{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998396635055542, "class": 2 }, { "id": 1, "prob": 0.9540849924087524, "class": 0 }, { "id": 2, "prob": 0.9972424507141113, "class": 1 }, { "id": 3, "prob": 0.3906331956386566, "class": 0 }, { "id": 4, "prob": 0.1068696454167366, "class": 0 }, { "id": 5, "prob": 0.017262576147913933, "class": 0 }, { "id": 6, "prob": 0.9963996410369873, "class": 0 } ], "prob": 0.99983966, "class": 2, "models": [ { "m": "az", "prob": 0.9997867, "class": 2 }, { "m": "az/native", "prob": 0.99983966, "class": 0 }, { "m": "az/pe", "prob": 0.99931514, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-02T23:37:36Z" }, "path": "93156", "raw": { "v": "4", "fs": [ { "f": "KO₇(As₁₀I₄C₄P₂CoEr₄Eu)H₆(Cm₃DsF₅Os₇Po₄U)Md₄(Bi₆PtSi)", "x": 100, "id": 0, "is": [ "RegCloseKey", "RegCreateKeyExA", "RegDeleteKeyA", "RegDeleteValueA", "RegEnumKeyA", "RegEnumValueA", "RegOpenKeyExA", "RegQueryValueExA", "RegSetValueExA", "ImageList_AddMasked", "ImageList_Create", "ImageList_Destroy", "InitCommonControls", "CreateBrushIndirect", "CreateFontIndirectA", "DeleteObject", "GetDeviceCaps", "SelectObject", "SetBkColor", "SetBkMode", "SetTextColor", "CloseHandle", "CompareFileTime", "CopyFileA", "CreateDirectoryA", "CreateFileA", "CreateProcessA", "CreateThread", "DeleteFileA", "ExitProcess", "ExpandEnvironmentStringsA", "FindClose", "FindFirstFileA", "FindNextFileA", "FreeLibrary", "GetCommandLineA", "GetCurrentProcess", "GetDiskFreeSpaceA", "GetExitCodeProcess", "GetFileAttributesA", "GetFileSize", "GetFullPathNameA", "GetLastError", "GetModuleFileNameA", "GetModuleHandleA", "GetPrivateProfileStringA", "GetProcAddress", "GetShortPathNameA", "GetSystemDirectoryA", "GetTempFileNameA", "GetTempPathA", "GetTickCount", "GetVersion", "GetWindowsDirectoryA", "GlobalAlloc", "GlobalFree", "GlobalLock", "GlobalUnlock", "LoadLibraryA", "LoadLibraryExA", "MoveFileA", "MulDiv", "MultiByteToWideChar", "ReadFile", "RemoveDirectoryA", "SearchPathA", "SetCurrentDirectoryA", "SetErrorMode", "SetFileAttributesA", "SetFilePointer", "SetFileTime", "Sleep", "WaitForSingleObject", "WriteFile", "WritePrivateProfileStringA", "lstrcatA", "lstrcmpA", "lstrcmpiA", "lstrcpynA", "lstrlenA", "CoCreateInstance", "CoTaskMemFree", "OleInitialize", "OleUninitialize", "SHBrowseForFolderA", "SHFileOperationA", "SHGetFileInfoA", "SHGetPathFromIDListA", "SHGetSpecialFolderLocation", "ShellExecuteA", "AppendMenuA", "BeginPaint", "CallWindowProcA", "CharNextA", "CharPrevA", "CheckDlgButton", "CloseClipboard", "CreateDialogParamA", "CreatePopupMenu", "CreateWindowExA", "DefWindowProcA", "DestroyWindow", "DialogBoxParamA", "DispatchMessageA", "DrawTextA", "EmptyClipboard", "EnableMenuItem", "EnableWindow", "EndDialog", "EndPaint", "ExitWindowsEx", "FillRect", "FindWindowExA", "GetClassInfoA", "GetClientRect", "GetDC", "GetDlgItem", "GetDlgItemTextA", "GetMessagePos", "GetSysColor", "GetSystemMenu", "GetSystemMetrics", "GetWindowLongA", "GetWindowRect", "InvalidateRect", "IsWindow", "IsWindowEnabled", "IsWindowVisible", "LoadBitmapA", "LoadCursorA", "LoadImageA", "MessageBoxIndirectA", "OpenClipboard", "PeekMessageA", "PostQuitMessage", "RegisterClassA", "ScreenToClient", "SendMessageA", "SendMessageTimeoutA", "SetClassLongA", "SetClipboardData", "SetCursor", "SetDlgItemTextA", "SetForegroundWindow", "SetTimer", "SetWindowLongA", "SetWindowPos", "SetWindowTextA", "ShowWindow", "SystemParametersInfoA", "TrackPopupMenu", "wsprintfA", "GetFileVersionInfoA", "GetFileVersionInfoSizeA", "VerQueryValueA" ], "ms": { "pe": { "signer": "AddTrust External CA Root, UTN-USERFirst-Object, COMODO Code Signing CA 2, DDLR LTD", "machine": 332.0, "checksum": 0.0, "rsrc_size": 23552.0, "subsystem": 2.0, "timestamp": 1329663717.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.91, "signing_time": 1358194386.0, "entry_section": ".text", "has_signature": true, "size_of_image": 286720.0, "timestamp_day": 19.0, "file_alignment": 512.0, "primary_signer": "The USERTRUST Network", "resource_count": 4.0, "signature_type": "developer", "timestamp_year": 2012.0, "characteristics": 783.0, "entry_point_rva": 16689.0, "size_of_headers": 1024.0, "timestamp_month": 2.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 8.0, "manifest_present": true, "signing_time_day": 14.0, "certificate_count": 1.0, "computed_checksum": 538078.0, "section_alignment": 4096.0, "signing_time_year": 2013.0, "number_of_sections": 7.0, "resource_timestamp": 1329663717.0, "signing_time_month": 1.0, "dll_characteristics": 32768.0, "linker_major_version": 2.0, "linker_minor_version": 22.0, "api_hashing_indicators": 1.0, "certificate_table_size": 5616.0, "resource_timestamp_day": 19.0, "resource_timestamp_year": 2012.0, "export_timestamp_present": false, "resource_timestamp_month": 2.0, "resource_timestamp_present": true }, "binary": { "code_size": 34304.0, "file_size": 523080.0, "entry_point": 16689.0, "has_overlay": true, "code_entropy": 6.08, "data_entropy": 3.02, "import_count": 155.0, "overlay_size": 442200.0, "string_count": 1432.0, "has_signature": true, "overlay_ratio": 0.85, "section_count": 7.0, "avg_complexity": 8.51, "function_count": 73.0, "import_density": 4.63, "max_complexity": 111.0, "string_density": 42.75, "overall_entropy": 3.29, "overlay_entropy": 6.79, "avg_basic_blocks": 14.45, "avg_section_size": 10605.71, "dependency_count": 8.0, "entropy_variance": 2.56, "function_density": 2.18, "avg_function_size": 331.66, "avg_string_length": 18.78, "complexity_per_kb": 0.25, "max_string_length": 729.0, "wide_string_count": 5.0, "writable_sections": 5.0, "avg_string_entropy": 3.31, "code_to_data_ratio": 0.86, "data_to_file_ratio": 0.0, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.05, "text_to_file_ratio": 0.07, "total_basic_blocks": 1055.0, "embedded_file_count": 6.0, "executable_sections": 1.0, "string_length_stddev": 31.58, "embedded_binary_count": 6.0, "largest_section_ratio": 0.07, "sentence_string_count": 183.0, "sentence_string_ratio": 0.13, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 49, "xor", "User-Agent:" ], [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 456, ".rdata" ], [ 494, "0@.bss" ], [ 536, ".idata" ], [ 576, ".ndata" ], [ 616, ".rsrc" ], [ 5543, "xor", "QseCۆcA.t: " ], [ 7702, "R4PP" ], [ 8960, "xor", "50er\"ųmnt" ], [ 9175, "xor", "50er\"Śbnt" ], [ 11700, "xor", "UserŞ/en%" ], [ 12977, "Instuc" ], [ 18240, "xor", "Drer\"Āent5" ], [ 19165, "xor", "Zwer\"ċdnt" ], [ 23321, "xor", "Drer\"ķent\\" ], [ 23674, "xor", "Zwer\"ĺdnt" ], [ 29193, "xor", "Uwer\"εdnt" ], [ 29779, "xor", "tqerڇeent5" ], [ 36160, "verifying installer: %d%%" ], [ 36195, "Error launching installer" ], [ 36221, "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho" ], [ 36281, "incomplete download and damaged media. Contact the" ], [ 36332, "installer's author to obtain a new copy." ], [ 36374, "More information at:" ], [ 36395, "http://nsis.sf.net/NSIS_Error" ], [ 36454, "Error writing temporary file. Make sure your temp folder is valid." ], [ 36522, "NSIS Error" ], [ 36548, "SeShutdownPrivilege" ], [ 36568, "%u.%u%s%s" ], [ 36579, "open" ], [ 36584, ".exe" ], [ 36592, "Control Panel\\Desktop\\ResourceLocale" ], [ 36632, ".DEFAULT\\Control Panel\\International" ], [ 36708, "RichEdit" ], [ 36767, "KERNEL32" ], [ 36776, "GetDiskFreeSpaceExA" ], [ 36808, "ADVAPI32" ], [ 36817, "RegDeleteKeyExA" ], [ 36833, "OpenProcessToken" ], [ 36850, "LookupPrivilegeValueA" ], [ 36872, "AdjustTokenPrivileges" ], [ 36894, "GetUserDefaultUILanguage" ], [ 36919, "SHLWAPI" ], [ 36927, "SHAutoComplete" ], [ 36942, "SHFOLDER" ], [ 36951, "SHGetFolderPathA" ], [ 36968, "\\Microsoft\\Internet Explorer\\Quick Launch" ], [ 37012, "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 37056, "[Rename]" ], [ 37304, "xor", "Twdt,Ifiod;8OsHcE" ], [ 37337, "xor", "Uqeq-Bganp:%NVIUDJ/6.5 " ], [ 37366, "xor", "\\sor'Aleet6" ], [ 37390, "xor", "\\uow\u0026Ekfcv4!ASISEL,1)2/(RoEi" ], [ 39913, "xor", "User-A!Ū|*38" ], [ 40030, "xor", "hҔf/Agent" ], [ 42430, "xor", "XǓf/Agent" ], [ 45774, "xor", "VsY4.A7#mt: NS+" ], [ 45830, "xor", "VsE5.AK\"mt: NSu" ], [ 45958, "xor", "Vs+;.A9,mtTiMS5" ], [ 46010, "xor", "Vsy8.AO/mt" ], [ 46070, "xor", "Vsq9.AG.mt: NSe" ], [ 46334, "xor", "VsW=.AY*mtjoMS/" ], [ 46426, "xor", "VsY4.A7#mt: NS+" ], [ 46482, "xor", "VsE5.AK\"mt: NSu" ], [ 46610, "xor", "Vs+;.A9,mtTiMS5" ], [ 46662, "xor", "Vsy8.AO/mt" ], [ 46722, "xor", "Vsq9.AG.mt: NSe" ], [ 46986, "xor", "VsW=.AY*mtjoMS/" ], [ 47054, "RegCloseKey" ], [ 47068, "RegCreateKeyExA" ], [ 47086, "RegDeleteKeyA" ], [ 47102, "RegDeleteValueA" ], [ 47134, "RegEnumValueA" ], [ 47150, "RegOpenKeyExA" ], [ 47166, "RegQueryValueExA" ], [ 47186, "RegSetValueExA" ], [ 47204, "ImageList_AddMasked" ], [ 47226, "ImageList_Create" ], [ 47246, "ImageList_Destroy" ], [ 47266, "InitCommonControls" ], [ 47288, "CreateBrushIndirect" ], [ 47310, "CreateFontIndirectA" ], [ 47332, "DeleteObject" ], [ 47348, "GetDeviceCaps" ], [ 47364, "SelectObject" ], [ 47406, "SetTextColor" ], [ 47422, "CloseHandle" ], [ 47436, "CompareFileTime" ], [ 47466, "CreateDirectoryA" ], [ 47486, "CreateFileA" ], [ 47500, "CreateProcessA" ], [ 47518, "CreateThread" ], [ 47534, "DeleteFileA" ], [ 47548, "ExitProcess" ], [ 47562, "ExpandEnvironmentStringsA" ], [ 47590, "FindClose" ], [ 47602, "FindFirstFileA" ], [ 47620, "FindNextFileA" ], [ 47636, "FreeLibrary" ], [ 47650, "GetCommandLineA" ], [ 47668, "GetCurrentProcess" ], [ 47688, "GetDiskFreeSpaceA" ], [ 47708, "GetExitCodeProcess" ], [ 47730, "GetFileAttributesA" ], [ 47752, "GetFileSize" ], [ 47766, "GetFullPathNameA" ], [ 47786, "GetLastError" ], [ 47802, "GetModuleFileNameA" ], [ 47824, "GetModuleHandleA" ], [ 47844, "GetPrivateProfileStringA" ], [ 47872, "GetProcAddress" ], [ 47890, "GetShortPathNameA" ], [ 47910, "GetSystemDirectoryA" ], [ 47932, "GetTempFileNameA" ], [ 47952, "GetTempPathA" ], [ 47968, "GetTickCount" ], [ 47984, "GetVersion" ], [ 47998, "GetWindowsDirectoryA" ], [ 48022, "GlobalAlloc" ], [ 48036, "GlobalFree" ], [ 48050, "GlobalLock" ], [ 48064, "GlobalUnlock" ], [ 48080, "LoadLibraryA" ], [ 48096, "LoadLibraryExA" ], [ 48136, "MultiByteToWideChar" ], [ 48158, "ReadFile" ], [ 48170, "RemoveDirectoryA" ], [ 48190, "SearchPathA" ], [ 48204, "SetCurrentDirectoryA" ], [ 48228, "SetErrorMode" ], [ 48244, "SetFileAttributesA" ], [ 48266, "SetFilePointer" ], [ 48284, "SetFileTime" ], [ 48298, "Sleep" ], [ 48306, "WaitForSingleObject" ], [ 48328, "WriteFile" ], [ 48340, "WritePrivateProfileStringA" ], [ 48370, "lstrcatA" ], [ 48382, "lstrcmpA" ], [ 48394, "lstrcmpiA" ], [ 48406, "lstrcpynA" ], [ 48418, "lstrlenA" ], [ 48430, "CoCreateInstance" ], [ 48450, "CoTaskMemFree" ], [ 48466, "OleInitialize" ], [ 48482, "OleUninitialize" ], [ 48500, "SHBrowseForFolderA" ], [ 48522, "SHFileOperationA" ], [ 48542, "SHGetFileInfoA" ], [ 48560, "SHGetPathFromIDListA" ], [ 48584, "SHGetSpecialFolderLocation" ], [ 48614, "ShellExecuteA" ], [ 48630, "AppendMenuA" ], [ 48644, "BeginPaint" ], [ 48658, "CallWindowProcA" ], [ 48700, "CheckDlgButton" ], [ 48718, "CloseClipboard" ], [ 48736, "CreateDialogParamA" ], [ 48758, "CreatePopupMenu" ], [ 48776, "CreateWindowExA" ], [ 48794, "DefWindowProcA" ], [ 48812, "DestroyWindow" ], [ 48828, "DialogBoxParamA" ], [ 48846, "DispatchMessageA" ], [ 48878, "EmptyClipboard" ], [ 48896, "EnableMenuItem" ], [ 48914, "EnableWindow" ], [ 48930, "EndDialog" ], [ 48942, "EndPaint" ], [ 48954, "ExitWindowsEx" ], [ 48970, "FillRect" ], [ 48982, "FindWindowExA" ], [ 48998, "GetClassInfoA" ], [ 49014, "GetClientRect" ], [ 49052, "GetDlgItemTextA" ], [ 49070, "GetMessagePos" ], [ 49086, "GetSysColor" ], [ 49100, "GetSystemMenu" ], [ 49116, "GetSystemMetrics" ], [ 49136, "GetWindowLongA" ], [ 49154, "GetWindowRect" ], [ 49170, "InvalidateRect" ], [ 49188, "IsWindow" ], [ 49200, "IsWindowEnabled" ], [ 49218, "IsWindowVisible" ], [ 49236, "LoadBitmapA" ], [ 49250, "LoadCursorA" ], [ 49264, "LoadImageA" ], [ 49278, "MessageBoxIndirectA" ], [ 49300, "OpenClipboard" ], [ 49316, "PeekMessageA" ], [ 49332, "PostQuitMessage" ], [ 49350, "RegisterClassA" ], [ 49368, "ScreenToClient" ], [ 49386, "SendMessageA" ], [ 49402, "SendMessageTimeoutA" ], [ 49424, "SetClassLongA" ], [ 49440, "SetClipboardData" ], [ 49460, "SetCursor" ], [ 49472, "SetDlgItemTextA" ], [ 49490, "SetForegroundWindow" ], [ 49512, "SetTimer" ], [ 49524, "SetWindowLongA" ], [ 49542, "SetWindowPos" ], [ 49558, "SetWindowTextA" ], [ 49576, "ShowWindow" ], [ 49590, "SystemParametersInfoA" ], [ 49614, "TrackPopupMenu" ], [ 49632, "wsprintfA" ], [ 49644, "GetFileVersionInfoA" ], [ 49666, "GetFileVersionInfoSizeA" ], [ 49692, "VerQueryValueA" ], [ 49744, "ADVAPI32.dll" ], [ 49766, "xor", "Vsq2.As%mtyo" ], [ 49776, "COMCTL32.DLL" ], [ 49790, "xor", "UsM2.AO%mt" ], [ 49802, "xor", "VsM2.AO%mt" ], [ 49824, "GDI32.dll" ], [ 50072, "KERNEL32.dll" ], [ 50085, "xor", "Use\"mBg5.w:p" ], [ 50104, "ole32.dll" ], [ 50140, "SHELL32.DLL" ], [ 50400, "USER32.dll" ], [ 50424, "VERSION.dll" ], [ 53074, "xor", "User-Agent: NS" ], [ 53322, "xor", "User-Agent: NS" ], [ 53570, "xor", "User-Agent: NS" ], [ 53816, "xor", "User-Agent: NSIS" ], [ 54068, "xor", "User-Agent: NSIS" ], [ 54316, "xor", "User-Agent: NSIS" ], [ 54568, "xor", "User-Agent: NSIS" ], [ 54822, "xor", "User-Agent: NS" ], [ 55074, "xor", "User-Agent: NS" ], [ 55323, "xor", "User-Agent: NSISDӶ" ], [ 55575, "xor", "User-Agent: NSISDﱢ\u003e" ], [ 55827, "xor", "User-Agent: NSISD" ], [ 56083, "xor", "User-Agent: NSISD׼" ], [ 56337, "xor", "User-Agent: NSI" ], [ 56587, "xor", "User-Agent: NSISDㄓ-" ], [ 56843, "xor", "User-Agent: NSISD" ], [ 57095, "xor", "User-Agent: NSISD爬-" ], [ 57864, "xor", "User-Agent: " ], [ 58116, "xor", "User-Agent: NSIS" ], [ 58368, "xor", "User-Agent: NSIS" ], [ 59132, "xor", "User-Agent: NSIS" ], [ 59392, "xor", "User-Agent: " ], [ 59647, "xor", "User-Agent: N" ], [ 59899, "xor", "User-Agent: NSISDҺ" ], [ 60151, "xor", "User-Agent: NSISD犪)" ], [ 60664, "xor", "User-Agent: NSIS" ], [ 60919, "xor", "User-Agent: NSISD׽" ], [ 61177, "xor", "User-Agent:" ], [ 61427, "xor", "User-Agent: NSISD匫\"" ], [ 61685, "xor", "User-Agent: NSI" ] ], "sz": 523080, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: AddTrust External CA Root", "e": [ "AddTrust External CA Root" ], "i": "metadata/signed/developer::addtrust-external-ca-root", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: UTN-USERFirst-Object", "e": [ "UTN-USERFirst-Object" ], "i": "metadata/signed/developer::utn-userfirst-object", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: COMODO Code Signing CA 2", "e": [ "COMODO Code Signing CA 2" ], "i": "metadata/signed/developer::comodo-code-signing-ca-2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: DDLR LTD", "e": [ "DDLR LTD" ], "i": "metadata/signed/developer::ddlr-ltd", "l": 2 }, { "c": 1.0, "d": "Signed by The USERTRUST Network", "e": [ "The USERTRUST Network" ], "i": "metadata/signed/leaf::the-usertrust-network", "l": 3 }, { "a": "T1059", "c": 0.8999999761581421, "d": "NSIS self-extracting installer", "e": [ "NSIS marker found" ], "i": "file/sfx/nsis", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "Embedded PE binary at file offset 0x15045 (~196608 bytes)", "e": [ "kind=Pe32 estimated_size=196608", "kind=Pe32 estimated_size=258048", "kind=Pe32 estimated_size=53248", "kind=Pe32 estimated_size=32768", "kind=Pe32 estimated_size=24576", "kind=Pe32 estimated_size=143360" ], "i": "binary/embedded/pe", "l": 3 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops::shell-get-special-folder-location", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SHFOLDER", "SERVERNT", "LANMANNT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingA" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 442200.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:" ], "i": "micro-behaviors/communications/http/request::user-agent-header", "l": 2, "m": "C0002" }, { "c": 1.0, "d": "NSIS runtime error title in rdata", "e": [ "NSIS Error" ], "i": "metadata/binary/installer/script::nsis-error-title-rdata", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Internet Settings registry key access", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ], "i": "micro-behaviors/os/registry/access::internet-settings-key", "l": 3 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry values via import", "e": [ "RegEnumValueA" ], "i": "micro-behaviors/os/registry/access::reg-enum-value-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003c\u003c\u003cObsolete\u003e\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://openbitcoin.org/", "http://openbitcoin.org/", "http://bit-accelerator.com/", "http://bit-accelerator.com/" ], "i": "objectives/command-and-control/infrastructure/domain::http-url-binary", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 73.