{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.21782178, "class": 0 }, { "m": "az/pe", "prob": 0.044354837, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T19:42:13Z" }, "path": "839aee5f9b2423c3be1f78f949ae3cfcee9094434297a35ff0318791ef87bf3e.dll", "raw": { "v": "5", "fs": [ { "f": "O₂(DyEr)H(Po)Md(Bi)", "x": 9, "ff": { "i": [ [ "kernel32", "CreateSemaphoreW" ], [ "kernel32", "VirtualProtectEx" ], [ "kernel32", "GetCurrentDirectoryW" ], [ "kernel32", "Sleep" ], [ "kernel32", "GetSystemDirectoryW" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "InterlockedIncrement" ], [ "kernel32", "InterlockedDecrement" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "InterlockedCompareExchange" ], [ "kernel32", "InterlockedExchange" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "HeapValidate" ], [ "kernel32", "IsBadReadPtr" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "HeapFree" ], [ "kernel32", "GetVersionExA" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "RaiseException" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "LCMapStringA" ], [ "kernel32", "GetLastError" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "GetStringTypeA" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsFree" ], [ "kernel32", "SetLastError" ], [ "kernel32", "FatalAppExitA" ], [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "HeapDestroy" ], [ "kernel32", "HeapCreate" ], [ "kernel32", "VirtualFree" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "DebugBreak" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "WriteFile" ], [ "kernel32", "OutputDebugStringA" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "GetFileType" ], [ "kernel32", "OutputDebugStringW" ], [ "kernel32", "LoadLibraryW" ], [ "kernel32", "SetHandleCount" ], [ "kernel32", "GetStartupInfoA" ], [ "kernel32", "FreeEnvironmentStringsA" ], [ "kernel32", "GetEnvironmentStrings" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "GetConsoleCP" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "GetLocaleInfoA" ], [ "kernel32", "IsValidLocale" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "EnumSystemLocalesA" ], [ "kernel32", "GetUserDefaultLCID" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "GetLocaleInfoW" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "WriteConsoleA" ], [ "kernel32", "GetConsoleOutputCP" ], [ "kernel32", "ReadFile" ], [ "kernel32", "CreateFileA" ], [ "clusapi", "ChangeClusterResourceGroup" ], [ "clusapi", "CloseClusterGroup" ], [ "clusapi", "EvictClusterNodeEx" ], [ "clusapi", "SetClusterNetworkPriorityOrder" ], [ "clusapi", "DeleteClusterGroup" ], [ "clusapi", "BackupClusterDatabase" ], [ "clusapi", "AddClusterResourceNode" ], [ "clusapi", "EvictClusterNode" ], [ "clusapi", "SetClusterServiceAccountPassword" ], [ "clusapi", "AddClusterResourceDependency" ], [ "clusapi", "GetClusterFromGroup" ], [ "clusapi", "DeleteClusterResource" ], [ "clusapi", "CreateClusterResourceType" ], [ "clusapi", "GetClusterGroupKey" ], [ "clusapi", "GetClusterFromNetwork" ], [ "clusapi", "CloseClusterResource" ], [ "clusapi", "CloseClusterNetInterface" ], [ "clusapi", "FailClusterResource" ], [ "clusapi", "GetClusterFromNetInterface" ], [ "clusapi", "CloseClusterNode" ], [ "clusapi", "CloseClusterNotifyPort" ], [ "clusapi", "ClusterCloseEnum" ], [ "clusapi", "GetClusterFromResource" ], [ "clusapi", "GetClusterFromNode" ], [ "clusapi", "ClusterControl" ], [ "clusapi", "CanResourceBeDependent" ], [ "clusapi", "CloseCluster" ], [ "clusapi", "SetClusterQuorumResource" ], [ "clusapi", "SetClusterResourceName" ], [ "clusapi", "CloseClusterNetwork" ], [ "clusapi", "DeleteClusterResourceType" ] ], "m": { "pe": { "checksum": 0.0, "has_safe_seh": 1.