 10592, "wide", "ADKINS" ], [ 10612, "wide", "PROPIONATE" ], [ 10640, "wide", "sovkhozy" ], [ 10664, "wide", "hassocks" ], [ 10688, "wide", "Ildnedes5" ], [ 10712, "wide", "Oppakningers6" ], [ 10744, "wide", "jappa" ], [ 10760, "wide", "Rapportopgaveens" ], [ 10800, "wide", "anthropophagi" ], [ 10832, "wide", "aggressions" ], [ 10860, "wide", "Pharyngoglossus7" ], [ 10900, "wide", "niches" ], [ 10924, "wide", "KONDITIONERNES" ], [ 10960, "wide", "frsteopfrelsers" ], [ 10996, "wide", "Gravicembalos" ], [ 11040, "wide", "CLIMACIACEAE" ], [ 11072, "wide", "BRYSTHULERNES" ], [ 11104, "wide", "Blgers" ], [ 11124, "wide", "ARLOUP" ], [ 11144, "wide", "Agraffer" ], [ 11168, "wide", "Aosmic" ], [ 11188, "wide", "NACHANI" ], [ 11208, "wide", "Stjernetaagens" ], [ 11244, "wide", "labialising" ], [ 11272, "wide", "pansexualist" ], [ 11304, "wide", "Obituarize" ], [ 11332, "wide", "COORDINATORY" ], [ 11364, "wide", "Escaping2" ], [ 11388, "wide", "Dodecaphony" ], [ 11416, "wide", "FLUXING" ], [ 11436, "wide", "OVERTOISE" ], [ 11460, "wide", "Axenically" ], [ 11488, "wide", "Udsendelseslederens" ], [ 11532, "wide", "Afsavn8" ], [ 11552, "wide", "PENTALOGIES" ], [ 11580, "wide", "AFKAPPER" ], [ 11604, "wide", "Bundgears4" ], [ 11632, "wide", "AMYLOGENS" ], [ 11656, "wide", "Normaltilstandenes5" ], [ 11700, "wide", "Ciceronic" ], [ 11724, "wide", "Denni" ], [ 11740, "wide", "lashers" ], [ 11760, "wide", "Bjlkehytterne" ], [ 11792, "wide", "FANTASIPRIS" ], [ 11820, "wide", "Princesslike9" ], [ 11852, "wide", "Unserved" ], [ 11876, "wide", "Thomson9" ], [ 11900, "wide", "Lenstider" ], [ 11924, "wide", "Retsformand" ], [ 11952, "wide", "Lanceringens2" ], [ 12024, "wide", "Intercrescence" ], [ 12060, "wide", "Rejuvenescence2" ], [ 12096, "wide", "Unpecked3" ], [ 12120, "wide", "erhversformaals" ], [ 12156, "wide", "DIACRANTERIAN" ], [ 12188, "wide", "hldningers" ], [ 12216, "wide", "Drggene7" ], [ 12240, "wide", "Phyllobranchia" ], [ 12276, "wide", "UBEGRIBELIG" ], [ 12304, "wide", "ACROMIOCLAVICULAR" ], [ 12344, "wide", "Carpetwoven" ], [ 12372, "wide", "Siruppernes5" ], [ 12404, "wide", "Anslagenes1" ], [ 12432, "wide", "kontoudtogs" ], [ 12460, "wide", "fruitless" ], [ 12484, "wide", "Myndighedsbehandlings" ], [ 12532, "wide", "umiddelbarhed" ], [ 12564, "wide", "udforingen" ], [ 12592, "wide", "Baronesser7" ], [ 12620, "wide", "havebrugskandidat" ], [ 12660, "wide", "enkemnds" ], [ 12684, "wide", "Dissipators5" ], [ 12716, "wide", "telefonabonnementets" ], [ 12764, "wide", "SOLVOLYSIS" ], [ 12792, "wide", "Hoblike" ], [ 12812, "wide", "Tutee" ], [ 12828, "wide", "Nonexpedient" ], [ 12860, "wide", "flovmnd" ], [ 12880, "wide", "Brahetrolleborg" ], [ 12916, "wide", "Egenproduktionernes" ], [ 12960, "wide", "FRGEFORBINDELSE" ], [ 12996, "wide", "UNGRAPHIC" ], [ 13020, "wide", "tryknings" ], [ 13044, "wide", "pitchpine" ], [ 13068, "wide", "RETOOL" ], [ 13088, "wide", "Poorness6" ], [ 13112, "wide", "FORVANSKES" ], [ 13140, "wide", "KUNDSKABSTRSTENS" ], [ 13180, "wide", "Forskningschefernes" ], [ 13224, "wide", "amaryllisens" ], [ 13256, "wide", "Auditren" ], [ 13280, "wide", "Uproused9" ], [ 13304, "wide", "Millionths7" ], [ 13332, "wide", "Remunerators" ], [ 13364, "wide", "Programdelenes" ], [ 13400, "wide", "Radiospillet5" ], [ 13432, "wide", "Dormitoris3" ], [ 13460, "wide", "STOWP" ], [ 13476, "wide", "Sprgendes" ], [ 13500, "wide", "aerocraft" ], [ 13524, "wide", "prsentationernes" ], [ 13564, "wide", "Diagonallsningernes" ], [ 13608, "wide", "Veniality" ], [ 13632, "wide", "Sulphoantimonious" ], [ 13672, "wide", "SHALLOWISH" ], [ 13700, "wide", "Wisigothic" ], [ 13728, "wide", "SALTMANDELS" ], [ 13756, "wide", "Turbulensens" ], [ 13788, "wide", "Ndsituationer" ], [ 13820, "wide", "Iagttagelsens1" ], [ 13856, "wide", "PERSONISATION" ], [ 