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "Check if running under WoW64", "e": [ "IsWow64Process" ], "i": "micro-behaviors/os/compat/wow64::is-wow64-process", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is enabled", "e": [ "IsWindowEnabled" ], "i": "micro-behaviors/ui/window/manage::is-window-enabled", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.9800000190734863, "d": "NSIS exehead assembly manifest", "e": [ "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], "i": "metadata/binary/installer/script::nsis-manifest-exehead", "l": 1 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "GET %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.800000011920929, "d": "High import density (\u003e3 imports/KB)", "e": [ "binary.import_density = 4.63" ], "i": "metadata/binary/metrics::high-import-density", "l": 2 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "c": 1.0, "d": "GetFileVersionInfoSizeA import", "e": [ "GetFileVersionInfoSizeA" ], "i": "well-known/malware/trojan/hijack-gen::padodor-get-file-version-info-size-a-import", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.800000011920929, "d": "Accesses ComSpec environment variable", "e": [ "COMSPEC" ], "i": "micro-behaviors/os/env/vars::comspec-env-var", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassA" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "a": "T1499", "c": 0.8999999761581421, "d": "Shutdown prank markers", "e": [ "Shutdown", "Shutdown" ], "i": "objectives/impact/ui/manipulation::shutdown-prank-markers", "l": 3 }, { "c": 0.800000011920929, "d": "Convert Shell folder ID to path (ANSI)", "e": [ "SHGetPathFromIDListA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-path-from-idlist-a", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 73.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.7799999713897705, "d": "Perform file operation through shell ANSI", "e": [ "SHFileOperationA" ], "i": "micro-behaviors/fs/shell-ops::shell-file-operation-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "GNU libstdc++ stdlib", "e": [ "__gnu_cxx", "__gnu_cxx", "__cxxabiv1", "__cxxabiv1", "__cxxabiv1", "__cxxabiv1", "__gnu_cxx", "__gnu_cxx" ], "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "l": 2 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.699999988079071, "d": "Initialize common controls library", "e": [ "InitCommonControls" ], "i": "micro-behaviors/ui/controls/widget::init-common-controls", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "EmptyClipboard", "SetClipboardData", "OpenClipboard", "Copy Details To Clipboard", "CloseClipboard" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 523080.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "OpenCL GPU computing framework", "e": [ "OpenCL", "OpenCL" ], "i": "objectives/impact/cryptojacking/miner::opencl-string", "l": 2 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://www.directdownloader.com/check.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-endpoint-url", "l": 1 }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.800000011920929, "d": "Write data to clipboard", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "l": 2 }, { "c": 0.7599999904632568, "d": "Winsock startup API string", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "Get message cursor position", "e": [ "GetMessagePos" ], "i": "micro-behaviors/ui/window/manage::get-message-pos", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 523080.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileA" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.699999988079071, "d": "Compare file modification times", "e": [ "CompareFileTime" ], "i": "micro-behaviors/fs/sync/fsync::compare-file-time", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy image list", "e": [ "ImageList_Destroy" ], "i": "micro-behaviors/ui/controls/widget::image-list-destroy", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 73.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 155.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "c": 0.699999988079071, "d": "Add masked image", "e": [ "ImageList_AddMasked" ], "i": "micro-behaviors/ui/controls/widget::image-list-add-masked", "l": 2 }, { "c": 0.7200000286102295, "d": "Write INI string value", "e": [ "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::write-private-profile-ansi", "l": 2 }, { "c": 0.75, "d": "Clear clipboard contents", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "l": 2 }, { "c": 0.699999988079071, "d": "Create brush object", "e": [ "CreateBrushIndirect" ], "i": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "l": 2 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.85" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.DLL", "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.699999988079071, "d": "Create image list", "e": [ "ImageList_Create" ], "i": "micro-behaviors/ui/controls/widget::image-list-create", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.699999988079071, "d": "gethostbyname import string", "e": [ "gethostbyname" ], "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import", "l": 2 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Two or more embedded PE headers", "e": [ "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::multiple-pe-embedded", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with dense string corpus", "e": [ "binary.string_density = 42.75" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-string-density-large-pe", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "NSIS runtime error URL in rdata", "e": [ "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho", "http://nsis.sf.net/NSIS_Error" ], "i": "metadata/binary/installer/script::nsis-error-url-rdata", "l": 1 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "download", "download", "download", "download", "download", "download", "download", "Download", "download", "download", "download", "Download", "Download", "Download", "download", "Download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "HTTP User-Agent header", "e": [ "User-Agent: NSISDӶ", "User-Agent: NSISD׼", "User-Agent: NSIS", "User-Agent:", "User-Agent: NSISDﱢ\u003e", "User-Agent: NS", "User-Agent: NSISD", "User-Agent: NSI", "User-Agent: NSISDㄓ-" ], "i": "micro-behaviors/communications/http/user-agent::user-agent-header-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.31" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.75, "d": "Open clipboard access", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1329663717.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1432.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.51" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8500000238418579, "d": "PE linked with binutils 2.x (MinGW/GCC)", "e": [ "pe.linker_major_version = 2.00" ], "i": "metadata/lang/compiler/native::linker-binutils-2x", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.29" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1055.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "a": "T1562.004", "c": 0.8999999761581421, "d": "Netsh firewall add allowedprogram exception", "e": [ "netsh firewall add allowedprogram" ], "i": "objectives/impact/degrade/firewall::netsh-firewall-allowedprogram", "l": 4 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.29" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 0.8500000238418579, "d": "Skips Windows installation directories", "e": [ "WINNT" ], "i": "objectives/impact/infect/binary::skip-windows-install-dir", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.7200000286102295, "d": "Winsock socket API string", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::ws2-socket-api-string", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.6600000262260437, "d": "Copy files (Windows API ANSI)", "e": [ "CopyFileA" ], "i": "micro-behaviors/fs/file/copy::copyfile-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.6499999761581421, "d": "Close clipboard", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1432.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.949999988079071, "d": "Six or more embedded PE headers", "e": [ "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::many-pe-embedded", "l": 1 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 286720.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.7200000286102295, "d": "Winsock connect API string", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::ws2-connect-api-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "GetFolder", "Connect" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M", "Software\\D", "Software\\D", "Software\\M" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "c": 0.8500000238418579, "d": "NSIS marker in low-string binary", "e": [ "…e=\"win32\"/\u003e\u003cdescription\u003eNullsoft Install System v2.46-7\u003c/description\u003e\u003ct…", "…e=\"win32\"/\u003e\u003cdescription\u003eNullsoft Install System v2.46\u003c/description\u003e\u003ctru…", "Nullsoft Install System v2.46-7" ], "i": "objectives/anti-static/obfuscation/imports::low-string-fp-nsis", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP GET method", "e": [ "GET %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/get::get", "l": 3 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "a": "T1071.001", "d": "Basic authentication", "e": [ "Authorization: Basic", "Authorization: Basic" ], "i": "micro-behaviors/communications/http/headers::basic-auth", "l": 3, "m": "C0002" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.6000000238418579, "d": "Base64-encoded HTTP protocol fragment", "e": [ "\\DirectDownloader\\DirectDownloader.exe run \"AnyDVD0iiillliii0aHR0cDovL3d3dy50b3JyZW50aG91bmQuY29tL3RvcnJlbnQvNjUxNjZhZjlkZmRlZDc" ], "i": "objectives/exfiltration/oob::http-b64", "l": 1 }, { "c": 0.8500000238418579, "d": ".NET Clipboard class reference (WinForms)", "e": [ "Clipboard" ], "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 442200.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.85" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowEnabled", "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AdjustTokenPrivileges", "GetUserDefaultUILanguage", "CreateFontIndirectA", "GetModuleFileNameA", "GetPrivateProfileStringA", "GetSystemDirectoryA", "GetWindowsDirectoryA", "MultiByteToWideChar", "SetCurrentDirectoryA", "WritePrivateProfileStringA", "MessageBoxIndirectA", "GetFileVersionInfoSizeA", "DirectDownloaderInstaller", "DirectDownloaderInstaller", "BitAcceleratorDDLRinstaller", "BitAcceleratorDDLRinstaller" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "CLSID registry path manipulation", "e": [ "CLSID\\{CAC42510-9B41-42c1-9DCD-7282A2D07C61}" ], "i": "objectives/persistence/system/registry/com-hijack::clsid-registry-path", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "cc 43 43 00", "e8 43 43 00", "e8 43 43 00", "cc 43 43 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1071.001", "d": "Authorization header", "e": [ "Authorization: Basic", "Proxy-Authorization: Basic" ], "i": "micro-behaviors/communications/http/headers::auth-header", "l": 3, "m": "C0002" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1432.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{CAC42510-9B41-42c1-9DCD-7282A2D07C61}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Delete registry key via import", "e": [ "RegDeleteKeyA" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-key-a-symbol", "l": 3 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 3 }, { "a": "T1071", "c": 0.75, "d": "PHP URL endpoint (often used for C2)", "e": [ "http://www.directdownloader.com/check.php?" ], "i": "objectives/command-and-control/infrastructure/domain::php-url", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CloseHandle, CompareFileTime, CopyFileA, CreateDirectoryA, CreateFileA, ... +54 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.DLL (ImageList_AddMasked, ImageList_Create, ImageList_Destroy, InitCommonControls)", "e": [ "COMCTL32.DLL" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey, RegCreateKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyA, ... +4 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (CreateBrushIndirect, CreateFontIndirectA, DeleteObject, GetDeviceCaps, SelectObject, ... +3 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (AppendMenuA, BeginPaint, CallWindowProcA, CharNextA, CharPrevA, ... +57 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.DLL (SHBrowseForFolderA, SHFileOperationA, SHGetFileInfoA, SHGetPathFromIDListA, SHGetSpecialFolderLocation, ... +1 more)", "e": [ "SHELL32.DLL" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.8199999928474426, "d": "Reads and writes INI via ANSI", "e": [ "GetPrivateProfileStringA", "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle-ansi", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetFileSize", "CreateFileA", "ReadFile", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8600000143051147, "d": "Runtime-resolved Winsock client APIs", "e": [ "connect", "WSAStartup", "WS2_32.dll", "socket" ], "i": "micro-behaviors/communications/socket/init::winsock-runtime-client-api-table", "l": 3 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "cc 43 43 00", "GetTickCount", "e8 43 43 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.800000011920929, "d": "Thread synchronization via message queue", "e": [ "CreateThread", "PeekMessageA" ], "i": "micro-behaviors/process/threading/async::thread-message-sync", "l": 2 }, { "c": 0.8500000238418579, "d": "Drop and execute file from Temp directory", "e": [ "WriteFile", "ShellExecuteA", "CreateProcessA", "GetTempPathA" ], "i": "objectives/command-and-control/dropper/staging::temp-file-execution", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempFileNameA", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindFirstFileA", "FindNextFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyExA", "RegCreateKeyExA", "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "MinGW PE with anti-analysis features", "e": [ "pe.linker_major_version = 2.00", "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/cross-compiled::mingw-with-anti-analysis", "l": 4, "m": "B0032" }, { "c": 0.949999988079071, "d": "Nullsoft NSIS installer marker", "e": [ "http://nsis.sf.net/NSIS_Error", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e", "NSIS Error", "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho" ], "i": "metadata/binary/installer/script::nsis", "l": 3 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegCreateKeyExA", "RegOpenKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "ReadFile", "GetFileSize", "CreateFileA", "binary.has_overlay = 1.00", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 3, "m": "B0032" }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetDiskFreeSpaceExA", "GetSystemMetrics", "GetDiskFreeSpaceA", "GetTickCount" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "CloseClipboard", "EmptyClipboard", "Copy Details To Clipboard", "SetClipboardData", "SetClipboardData", "OpenClipboard" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "User-Agent: NSISD(KU-n}uh;.=1=0x \u003cxor\u003e", "Tqdp,Cfgov;\"OQHQE\\/!.\" 8MOzIlLa\tUSeR-agE \u003cxor\u003e", "Trds,@weou;!ORHREM.0/3\")Onxhnmc(Wrgs/@ed \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "8351a08759e898e6562cf35cf0e21ecd15b3fc9163b7d2401b70386eadfc6ebe", "path": "93156", "type": "pe" }, { "f": "KO₆(C₅I₂As₈CoEr₄P)H₅(DsF₅Os₄Po₄U)Md₂(Bi₆Si)", "x": 20, "dp": 1, "id": 1, "is": [ "CompareFileTime", "SearchPathA", "GetShortPathNameA", "GetFullPathNameA", "MoveFileA", "SetCurrentDirectoryA", "GetFileAttributesA", "GetLastError", "CreateDirectoryA", "SetFileAttributesA", "Sleep", "GetTickCount", "GetFileSize", "GetModuleFileNameA", "GetCurrentProcess", "CopyFileA", "ExitProcess", "GetWindowsDirectoryA", "SetFileTime", "GetCommandLineA", "SetErrorMode", "LoadLibraryA", "lstrcpynA", "GetDiskFreeSpaceA", "GlobalUnlock", "GlobalLock", "CreateThread", "CreateProcessA", "RemoveDirectoryA", "CreateFileA", "GetTempFileNameA", "lstrlenA", "lstrcatA", "GetSystemDirectoryA", "GetVersion", "CloseHandle", "lstrcmpiA", "lstrcmpA", "ExpandEnvironmentStringsA", "GlobalFree", "GlobalAlloc", "WaitForSingleObject", "GetExitCodeProcess", "GetModuleHandleA", "LoadLibraryExA", "GetProcAddress", "FreeLibrary", "MultiByteToWideChar", "WritePrivateProfileStringA", "GetPrivateProfileStringA", "WriteFile", "ReadFile", "MulDiv", "SetFilePointer", "FindClose", "FindNextFileA", "FindFirstFileA", "DeleteFileA", "GetTempPathA", "EndDialog", "ScreenToClient", "GetWindowRect", "EnableMenuItem", "GetSystemMenu", "SetClassLongA", "IsWindowEnabled", "SetWindowPos", "GetSysColor", "GetWindowLongA", "SetCursor", "LoadCursorA", "CheckDlgButton", "GetMessagePos", "LoadBitmapA", "CallWindowProcA", "IsWindowVisible", "CloseClipboard", "SetClipboardData", "EmptyClipboard", "RegisterClassA", "TrackPopupMenu", "AppendMenuA", "CreatePopupMenu", "GetSystemMetrics", "SetDlgItemTextA", "GetDlgItemTextA", "MessageBoxIndirectA", "CharPrevA", "DispatchMessageA", "PeekMessageA", "DestroyWindow", "CreateDialogParamA", "SetTimer", "SetWindowTextA", "PostQuitMessage", "SetForegroundWindow", "wsprintfA", "SendMessageTimeoutA", "FindWindowExA", "SystemParametersInfoA", "CreateWindowExA", "GetClassInfoA", "DialogBoxParamA", "CharNextA", "OpenClipboard", "ExitWindowsEx", "IsWindow", "GetDlgItem", "SetWindowLongA", "LoadImageA", "GetDC", "EnableWindow", "InvalidateRect", "SendMessageA", "DefWindowProcA", "BeginPaint", "GetClientRect", "FillRect", "DrawTextA", "EndPaint", "ShowWindow", "SetBkColor", "GetDeviceCaps", "DeleteObject", "CreateBrushIndirect", "CreateFontIndirectA", "SetBkMode", "SetTextColor", "SelectObject", "SHGetPathFromIDListA", "SHBrowseForFolderA", "SHGetFileInfoA", "ShellExecuteA", "SHFileOperationA", "SHGetSpecialFolderLocation", "RegQueryValueExA", "RegSetValueExA", "RegEnumKeyA", "RegEnumValueA", "RegOpenKeyExA", "RegDeleteKeyA", "RegDeleteValueA", "RegCloseKey", "RegCreateKeyExA", "ImageList_AddMasked", "ImageList_Destroy", "ORDINAL 17", "ImageList_Create", "CoTaskMemFree", "OleInitialize", "OleUninitialize", "CoCreateInstance", "GetFileVersionInfoSizeA", "GetFileVersionInfoA", "VerQueryValueA" ], "ms": { "pe": { "signer": "AddTrust External CA Root, UTN-USERFirst-Object, COMODO Code Signing CA 2, DDLR LTD", "machine": 332.0, "checksum": 0.0, "rsrc_size": 15360.0, "subsystem": 2.0, "timestamp": 1260053441.