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 342847.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 65.0, "base_relocation_entry_count": 5645.0 }, "file": { "size": 335872.0, "entropy": 6.17, "size_bytes": 335872.0 }, "binary": { "is_pie": 0.0, "code_entropy": 6.34, "data_entropy": 3.7, "string_count": 2297.0, "entropy_variance": 4.08, "avg_string_length": 18.64, "max_string_length": 334.0, "code_to_data_ratio": 0.96, "string_length_stddev": 25.34, "largest_section_ratio": 0.88, "sentence_string_count": 444.0, "sentence_string_ratio": 0.19, "high_entropy_string_count": 3.0 }, "imports": { "count": 120.0 }, "sections": { "count": 4.0, "code_size": 294912.0, "entropy_max": 6.34, "entropy_mean": 3.91, "name_entropy": 3.27, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 456, "u8", ".rsrc" ], [ 495, "u8", "@.reloc" ], [ 4888, "u8", "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\streambuf" ], [ 4944, "wide", "std::_String_const_iterator\u003cchar,struct std::char_traits\u003cchar\u003e,class std::allocator\u003cchar\u003e \u003e::operator *" ], [ 5152, "wide", "string iterator not dereferencable" ], [ 5224, "wide", "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\xstring" ], [ 5320, "wide", "\"invalid argument\"" ], [ 5360, "wide", "std::_String_const_iterator\u003cchar,struct std::char_traits\u003cchar\u003e,class std::allocator\u003cchar\u003e \u003e::_String_const_iterator" ], [ 5592, "wide", "(\"_Pstring == NULL || _Ptr != NULL \u0026\u0026 ((_Mystring *)_Pstring)-\u003e_Myptr() \u003c= _Ptr \u0026\u0026 _Ptr \u003c= (((_Mystring *)_Pstring)-\u003e_Myptr() + " ], [ 5928, "u8", "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\xlocale" ], [ 6056, "wide", "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\xlocale" ], [ 6152, "wide", "invalid iterator range" ], [ 6232, "u8", "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\xiosbase" ], [ 6368, "wide", "std::ctype\u003cwchar_t\u003e::_Do_widen_s" ], [ 6536, "wide", "std::ctype\u003cwchar_t\u003e::_Do_narrow_s" ], [ 6604, "u8", "locale0.cpp" ], [ 6636, "u8", "string too long" ], [ 6676, "u8", "invalid string position" ], [ 6712, "u8", "xmutex.cpp" ], [ 6724, "wide", "xmbtowc.c" ], [ 6888, "u8", "xmbtowc.c" ], [ 6904, "u8", "_tolower.c" ], [ 6916, "wide", "sizeInBytes \u003e= count" ], [ 6960, "wide", "src != NULL" ], [ 6984, "wide", "memmove_s" ], [ 7004, "wide", "memmove_s.c" ], [ 7028, "wide", "dst != NULL" ], [ 7064, "u8", "Unknown exception" ], [ 7096, "wide", "(format != NULL)" ], [ 7132, "u8", "Client" ], [ 7140, "u8", "Ignore" ], [ 7152, "u8", "Normal" ], [ 7160, "u8", "Free" ], [ 7168, "u8", "Error: memory allocation: bad memory block type." ], [ 7220, "u8", "Invalid allocation size: %Iu bytes." ], [ 7264, "u8", "Client hook allocation failure." ], [ 7300, "u8", "Client hook allocation failure at file %hs line %d." ], [ 7356, "wide", "dbgheap.c" ], [ 7376, "wide", "_CrtCheckMemory()" ], [ 7412, "wide", "_calloc_dbg" ], [ 7608, "wide", "fRealloc || (!fRealloc \u0026\u0026 pNewBlock == pOldBlock)" ], [ 7712, "wide", "pOldBlock-\u003enLine == IGNORE_LINE \u0026\u0026 pOldBlock-\u003elRequest == IGNORE_REQ" ], [ 7928, "u8", "The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()" ], [ 8004, "u8", "Client hook re-allocation failure." ], [ 8040, "u8", "Client hook re-allocation failure at file %hs line %d." ], [ 8094, "wide", "pUserData != NULL" ], [ 8220, "wide", "pHead-\u003enBlockUse == nBlockUse" ], [ 8280, "wide", "pHead-\u003enLine == IGNORE_LINE \u0026\u0026 pHead-\u003elRequest == IGNORE_REQ" ], [ 8408, "u8", "HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.