13888, "wide", "VILLYS" ], [ 13908, "wide", "Fleers7" ], [ 13928, "wide", "Opvejes" ], [ 13948, "wide", "Subnotation2" ], [ 13980, "wide", "CABLELAID" ], [ 14004, "wide", "formentlig" ], [ 14032, "wide", "Mutable" ], [ 14052, "wide", "styrkeprver" ], [ 14080, "wide", "TMMERVRKET" ], [ 14108, "wide", "Outscolds3" ], [ 14136, "wide", "Nidkres1" ], [ 14160, "wide", "daadyrklle" ], [ 14188, "wide", "Taltushtuntude" ], [ 14224, "wide", "Rdstrmpes" ], [ 14248, "wide", "KOMMISSORIER" ], [ 14280, "wide", "Sjlegruppe" ], [ 14308, "wide", "succesfuldes" ], [ 14340, "wide", "wali" ], [ 14356, "wide", "Sniglbene" ], [ 14380, "wide", "Designlisterne6" ], [ 14416, "wide", "Cataloguize4" ], [ 14452, "wide", "fascination" ], [ 14480, "wide", "PUPILISES" ], [ 14504, "wide", "Endocrinologies" ], [ 14540, "wide", "Frisr5" ], [ 14560, "wide", "Forbrugersamfund" ], [ 14600, "wide", "Antimaterialism1" ], [ 14640, "wide", "Ford" ], [ 14656, "wide", "Patronym" ], [ 14680, "wide", "SNOWDRIFTS" ], [ 14708, "wide", "unvigorously" ], [ 14740, "wide", "Groping5" ], [ 14764, "wide", "PERICHDRIA" ], [ 14792, "wide", "Noncrystallizing6" ], [ 14832, "wide", "DMONOLOGI" ], [ 14856, "wide", "HUMPLERNES" ], [ 14884, "wide", "Ingenious9" ], [ 14912, "wide", "SKILLINGENDE" ], [ 14944, "wide", "specula" ], [ 14964, "wide", "indkaldte" ], [ 14988, "wide", "Pathognomonical" ], [ 15052, "wide", "Moust" ], [ 15068, "wide", "Misopaterist" ], [ 15100, "wide", "Kalundborgenser8" ], [ 15140, "wide", "Policequest9" ], [ 15172, "wide", "udbydelserne" ], [ 15204, "wide", "Beregningsformernes" ], [ 15248, "wide", "Hjernearbejdes7" ], [ 15284, "wide", "afsnringens" ], [ 15312, "wide", "Gildehus" ], [ 15336, "wide", "Picturesque" ], [ 15364, "wide", "Lektorats" ], [ 15388, "wide", "rickmatic" ], [ 15412, "wide", "Brsnoteringen" ], [ 15444, "wide", "Broccolienes" ], [ 15476, "wide", "Revisionsaktieselskabets" ], [ 15532, "wide", "MOONWORT" ], [ 15556, "wide", "tilvnnedes" ], [ 15584, "wide", "Cusecs" ], [ 15604, "wide", "asylansgerne" ], [ 15636, "wide", "Krystalkuglens" ], [ 15672, "wide", "fredstiderne" ], [ 15704, "wide", "uhomogent" ], [ 15728, "wide", "Materialness" ], [ 15760, "wide", "votivtavle" ], [ 15788, "wide", "Gamboler4" ], [ 15812, "wide", "UNCHARITY" ], [ 15836, "wide", "Lysebrunes3" ], [ 15864, "wide", "Blikvarefabrikkers" ], [ 15908, "wide", "Dorhawks" ], [ 15928, "wide", "pY122" ], [ 15944, "wide", "rbdigheden" ], [ 15972, "wide", "RESPIRATE" ], [ 15996, "wide", "BLINKFYRET" ], [ 16024, "wide", "Teminalnavnets3" ], [ 16060, "wide", "Desterilized" ], [ 19050, "u8", "8Q6A" ], [ 20287, "u8", "js()" ] ], "v": { "file.stem": "835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf", "pe.imphash": "a19b14051f52f56134dc6b485eea5541", "pe.machine": "i386", "pe.rich.key": 2288615565, "pe.rich.hash": "cfa14d932599a86407a6162cc2d261fa", "pe.subsystem": "windows_gui", "pe.timestamp": 1361062118, "file.basename": "835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf.exe", "pe.image_base": 4194304, "pe.image_size": 122880, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4352, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "e8737d4a1ef52aa4e8b780f690f88846de3022c9", "pe.image_hash.sha256": "40664812b5c873faf2c5fc7b9fbbb3f2a8b3d746fddbd90c102b3b8e2e8608fc", "pe.image_hash.sha384": "8888e8a745720956a4b274d018df30657bdd03212a6622d862ffaf7ffd8b10c12e5a4da1551aec94789eab3d0d904426", "pe.image_hash.sha512": "95294425b43d96ebab65c2297690ea1fda8be12684fac79bc23f2c1439460389786826be9dcb7bce1003ddb8e2883208d884587713b52af717850f9bfce04516", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 108260, "pe.data_directories[1].rva": 118784, "pe.data_directories[2].rva": 544, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2605, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 100, "pe.rich.entries[0].