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 5.44, "signing_time": 1348095972.0, "entry_section": ".text", "has_signature": true, "size_of_image": 196608.0, "timestamp_day": 5.0, "file_alignment": 512.0, "primary_signer": "The USERTRUST Network", "resource_count": 4.0, "signature_type": "developer", "timestamp_year": 2009.0, "characteristics": 271.0, "entry_point_rva": 12491.0, "size_of_headers": 1024.0, "timestamp_month": 12.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 8.0, "manifest_present": true, "signing_time_day": 19.0, "certificate_count": 1.0, "computed_checksum": 260173.0, "section_alignment": 4096.0, "signing_time_year": 2012.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "signing_time_month": 9.0, "dll_characteristics": 32768.0, "rich_header_present": true, "linker_major_version": 6.0, "api_hashing_indicators": 1.0, "certificate_table_size": 5632.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 23040.0, "file_size": 196608.0, "entry_point": 12491.0, "has_overlay": true, "code_entropy": 6.43, "data_entropy": 3.27, "import_count": 155.0, "overlay_size": 8952.0, "string_count": 623.0, "has_signature": true, "overlay_ratio": 0.05, "section_count": 5.0, "avg_complexity": 20.19, "function_count": 36.0, "import_density": 6.89, "max_complexity": 248.0, "string_density": 27.69, "overall_entropy": 4.33, "overlay_entropy": 7.97, "avg_basic_blocks": 32.28, "avg_section_size": 8806.4, "dependency_count": 8.0, "entropy_variance": 2.25, "function_density": 1.6, "avg_function_size": 487.67, "avg_string_length": 16.31, "complexity_per_kb": 0.9, "max_string_length": 727.0, "wide_string_count": 10.0, "writable_sections": 2.0, "avg_string_entropy": 3.16, "code_to_data_ratio": 1.1, "data_to_file_ratio": 0.01, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.08, "text_to_file_ratio": 0.12, "total_basic_blocks": 1162.0, "executable_sections": 1.0, "string_length_stddev": 31.25, "largest_section_ratio": 0.12, "sentence_string_count": 51.0, "sentence_string_ratio": 0.08, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0, "high_complexity_functions": 3.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 117, "xor", "XYD\tUSERFirB̩u" ], [ 464, ".text" ], [ 543, "@.data" ], [ 584, ".ndata" ], [ 624, ".rsrc" ], [ 1012, "xor", "UTN-USERFirs!" ], [ 1703, "s495" ], [ 2004, "5T6B" ], [ 3563, "xor", "RDN-=SARF?\"" ], [ 5720, "PSWV" ], [ 5939, "SQSSSPW" ], [ 6106, "VQSPW" ], [ 6225, "QVPW" ], [ 6243, "SQVPW" ], [ 9131, "t19u" ], [ 9425, "SUV3" ], [ 11247, "SUVW" ], [ 11501, "UUUUW" ], [ 11556, "5X6B" ], [ 13584, "xor", "X!_GU9D:Whrs" ], [ 16868, "5H6B" ], [ 17209, "5P6B" ], [ 19480, "PWVU" ], [ 19550, "PPPU" ], [ 19803, "SVW3" ], [ 24716, "RichEdit" ], [ 24764, ".DEFAULT\\Control Panel\\International" ], [ 24804, "Control Panel\\Desktop\\ResourceLocale" ], [ 24844, "[Rename]" ], [ 24860, "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 24904, "\\Microsoft\\Internet Explorer\\Quick Launch" ], [ 25840, "DeleteFileA" ], [ 25854, "FindFirstFileA" ], [ 25872, "FindNextFileA" ], [ 25888, "FindClose" ], [ 25900, "SetFilePointer" ], [ 25918, "ReadFile" ], [ 25930, "WriteFile" ], [ 25942, "GetPrivateProfileStringA" ], [ 25970, "WritePrivateProfileStringA" ], [ 26000, "MultiByteToWideChar" ], [ 26022, "FreeLibrary" ], [ 26036, "GetProcAddress" ], [ 26054, "LoadLibraryExA" ], [ 26072, "GetModuleHandleA" ], [ 26092, "GetExitCodeProcess" ], [ 26114, "WaitForSingleObject" ], [ 26136, "GlobalAlloc" ], [ 26150, "GlobalFree" ], [ 26164, "ExpandEnvironmentStringsA" ], [ 26192, "lstrcmpA" ], [ 26204, "lstrcmpiA" ], [ 26216, "CloseHandle" ], [ 26230, "SetFileTime" ], [ 26244, "CompareFileTime" ], [ 26262, "SearchPathA" ], [ 26276, "GetShortPathNameA" ], [ 26296, "GetFullPathNameA" ], [ 26328, "SetCurrentDirectoryA" ], [ 26352, "GetFileAttributesA" ], [ 26374, "GetLastError" ], [ 26390, "CreateDirectoryA" ], [ 26410, "SetFileAttributesA" ], [ 26432, "Sleep" ], [ 26440, "GetTickCount" ], [ 26456, "GetFileSize" ], [ 26470, "GetModuleFileNameA" ], [ 26492, "GetCurrentProcess" ], [ 26524, "ExitProcess" ], [ 26538, "GetWindowsDirectoryA" ], [ 26562, "GetTempPathA" ], [ 26578, "GetCommandLineA" ], [ 26596, "SetErrorMode" ], [ 26612, "LoadLibraryA" ], [ 26628, "lstrcpynA" ], [ 26640, "GetDiskFreeSpaceA" ], [ 26660, "GlobalUnlock" ], [ 26676, "GlobalLock" ], [ 26690, "CreateThread" ], [ 26706, "CreateProcessA" ], [ 26724, "RemoveDirectoryA" ], [ 26744, "CreateFileA" ], [ 26758, "GetTempFileNameA" ], [ 26778, "lstrlenA" ], [ 26790, "lstrcatA" ], [ 26802, "GetSystemDirectoryA" ], [ 26824, "GetVersion" ], [ 26836, "KERNEL32.dll" ], [ 26852, "EndPaint" ], [ 26876, "FillRect" ], [ 26888, "GetClientRect" ], [ 26904, "BeginPaint" ], [ 26918, "DefWindowProcA" ], [ 26936, "SendMessageA" ], [ 26952, "InvalidateRect" ], [ 26970, "EnableWindow" ], [ 26994, "LoadImageA" ], [ 27008, "SetWindowLongA" ], [ 27040, "IsWindow" ], [ 27052, "FindWindowExA" ], [ 27068, "SendMessageTimeoutA" ], [ 27090, "wsprintfA" ], [ 27102, "ShowWindow" ], [ 27116, "SetForegroundWindow" ], [ 27138, "PostQuitMessage" ], [ 27156, "SetWindowTextA" ], [ 27174, "SetTimer" ], [ 27186, "CreateDialogParamA" ], [ 27208, "DestroyWindow" ], [ 27224, "ExitWindowsEx" ], [ 27252, "DialogBoxParamA" ], [ 27270, "GetClassInfoA" ], [ 27286, "CreateWindowExA" ], [ 27304, "SystemParametersInfoA" ], [ 27328, "RegisterClassA" ], [ 27346, "EndDialog" ], [ 27358, "ScreenToClient" ], [ 27376, "GetWindowRect" ], [ 27392, "EnableMenuItem" ], [ 27410, "GetSystemMenu" ], [ 27426, "SetClassLongA" ], [ 27442, "IsWindowEnabled" ], [ 27460, "SetWindowPos" ], [ 27476, "GetSysColor" ], [ 27490, "GetWindowLongA" ], [ 27508, "SetCursor" ], [ 27520, "LoadCursorA" ], [ 27534, "CheckDlgButton" ], [ 27552, "GetMessagePos" ], [ 27568, "LoadBitmapA" ], [ 27582, "CallWindowProcA" ], [ 27600, "IsWindowVisible" ], [ 27618, "CloseClipboard" ], [ 27636, "SetClipboardData" ], [ 27656, "EmptyClipboard" ], [ 27674, "OpenClipboard" ], [ 27690, "TrackPopupMenu" ], [ 27708, "AppendMenuA" ], [ 27722, "CreatePopupMenu" ], [ 27740, "GetSystemMetrics" ], [ 27760, "SetDlgItemTextA" ], [ 27778, "GetDlgItemTextA" ], [ 27796, "MessageBoxIndirectA" ], [ 27830, "DispatchMessageA" ], [ 27850, "PeekMessageA" ], [ 27864, "USER32.dll" ], [ 27878, "SelectObject" ], [ 27894, "SetTextColor" ], [ 27922, "CreateFontIndirectA" ], [ 27944, "CreateBrushIndirect" ], [ 27966, "DeleteObject" ], [ 27982, "GetDeviceCaps" ], [ 28010, "GDI32.dll" ], [ 28022, "SHFileOperationA" ], [ 28042, "ShellExecuteA" ], [ 28058, "SHGetFileInfoA" ], [ 28076, "SHBrowseForFolderA" ], [ 28098, "SHGetPathFromIDListA" ], [ 28122, "SHGetSpecialFolderLocation" ], [ 28150, "SHELL32.dll" ], [ 28164, "RegEnumValueA" ], [ 28194, "RegQueryValueExA" ], [ 28214, "RegSetValueExA" ], [ 28232, "RegCreateKeyExA" ], [ 28250, "RegCloseKey" ], [ 28264, "RegDeleteValueA" ], [ 28282, "RegDeleteKeyA" ], [ 28298, "RegOpenKeyExA" ], [ 28312, "ADVAPI32.dll" ], [ 28328, "ImageList_Destroy" ], [ 28348, "ImageList_AddMasked" ], [ 28370, "ImageList_Create" ], [ 28388, "COMCTL32.dll" ], [ 28404, "CoCreateInstance" ], [ 28424, "OleUninitialize" ], [ 28442, "OleInitialize" ], [ 28458, "CoTaskMemFree" ], [ 28472, "ole32.dll" ], [ 28484, "VerQueryValueA" ], [ 28502, "GetFileVersionInfoA" ], [ 28524, "GetFileVersionInfoSizeA" ], [ 28548, "VERSION.dll" ], [ 28696, "verifying installer: %d%%" ], [ 28728, "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho" ], [ 28788, "incomplete download and damaged media. Contact the" ], [ 28839, "installer's author to obtain a new copy." ], [ 28881, "More information at:" ], [ 28902, "http://nsis.sf.net/NSIS_Error" ], [ 28932, "Error launching installer" ], [ 28972, "SeShutdownPrivilege" ], [ 29012, "NSIS Error" ], [ 29024, "Error writing temporary file. Make sure your temp folder is valid." ], [ 29116, ".exe" ], [ 29124, "open" ], [ 29132, "%u.%u%s%s" ], [ 29256, "SHGetFolderPathA" ], [ 29276, "SHFOLDER" ], [ 29288, "SHAutoComplete" ], [ 29304, "SHLWAPI" ], [ 29312, "GetUserDefaultUILanguage" ], [ 29340, "AdjustTokenPrivileges" ], [ 29364, "LookupPrivilegeValueA" ], [ 29388, "OpenProcessToken" ], [ 29408, "RegDeleteKeyExA" ], [ 29424, "ADVAPI32" ], [ 29448, "GetDiskFreeSpaceExA" ], [ 29468, "KERNEL32" ], [ 29494, "xor", "hq= _Som:UL\\V" ], [ 30300, "xor", "UTN-USERFirs߀" ], [ 31045, "xor", "UTN-USERFir" ], [ 31420, "xor", "UTN-USERFirs" ], [ 32556, "xor", "UTN-USERFirsֱ" ], [ 33124, "xor", "UTN-USERFirs" ], [ 33508, "xor", "UTN-USERFirs܎" ], [ 33696, "xor", "UTN-USERFirs" ], [ 34077, "xor", "UTN-USERFir" ], [ 34268, "xor", "UTN-USERFirs" ], [ 34460, "xor", "UTN-USERFirs" ], [ 34845, "xor", "UTN-USERFir" ], [ 35036, "xor", "UTN-USERFirsņ" ], [ 35224, "xor", "UTN-USERFirs" ], [ 35416, "xor", "UTN-USERFirs" ], [ 35608, "xor", "UTN-USERFirs" ], [ 35801, "xor", "UTN-USERFir" ], [ 35989, "xor", "UTN-USERFir" ], [ 36180, "xor", "UTN-USERFirsֆ" ], [ 36372, "xor", "UTN-USERFirsՁ" ], [ 36564, "xor", "UTN-USERFirsփ" ], [ 36756, "xor", "UTN-USERFirsӟ" ], [ 36948, "xor", "UTN-USERFirsޜ" ], [ 37140, "xor", "UTN-USERFirsַ" ], [ 37333, "xor", "UTN-USERFir" ], [ 37524, "xor", "UTN-USERFirsݏ" ], [ 37716, "xor", "UTN-USERFirsو" ], [ 37908, "xor", "UTN-USERFirsۄ" ], [ 38101, "xor", "UTN-USERFir" ], [ 38322, "xor", "UTN-USERFi" ], [ 38525, "xor", "UTN-USERFir´" ], [ 39324, "xor", "UTN-USERFirs" ], [ 39436, "xor", "UTN-USERFirs" ], [ 39988, "xor", "UTN-USERFirsԲ" ], [ 40078, "xor", "UTN-USERFi" ], [ 40264, "xor", "UTN-USERFirs߅" ], [ 40356, "xor", "UTN-USERFirs" ], [ 40450, "xor", "UTN-USERFi" ], [ 40544, "xor", "UTN-USERFirsՏ" ], [ 40732, "xor", "UTN-USERFirsՊ" ], [ 40828, "xor", "UTN-USERFirsЋ" ], [ 40925, "xor", "UTN-USERFir" ], [ 41112, "xor", "UTN-USERFirsЄ" ], [ 41208, "xor", "UTN-USERFirsք" ], [ 41304, "xor", "UTN-USERFirsҊ" ], [ 42001, "xor", "UTN-USERFir;" ], [ 42105, "xor", "UTN-USERFir" ], [ 42324, "xor", "UTN-USERFirsڀ" ] ], "sz": 196608, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: AddTrust External CA Root", "e": [ "AddTrust External CA Root" ], "i": "metadata/signed/developer::addtrust-external-ca-root", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: UTN-USERFirst-Object", "e": [ "UTN-USERFirst-Object" ], "i": "metadata/signed/developer::utn-userfirst-object", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: COMODO Code Signing CA 2", "e": [ "COMODO Code Signing CA 2" ], "i": "metadata/signed/developer::comodo-code-signing-ca-2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: DDLR LTD", "e": [ "DDLR LTD" ], "i": "metadata/signed/developer::ddlr-ltd", "l": 2 }, { "c": 1.0, "d": "Signed by The USERTRUST Network", "e": [ "The USERTRUST Network" ], "i": "metadata/signed/leaf::the-usertrust-network", "l": 3 }, { "a": "T1059", "c": 0.8999999761581421, "d": "NSIS self-extracting installer", "e": [ "NSIS marker found" ], "i": "file/sfx/nsis", "l": 3 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops::shell-get-special-folder-location", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceA", "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SHFOLDER" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.43)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry values via import", "e": [ "RegEnumValueA" ], "i": "micro-behaviors/os/registry/access::reg-enum-value-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003c\u003c\u003cObsolete\u003e\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://bit-accelerator.com/", "http://bit-accelerator.com/" ], "i": "objectives/command-and-control/infrastructure/domain::http-url-binary", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 36.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "Check if window is enabled", "e": [ "IsWindowEnabled" ], "i": "micro-behaviors/ui/window/manage::is-window-enabled", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.9800000190734863, "d": "NSIS exehead assembly manifest", "e": [ "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], "i": "metadata/binary/installer/script::nsis-manifest-exehead", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.800000011920929, "d": "High import density (\u003e3 imports/KB)", "e": [ "binary.import_density = 6.89" ], "i": "metadata/binary/metrics::high-import-density", "l": 2 }, { "c": 1.0, "d": "GetFileVersionInfoSizeA import", "e": [ "GetFileVersionInfoSizeA" ], "i": "well-known/malware/trojan/hijack-gen::padodor-get-file-version-info-size-a-import", "l": 1 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassA" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "a": "T1499", "c": 0.8999999761581421, "d": "Shutdown prank markers", "e": [ "Shutdown", "Shutdown" ], "i": "objectives/impact/ui/manipulation::shutdown-prank-markers", "l": 3 }, { "c": 0.800000011920929, "d": "Convert Shell folder ID to path (ANSI)", "e": [ "SHGetPathFromIDListA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-path-from-idlist-a", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 36.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.7799999713897705, "d": "Perform file operation through shell ANSI", "e": [ "SHFileOperationA" ], "i": "micro-behaviors/fs/shell-ops::shell-file-operation-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "GNU libstdc++ stdlib", "e": [ "__gnu_cxx", "__gnu_cxx", "__cxxabiv1", "__cxxabiv1", "__cxxabiv1", "__cxxabiv1", "__gnu_cxx", "__gnu_cxx" ], "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "l": 2 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "OpenClipboard", "CloseClipboard", "SetClipboardData", "EmptyClipboard" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 196608.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "80 70 40 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.800000011920929, "d": "Write data to clipboard", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "Get message cursor position", "e": [ "GetMessagePos" ], "i": "micro-behaviors/ui/window/manage::get-message-pos", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileA" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.699999988079071, "d": "Compare file modification times", "e": [ "CompareFileTime" ], "i": "micro-behaviors/fs/sync/fsync::compare-file-time", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy image list", "e": [ "ImageList_Destroy" ], "i": "micro-behaviors/ui/controls/widget::image-list-destroy", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "c": 0.699999988079071, "d": "Add masked image", "e": [ "ImageList_AddMasked" ], "i": "micro-behaviors/ui/controls/widget::image-list-add-masked", "l": 2 }, { "c": 0.7200000286102295, "d": "Write INI string value", "e": [ "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::write-private-profile-ansi", "l": 2 }, { "c": 0.75, "d": "Clear clipboard contents", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "l": 2 }, { "c": 0.699999988079071, "d": "Create brush object", "e": [ "CreateBrushIndirect" ], "i": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.DLL", "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.699999988079071, "d": "Create image list", "e": [ "ImageList_Create" ], "i": "micro-behaviors/ui/controls/widget::image-list-create", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "download", "download", "download", "download", "download", "Download", "download", "download", "download", "Download", "Download", "Download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 1024)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.16" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.75, "d": "Open clipboard access", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1260053441.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "NSIS runtime error title in data", "e": [ "NSIS Error" ], "i": "metadata/binary/installer/script::nsis-error-title-data", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.33" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1162.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 3 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.33" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 20.19" ], "i": "metadata/binary/metrics/markers::high-complexity-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "NSIS runtime error URL in data", "e": [ "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho", "http://nsis.sf.net/NSIS_Error" ], "i": "metadata/binary/installer/script::nsis-error-url-data", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.6600000262260437, "d": "Copy files (Windows API ANSI)", "e": [ "CopyFileA" ], "i": "micro-behaviors/fs/file/copy::copyfile-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.6499999761581421, "d": "Close clipboard", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 623.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 7.97" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 196608.