\nCRT detected that the application wrote to memory after end of heap buf" ], [ 8465, "u8", "CRT detected that the application wrote to memory after end of heap buffer." ], [ 8544, "u8", "HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.\nCRT detected that the application wrote to memory before start of heap" ], [ 8602, "u8", "CRT detected that the application wrote to memory before start of heap buffer." ], [ 8688, "wide", "_BLOCK_TYPE_IS_VALID(pHead-\u003enBlockUse)" ], [ 8768, "u8", "Client hook free failure." ], [ 8800, "u8", "The Block at 0x%p was allocated by aligned routines, use _aligned_free()" ], [ 8876, "wide", "_msize_dbg" ], [ 8900, "u8", "%hs located at 0x%p is %Iu bytes long." ], [ 8940, "u8", "%hs allocated at file %hs(%d)." ], [ 8976, "u8", "HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.\nCRT detected that the application wrote to a heap buffer that was freed." ], [ 9032, "u8", "CRT detected that the application wrote to a heap buffer that was freed." ], [ 9108, "u8", "DAMAGED" ], [ 9116, "u8", "_heapchk fails with unknown return value!" ], [ 9160, "u8", "_heapchk fails with _HEAPBADPTR." ], [ 9196, "u8", "_heapchk fails with _HEAPBADEND." ], [ 9232, "u8", "_heapchk fails with _HEAPBADNODE." ], [ 9268, "u8", "_heapchk fails with _HEAPBADBEGIN." ], [ 9302, "wide", "_CrtSetDbgFlag" ], [ 9336, "wide", "(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits \u0026 0x0ffff \u0026 ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALW" ], [ 9720, "wide", "_get_osver(\u0026osver)" ], [ 9760, "wide", "_CrtIsValidHeapPointer" ], [ 9808, "u8", "Bad memory block found at 0x%p." ], [ 9844, "wide", "_CrtMemCheckpoint" ], [ 9880, "wide", "state != NULL" ], [ 9908, "u8", "Object dump complete." ], [ 9932, "u8", "crt block at 0x%p, subtype %x, %Iu bytes long." ], [ 9980, "u8", "normal block at 0x%p, %Iu bytes long." ], [ 10020, "u8", "client block at 0x%p, subtype %x, %Iu bytes long." ], [ 10080, "u8", "%hs(%d) :" ], [ 10092, "u8", "#File Error#(%d) :" ], [ 10112, "u8", "Dumping objects -\u003e" ], [ 10132, "u8", "Data: \u003c%s\u003e %s" ], [ 10146, "wide", "(*_errno())" ], [ 10172, "wide", "_printMemBlockData" ], [ 10220, "u8", "Detected memory leaks!" ], [ 10244, "u8", "onexit.c" ], [ 10256, "wide", "dbgdel.cpp" ], [ 10280, "wide", "memcpy_s" ], [ 10300, "wide", "memcpy_s.c" ], [ 10332, "wide", "Assertion Failed" ], [ 10368, "wide", "Error" ], [ 10380, "wide", "Warning" ], [ 10400, "wide", "f:\\rtm\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c" ], [ 10500, "u8", "_CrtDbgReport: String too long or Invalid characters in String" ], [ 10568, "wide", "strcpy_s(szaFormat, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")" ], [ 10752, "wide", "wcstombs_s(0, szaFormat, 4096, szFormat, ((size_t)-1))" ], [ 10864, "wide", "strcpy_s(szaModule, 4096, \"Expression cannot be displayed on Win9x\")" ], [ 11008, "wide", "wcstombs_s(0, szaModule, 4096, szModule, ((size_t)-1))" ], [ 11120, "u8", "Expression cannot be displayed on Win9x" ], [ 11158, "wide", "xstrcpy_s(szaFile, 4096, \"Expression cannot be displayed on Win9x\")" ], [ 11298, "wide", ".strcat_s(szaFile, 4096, \"...