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.coff.dos_header_pe_pointer": 176, "pe.rich.entries[0].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1236279235 }, "id": "pe", "sc": [ [ ".text", 4096, 106496, 5.91, "r-x" ], [ ".data", 0, 0, 0.0, "rw-" ], [ ".rsrc", 110592, 4096, 2.4, "r--" ] ] }, "id": 0, "sz": 114688, "ts": [ { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1083.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x1b2f2" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "MethCallEngine", "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x1a780", "0x1a7ea" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x1b1a6" ] }, { "c": 1.0, "d": "ShellObject 117.16.16.16:50 endpoint", "e": [ "117.16.16.16:50" ], "i": "well-known/malware/trojan/shellobject/vb6-recycler::c2-117-16-16-16-50", "l": 1, "el": [ "0x1b45d" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x1020" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x1a7a6" ] }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x1b40a" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x1b42c" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x1b2b6" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.91" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "SetLayeredWindowAttributes string", "e": [ "SetLayeredWindowAttributes" ], "i": "objectives/command-and-control/dropper/binder::set-layered-window-attributes-text", "l": 1, "el": [ "0x241c" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 24.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x2470" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x19432" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x1b336" ] }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1236279235,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x230" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1083.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x1b3de" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0x2244" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "49" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0xc680" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x1b246" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "EnumSystemCodePagesA", "FileTimeToLocalFileTime", "SetLayeredWindowAttributes", "ConfigCloudStorageEnabled", "GetOpenFileNamePreview" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x2378", "0x2548", "0x241c", "0x1b9b0", "0x2480" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 106496, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1083.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x1b42c" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x15ab" ] }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 24.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "51.153.102.207:20397", "117.16.16.16:50" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1, "el": [ "0x22db", "0x1b45d" ] }, { "c": 1.0, "d": "Android Pictures folder", "e": [ "Picturesque" ], "i": "objectives/impact/wipe/disk/mass-delete::android-pictures", "l": 1, "el": [ "0x3be8" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 24.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 24.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x150f" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (ORDINAL 690, MethCallEngine, ORDINAL 593, ORDINAL 703, ORDINAL 706, ... +19 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "24 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "DllFunctionCall", "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x1a7a6", "0x230" ] } ], "sha": "835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-11/835179a5b8a9c27a30cd81a9caa1e5af30f9e2fc9e6c1cc0c05187049d184faf.exe", "type": "pe" } ], "tv": "ca5ef" } }