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M", "Software\\D" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "c": 0.8500000238418579, "d": "NSIS marker in low-string binary", "e": [ "…e=\"win32\"/\u003e\u003cdescription\u003eNullsoft Install System v2.46\u003c/description\u003e\u003ctru…" ], "i": "objectives/anti-static/obfuscation/imports::low-string-fp-nsis", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowEnabled", "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetPrivateProfileStringA", "WritePrivateProfileStringA", "MultiByteToWideChar", "SetCurrentDirectoryA", "GetModuleFileNameA", "GetWindowsDirectoryA", "GetSystemDirectoryA", "MessageBoxIndirectA", "CreateFontIndirectA", "GetFileVersionInfoSizeA", "GetUserDefaultUILanguage", "AdjustTokenPrivileges", "DirectDownloaderPreinstaller", "GdipCreateBitmapFromStream", "InitializeCriticalSection", "InterlockedDecrement" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "5c 71 40 00", "40 71 40 00", "78 70 40 00", "40 71 40 00", "78 70 40 00", "40 71 40 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Delete registry key via import", "e": [ "RegDeleteKeyA" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-key-a-symbol", "l": 3 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 3 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (ImageList_AddMasked, ImageList_Destroy, ORDINAL 17, ImageList_Create)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, ... +54 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, ... +3 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, ... +4 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, ... +57 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, ... +1 more)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.8199999928474426, "d": "Reads and writes INI via ANSI", "e": [ "WritePrivateProfileStringA", "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle-ansi", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "GetModuleFileNameA", "GetFileSize", "ReadFile", "CreateFileA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.rich_header_present = 1.00", "binary.import_count = 155.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "78 70 40 00", "40 71 40 00", "5c 71 40 00", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 1 }, { "c": 0.800000011920929, "d": "Thread synchronization via message queue", "e": [ "PeekMessageA", "CreateThread" ], "i": "micro-behaviors/process/threading/async::thread-message-sync", "l": 2 }, { "c": 0.8500000238418579, "d": "Drop and execute file from Temp directory", "e": [ "CreateProcessA", "WriteFile", "ShellExecuteA", "GetTempPathA" ], "i": "objectives/command-and-control/dropper/staging::temp-file-execution", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempFileNameA", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindClose", "FindFirstFileA", "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExA", "RegCreateKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "c": 0.949999988079071, "d": "Nullsoft NSIS installer marker", "e": [ "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e", "NSIS Error", "http://nsis.sf.net/NSIS_Error", "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho" ], "i": "metadata/binary/installer/script::nsis", "l": 3 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegCreateKeyExA", "RegSetValueExA", "RegOpenKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetDiskFreeSpaceA", "GetDiskFreeSpaceExA", "GetSystemMetrics", "GetTickCount" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "SetClipboardData", "EmptyClipboard", "SetClipboardData", "CloseClipboard", "OpenClipboard" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 } ], "sha": "9a6b325d633af17d2fd87bbe0a4c98ceb11bafdc954e371e3a0b54e71d7fd21b", "path": "93156!!embedded:pe@0x15045", "type": "pe" }, { "f": "KO₅(As₇Er₄AlC₄I₂)H₄(DbOsPo₄Ds)Md₃(PtSiBi₃)", "x": 87, "dp": 1, "id": 2, "is": [ "RegCloseKey", "RegCreateKeyExA", "RegOpenKeyExA", "RegQueryValueExA", "RegSetValueExA", "CreateCompatibleBitmap", "CreateCompatibleDC", "CreateFontA", "CreateSolidBrush", "DeleteDC", "DeleteObject", "GetStockObject", "SelectObject", "SetBkColor", "SetBkMode", "SetTextColor", "GdipAlloc", "GdipCloneImage", "GdipCreateBitmapFromStream", "GdipCreateFromHDC", "GdipDeleteGraphics", "GdipDisposeImage", "GdipDrawImageI", "GdipFree", "GdiplusShutdown", "GdiplusStartup", "AddAtomA", "CloseHandle", "CreateMutexA", "CreateSemaphoreA", "DeleteCriticalSection", "EnterCriticalSection", "ExitProcess", "FindAtomA", "FindResourceA", "GetAtomNameA", "GetCommandLineA", "GetCommandLineW", "GetCurrentThreadId", "GetLastError", "GetModuleHandleA", "GetProcAddress", "GetStartupInfoA", "GlobalAlloc", "GlobalFree", "GlobalLock", "GlobalUnlock", "InitializeCriticalSection", "InterlockedDecrement", "InterlockedIncrement", "LeaveCriticalSection", "LoadResource", "LocalFree", "LockResource", "ReleaseMutex", "ReleaseSemaphore", "SetLastError", "SetUnhandledExceptionFilter", "SizeofResource", "Sleep", "TlsAlloc", "TlsFree", "TlsGetValue", "TlsSetValue", "VirtualProtect", "VirtualQuery", "WaitForSingleObject", "write", "getmainargs", "p__environ", "p__fmode", "set_app_type", "assert", "cexit", "iob", "onexit", "setmode", "abort", "atexit", "calloc", "fputc", "fputs", "free", "fwrite", "malloc", "realloc", "signal", "sprintf", "strcmp", "strcpy", "vfprintf", "CreateStreamOnHGlobal", "CommandLineToArgvW", "SHBrowseForFolderA", "SHGetFolderPathA", "SHGetPathFromIDListA", "ShellExecuteA", "BeginPaint", "ClientToScreen", "CreateWindowExA", "DefWindowProcA", "DestroyWindow", "DispatchMessageA", "EndPaint", "GetCapture", "GetDC", "GetMessageA", "GetSystemMetrics", "LoadCursorA", "LoadIconA", "MessageBoxExA", "PostQuitMessage", "RegisterClassExA", "ReleaseCapture", "ReleaseDC", "SendMessageA", "SetCapture", "SetCursor", "SetTimer", "SetWindowLongA", "SetWindowPos", "SetWindowTextA", "ShowWindow", "TranslateMessage", "wsprintfA" ], "ms": { "pe": { "signer": "AddTrust External CA Root, UTN-USERFirst-Object, COMODO Code Signing CA 2, DDLR LTD", "machine": 332.0, "checksum": 0.0, "rsrc_size": 133632.0, "subsystem": 2.0, "timestamp": 1348088592.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 7.86, "signing_time": 1348095941.0, "entry_section": ".text", "has_signature": true, "size_of_image": 258048.0, "timestamp_day": 19.0, "tls_callbacks": 2.0, "file_alignment": 512.0, "primary_signer": "The USERTRUST Network", "resource_count": 4.0, "signature_type": "developer", "timestamp_year": 2012.0, "characteristics": 783.0, "entry_point_rva": 4740.0, "size_of_headers": 1024.0, "timestamp_month": 9.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 8.0, "manifest_present": true, "signing_time_day": 19.0, "certificate_count": 1.0, "computed_checksum": 293808.0, "section_alignment": 4096.0, "signing_time_year": 2012.0, "number_of_sections": 8.0, "resource_timestamp": 1348088591.0, "signing_time_month": 9.0, "linker_major_version": 2.0, "linker_minor_version": 21.0, "api_hashing_indicators": 1.0, "certificate_table_size": 5632.0, "resource_timestamp_day": 19.0, "resource_timestamp_year": 2012.0, "export_timestamp_present": false, "resource_timestamp_month": 9.0, "resource_timestamp_present": true }, "binary": { "code_size": 64000.0, "file_size": 258048.0, "entry_point": 4740.0, "code_entropy": 5.87, "data_entropy": 3.53, "import_count": 125.0, "string_count": 738.0, "has_signature": true, "section_count": 8.0, "avg_complexity": 4.12, "function_count": 50.0, "import_density": 2.0, "max_complexity": 35.0, "string_density": 11.81, "overall_entropy": 3.08, "avg_basic_blocks": 6.04, "avg_section_size": 26496.0, "dependency_count": 8.0, "entropy_variance": 3.04, "function_density": 0.8, "avg_function_size": 87.98, "avg_string_length": 16.87, "complexity_per_kb": 0.07, "max_string_length": 175.0, "wide_string_count": 25.0, "writable_sections": 6.0, "avg_string_entropy": 3.12, "code_to_data_ratio": 0.43, "data_to_file_ratio": 0.0, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.52, "text_to_file_ratio": 0.25, "total_basic_blocks": 302.0, "executable_sections": 1.0, "high_entropy_regions": 1.0, "string_length_stddev": 16.99, "largest_section_ratio": 0.52, "sentence_string_count": 86.0, "sentence_string_ratio": 0.12, "behavioral_import_ratio": 0.03, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 117, "xor", "XYD\tUSERFir#1-O." ], [ 376, ".text" ], [ 456, ".rdata" ], [ 536, ".idata" ], [ 576, ".CRT" ], [ 616, ".tls" ], [ 656, ".rsrc" ], [ 23316, "UWVS" ], [ 28987, "CUNG" ], [ 32053, "Q09Y" ], [ 32387, "nt21" ], [ 32584, "WVSQ" ], [ 37674, "xor", "bЎY\\oa\u0026C/K" ], [ 40489, "xor", ")pj.ZԬMFi" ], [ 64681, "xor", "UVN.UWEWFo" ], [ 64850, "xor", "TUORUSERFi" ], [ 64866, "xor", "TUORUSERFi" ], [ 64882, "xor", "TUORUSERFi" ], [ 64898, "xor", "TUORUSERFi" ], [ 65024, "DDLR" ], [ 65536, "libgcj-12.dll" ], [ 65550, "_Jv_RegisterClasses" ], [ 65576, "IDB_BACKGROUND2" ], [ 65592, "IDB_DECLINE" ], [ 65604, "IDB_NEXT" ], [ 65613, "IDB_BACKGROUND1" ], [ 65629, "IDB_EMPTY" ], [ 65639, "IDB_OPTIMIZERPRO" ], [ 65656, "IDB_BACKGROUND2_1" ], [ 65674, "IDB_GREEN" ], [ 65688, "Are you sure you want to exit and cancel your download?" ], [ 65744, "Notice! Closing the installer will cancel your download of \"" ], [ 65805, "%s%s%s" ], [ 65812, "C:\\Users\\User\\DirectDownlaoderOffers\\DirectDownloaderPreinstaller\\main.cpp" ], [ 65887, "!s_Dragging" ], [ 65899, "s_Dragging" ], [ 65910, "GetCapture() == hwnd" ], [ 65932, "http://www.pcutilitiespro.com/privacy.aspx" ], [ 65975, "open" ], [ 65980, "http://bit-accelerator.com/privacypolicy/" ], [ 66024, "http://www.openbitcoin.org/privacy/" ], [ 66060, "http://www.pcutilitiespro.com/terms-and-conditions.aspx" ], [ 66116, "http://bit-accelerator.com/termsofservice/" ], [ 66160, "http://www.openbitcoin.org/termsofservice/" ], [ 66204, "http://www.directdownloader.com/faq/" ], [ 66244, "http://www.directdownloader.com/privacy/" ], [ 66288, "http://www.directdownloader.com/terms/" ], [ 66327, "Choose destination folder..." ], [ 66356, "Software\\DirectDownloader" ], [ 66382, "SaveDir" ], [ 66496, "IDI_APPLICATION" ], [ 66512, "Direct Downloader" ], [ 66530, "Browse..." ], [ 66540, "Button" ], [ 66547, "STATIC" ], [ 66554, "ARIAL" ], [ 66560, "TAHOMA" ], [ 66567, "EDIT" ], [ 66572, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Optimizer Pro_is1" ], [ 66642, "UninstallString" ], [ 66670, "Privacy" ], [ 66680, "Speed up your pc with optimizer pro!" ], [ 66717, "Terms Of Service" ], [ 66734, "Privacy Policy" ], [ 66749, "USER32.DLL" ], [ 66760, "UpdateLayeredWindow" ], [ 66780, "IDB_BACKGROUND3" ], [ 66796, "NEXT" ], [ 66801, "Button" ], [ 66808, "SKIP" ], [ 66813, "DirectDownloader" ], [ 66830, "STATIC" ], [ 66843, "Privacy Policy |" ], [ 66860, "Terms of Use" ], [ 66873, "TAHOMA" ], [ 66932, "std::exception" ], [ 66947, "std::bad_exception" ], [ 66968, "eh_globals" ], [ 66979, "init" ], [ 66984, "__gnu_cxx::__concurrence_lock_error" ], [ 67020, "__gnu_cxx::__concurrence_unlock_error" ], [ 67060, "pure virtual method called\n" ], [ 67088, "__terminate_handler_sh" ], [ 67112, "__unexpected_handler_sh" ], [ 67136, "terminate called recursively\n" ], [ 67168, "terminate called after throwing an instance of '" ], [ 67220, "terminate called without an active exception\n" ], [ 67824, "_GLOBAL_" ], [ 67833, "(anonymous namespace)" ], [ 68352, "string literal" ], [ 68853, "vtable for " ], [ 68865, "VTT for " ], [ 68874, "construction vtable for " ], [ 68904, "typeinfo for " ], [ 68918, "typeinfo name for " ], [ 68937, "typeinfo fn for " ], [ 68954, "non-virtual thunk to " ], [ 68976, "virtual thunk to " ], [ 68994, "covariant return thunk to " ], [ 69021, "java Class for " ], [ 69037, "guard variable for " ], [ 69057, "reference temporary for " ], [ 69082, "hidden alias for " ], [ 69123, "operator" ], [ 69132, "operator " ], [ 69159, "false" ], [ 69165, "true" ], [ 69174, "java resource " ], [ 69189, "decltype (" ], [ 69211, "global constructors keyed to " ], [ 69241, "global destructors keyed to " ], [ 69282, "{unnamed type#" ], [ 69584, "restrict" ], [ 69594, "volatile" ], [ 69614, "complex " ], [ 69623, "imaginary " ], [ 69638, "__vector(" ], [ 69808, "{default arg#" ], [ 69900, "signed char" ], [ 69912, "bool" ], [ 69917, "boolean" ], [ 69925, "char" ], [ 69935, "double" ], [ 69942, "long double" ], [ 69954, "float" ], [ 69960, "__float128" ], [ 69971, "unsigned char" ], [ 69989, "unsigned int" ], [ 70002, "unsigned" ], [ 70016, "unsigned long" ], [ 70030, "__int128" ], [ 70039, "unsigned __int128" ], [ 70063, "unsigned short" ], [ 70078, "void" ], [ 70083, "wchar_t" ], [ 70091, "long long" ], [ 70101, "unsigned long long" ], [ 70120, "decimal32" ], [ 70130, "decimal64" ], [ 70140, "decimal128" ], [ 70156, "char16_t" ], [ 70165, "char32_t" ], [ 70174, "decltype(nullptr)" ], [ 70868, "std::allocator" ], [ 70883, "allocator" ], [ 70893, "std::basic_string" ], [ 70911, "basic_string" ], [ 70924, "std::string" ], [ 70936, "std::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e" ], [ 71007, "std::istream" ], [ 71020, "std::basic_istream\u003cchar, std::char_traits\u003cchar\u003e \u003e" ], [ 71070, "basic_istream" ], [ 71084, "std::ostream" ], [ 71100, "std::basic_ostream\u003cchar, std::char_traits\u003cchar\u003e \u003e" ], [ 71150, "basic_ostream" ], [ 71164, "std::iostream" ], [ 71180, "std::basic_iostream\u003cchar, std::char_traits\u003cchar\u003e \u003e" ], [ 71231, "basic_iostream" ], [ 71504, "delete[]" ], [ 71521, "delete" ], [ 71551, "xor", "U3+-knE52iLs" ], [ 71719, "sizeof " ], [ 71733, "alignof " ], [ 72503, "xor", "UWN-UQERFuJ2t2w#" ], [ 72644, "Mingw runtime failure:\n" ], [ 72668, " VirtualQuery failed for %d bytes at address %p" ], [ 72720, " Unknown pseudo relocation protocol version %d.\n" ], [ 72772, " Unknown pseudo relocation bit size %d.\n" ], [ 72816, "fc_static" ], [ 72826, "fc_key" ], [ 72833, "use_fc_key" ], [ 72844, "sjlj_once" ], [ 72856, "gcc-shmem-tdm2" ], [ 73016, "14CGdiPlusBitmap" ], [ 73036, "22CGdiPlusBitmapResource" ], [ 73088, "N10__cxxabiv115__forced_unwindE" ], [ 73120, "N10__cxxabiv117__class_type_infoE" ], [ 73184, "N10__cxxabiv119__foreign_exceptionE" ], [ 73248, "N10__cxxabiv120__si_class_type_infoE" ], [ 73312, "N7Gdiplus11GdiplusBaseE" ], [ 73336, "N7Gdiplus5ImageE" ], [ 73356, "N7Gdiplus6BitmapE" ], [ 73376, "N9__gnu_cxx24__concurrence_lock_errorE" ], [ 73440, "N9__gnu_cxx26__concurrence_unlock_errorE" ], [ 73504, "St13bad_exception" ], [ 73524, "St9exception" ], [ 73540, "St9type_info" ], [ 73946, "xor", "UTN-USERFiBN5-3" ], [ 74429, "xor", "UTN-USERFir" ], [ 74818, "xor", "TTʗTSERFi" ], [ 75354, "xor", "TTʗTSERFi" ], [ 75514, "RegCloseKey" ], [ 75528, "RegCreateKeyExA" ], [ 75546, "RegOpenKeyExA" ], [ 75562, "RegQueryValueExA" ], [ 75582, "RegSetValueExA" ], [ 75600, "CreateCompatibleBitmap" ], [ 75626, "CreateCompatibleDC" ], [ 75648, "CreateFontA" ], [ 75662, "CreateSolidBrush" ], [ 75682, "DeleteDC" ], [ 75694, "DeleteObject" ], [ 75710, "GetStockObject" ], [ 75728, "SelectObject" ], [ 75770, "SetTextColor" ], [ 75786, "GdipAlloc" ], [ 75798, "GdipCloneImage" ], [ 75816, "GdipCreateBitmapFromStream" ], [ 75846, "GdipCreateFromHDC" ], [ 75866, "GdipDeleteGraphics" ], [ 75888, "GdipDisposeImage" ], [ 75908, "GdipDrawImageI" ], [ 75926, "GdipFree" ], [ 75938, "GdiplusShutdown" ], [ 75956, "GdiplusStartup" ], [ 75986, "CloseHandle" ], [ 76000, "CreateMutexA" ], [ 76016, "CreateSemaphoreA" ], [ 76036, "DeleteCriticalSection" ], [ 76060, "EnterCriticalSection" ], [ 76084, "ExitProcess" ], [ 76110, "FindResourceA" ], [ 76126, "GetAtomNameA" ], [ 76142, "GetCommandLineA" ], [ 76160, "GetCommandLineW" ], [ 76178, "GetCurrentThreadId" ], [ 76200, "GetLastError" ], [ 76216, "GetModuleHandleA" ], [ 76236, "GetProcAddress" ], [ 76254, "GetStartupInfoA" ], [ 76272, "GlobalAlloc" ], [ 76286, "GlobalFree" ], [ 76300, "GlobalLock" ], [ 76314, "GlobalUnlock" ], [ 76330, "InitializeCriticalSection" ], [ 76358, "InterlockedDecrement" ], [ 76382, "InterlockedIncrement" ], [ 76406, "LeaveCriticalSection" ], [ 76430, "LoadResource" ], [ 76446, "LocalFree" ], [ 76458, "LockResource" ], [ 76474, "ReleaseMutex" ], [ 76490, "ReleaseSemaphore" ], [ 76510, "SetLastError" ], [ 76526, "SetUnhandledExceptionFilter" ], [ 76556, "SizeofResource" ], [ 76574, "Sleep" ], [ 76582, "TlsAlloc" ], [ 76594, "TlsFree" ], [ 76604, "TlsGetValue" ], [ 76618, "TlsSetValue" ], [ 76632, "VirtualProtect" ], [ 76650, "VirtualQuery" ], [ 76666, "WaitForSingleObject" ], [ 76688, "_write" ] ], "sz": 258048, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: AddTrust External CA Root", "e": [ "AddTrust External CA Root" ], "i": "metadata/signed/developer::addtrust-external-ca-root", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: UTN-USERFirst-Object", "e": [ "UTN-USERFirst-Object" ], "i": "metadata/signed/developer::utn-userfirst-object", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: COMODO Code Signing CA 2", "e": [ "COMODO Code Signing CA 2" ], "i": "metadata/signed/developer::comodo-code-signing-ca-2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: DDLR LTD", "e": [ "DDLR LTD" ], "i": "metadata/signed/developer::ddlr-ltd", "l": 2 }, { "c": 1.0, "d": "Signed by The USERTRUST Network", "e": [ "The USERTRUST Network" ], "i": "metadata/signed/leaf::the-usertrust-network", "l": 3 }, { "c": 0.8999999761581421, "d": "Allocate zeroed memory", "e": [ "calloc" ], "i": "micro-behaviors/mem/c-runtime/functions::calloc", "l": 2 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 0.8799999952316284, "d": "High entropy resource section (encrypted payload)", "e": [ "pe.rsrc_entropy = 7.86" ], "i": "well-known/malware/trojan/shellobject::xll-high-rsrc-entropy", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 133632.00" ], "i": "well-known/malware/trojan/shellobject::xll-large-rsrc-section", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 125.