\")" ], [ 11368, "wide", "wcstombs_s(0, szaFile, 4096, szFile, ((size_t)-1))" ], [ 11472, "wide", "_get_osplatform(\u0026osplatform)" ], [ 11532, "wide", "_CrtDbgReportWV" ], [ 11568, "wide", "Microsoft Visual C++ Debug Library" ], [ 11640, "wide", "_CrtDbgReport: String too long or IO Error" ], [ 11728, "wide", "wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")" ], [ 12112, "wide", "Expression:" ], [ 12144, "wide", "For information on how your program can cause an assertion\nfailure, see the Visual C++ documentation on asserts." ], [ 12376, "wide", "wcsncpy_s(szShortProgName, 260 - (szShortProgName - szExeName), dotdotdot, 3)" ], [ 12532, "wide", "\u003cprogram name unknown\u003e" ], [ 12584, "wide", "wcscpy_s(szExeName, 260, L\"\u003cprogram name unknown\u003e\")" ], [ 12688, "wide", "__crtMessageWindowW" ], [ 12752, "wide", "ploci-\u003ectype1_refcount \u003e 0" ], [ 12808, "wide", "initctyp.c" ], [ 12832, "u8", "initctyp.c" ], [ 12844, "wide", "pValue != NULL" ], [ 12880, "wide", "( (_Stream-\u003e_flag \u0026 _IOSTRG) || ( (_textmode_safe(_fileno(_Stream)) == __IOINFO_TM_ANSI) \u0026\u0026 !_tm_unicode_safe(_fileno(_Stream)))" ], [ 13140, "wide", "(stream != NULL)" ], [ 13176, "u8", "_file.c" ], [ 13216, "wide", "(buffer != NULL)" ], [ 13252, "wide", "fwrite" ], [ 13268, "wide", "fwrite.c" ], [ 13288, "wide", "(\"Inconsistent Stream Count. Flush between consecutive read and write\", stream-\u003e_cnt \u003e= 0)" ], [ 13472, "wide", "fputwc" ], [ 13488, "wide", "fputwc.c" ], [ 13536, "wide", "ungetwc" ], [ 13552, "wide", "ungetwc.c" ], [ 13572, "wide", "ungetc" ], [ 13588, "wide", "ungetc.c" ], [ 13608, "wide", "_ungetc_nolock" ], [ 13640, "wide", "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\ungetc_nolock.inl" ], [ 13768, "wide", "fgetc.c" ], [ 13784, "wide", "fgetwc" ], [ 13800, "wide", "fgetwc.c" ], [ 13848, "wide", "fgetpos" ], [ 13864, "wide", "fgetpos.c" ], [ 13888, "wide", "((whence == SEEK_SET) || (whence == SEEK_CUR) || (whence == SEEK_END))" ], [ 14032, "wide", "fseek" ], [ 14044, "wide", "fseek.c" ], [ 14060, "wide", "fsetpos" ], [ 14076, "wide", "fsetpos.c" ], [ 14096, "u8", "setvbuf.c" ], [ 14300, "wide", "setvbuf" ], [ 14316, "wide", "setvbuf.c" ], [ 14336, "wide", "fclose" ], [ 14352, "wide", "fclose.c" ], [ 14372, "wide", "_fclose_nolock" ], [ 14404, "u8", "LC_TIME" ], [ 14412, "u8", "LC_NUMERIC" ], [ 14424, "u8", "LC_MONETARY" ], [ 14436, "u8", "LC_CTYPE" ], [ 14448, "u8", "LC_COLLATE" ], [ 14460, "u8", "LC_ALL" ], [ 14575, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 14672, "wide", "setlocal.c" ], [ 14696, "wide", "((ptloci-\u003elc_category[category].wlocale != NULL) \u0026\u0026 (ptloci-\u003elc_category[category].wrefcount != NULL)) || ((ptloci-\u003elc_category[" ], [ 15116, "u8", "setlocal.c" ], [ 15128, "wide", "setlocale" ], [ 15152, "wide", "LC_MIN \u003c= _category \u0026\u0026 _category \u003c= LC_MAX" ], [ 15240, "wide", "strncpy_s(lctemp, (sizeof(lctemp) / sizeof(lctemp[0])), s, len)" ], [ 15368, "wide", "_setlocale_nolock" ], [ 15416, "wide", "strcpy_s(pch + sizeof(int), cch - sizeof(int), lctemp)" ], [ 15528, "wide", "_setlocale_set_cat" ], [ 15568, "wide", "strcat_s(pch, cch, \";\")" ], [ 15616, "wide", "_setlocale_get_all" ], [ 15664, "wide", "strcpy_s(output, sizeInChars, cacheout)" ], [ 15744, "wide", "strncpy_s(cachein, cacheinSize, source, charactersInSource + 1)" ], [ 