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.8500000238418579, "d": "Get message (ANSI)", "e": [ "GetMessageA" ], "i": "micro-behaviors/os/message/queue::get-message-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003c\u003c\u003cObsolete\u003e\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE has multiple TLS callbacks", "e": [ "pe.tls_callbacks = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-multi-callbacks", "l": 3 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://bit-accelerator.com/", "http://bit-accelerator.com/" ], "i": "objectives/command-and-control/infrastructure/domain::http-url-binary", "l": 3, "m": "C0002" }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery", "sub.KERNEL32.dll_VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 50.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA", "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI+ bitmap created from stream", "e": [ "GdipCreateBitmapFromStream" ], "i": "micro-behaviors/data/encode/image/gdiplus::create-bitmap-from-stream", "l": 3 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassExA" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "a": "T1499", "c": 0.8999999761581421, "d": "Shutdown prank markers", "e": [ "Shutdown" ], "i": "objectives/impact/ui/manipulation::shutdown-prank-markers", "l": 3 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.800000011920929, "d": "Convert Shell folder ID to path (ANSI)", "e": [ "SHGetPathFromIDListA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-path-from-idlist-a", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 50.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 125.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.800000011920929, "d": "GetAtomNameA API for atom retrieval", "e": [ "GetAtomNameA" ], "i": "objectives/evasion/process/injection/atom-bombing::getatomnama-api", "l": 1, "m": "C0041" }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "GNU libstdc++ stdlib", "e": [ "__gnu_cxx", "__gnu_cxx", "__cxxabiv1", "__cxxabiv1", "__cxxabiv1", "__cxxabiv1", "__gnu_cxx", "__gnu_cxx" ], "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 133632, entropy: 7.86)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 258048.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Variadic formatted output", "e": [ "vfprintf" ], "i": "micro-behaviors/os/stdio::vfprintf", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 125.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexA", "sub.KERNEL32.dll_CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "MinGW pseudo relocation runtime", "e": [ "Unknown pseudo relocation protocol version %d.", "Unknown pseudo relocation bit size %d." ], "i": "metadata/binary/framework::mingw-pseudoreloc-runtime", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 50.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "String copy (unsafe)", "e": [ "strcpy" ], "i": "micro-behaviors/data/string::strcpy", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload::find-resource-a", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Install signal handler", "e": [ "signal" ], "i": "micro-behaviors/os/signal/handler::signal", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.DLL" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Two or more embedded PE headers", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::multiple-pe-embedded", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "download", "download", "Download", "download", "download", "download", "Download", "Download", "Download", "download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 125.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.12" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Reallocate memory", "e": [ "realloc" ], "i": "micro-behaviors/mem/c-runtime/functions::realloc", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1348088592.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "String comparison", "e": [ "strcmp" ], "i": "micro-behaviors/data/string::strcmp", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.12" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8500000238418579, "d": "PE linked with binutils 2.x (MinGW/GCC)", "e": [ "pe.linker_major_version = 2.00" ], "i": "metadata/lang/compiler/native::linker-binutils-2x", "l": 3 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.08" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 125.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.08" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.800000011920929, "d": "AddAtomA API atom table access", "e": [ "AddAtomA" ], "i": "objectives/evasion/process/injection/atom-bombing::addatoma-api", "l": 1, "m": "C0041" }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.9300000071525574, "d": "GCJ runtime library dependency", "e": [ "libgcj-12.dll" ], "i": "metadata/binary/framework::gcj-runtime-library", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI+ library initialization", "e": [ "GdiplusStartup" ], "i": "micro-behaviors/data/encode/image/gdiplus::startup", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 125.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreA" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 133632.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 738.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32 ANSI", "e": [ "SHGetFolderPathA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-folder-path-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 125.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 258048.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\D" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 0.800000011920929, "d": "FindAtomA API atom table lookup", "e": [ "FindAtomA" ], "i": "objectives/evasion/process/injection/atom-bombing::findatoma-api", "l": 1, "m": "C0041" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8199999928474426, "d": "sprintf string formatting API", "e": [ "sprintf" ], "i": "micro-behaviors/fs/path/construct::sprintf-format-api", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE TLS callback table present", "e": [ "pe.tls_callbacks = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-callbacks-metric", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "DirectDownloaderPreinstaller", "GdipCreateBitmapFromStream", "InitializeCriticalSection", "InterlockedDecrement", "InterlockedIncrement", "SetUnhandledExceptionFilter", "CreateStreamOnHGlobal", "GetProcessWindowStation", "GetUserObjectInformationA", "GetDeviceDriverBaseNameA", "GetModuleBaseNameA", "GetModuleFileNameA", "WideCharToMultiByte", "UnhandledExceptionFilter", "DisableThreadLibraryCalls", "GetCurrentProcessId" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.86)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 2, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links GDIPLUS.DLL (GdipAlloc, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateFromHDC, GdipDeleteGraphics, ... +5 more)", "e": [ "GDIPLUS.DLL" ], "i": "metadata/dylib::gdiplus/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (BeginPaint, ClientToScreen, CreateWindowExA, DefWindowProcA, DestroyWindow, ... +23 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLE32.dll (CreateStreamOnHGlobal)", "e": [ "OLE32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (AddAtomA, CloseHandle, CreateMutexA, CreateSemaphoreA, DeleteCriticalSection, ... +36 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.DLL (RegCloseKey, RegCreateKeyExA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA)", "e": [ "ADVAPI32.DLL" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.DLL (CommandLineToArgvW, SHBrowseForFolderA, SHGetFolderPathA, SHGetPathFromIDListA, ShellExecuteA)", "e": [ "SHELL32.DLL" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (write, getmainargs, p__environ, p__fmode, set_app_type, ... +19 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (CreateCompatibleBitmap, CreateCompatibleDC, CreateFontA, CreateSolidBrush, DeleteDC, ... +6 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "VS_VERSION_INFO", "FileVersion", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.800000011920929, "d": "Signed versioned temp handoff context", "e": [ "DDLR LTD", "binary.import_count = 125.00", "UTN-USERFirst-Object", "VS_VERSION_INFO", "COMODO Code Signing CA 2", "AddTrust External CA Root" ], "i": "objectives/command-and-control/dropper/execution/loader::signed-versioned-temp-handoff-profile", "l": 1 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "FindResourceA", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "CreateMutexA", "ExitProcess", "sub.KERNEL32.dll_CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExA", "RegCreateKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "MinGW PE with anti-analysis features", "e": [ "pe.tls_callbacks = 2.00", "pe.api_hashing_indicators = 1.00", "pe.linker_major_version = 2.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/cross-compiled::mingw-with-anti-analysis", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "SizeofResource", "FindResourceA", "LockResource", "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 1 }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegCreateKeyExA", "RegOpenKeyExA", "RegOpenKeyExA", "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1055.001", "c": 0.8500000238418579, "d": "Atom bombing injection capability", "e": [ "GetAtomNameA", "AddAtomA", "FindAtomA" ], "i": "objectives/evasion/process/injection/atom-bombing::atom-bombing-capable", "l": 4, "m": "C0041" }, { "a": "T1055.001", "c": 0.8999999761581421, "d": "Full atom-table API triad (Add/Find/GetAtomName)", "e": [ "FindAtomA", "AddAtomA", "GetAtomNameA" ], "i": "objectives/evasion/process/injection/atom-bombing::atom-bombing-triple", "l": 4, "m": "C0041" } ], "sha": "399867ddf9b23ca99a52c84e5f1135ae793b4546b4541531768d2d8bcd5a29f1", "path": "93156!!embedded:pe@0x23941", "type": "pe" }, { "f": "KO₆(As₇Er₆AlC₂IS)H₄(CmPo₅DsOs)Md₃(SiBi₃)", "x": 11, "dp": 1, "id": 3, "is": [ "LoadLibraryA", "GetProcAddress", "FreeLibrary", "OpenProcess", "CloseHandle", "TerminateProcess", "GlobalFree", "lstrcpyA", "GetCommandLineA", "GetVersionExA", "ExitProcess", "GetModuleHandleA", "GetCurrentProcess", "SetHandleCount", "GetStdHandle", "GetFileType", "GetStartupInfoA", "GetModuleFileNameA", "HeapDestroy", "HeapCreate", "VirtualFree", "HeapFree", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetLastError", "GetEnvironmentStringsW", "UnhandledExceptionFilter", "DisableThreadLibraryCalls", "WriteFile", "SetFilePointer", "HeapAlloc", "GetACP", "GetOEMCP", "GetCPInfo", "VirtualAlloc", "HeapReAlloc", "RtlUnwind", "InterlockedExchange", "VirtualQuery", "SetStdHandle", "QueryPerformanceCounter", "GetTickCount", "GetCurrentThreadId", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "HeapSize", "LCMapStringA", "MultiByteToWideChar", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "FlushFileBuffers", "GetLocaleInfoA", "VirtualProtect", "GetSystemInfo", "FindWindowA", "GetDesktopWindow", "wsprintfA", "UpdateWindow" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 1109268374.0, "image_base": 268435456.0, "rsrc_entropy": 2.67, "entry_section": ".text", "size_of_image": 53248.0, "timestamp_day": 24.0, "file_alignment": 512.0, "resource_count": 1.0, "timestamp_year": 2005.0, "characteristics": 8462.0, "entry_point_rva": 6899.0, "size_of_headers": 1024.0, "timestamp_month": 2.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1109268373.0, "import_dll_count": 2.0, "computed_checksum": 88417.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "rich_header_present": true, "export_timestamp_day": 24.0, "linker_major_version": 7.0, "linker_minor_version": 10.0, "version_info_present": true, "export_timestamp_year": 2005.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 2.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 23552.0, "file_size": 53248.0, "entry_point": 6899.0, "has_overlay": true, "code_entropy": 6.57, "data_entropy": 3.21, "export_count": 3.0, "import_count": 61.0, "overlay_size": 16896.0, "string_count": 313.0, "overlay_ratio": 0.32, "section_count": 5.0, "avg_complexity": 14.53, "function_count": 34.0, "import_density": 2.65, "max_complexity": 47.0, "string_density": 13.61, "overall_entropy": 4.2, "overlay_entropy": 5.51, "avg_basic_blocks": 21.91, "avg_section_size": 7065.6, "dependency_count": 2.0, "entropy_variance": 1.74, "function_density": 1.48, "avg_function_size": 296.68, "avg_string_length": 21.27, "complexity_per_kb": 0.63, "max_string_length": 176.0, "wide_string_count": 8.0, "writable_sections": 1.0, "avg_string_entropy": 3.3, "code_to_data_ratio": 2.0, "data_to_file_ratio": 0.04, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.44, "total_basic_blocks": 745.0, "executable_sections": 1.0, "string_length_stddev": 21.6, "largest_section_ratio": 0.44, "sentence_string_count": 86.0, "sentence_string_ratio": 0.27, "behavioral_import_ratio": 0.07, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".rsrc" ], [ 655, "@.reloc" ], [ 6142, "RPWS" ], [ 8189, "QQSVW3" ], [ 8589, "SUVW" ], [ 9590, "SVWU" ], [ 19139, "SVW3" ], [ 22797, "6PWS" ], [ 22941, "WWWWVSW" ], [ 24889, "700WP" ], [ 24905, "`h````" ], [ 24940, "(null)" ], [ 24956, "(null)" ], [ 24964, "CorExitProcess" ], [ 24980, "mscoree.dll" ], [ 25020, "runtime error " ], [ 25040, "TLOSS error" ], [ 25056, "SING error" ], [ 25072, "DOMAIN error\r\n" ], [ 25088, "R6029\r\n- This application cannot run using the active version of the Microsoft .NET Runtime\nPlease contact the application's sup" ], [ 25095, "- This application cannot run using the active version of the Microsoft .NET Runtime" ], [ 25180, "Please contact the application's support team for more information." ], [ 25252, "R6028\r\n- unable to initialize heap\r\n" ], [ 25259, "- unable to initialize heap" ], [ 25292, "R6027\r\n- not enough space for lowio initialization\r\n" ], [ 25299, "- not enough space for lowio initialization" ], [ 25348, "R6026\r\n- not enough space for stdio initialization\r\n" ], [ 25355, "- not enough space for stdio initialization" ], [ 25404, "R6025\r\n- pure virtual function call\r\n" ], [ 25411, "- pure virtual function call" ], [ 25444, "R6024\r\n- not enough space for _onexit/atexit table\r\n" ], [ 25451, "- not enough space for _onexit/atexit table" ], [ 25500, "R6019\r\n- unable to open console device\r\n" ], [ 25507, "- unable to open console device" ], [ 25544, "R6018\r\n- unexpected heap error\r\n" ], [ 25551, "- unexpected heap error" ], [ 25580, "R6017\r\n- unexpected multithread lock error\r\n" ], [ 25587, "- unexpected multithread lock error" ], [ 25628, "R6016\r\n- not enough space for thread data\r\n" ], [ 25635, "- not enough space for thread data" ], [ 25672, "\r\nThis application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team fo" ], [ 25674, "This application has requested the Runtime to terminate it in an unusual way." ], [ 25824, "R6009\r\n- not enough space for environment\r\n" ], [ 25831, "- not enough space for environment" ], [ 25868, "R6008\r\n- not enough space for arguments\r\n" ], [ 25875, "- not enough space for arguments" ], [ 25912, "R6002\r\n- floating point not loaded\r\n" ], [ 25919, "- floating point not loaded" ], [ 25952, "Microsoft Visual C++ Runtime Library" ], [ 25996, "Runtime Error!\n\nProgram: " ], [ 26028, "\u003cprogram name unknown\u003e" ], [ 26826, " h(((( H" ], [ 27356, "GetProcessWindowStation" ], [ 27380, "GetUserObjectInformationA" ], [ 27408, "GetLastActivePopup" ], [ 27428, "GetActiveWindow" ], [ 27444, "MessageBoxA" ], [ 27456, "user32.dll" ], [ 27480, "A buffer overrun has been detected which has corrupted the program's\ninternal state. The program cannot safely continue executi" ], [ 27549, "internal state. The program cannot safely continue execution and must" ], [ 27620, "now be terminated." ], [ 27640, "Buffer overrun detected!" ], [ 27672, "A security error of unknown cause has been detected which has\ncorrupted the program's internal state. The program cannot safely" ], [ 27734, "corrupted the program's internal state. The program cannot safely" ], [ 27801, "continue execution and must now be terminated." ], [ 27852, "Unknown security failure detected!" ], [ 28000, "Shell_TrayWnd" ], [ 28020, "GetDeviceDriverBaseNameA" ], [ 28048, "EnumDeviceDrivers" ], [ 28068, "GetModuleBaseNameA" ], [ 28088, "EnumProcessModules" ], [ 28108, "EnumProcesses" ], [ 28124, "PSAPI.DLL" ], [ 28546, "LoadLibraryA" ], [ 28562, "GetProcAddress" ], [ 28580, "FreeLibrary" ], [ 28594, "OpenProcess" ], [ 28608, "CloseHandle" ], [ 28622, "TerminateProcess" ], [ 28642, "GlobalFree" ], [ 28656, "lstrcpyA" ], [ 28668, "GetCommandLineA" ], [ 28686, "GetVersionExA" ], [ 28702, "ExitProcess" ], [ 28716, "GetModuleHandleA" ], [ 28736, "GetCurrentProcess" ], [ 28756, "SetHandleCount" ], [ 28774, "GetStdHandle" ], [ 28790, "GetFileType" ], [ 28804, "GetStartupInfoA" ], [ 28822, "GetModuleFileNameA" ], [ 28844, "HeapDestroy" ], [ 28858, "HeapCreate" ], [ 28872, "VirtualFree" ], [ 28886, "HeapFree" ], [ 28898, "FreeEnvironmentStringsA" ], [ 28924, "GetEnvironmentStrings" ], [ 28948, "FreeEnvironmentStringsW" ], [ 28974, "WideCharToMultiByte" ], [ 28996, "GetLastError" ], [ 29012, "GetEnvironmentStringsW" ], [ 29038, "UnhandledExceptionFilter" ], [ 29066, "DisableThreadLibraryCalls" ], [ 29094, "WriteFile" ], [ 29106, "SetFilePointer" ], [ 29124, "HeapAlloc" ], [ 29146, "GetOEMCP" ], [ 29158, "GetCPInfo" ], [ 29170, "VirtualAlloc" ], [ 29186, "HeapReAlloc" ], [ 29200, "RtlUnwind" ], [ 29212, "InterlockedExchange" ], [ 29234, "VirtualQuery" ], [ 29250, "SetStdHandle" ], [ 29266, "QueryPerformanceCounter" ], [ 29292, "GetTickCount" ], [ 29308, "GetCurrentThreadId" ], [ 29330, "GetCurrentProcessId" ], [ 29352, "GetSystemTimeAsFileTime" ], [ 29378, "HeapSize" ], [ 29390, "LCMapStringA" ], [ 29406, "MultiByteToWideChar" ], [ 29428, "LCMapStringW" ], [ 29444, "GetStringTypeA" ], [ 29462, "GetStringTypeW" ], [ 29480, "FlushFileBuffers" ], [ 29500, "GetLocaleInfoA" ], [ 29518, "VirtualProtect" ], [ 29536, "GetSystemInfo" ], [ 29550, "KERNEL32.dll" ], [ 29566, "UpdateWindow" ], [ 29582, "FindWindowA" ], [ 29596, "GetDesktopWindow" ], [ 29616, "wsprintfA" ], [ 29626, "USER32.dll" ], [ 29718, "Processes.dll" ], [ 29732, "FindDevice" ], [ 29743, "FindProcess" ], [ 29755, "KillProcess" ], [ 32358, "VS_VERSION_INFO" ], [ 32450, "wide", "StringFileInfo" ], [ 32510, "Comments" ], [ 32528, "NSIS Plug-in for Windows process management. Only WinNT, Win2K, WinXP and Win2003 Server supported." ], [ 32734, "CompanyName" ], [ 32760, "wide", "Andrei Ciubotaru [Hardwired]" ], [ 32826, "FileDescription" ], [ 32860, "wide", "Windows Processes Management" ], [ 32926, "wide", "FileVersion" ], [ 32982, "InternalName" ], [ 33008, "wide", "Processes" ], [ 33034, "LegalCopyright" ], [ 33064, "Copyright (c) 2004 Hardwired. No rights reserved." ], [ 33170, "OriginalFilename" ], [ 33204, "Processes.dll" ], [ 33238, "ProductName" ], [ 33264, "Processes" ], [ 33290, "ProductVersion" ], [ 33350, "wide", "VarFileInfo" ], [ 33382, "Translation" ], [ 34783, "41878r8" ], [ 36810, "0@.bss" ], [ 36852, ".edata" ], [ 36890, "0@.idata" ], [ 36932, ".reloc" ], [ 41988, "kernel32" ], [ 41997, "IsWow64Process" ], [ 42012, "error" ], [ 42030, "SysListView32" ], [ 42044, "/TIMEOUT=" ], [ 42054, "/OEM" ], [ 42070, "timeout" ], [ 42570, "nsExec.dll" ], [ 42581, "Exec" ], [ 42596, "ExecToStack" ], [ 43470, "InitializeSecurityDescriptor" ], [ 43502, "SetSecurityDescriptorDacl" ], [ 43556, "CreateFileA" ], [ 43570, "CreateFileMappingA" ], [ 43592, "CreatePipe" ], [ 43606, "CreateProcessA" ], [ 43624, "DeleteFileA" ], [ 43690, "GetExitCodeProcess" ], [ 43790, "GetTempFileNameA" ], [ 43842, "GlobalAlloc" ], [ 43870, "GlobalLock" ], [ 43884, "GlobalReAlloc" ], [ 43900, "GlobalSize" ], [ 43914, "GlobalUnlock" ], [ 43930, "MapViewOfFile" ], [ 43946, "PeekNamedPipe" ], [ 43962, "ReadFile" ], [ 43974, "Sleep" ], [ 44002, "UnmapViewOfFile" ], [ 44020, "WaitForSingleObject" ], [ 44042, "lstrcatA" ], [ 44054, "lstrcmpiA" ], [ 44078, "lstrcpynA" ], [ 44090, "lstrlenA" ], [ 44126, "FindWindowExA" ], [ 44142, "OemToCharBuffA" ], [ 44160, "SendMessageA" ], [ 44196, "ADVAPI32.dll" ], [ 45264, "Rich" ], [ 46821, "wmtaHtTHtGHt:Ht-Ht Ht" ], [ 49756, "98 SE" ], [ 49764, "95 OSR2" ], [ 49784, "2000" ], [ 49796, "Server 2003" ], [ 49816, "Server 2003 R2" ], [ 49832, "kernel32.dll" ], [ 49848, "GetNativeSystemInfo" ], [ 49868, "Server 2008" ], [ 49880, "Vista" ], [ 49888, "Server 2008 R2" ], [ 49908, "Workstation 4.0" ], [ 49924, "Professional" ], [ 49940, "Professional x64 Edition" ], [ 49968, "Embedded" ], [ 49980, "Home Edition" ], [ 49996, "SYSTEM\\WPA\\TabletPC" ], [ 50016, "Installed" ], [ 50028, "SYSTEM\\WPA\\MediaCenter" ], [ 50052, "Home Premium N" ], [ 50068, "Enterprise N" ], [ 50084, "Ultimate N" ], [ 50096, "Starter N" ], [ 50108, "Professional N" ], [ 50124, "Business N" ], [ 50136, "Ultimate" ], [ 50148, "Home Basic" ], [ 50160, "Home Premium" ], [ 50176, "Enterprise" ], [ 50188, "Home Basic N" ], [ 50204, "Business" ], [ 50216, "Starter" ], [ 50224, "GetProductInfo" ], [ 50260, "SERVERNT" ], [ 50272, "LANMANNT" ], [ 50284, "Workstation" ], [ 50296, "WINNT" ], [ 50304, "ProductType" ], [ 50316, "SYSTEM\\CurrentControlSet\\Control\\ProductOptions" ], [ 50364, "Server 4.0" ], [ 50376, "Server 4.0 Enterprise Edition" ], [ 50408, "Server" ], [ 50416, "Advanced Server" ], [ 50432, "Datacenter Server" ], [ 50452, "Standard Edition" ], [ 50472, "Storage Server 2003" ], [ 50492, "Enterprise Edition" ], [ 50512, "Datacenter Edition" ], [ 50532, "Standard x64 Edition" ], [ 50556, "Enterprise x64 Edition" ] ], "sz": 53248, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SERVERNT", "LANMANNT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingA" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.57)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.27" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 34.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.699999988079071, "d": "Check if running under WoW64", "e": [ "IsWow64Process" ], "i": "micro-behaviors/os/compat/wow64::is-wow64-process", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 1.0, "d": "CompanyName field marker", "e": [ "CompanyName" ], "i": "well-known/malware/worm/ludbaruma::companyname-field", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 34.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 53248.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "14 70 00 10" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "a": "T1057", "c": 0.800000011920929, "d": "PSAPI.dll dynamic load string", "e": [ "PSAPI" ], "i": "micro-behaviors/process/enumerate/psapi::psapi-dll-string", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Two or more embedded PE headers", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::multiple-pe-embedded", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 2048)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.30" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1109268374.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 14.53" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.20" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.20" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Skips Windows installation directories", "e": [ "WINNT" ], "i": "objectives/impact/infect/binary::skip-windows-install-dir", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.9200000166893005, "d": "Disable DLL thread notifications", "e": [ "DisableThreadLibraryCalls" ], "i": "micro-behaviors/os/module/load::disable-thread-library-calls", "l": 1 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 313.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 53248.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.75, "d": "Find window by class/title (ANSI)", "e": [ "FindWindowA" ], "i": "micro-behaviors/ui/window/manage::find-window-a-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "GetDeviceDriverBaseNameA", "GetModuleBaseNameA", "GetModuleFileNameA", "WideCharToMultiByte", "UnhandledExceptionFilter", "DisableThreadLibraryCalls", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "MultiByteToWideChar", "InitializeSecurityDescriptor", "SetSecurityDescriptorDacl", "GetNativeSystemInfo", "WindowsPlatformArchitecture", "WindowsServicePackBuild" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "00 99 00 10", "00 99 00 10", "68 70 00 10", "8c 70 00 10", "8c 70 00 10", "7c 70 00 10", "68 70 00 10", "68 70 00 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 61.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "wsprintfA import present", "e": [ "wsprintfA" ], "i": "well-known/malware/worm/mydoom::wsprintfa-import", "l": 1 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (LoadLibraryA, GetProcAddress, FreeLibrary, OpenProcess, CloseHandle, ... +52 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (FindWindowA, GetDesktopWindow, wsprintfA, UpdateWindow)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "QueryPerformanceCounter", "GetTickCount" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Pipe creation with handle redirect", "e": [ "CreatePipe", "SetStdHandle" ], "i": "micro-behaviors/communications/ipc/pipe::pipe-io-redirect", "l": 3 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Timing API junk branches in minimal stub", "e": [ "68 70 00 10", "7c 70 00 10", "8c 70 00 10", "00 99 00 10", "GetTickCount" ], "i": "objectives/anti-static/obfuscation/instruction/junk::timing-junk-code-stub", "l": 3 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 3, "m": "F0007" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 } ], "sha": "f2beb6d1508239ab7ad9d091442970c850a3646359a960fc8d1a8ad0e7ca851a", "path": "93156!!embedded:pe@0x58f45", "type": "pe" }, { "f": "KO₅(As₅C₂Er₄I₂S)H₄(CmFOsPo)Md₃(Bi₄Pt)", "x": 9, "dp": 1, "id": 4, "is": [ "InitializeSecurityDescriptor", "SetSecurityDescriptorDacl", "CloseHandle", "CopyFileA", "CreateFileA", "CreateFileMappingA", "CreatePipe", "CreateProcessA", "DeleteFileA", "ExitProcess", "GetCommandLineA", "GetCurrentProcess", "GetExitCodeProcess", "GetModuleFileNameA", "GetModuleHandleA", "GetProcAddress", "GetStartupInfoA", "GetTempFileNameA", "GetTickCount", "GetVersionExA", "GlobalAlloc", "GlobalFree", "GlobalLock", "GlobalReAlloc", "GlobalSize", "GlobalUnlock", "MapViewOfFile", "PeekNamedPipe", "ReadFile", "Sleep", "TerminateProcess", "UnmapViewOfFile", "WaitForSingleObject", "lstrcatA", "lstrcmpiA", "lstrcpyA", "lstrcpynA", "lstrlenA", "CharNextA", "CharPrevA", "FindWindowExA", "OemToCharBuffA", "SendMessageA", "wsprintfA" ], "ms": { "pe": { "machine": 332.0, "checksum": 72946.0, "subsystem": 2.0, "timestamp": 1329663738.0, "image_base": 1855193088.0, "entry_section": ".text", "size_of_image": 32768.0, "timestamp_day": 19.0, "file_alignment": 512.0, "timestamp_year": 2012.0, "characteristics": 8974.0, "entry_point_rva": 4406.0, "size_of_headers": 1024.0, "timestamp_month": 2.0, "checksum_present": true, "export_timestamp": 1329663738.0, "import_dll_count": 3.0, "checksum_mismatch": true, "computed_checksum": 58303.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "export_timestamp_day": 19.0, "linker_major_version": 2.0, "linker_minor_version": 22.0, "export_timestamp_year": 2012.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 2.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 4608.0, "file_size": 32768.0, "entry_point": 4406.0, "has_overlay": true, "code_entropy": 6.09, "data_entropy": 2.35, "export_count": 3.0, "import_count": 44.0, "overlay_size": 24064.0, "string_count": 187.0, "overlay_ratio": 0.73, "section_count": 6.0, "avg_complexity": 6.71, "function_count": 14.0, "import_density": 9.78, "max_complexity": 47.0, "string_density": 41.56, "overall_entropy": 2.95, "overlay_entropy": 5.9, "avg_basic_blocks": 12.71, "avg_section_size": 1280.0, "dependency_count": 3.0, "entropy_variance": 2.2, "function_density": 3.11, "avg_function_size": 276.93, "avg_string_length": 17.33, "complexity_per_kb": 1.49, "max_string_length": 66.0, "wide_string_count": 14.0, "writable_sections": 2.0, "avg_string_entropy": 3.24, "code_to_data_ratio": 1.5, "entry_point_is_rva": true, "text_to_file_ratio": 0.14, "total_basic_blocks": 178.0, "executable_sections": 1.0, "string_length_stddev": 12.03, "largest_section_ratio": 0.14, "sentence_string_count": 44.0, "sentence_string_ratio": 0.24, "behavioral_import_ratio": 0.05, "function_analysis_depth": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 454, "0@.bss" ], [ 496, ".edata" ], [ 534, "0@.idata" ], [ 576, ".reloc" ], [ 5632, "kernel32" ], [ 5641, "IsWow64Process" ], [ 5656, "error" ], [ 5674, "SysListView32" ], [ 5688, "/TIMEOUT=" ], [ 5698, "/OEM" ], [ 5714, "timeout" ], [ 6214, "nsExec.dll" ], [ 6225, "Exec" ], [ 6240, "ExecToStack" ], [ 7114, "InitializeSecurityDescriptor" ], [ 7146, "SetSecurityDescriptorDacl" ], [ 7174, "CloseHandle" ], [ 7200, "CreateFileA" ], [ 7214, "CreateFileMappingA" ], [ 7236, "CreatePipe" ], [ 7250, "CreateProcessA" ], [ 7268, "DeleteFileA" ], [ 7282, "ExitProcess" ], [ 7296, "GetCommandLineA" ], [ 7314, "GetCurrentProcess" ], [ 7334, "GetExitCodeProcess" ], [ 7356, "GetModuleFileNameA" ], [ 7378, "GetModuleHandleA" ], [ 7398, "GetProcAddress" ], [ 7416, "GetStartupInfoA" ], [ 7434, "GetTempFileNameA" ], [ 7454, "GetTickCount" ], [ 7470, "GetVersionExA" ], [ 7486, "GlobalAlloc" ], [ 7500, "GlobalFree" ], [ 7514, "GlobalLock" ], [ 7528, "GlobalReAlloc" ], [ 7544, "GlobalSize" ], [ 7558, "GlobalUnlock" ], [ 7574, "MapViewOfFile" ], [ 7590, "PeekNamedPipe" ], [ 7606, "ReadFile" ], [ 7618, "Sleep" ], [ 7626, "TerminateProcess" ], [ 7646, "UnmapViewOfFile" ], [ 7664, "WaitForSingleObject" ], [ 7686, "lstrcatA" ], [ 7698, "lstrcmpiA" ], [ 7710, "lstrcpyA" ], [ 7722, "lstrcpynA" ], [ 7734, "lstrlenA" ], [ 7770, "FindWindowExA" ], [ 7786, "OemToCharBuffA" ], [ 7804, "SendMessageA" ], [ 7820, "wsprintfA" ], [ 7840, "ADVAPI32.dll" ], [ 8000, "KERNEL32.dll" ], [ 8040, "USER32.dll" ], [ 8908, "Rich" ], [ 9267, "@.data" ], [ 9308, ".rsrc" ], [ 9347, "@.reloc" ], [ 10465, "wmtaHtTHtGHt:Ht-Ht Ht" ], [ 13400, "98 SE" ], [ 13408, "95 OSR2" ], [ 13428, "2000" ], [ 13440, "Server 2003" ], [ 13460, "Server 2003 R2" ], [ 13476, "kernel32.dll" ], [ 13492, "GetNativeSystemInfo" ], [ 13512, "Server 2008" ], [ 13524, "Vista" ], [ 13532, "Server 2008 R2" ], [ 13552, "Workstation 4.0" ], [ 13568, "Professional" ], [ 13584, "Professional x64 Edition" ], [ 13612, "Embedded" ], [ 13624, "Home Edition" ], [ 13640, "SYSTEM\\WPA\\TabletPC" ], [ 13660, "Installed" ], [ 13672, "SYSTEM\\WPA\\MediaCenter" ], [ 13696, "Home Premium N" ], [ 13712, "Enterprise N" ], [ 13728, "Ultimate N" ], [ 13740, "Starter N" ], [ 13752, "Professional N" ], [ 13768, "Business N" ], [ 13780, "Ultimate" ], [ 13792, "Home Basic" ], [ 13804, "Home Premium" ], [ 13820, "Enterprise" ], [ 13832, "Home Basic N" ], [ 13848, "Business" ], [ 13860, "Starter" ], [ 13868, "GetProductInfo" ], [ 13904, "SERVERNT" ], [ 13916, "LANMANNT" ], [ 13928, "Workstation" ], [ 13940, "WINNT" ], [ 13948, "ProductType" ], [ 13960, "SYSTEM\\CurrentControlSet\\Control\\ProductOptions" ], [ 14008, "Server 4.0" ], [ 14020, "Server 4.0 Enterprise Edition" ], [ 14052, "Server" ], [ 14060, "Advanced Server" ], [ 14076, "Datacenter Server" ], [ 14096, "Standard Edition" ], [ 14116, "Storage Server 2003" ], [ 14136, "Enterprise Edition" ], [ 14156, "Datacenter Edition" ], [ 14176, "Standard x64 Edition" ], [ 14200, "Enterprise x64 Edition" ], [ 14224, "Datacenter x64 Edition" ], [ 14248, "Enterprise Edition for Itanium-based Systems" ], [ 14296, "Datacenter Edition for Itanium-based Systems" ], [ 14344, "Server Enterprise without Hyper-V (core installation)" ], [ 14400, "Hyper-V Server" ], [ 14416, "Storage Server Express (core installation)" ], [ 14460, "Storage Server Standard (core installation)" ], [ 14504, "Storage Server Workgroup (core installation)" ], [ 14552, "Storage Server Enterprise (core installation)" ], [ 14600, "MultiPoint Server" ], [ 14620, "Server Standard without Hyper-V (core installation)" ], [ 14672, "Server Standard without Hyper-V" ], [ 14704, "Server Foundation" ], [ 14724, "Server 2008 without Hyper-V for Windows Essential Server Solutions" ], [ 14792, "Essential Business Server Security Server" ], [ 14836, "Essential Business Server Messaging Server" ], [ 14880, "Server Enterprise without Hyper-V" ], [ 14916, "Server Datacenter without Hyper-V (core installation)" ], [ 14972, "Server Datacenter without Hyper-V" ], [ 15008, "Essential Business Server Management Server" ], [ 15052, "Web Server Edition (core installation)" ], [ 15092, "Web Server Edition" ], [ 15112, "Storage Server Workgroup" ], [ 15140, "Storage Server Standard" ], [ 15164, "Storage Server Express" ], [ 15188, "Storage Server Enterprise" ], [ 15216, "Server Standard (core installation)" ], [ 15252, "Server Standard" ], [ 15268, "Small Business Server Premium" ], [ 15300, "Small Business Server" ], [ 15324, "Server 2008 for Windows Essential Server Solutions" ], [ 15376, "Server Enterprise for Itanium-based Systems" ], [ 15420, "Server Enterprise (core installation)" ], [ 15460, "Server Enterprise" ], [ 15480, "Server Datacenter (core installation)" ], [ 15520, "Server Datacenter" ], [ 15540, "HPC Edition" ], [ 15552, "Service Pack 6a" ], [ 15568, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Hotfix\\Q246009" ], [ 15628, "Service Pack 6" ], [ 15802, "GetSystemInfo" ], [ 15908, "GetSystemMetrics" ], [ 15952, "RegCloseKey" ], [ 15966, "RegQueryValueExA" ], [ 15986, "RegOpenKeyExA" ], [ 16160, "GetVersion.dll" ], [ 16175, "WindowsName" ], [ 16187, "WindowsPlatformArchitecture" ], [ 16215, "WindowsPlatformId" ], [ 16233, "WindowsServerName" ], [ 16251, "WindowsServicePack" ], [ 16270, "WindowsServicePackBuild" ], [ 16294, "WindowsServicePackMajor" ], [ 16318, "WindowsServicePackMinor" ], [ 16342, "WindowsType" ], [ 16354, "WindowsVersion" ], [ 16490, "wide", "VS_VERSION_INFO" ], [ 16582, "wide", "StringFileInfo" ], [ 16642, "wide", "FileDescription" ], [ 16676, "wide", "GetVersion Dynamic Link Library" ], [ 16746, "wide", "FileVersion" ], [ 16794, "wide", "InternalName" ], [ 16820, "wide", "GetVersion" ], [ 16850, "wide", "OriginalFilename" ], [ 16884, "wide", "GetVersion.dll" ], [ 16922, "wide", "ProductName" ], [ 16948, "wide", "GetVersion NSIS plug-in" ], [ 17002, "wide", "ProductVersion" ], [ 17054, "wide", "VarFileInfo" ], [ 17086, "wide", "Translation" ], [ 18896, ".rdata" ], [ 19096, ".tls" ], [ 23931, "WVS1" ] ], "sz": 32768, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SERVERNT", "LANMANNT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingA" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 44.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 1.0, "d": "Uses named pipe IPC APIs", "e": [ "PeekNamedPipe" ], "i": "micro-behaviors/communications/ipc/named-pipe::named-pipe-api-usage", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.24" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 14.