15872, "wide", "strcpy_s(output, sizeInChars, \"C\")" ], [ 15944, "wide", "_expandlocale" ], [ 16340, "wide", "_strcats" ], [ 16360, "wide", "strncpy_s(names-\u003eszCodePage, (sizeof(names-\u003eszCodePage) / sizeof(names-\u003eszCodePage[0])), locale, len)" ], [ 16568, "wide", "strncpy_s(names-\u003eszCountry, (sizeof(names-\u003eszCountry) / sizeof(names-\u003eszCountry[0])), locale, len)" ], [ 16768, "wide", "strncpy_s(names-\u003eszLanguage, (sizeof(names-\u003eszLanguage) / sizeof(names-\u003eszLanguage[0])), locale, len)" ], [ 16974, "wide", ",strncpy_s(names-\u003eszCodePage, (sizeof(names-\u003eszCodePage) / sizeof(names-\u003eszCodePage[0])), \u0026locale[1], 16-1)" ], [ 17192, "wide", "__lc_strtolc" ], [ 17232, "wide", "strcpy_s(locale, sizeInBytes, (char *)names-\u003eszLanguage)" ], [ 17348, "wide", "__lc_lctostr" ], [ 17380, "u8", "bad exception" ], [ 18178, "wide", "h(((( H" ], [ 18856, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 19240, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 19464, "wide", "length \u003c sizeInTChars" ], [ 19560, "wide", "sizeInTChars \u003e (size_t)(is_neg ? 2 : 1)" ], [ 19640, "wide", "sizeInTChars \u003e 0" ], [ 19676, "wide", "xtoa_s" ], [ 19696, "wide", "f:\\rtm\\vctools\\crt_bld\\self_x86\\crt\\src\\xtoa.c" ], [ 19792, "wide", "buf != NULL" ], [ 19840, "wide", "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\malloc.h" ], [ 19944, "wide", "(\"Corrupted pointer passed to _freea\", 0)" ], [ 20032, "wide", "strncpy_s( (char *)lpDestStr, cchDest, (char *)outbuffer, cchDest \u003c= outbuff_size ? cchDest - 1 : outbuff_size )" ], [ 20260, "wide", "__crtLCMapStringW_stat" ], [ 20308, "wide", "w_map.c" ], [ 20392, "wide", "Buffer is too small" ], [ 20432, "wide", "(((_Src))) != NULL" ], [ 20472, "wide", "strcpy_s" ], [ 20496, "wide", "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\tcscpy_s.inl" ], [ 20608, "wide", "((_Dst)) != NULL \u0026\u0026 ((_SizeInBytes)) \u003e 0" ], [ 20696, "wide", "(\"inconsistent IOB fields\", stream-\u003e_ptr - stream-\u003e_base \u003e= 0)" ], [ 20824, "wide", "_flsbuf.c" ], [ 20844, "wide", "str != NULL" ], [ 20868, "wide", "(null)" ], [ 20884, "u8", "(null)" ], [ 20937, "u8", "700WP" ], [ 20953, "u8", "`h````" ], [ 20992, "wide", "(\"'n' format specifier disabled\", 0)" ], [ 21172, "wide", "_vsnprintf_helper" ], [ 21208, "wide", "f:\\rtm\\vctools\\crt_bld\\self_x86\\crt\\src\\vsprintf.c" ], [ 21312, "wide", "(\"Buffer too small\", 0)" ], [ 21360, "wide", "string != NULL \u0026\u0026 sizeInBytes \u003e 0" ], [ 21428, "wide", "_vsprintf_s_l" ], [ 21456, "wide", "format != NULL" ], [ 21488, "wide", "_vsnprintf_s_l" ], [ 21520, "u8", "EncodePointer" ], [ 21536, "u8", "KERNEL32.DLL" ], [ 21552, "u8", "DecodePointer" ], [ 21568, "u8", "tidtable.c" ], [ 21580, "u8", "FlsFree" ], [ 21588, "u8", "FlsSetValue" ], [ 21600, "u8", "FlsGetValue" ], [ 21612, "u8", "FlsAlloc" ], [ 21624, "u8", "mlock.c" ], [ 21632, "u8", "Assertion Failed" ], [ 21652, "u8", "Error" ], [ 21660, "u8", "Warning" ], [ 21666, "wide", "gdbgrpt.c" ], [ 21688, "u8", "Microsoft Visual C++ Debug Library" ], [ 21724, "u8", "_CrtDbgReport: String too long or IO Error" ], [ 21768, "wide", "strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")" ], [ 21920, "u8", "Debug %s!" ], [ 21931, "u8", "Program: %s%s%s%s%s%s%s%s%s%s%s%s" ], [ 21966, "u8", "(Press Retry to debug the application)" ], [ 22040, "u8", "Expression:" ], [ 22056, "u8", "For information on how your program can cause an