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "Check if running under WoW64", "e": [ "IsWow64Process" ], "i": "micro-behaviors/os/compat/wow64::is-wow64-process", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.800000011920929, "d": "High import density (\u003e3 imports/KB)", "e": [ "binary.import_density = 9.78" ], "i": "metadata/binary/metrics::high-import-density", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 32768.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1559", "c": 0.8999999761581421, "d": "Create anonymous pipe", "e": [ "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::create-pipe", "l": 2 }, { "c": 0.8999999761581421, "d": "Set security descriptor DACL", "e": [ "SetSecurityDescriptorDacl" ], "i": "micro-behaviors/os/security/descriptor::set-security-descriptor-dacl", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Initialize security descriptor", "e": [ "InitializeSecurityDescriptor" ], "i": "micro-behaviors/os/security/descriptor::initialize-security-descriptor", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.73" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Two or more embedded PE headers", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::multiple-pe-embedded", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.24" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1329663738.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.71" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8500000238418579, "d": "PE linked with binutils 2.x (MinGW/GCC)", "e": [ "pe.linker_major_version = 2.00" ], "i": "metadata/lang/compiler/native::linker-binutils-2x", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.95" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00", "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 44.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.95" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Skips Windows installation directories", "e": [ "WINNT" ], "i": "objectives/impact/infect/binary::skip-windows-install-dir", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.6600000262260437, "d": "Copy files (Windows API ANSI)", "e": [ "CopyFileA" ], "i": "micro-behaviors/fs/file/copy::copyfile-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 44.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 187.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1559", "c": 0.8999999761581421, "d": "Peek at pipe data without reading", "e": [ "PeekNamedPipe" ], "i": "micro-behaviors/communications/ipc/pipe::peek-named-pipe", "l": 3 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 1.43)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 44.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 32768.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.73" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeSecurityDescriptor", "SetSecurityDescriptorDacl", "GetModuleFileNameA", "GetNativeSystemInfo", "WindowsPlatformArchitecture", "WindowsServicePackBuild", "WindowsServicePackMajor", "WindowsServicePackMinor" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 44.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "wsprintfA import present", "e": [ "wsprintfA" ], "i": "well-known/malware/worm/mydoom::wsprintfa-import", "l": 1 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (InitializeSecurityDescriptor, SetSecurityDescriptorDacl)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CloseHandle, CopyFileA, CreateFileA, CreateFileMappingA, CreatePipe, ... +31 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CharNextA, CharPrevA, FindWindowExA, OemToCharBuffA, SendMessageA, ... +1 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "VS_VERSION_INFO", "FileVersion", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Pipe creation with handle redirect", "e": [ "PeekNamedPipe", "CreatePipe" ], "i": "micro-behaviors/communications/ipc/pipe::pipe-io-redirect", "l": 3 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "184858ee308cd3db5a5b932d3454a06aa67653f20b504830ab30d8af29c260d1", "path": "93156!!embedded:pe@0x61d49", "type": "pe" }, { "f": "KO₅(As₄C₂Er₂I₂S)H₂(OsPo)Md₂(Bi₄)", "x": 5, "dp": 1, "id": 5, "is": [ "lstrcmpiA", "GetModuleHandleA", "lstrcpynA", "GlobalAlloc", "GetProcAddress", "GetSystemInfo", "GetVersionExA", "GetSystemMetrics", "wsprintfA", "RegQueryValueExA", "RegOpenKeyExA", "RegCloseKey" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 1024.0, "subsystem": 2.0, "timestamp": 1286898477.0, "image_base": 268435456.0, "rsrc_entropy": 2.4, "entry_section": ".text", "size_of_image": 24576.0, "timestamp_day": 12.0, "file_alignment": 512.0, "resource_count": 1.0, "timestamp_year": 2010.0, "characteristics": 8450.0, "entry_point_rva": 7247.0, "size_of_headers": 1024.0, "timestamp_month": 10.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1286898477.0, "import_dll_count": 3.0, "computed_checksum": 65736.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 12.0, "linker_major_version": 10.0, "version_info_present": true, "export_timestamp_year": 2010.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 10.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 3584.0, "file_size": 24576.0, "entry_point": 7247.0, "has_overlay": true, "code_entropy": 5.47, "data_entropy": 2.48, "export_count": 10.0, "import_count": 12.0, "overlay_size": 14848.0, "string_count": 142.0, "overlay_ratio": 0.6, "section_count": 5.0, "avg_complexity": 13.58, "function_count": 12.0, "import_density": 3.43, "max_complexity": 80.0, "string_density": 40.57, "overall_entropy": 3.33, "overlay_entropy": 5.91, "avg_basic_blocks": 20.25, "avg_section_size": 1740.8, "dependency_count": 3.0, "entropy_variance": 1.97, "function_density": 3.43, "avg_function_size": 253.25, "avg_string_length": 18.96, "complexity_per_kb": 3.88, "max_string_length": 66.0, "wide_string_count": 6.0, "writable_sections": 1.0, "avg_string_entropy": 3.3, "code_to_data_ratio": 0.7, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.04, "text_to_file_ratio": 0.15, "total_basic_blocks": 243.0, "executable_sections": 1.0, "string_length_stddev": 13.11, "largest_section_ratio": 0.15, "sentence_string_count": 44.0, "sentence_string_ratio": 0.31, "behavioral_import_ratio": 0.08, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 200, "Rich" ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".rsrc" ], [ 639, "@.reloc" ], [ 1757, "wmtaHtTHtGHt:Ht-Ht Ht" ], [ 4692, "98 SE" ], [ 4700, "95 OSR2" ], [ 4720, "2000" ], [ 4732, "Server 2003" ], [ 4752, "Server 2003 R2" ], [ 4768, "kernel32.dll" ], [ 4784, "GetNativeSystemInfo" ], [ 4804, "Server 2008" ], [ 4816, "Vista" ], [ 4824, "Server 2008 R2" ], [ 4844, "Workstation 4.0" ], [ 4860, "Professional" ], [ 4876, "Professional x64 Edition" ], [ 4904, "Embedded" ], [ 4916, "Home Edition" ], [ 4932, "SYSTEM\\WPA\\TabletPC" ], [ 4952, "Installed" ], [ 4964, "SYSTEM\\WPA\\MediaCenter" ], [ 4988, "Home Premium N" ], [ 5004, "Enterprise N" ], [ 5020, "Ultimate N" ], [ 5032, "Starter N" ], [ 5044, "Professional N" ], [ 5060, "Business N" ], [ 5072, "Ultimate" ], [ 5084, "Home Basic" ], [ 5096, "Home Premium" ], [ 5112, "Enterprise" ], [ 5124, "Home Basic N" ], [ 5140, "Business" ], [ 5152, "Starter" ], [ 5160, "GetProductInfo" ], [ 5196, "SERVERNT" ], [ 5208, "LANMANNT" ], [ 5220, "Workstation" ], [ 5232, "WINNT" ], [ 5240, "ProductType" ], [ 5252, "SYSTEM\\CurrentControlSet\\Control\\ProductOptions" ], [ 5300, "Server 4.0" ], [ 5312, "Server 4.0 Enterprise Edition" ], [ 5344, "Server" ], [ 5352, "Advanced Server" ], [ 5368, "Datacenter Server" ], [ 5388, "Standard Edition" ], [ 5408, "Storage Server 2003" ], [ 5428, "Enterprise Edition" ], [ 5448, "Datacenter Edition" ], [ 5468, "Standard x64 Edition" ], [ 5492, "Enterprise x64 Edition" ], [ 5516, "Datacenter x64 Edition" ], [ 5540, "Enterprise Edition for Itanium-based Systems" ], [ 5588, "Datacenter Edition for Itanium-based Systems" ], [ 5636, "Server Enterprise without Hyper-V (core installation)" ], [ 5692, "Hyper-V Server" ], [ 5708, "Storage Server Express (core installation)" ], [ 5752, "Storage Server Standard (core installation)" ], [ 5796, "Storage Server Workgroup (core installation)" ], [ 5844, "Storage Server Enterprise (core installation)" ], [ 5892, "MultiPoint Server" ], [ 5912, "Server Standard without Hyper-V (core installation)" ], [ 5964, "Server Standard without Hyper-V" ], [ 5996, "Server Foundation" ], [ 6016, "Server 2008 without Hyper-V for Windows Essential Server Solutions" ], [ 6084, "Essential Business Server Security Server" ], [ 6128, "Essential Business Server Messaging Server" ], [ 6172, "Server Enterprise without Hyper-V" ], [ 6208, "Server Datacenter without Hyper-V (core installation)" ], [ 6264, "Server Datacenter without Hyper-V" ], [ 6300, "Essential Business Server Management Server" ], [ 6344, "Web Server Edition (core installation)" ], [ 6384, "Web Server Edition" ], [ 6404, "Storage Server Workgroup" ], [ 6432, "Storage Server Standard" ], [ 6456, "Storage Server Express" ], [ 6480, "Storage Server Enterprise" ], [ 6508, "Server Standard (core installation)" ], [ 6544, "Server Standard" ], [ 6560, "Small Business Server Premium" ], [ 6592, "Small Business Server" ], [ 6616, "Server 2008 for Windows Essential Server Solutions" ], [ 6668, "Server Enterprise for Itanium-based Systems" ], [ 6712, "Server Enterprise (core installation)" ], [ 6752, "Server Enterprise" ], [ 6772, "Server Datacenter (core installation)" ], [ 6812, "Server Datacenter" ], [ 6832, "HPC Edition" ], [ 6844, "Service Pack 6a" ], [ 6860, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Hotfix\\Q246009" ], [ 6920, "Service Pack 6" ], [ 7078, "GetVersionExA" ], [ 7094, "GetSystemInfo" ], [ 7110, "GetProcAddress" ], [ 7128, "GetModuleHandleA" ], [ 7148, "lstrcmpiA" ], [ 7160, "lstrcpynA" ], [ 7172, "GlobalAlloc" ], [ 7184, "KERNEL32.dll" ], [ 7200, "GetSystemMetrics" ], [ 7220, "wsprintfA" ], [ 7230, "USER32.dll" ], [ 7244, "RegCloseKey" ], [ 7258, "RegQueryValueExA" ], [ 7278, "RegOpenKeyExA" ], [ 7292, "ADVAPI32.dll" ], [ 7452, "GetVersion.dll" ], [ 7467, "WindowsName" ], [ 7479, "WindowsPlatformArchitecture" ], [ 7507, "WindowsPlatformId" ], [ 7525, "WindowsServerName" ], [ 7543, "WindowsServicePack" ], [ 7562, "WindowsServicePackBuild" ], [ 7586, "WindowsServicePackMajor" ], [ 7610, "WindowsServicePackMinor" ], [ 7634, "WindowsType" ], [ 7646, "WindowsVersion" ], [ 7782, "wide", "VS_VERSION_INFO" ], [ 7874, "wide", "StringFileInfo" ], [ 7934, "FileDescription" ], [ 7968, "GetVersion Dynamic Link Library" ], [ 8038, "FileVersion" ], [ 8086, "InternalName" ], [ 8112, "wide", "GetVersion" ], [ 8142, "wide", "OriginalFilename" ], [ 8176, "GetVersion.dll" ], [ 8214, "ProductName" ], [ 8240, "GetVersion NSIS plug-in" ], [ 8294, "ProductVersion" ], [ 8346, "wide", "VarFileInfo" ], [ 8378, "wide", "Translation" ], [ 10188, ".rdata" ], [ 10268, ".edata" ], [ 10306, "0@.idata" ], [ 10388, ".tls" ], [ 10428, ".reloc" ], [ 15223, "WVS1" ] ], "sz": 24576, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SERVERNT", "LANMANNT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.31" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "DLL exports five to ten APIs", "e": [ "binary.export_count = 10.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-5-10", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 12.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.800000011920929, "d": "High import density (\u003e3 imports/KB)", "e": [ "binary.import_density = 3.43" ], "i": "metadata/binary/metrics::high-import-density", "l": 2 }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 24576.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 10.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 10.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.60" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.30" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1286898477.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 13.58" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.33" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.33" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "Skips Windows installation directories", "e": [ "WINNT" ], "i": "objectives/impact/infect/binary::skip-windows-install-dir", "l": 1 }, { "c": 1.0, "d": "OriginalFilename field marker", "e": [ "OriginalFilename" ], "i": "well-known/malware/worm/ludbaruma::originalfilename-field", "l": 1 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 142.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 24576.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.8999999761581421, "d": "DLL exports ten to twenty-five APIs", "e": [ "binary.export_count = 10.00" ], "i": "metadata/binary/symbols::sideload-export-cluster-size-10-25", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.60" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetNativeSystemInfo", "WindowsPlatformArchitecture", "WindowsServicePackBuild", "WindowsServicePackMajor", "WindowsServicePackMinor" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 12.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "wsprintfA import present", "e": [ "wsprintfA" ], "i": "well-known/malware/worm/mydoom::wsprintfa-import", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetSystemMetrics, wsprintfA)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegQueryValueExA, RegOpenKeyExA, RegCloseKey)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (lstrcmpiA, GetModuleHandleA, lstrcpynA, GlobalAlloc, GetProcAddress, ... +2 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "446e3d0da8c9be3a328ed847fa9cfb795ea8767726df13f56092d1127a103076", "path": "93156!!embedded:pe@0x63f4d", "type": "pe" }, { "f": "KO₅(As₅AlC₃Er₂S)H₄(Cm₃OsPoDs)Md₅(Bi₂PtSiPa)", "x": 50, "dp": 1, "id": 6, "is": [ "RegCloseKey", "RegOpenKeyExA", "RegQueryValueExA", "CloseHandle", "CreateFileA", "CreateSemaphoreA", "CreateThread", "DeleteCriticalSection", "DeleteFileA", "EnterCriticalSection", "FreeLibrary", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThreadId", "GetLastError", "GetModuleHandleA", "GetProcAddress", "GetSystemTimeAsFileTime", "GetTickCount", "GlobalAlloc", "GlobalFree", "InitializeCriticalSection", "InterlockedCompareExchange", "LeaveCriticalSection", "LoadLibraryA", "LoadLibraryW", "MulDiv", "QueryPerformanceCounter", "ReleaseSemaphore", "SetLastError", "SetUnhandledExceptionFilter", "Sleep", "TerminateProcess", "TlsAlloc", "TlsFree", "TlsGetValue", "TlsSetValue", "UnhandledExceptionFilter", "VirtualProtect", "VirtualQuery", "WaitForSingleObject", "WriteFile", "lstrcatA", "lstrcmpiA", "lstrcpyA", "lstrcpynA", "lstrlenA", "write", "dllonexit", "amsg_exit", "initterm", "iob", "lock", "onexit", "unlock", "winmajor", "abort", "calloc", "fputc", "fputs", "free", "fwrite", "malloc", "memcmp", "memcpy", "realloc", "sprintf", "strcmp", "strcpy", "strlen", "strncmp", "vfprintf", "CallWindowProcA", "CharPrevA", "CreateWindowExA", "DestroyWindow", "EnableWindow", "FindWindowExA", "GetClientRect", "GetDlgItem", "GetFocus", "GetWindowLongA", "GetWindowRect", "IsWindowVisible", "RegisterWindowMessageA", "SendMessageA", "SetDlgItemTextA", "SetWindowLongA", "SetWindowTextA", "ShowWindow", "wsprintfA", "WSACleanup", "WSAGetLastError", "WSAStartup", "WSAFDIsSet", "closesocket", "connect", "gethostbyname", "getsockname", "htons", "inet_addr", "ioctlsocket", "recv", "select", "send", "shutdown", "socket" ], "ms": { "pe": { "machine": 332.0, "checksum": 138853.0, "subsystem": 2.0, "timestamp": 1329663742.0, "image_base": 1891631104.0, "entry_section": ".text", "size_of_image": 143360.0, "timestamp_day": 19.0, "tls_callbacks": 2.0, "file_alignment": 512.0, "timestamp_year": 2012.0, "characteristics": 8974.0, "entry_point_rva": 14216.0, "size_of_headers": 1024.0, "timestamp_month": 2.0, "checksum_present": true, "export_timestamp": 1329663742.0, "import_dll_count": 5.0, "checksum_mismatch": true, "computed_checksum": 121531.0, "section_alignment": 4096.0, "number_of_sections": 9.0, "resource_timestamp": 0.0, "export_timestamp_day": 19.0, "linker_major_version": 2.0, "linker_minor_version": 22.0, "export_timestamp_year": 2012.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 2.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "binary": { "code_size": 60416.0, "file_size": 103927.0, "entry_point": 14216.0, "has_overlay": true, "code_entropy": 6.17, "data_entropy": 2.82, "export_count": 2.0, "import_count": 107.0, "overlay_size": 5623.0, "string_count": 354.0, "overlay_ratio": 0.05, "section_count": 9.0, "avg_complexity": 5.75, "function_count": 126.0, "import_density": 1.81, "max_complexity": 59.0, "string_density": 6.0, "overall_entropy": 2.69, "overlay_entropy": 7.39, "avg_basic_blocks": 9.23, "avg_section_size": 10808.89, "dependency_count": 5.0, "entropy_variance": 2.69, "function_density": 2.14, "avg_function_size": 248.97, "avg_string_length": 15.86, "complexity_per_kb": 0.1, "max_string_length": 70.0, "writable_sections": 5.0, "avg_string_entropy": 3.23, "code_to_data_ratio": 1.64, "data_to_file_ratio": 0.19, "entry_point_is_rva": true, "text_to_file_ratio": 0.58, "total_basic_blocks": 1163.0, "executable_sections": 1.0, "string_length_stddev": 10.85, "largest_section_ratio": 0.58, "sentence_string_count": 54.0, "sentence_string_ratio": 0.15, "behavioral_import_ratio": 0.08, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0 } }, "ss": [ [ 49, "xor", "User-Agent:" ], [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 456, ".rdata" ], [ 536, ".edata" ], [ 574, "0@.idata" ], [ 616, ".CRT" ], [ 656, ".tls" ], [ 696, ".reloc" ], [ 1014, "xor", "User-Agenti" ], [ 5491, "WVS1" ], [ 19147, "ht91" ], [ 21856, "UWVS" ], [ 47168, "UWVS1" ], [ 56466, "xor", "Wser\"Ĝent" ], [ 59316, "CUNG" ], [ 61159, "xor", "Tqes,Agent: N" ], [ 61251, "xor", "TqesRAgent: N" ], [ 80896, "libgcj-12.dll" ], [ 80910, "_Jv_RegisterClasses" ], [ 80933, "resolving hostname" ], [ 80952, "connecting to host" ], [ 80971, "connecting to host (calling select())" ], [ 81009, "creating socket" ], [ 81025, "empty hostname" ], [ 81040, "invalid socket passed to connect" ], [ 81071, "xor", "!ser-Lme/6yd" ], [ 81079, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], [ 81151, "invalid URL" ], [ 81163, "error allocating memory" ], [ 81187, "GET %s HTTP/1.0\r\n" ], [ 81216, "Authorization: Basic " ], [ 81238, "Proxy-Authorization: Basic " ], [ 81266, "could not create connection object" ], [ 81326, "content-length:" ], [ 81352, "STATIC" ], [ 81359, "msctls_progress32" ], [ 81377, "success" ], [ 81385, "Bad response status." ], [ 81406, "download incomplete" ], [ 81426, "Timed out on connecting." ], [ 81451, "Timed out on getting headers." ], [ 81481, "Downloading timed out." ], [ 81504, "cancel" ], [ 81511, "Server did not specify content length." ], [ 81550, "Server aborted." ], [ 81566, "/TRANSLATE2" ], [ 81578, "/TRANSLATE" ], [ 81589, "Downloading %s" ], [ 81604, "Connecting ..." ], [ 81619, " (1 second remaining)" ], [ 81641, " (1 minute remaining)" ], [ 81663, " (1 hour remaining)" ], [ 81683, " (%u seconds remaining)" ], [ 81707, " (%u minutes remaining)" ], [ 81731, " (%u hours remaining)" ], [ 81753, "%skB (%d%%) of %skB at %u.%01ukB/s" ], [ 81788, "/TIMEOUT=" ], [ 81798, "/PROXY" ], [ 81805, "/NOIEPROXY" ], [ 81816, "Unable to open %s" ], [ 81834, "nsisdl create" ], [ 81848, "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ], [ 81908, "ProxyEnable" ], [ 81920, "ProxyServer" ], [ 81942, "User-Agent: NSISDL/1.2 (Mozilla)" ], [ 81975, "Accept: */*" ], [ 81987, "Reading headers" ], [ 82059, "pstd::exception" ], [ 82075, "std::bad_exception" ], [ 82096, "__gnu_cxx::__concurrence_lock_error" ], [ 82132, "__gnu_cxx::__concurrence_unlock_error" ], [ 82172, "pure virtual method called\n" ], [ 82200, "terminate called recursively\n" ], [ 82232, "terminate called after throwing an instance of '" ], [ 82284, "terminate called without an active exception\n" ], [ 82899, "p_GLOBAL_" ], [ 82909, "(anonymous namespace)" ], [ 83427, "pstring literal" ], [ 83929, "vtable for " ], [ 83941, "VTT for " ], [ 83950, "construction vtable for " ], [ 83980, "typeinfo for " ], [ 83994, "typeinfo name for " ], [ 84013, "typeinfo fn for " ], [ 84030, "non-virtual thunk to " ], [ 84052, "virtual thunk to " ], [ 84070, "covariant return thunk to " ], [ 84097, "java Class for " ], [ 84113, "guard variable for " ], [ 84133, "reference temporary for " ], [ 84158, "hidden alias for " ], [ 84199, "operator" ], [ 84208, "operator " ], [ 84235, "false" ], [ 84241, "true" ], [ 84250, "java resource " ], [ 84265, "decltype (" ], [ 84287, "global constructors keyed to " ], [ 84317, "global destructors keyed to " ], [ 84358, "{unnamed type#" ], [ 84671, "p restrict" ], [ 84682, "volatile" ], [ 84702, "complex " ], [ 84711, "imaginary " ], [ 84726, "__vector(" ], [ 84895, "p{default arg#" ], [ 84917, "signed char" ], [ 84929, "bool" ], [ 84934, "boolean" ], [ 84942, "char" ], [ 84952, "double" ], [ 84959, "long double" ], [ 84971, "float" ], [ 84977, "__float128" ], [ 84988, "unsigned char" ], [ 85006, "unsigned int" ], [ 85019, "unsigned" ], [ 85033, "unsigned long" ], [ 85047, "__int128" ], [ 85056, "unsigned __int128" ], [ 85080, "unsigned short" ], [ 85095, "void" ], [ 85100, "wchar_t" ], [ 85108, "long long" ], [ 85118, "unsigned long long" ], [ 85137, "decimal32" ], [ 85147, "decimal64" ], [ 85157, "decimal128" ], [ 85173, "char16_t" ], [ 85182, "char32_t" ], [ 85191, "decltype(nullptr)" ], [ 85876, "std::allocator" ], [ 85891, "allocator" ], [ 85901, "std::basic_string" ], [ 85919, "basic_string" ], [ 85932, "std::string" ], [ 85944, "std::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e" ], [ 86015, "std::istream" ], [ 86028, "std::basic_istream\u003cchar, std::char_traits\u003cchar\u003e \u003e" ], [ 86078, "basic_istream" ], [ 86092, "std::ostream" ], [ 86108, "std::basic_ostream\u003cchar, std::char_traits\u003cchar\u003e \u003e" ], [ 86158, "basic_ostream" ], [ 86172, "std::iostream" ], [ 86188, "std::basic_iostream\u003cchar, std::char_traits\u003cchar\u003e \u003e" ], [ 86239, "basic_iostream" ], [ 86512, "delete[]" ], [ 86529, "delete" ], [ 86727, "sizeof " ], [ 86741, "alignof " ], [ 87111, "xor", "%per-CgenF\\" ], [ 87648, "mingwm10.dll" ], [ 87661, "__mingwthr_remove_key_dtor" ], [ 87688, "__mingwthr_key_dtor" ], [ 87711, "pMingw-w64 runtime failure:\n" ], [ 87740, "Address %p has no image-section" ], [ 87772, " VirtualQuery failed for %d bytes at address %p" ], [ 87824, " Unknown pseudo relocation protocol version %d.\n" ], [ 87876, " Unknown pseudo relocation bit size %d.\n" ], [ 87928, "msvcrt.dll" ], [ 88064, "N10__cxxabiv115__forced_unwindE" ], [ 88096, "N10__cxxabiv117__class_type_infoE" ], [ 88160, "N10__cxxabiv119__foreign_exceptionE" ], [ 88224, "N10__cxxabiv120__si_class_type_infoE" ], [ 88288, "N9__gnu_cxx24__concurrence_lock_errorE" ], [ 88352, "N9__gnu_cxx26__concurrence_unlock_errorE" ], [ 88405, "xor", "User-Agent:s:bz1%(" ], [ 88416, "St13bad_exception" ], [ 88436, "St9bad_alloc" ], [ 88452, "St9exception" ], [ 88468, "St9type_info" ], [ 88480, "xor", "User-Agent: " ], [ 88565, "xor", "User-Agent: NSI" ], [ 88600, "xor", "User-Agent: " ], [ 89148, "NSISdl.dll" ], [ 89159, "download" ], [ 89168, "download_quiet" ], [ 90646, "RegCloseKey" ], [ 90660, "RegOpenKeyExA" ], [ 90676, "RegQueryValueExA" ], [ 90696, "CloseHandle" ], [ 90710, "CreateFileA" ], [ 90724, "CreateSemaphoreA" ], [ 90744, "CreateThread" ], [ 90760, "DeleteCriticalSection" ], [ 90784, "DeleteFileA" ], [ 90798, "EnterCriticalSection" ], [ 90822, "FreeLibrary" ], [ 90836, "GetCurrentProcess" ], [ 90856, "GetCurrentProcessId" ], [ 90878, "GetCurrentThreadId" ], [ 90900, "GetLastError" ], [ 90916, "GetModuleHandleA" ], [ 90936, "GetProcAddress" ], [ 90954, "GetSystemTimeAsFileTime" ], [ 90980, "GetTickCount" ], [ 90996, "GlobalAlloc" ], [ 91010, "GlobalFree" ], [ 91024, "InitializeCriticalSection" ], [ 91052, "InterlockedCompareExchange" ], [ 91082, "LeaveCriticalSection" ], [ 91106, "LoadLibraryA" ], [ 91122, "LoadLibraryW" ], [ 91148, "QueryPerformanceCounter" ], [ 91174, "ReleaseSemaphore" ], [ 91194, "SetLastError" ], [ 91210, "SetUnhandledExceptionFilter" ], [ 91240, "Sleep" ], [ 91248, "TerminateProcess" ], [ 91268, "TlsAlloc" ], [ 91280, "TlsFree" ], [ 91290, "TlsGetValue" ], [ 91304, "TlsSetValue" ], [ 91318, "UnhandledExceptionFilter" ], [ 91346, "VirtualProtect" ], [ 91364, "VirtualQuery" ], [ 91380, "WaitForSingleObject" ], [ 91402, "WriteFile" ], [ 91414, "lstrcatA" ], [ 91426, "lstrcmpiA" ], [ 91438, "lstrcpyA" ], [ 91450, "lstrcpynA" ], [ 91462, "lstrlenA" ], [ 91474, "_write" ], [ 91484, "__dllonexit" ], [ 91498, "_amsg_exit" ], [ 91512, "_initterm" ], [ 91540, "_onexit" ], [ 91550, "_unlock" ], [ 91560, "_winmajor" ], [ 91572, "abort" ], [ 91580, "calloc" ], [ 91606, "free" ], [ 91614, "fwrite" ], [ 91624, "malloc" ], [ 91634, "memcmp" ], [ 91644, "memcpy" ], [ 91654, "realloc" ], [ 91664, "sprintf" ], [ 91694, "strlen" ], [ 91704, "strncmp" ], [ 91714, "vfprintf" ], [ 91726, "CallWindowProcA" ], [ 91756, "CreateWindowExA" ], [ 91774, "DestroyWindow" ], [ 91790, "EnableWindow" ], [ 91806, "FindWindowExA" ], [ 91822, "GetClientRect" ], [ 91852, "GetFocus" ], [ 91864, "GetWindowLongA" ], [ 91882, "GetWindowRect" ], [ 91898, "IsWindowVisible" ], [ 91916, "RegisterWindowMessageA" ], [ 91942, "SendMessageA" ], [ 91958, "SetDlgItemTextA" ] ], "sz": 103927, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Allocate zeroed memory", "e": [ "calloc" ], "i": "micro-behaviors/mem/c-runtime/functions::calloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Winsock outbound connect import", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::connect-api", "l": 3 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:", "User-Agent:" ], "i": "micro-behaviors/communications/http/request::user-agent-header", "l": 2, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Internet Settings registry key access", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ], "i": "micro-behaviors/os/registry/access::internet-settings-key", "l": 3 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE has multiple TLS callbacks", "e": [ "pe.tls_callbacks = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-multi-callbacks", "l": 3 }, { "c": 0.800000011920929, "d": "Uses internet communication API imports", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/http::has-internet-communication-apis", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 126.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "GET %s HTTP/1.0\r\n" ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Winsock send import", "e": [ "send" ], "i": "micro-behaviors/communications/socket/init::send-api", "l": 2 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 126.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory compare", "e": [ "memcmp" ], "i": "micro-behaviors/mem/c-runtime/functions::memcmp", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "GNU libstdc++ stdlib", "e": [ "__gnu_cxx", "__gnu_cxx", "__cxxabiv1", "__cxxabiv1", "__cxxabiv1", "__cxxabiv1", "__gnu_cxx", "__gnu_cxx" ], "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 103927.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Variadic formatted output", "e": [ "vfprintf" ], "i": "micro-behaviors/os/stdio::vfprintf", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "43", "40" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.7599999904632568, "d": "Winsock startup API string", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "l": 1 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "MinGW pseudo relocation runtime", "e": [ "Unknown pseudo relocation protocol version %d.", "Unknown pseudo relocation bit size %d." ], "i": "metadata/binary/framework::mingw-pseudoreloc-runtime", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Winsock receive import", "e": [ "recv" ], "i": "micro-behaviors/communications/socket/init::recv-api", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA", "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 126.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "String copy (unsafe)", "e": [ "strcpy" ], "i": "micro-behaviors/data/string::strcpy", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8500000238418579, "d": "Release semaphore count", "e": [ "ReleaseSemaphore" ], "i": "micro-behaviors/process/sync/semaphore::release-semaphore", "l": 2, "m": "C0042" }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "gethostbyname import string", "e": [ "gethostbyname" ], "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 0.8999999761581421, "d": "String length", "e": [ "strlen" ], "i": "micro-behaviors/data/string::strlen", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Cleanup Winsock library", "e": [ "WSACleanup" ], "i": "micro-behaviors/communications/socket/init::wsa-cleanup", "l": 2 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "download", "Download", "Download", "download", "download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "HTTP User-Agent header", "e": [ "User-Agent:s:bz1%(", "User-Agent:", "User-Agent: NSISDL/1.2 (Mozilla)", "User-Agent: WC", "User-Agent: ", "User-Agent: NSI" ], "i": "micro-behaviors/communications/http/user-agent::user-agent-header-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.23" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Reallocate memory", "e": [ "realloc" ], "i": "micro-behaviors/mem/c-runtime/functions::realloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1329663742.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "String comparison", "e": [ "strcmp" ], "i": "micro-behaviors/data/string::strcmp", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.75" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8500000238418579, "d": "PE linked with binutils 2.x (MinGW/GCC)", "e": [ "pe.linker_major_version = 2.00" ], "i": "metadata/lang/compiler/native::linker-binutils-2x", "l": 3 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.69" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1163.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize Winsock library", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::wsa-startup", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.69" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Limited string comparison", "e": [ "strncmp" ], "i": "micro-behaviors/data/string::strncmp", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.9300000071525574, "d": "GCJ runtime library dependency", "e": [ "libgcj-12.dll" ], "i": "metadata/binary/framework::gcj-runtime-library", "l": 2 }, { "c": 0.7200000286102295, "d": "Winsock socket API string", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::ws2-socket-api-string", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.8500000238418579, "d": "Winsock shutdown import", "e": [ "shutdown" ], "i": "micro-behaviors/communications/socket/init::shutdown-api", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreA" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 354.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Winsock socket creation import", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::socket-api", "l": 3 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.8500000238418579, "d": "Get last Windows socket error", "e": [ "WSAGetLastError" ], "i": "micro-behaviors/communications/socket/init::wsa-get-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 143360.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "WSAStartup import", "e": [ "WSAStartup" ], "i": "well-known/malware/trojan/hijack-gen::padodor-wsa-startup-import", "l": 1 }, { "c": 0.7200000286102295, "d": "Winsock connect API string", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::ws2-connect-api-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP GET method", "e": [ "GET %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/get::get", "l": 3 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8199999928474426, "d": "sprintf string formatting API", "e": [ "sprintf" ], "i": "micro-behaviors/fs/path/construct::sprintf-format-api", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "a": "T1071.001", "d": "Basic authentication", "e": [ "Authorization: Basic", "Authorization: Basic" ], "i": "micro-behaviors/communications/http/headers::basic-auth", "l": 3, "m": "C0002" }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE TLS callback table present", "e": [ "pe.tls_callbacks = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-callbacks-metric", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowVisible" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetCurrentProcessId", "GetSystemTimeAsFileTime", "InitializeCriticalSection", "InterlockedCompareExchange", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1071.001", "d": "Authorization header", "e": [ "Proxy-Authorization: Basic ", "Authorization: Basic " ], "i": "micro-behaviors/communications/http/headers::auth-header", "l": 3, "m": "C0002" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 3 }, { "c": 0.949999988079071, "d": "links msvcrt.dll (write, dllonexit, amsg_exit, initterm, iob, ... +20 more)", "e": [ "msvcrt.dll" ], "i": "metadata/dylib::msvcrt/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (WSACleanup, WSAGetLastError, WSAStartup, WSAFDIsSet, closesocket, ... +11 more)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey, RegOpenKeyExA, RegQueryValueExA)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (CallWindowProcA, CharPrevA, CreateWindowExA, DestroyWindow, EnableWindow, ... +14 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CloseHandle, CreateFileA, CreateSemaphoreA, CreateThread, DeleteCriticalSection, ... +39 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Winsock client symbol lifecycle", "e": [ "socket", "recv", "connect", "send", "shutdown" ], "i": "micro-behaviors/communications/socket/init::winsock-client-symbol-lifecycle", "l": 3 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8600000143051147, "d": "Runtime-resolved Winsock client APIs", "e": [ "WS2_32.dll", "socket", "connect", "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::winsock-runtime-client-api-table", "l": 3 }, { "c": 0.8999999761581421, "d": "Winsock client connection lifecycle", "e": [ "socket", "recv", "WS2_32.dll", "connect", "shutdown", "send" ], "i": "micro-behaviors/communications/socket/init::winsock-client-lifecycle", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "MinGW PE with anti-analysis features", "e": [ "pe.linker_major_version = 2.00", "pe.tls_callbacks = 2.00", "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/cross-compiled::mingw-with-anti-analysis", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "2dd4b73cc009133cc146d189448be2b8be3d93027d44bba1b520e11439a8e39e", "path": "93156!!embedded:pe@0x66551", "type": "pe" } ], "tv": "b2c18" } }