assertion\nfailure, see the Visual C++ documentation on asserts." ], [ 22058, "u8", "For information on how your program can cause an assertion" ], [ 22117, "u8", "failure, see the Visual C++ documentation on asserts." ], [ 22336, "u8", "\u003cprogram name unknown\u003e" ], [ 22360, "wide", "strcpy_s(szExeName, 260, \"\u003cprogram name unknown\u003e\")" ], [ 22464, "wide", "__crtMessageWindowA" ], [ 22504, "wide", "_expand_base" ], [ 22532, "wide", "expand.c" ], [ 22552, "wide", "pBlock != NULL" ], [ 22584, "wide", "_get_winmajor(\u0026winmajor)" ], [ 22636, "wide", "__heap_select" ], [ 22664, "wide", "heapinit.c" ], [ 22688, "u8", "CorExitProcess" ], [ 22704, "u8", "mscoree.dll" ], [ 22714, "wide", "l_osplatform!=0" ], [ 22748, "wide", "_get_osplatform" ], [ 22780, "wide", "crt0dat.c" ], [ 22800, "wide", "_get_osver" ], [ 22824, "wide", "_get_winmajor" ], [ 22852, "u8", "mbctype.c" ], [ 22864, "wide", "isctype.c" ], [ 22936, "wide", "dbgrptt.c" ] ], "v": { "file.stem": "839aee5f9b2423c3be1f78f949ae3cfcee9094434297a35ff0318791ef87bf3e", "pe.imphash": "07743d971ebca1a810df41e8aa986ec2", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1189026578, "file.basename": "839aee5f9b2423c3be1f78f949ae3cfcee9094434297a35ff0318791ef87bf3e.dll", "pe.image_base": 268435456, "pe.image_size": 708608, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 130256, "pe.headers_size": 4096, "pe.version.type": "dll", "pe.debug.pdb.age": 1, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.debug.pdb.guid": "0c16ca8f-a9a3-49c4-9019-d352987ce9c9", "pe.debug.pdb.path": "e:\\28\\35\\What\\Cross\\53\\4\\7\\Experiment\\44\\truck\\vary\\77\\Consonant\\Blue\\Left.pdb", "pe.debug.pdb.stem": "Left", "pe.file_alignment": 4096, "pe.image_hash.sha1": "1ef2bf97597e793e4938248c09d921f968e5ee77", "pe.version.company": "Greatdifficult", "pe.load_config.size": 72, "pe.image_hash.sha256": "c8ca33713ff872142216a3e7a39778e5ef86e2ba646c900cf602907aa0ebdf57", "pe.image_hash.sha384": "a18f553f4a4e89aba6dc8a7bd0fc5a8e992c211202058a39b9d68fa12ca010935a276ccb1347069dc8d5974a4f7fc34a", "pe.image_hash.sha512": "a23a57a6aa4fa5892997bb906d08b6259cae98c871a79c632076c8401ad12b7592ada97be451d15d6814b43a7b013a8755e74c3f526dab2bc2d0f64801cee71c", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "Seasonconsonant © 2017", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.debug.pdb.basename": "Left.pdb", "pe.characteristics_raw": 8450, "pe.debug.pdb.timestamp": 1189026578, "pe.version.description": "Seasonconsonant", "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 8, "pe.version.file_version": "4.5.5.938", "pe.version.product_name": "Left.dll", "pe.debug.entries[0].type": "codeview", "pe.version.internal_name": "Soldier Particular", "pe.data_directories[0].rva": 294548, "pe.data_directories[1].rva": 684032, "pe.data_directories[2].rva": 688128, "pe.data_directories[3].rva": 4720, "pe.data_directories[4].rva": 57752, "pe.data_directories[5].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "4.5.5.938", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 60, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 768, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 11880, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "load_config", "pe.data_directories[4].size": 64, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 488, "pe.debug.entries[0].type_id": 2, "pe.coff.dos_header_pe_pointer": 128, "pe.debug.entries[0].size_bytes": 103, "pe.load_config.security_cookie": 268736348, "pe.base_relocations.block_count": 65, "pe.base_relocations.entry_count": 5645, "pe.load_config.se_handler_count": 63, "pe.load_config.se_handler_table": 268495312, "pe.base_relocations.padding_count": 35, "pe.debug.entries[0].timestamp_unix": 1189026578 }, "id": "pe", "sc": [ [ ".text", 4096, 294912, 6.34, "r-x" ], [ ".data", 299008, 12288, 3.7, "rw-" ], [ ".rsrc", 311296, 4096, 0.81, "r--" ], [ ".reloc", 315392, 20480, 4.78, "r--" ] ] }, "id": 0, "sz": 335872, "ts": [ { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Seasonconsonant © 2017" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "4.5.5.938" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.34)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 120.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 120.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "48", "42", "49" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x35f91", "0x2996c", "0x171e1" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x4c256" ] }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2, "el": [ "0x118c", "0x1188", "0x1184" ] }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtectEx" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1, "el": [ "0x1084" ] }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "e:\\28\\35\\What\\Cross\\53\\4\\7\\Experiment\\44\\truck\\vary\\77\\Consonant\\Blue\\Left.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "0x10b4" ] }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2, "el": [ "0x11a0" ] }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2, "el": [ "0x1110" ] }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 120.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Seasonconsonant" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2, "el": [ "0x1108" ] }, { "c": 0.8999999761581421, "d": "Create semaphore object", "e": [ "CreateSemaphoreW" ], "i": "micro-behaviors/process/sync/semaphore::create-semaphore", "l": 2, "m": "C0042", "el": [ "0x1080" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x191cf" ] }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "imports.count = 120.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2, "el": [ "0x112c" ] }, { "d": "PDB path on non-standard drive letter", "e": [ "e:\\28\\35\\What\\Cross\\53\\4\\7\\Experiment\\44\\truck\\vary\\77\\Consonant\\Blue\\Left.pdb" ], "i": "metadata/binary/debug::pdb-nonstandard-drive", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2, "el": [ "0x1134", "0x10d8" ] }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2, "el": [ "0x10c4" ] }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0x00010000" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1, "el": [ "0xdb20" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "_heapchk fails with unknown return value!", "pValue != NULL", "FlsSetValue", "(\"Invalid input value\", 0)", "TlsSetValue", "TlsGetValue", "FlsGetValue", "The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with on" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x239c", "0x322c", "0x5454", "0xde40", "0x486f2", "0x486d8", "0x5460", "0x96f8" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "4.5.5.938" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2, "el": [ "0x10c8" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x4c1ba" ] }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2297.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "839aee5f9b2423c3be1f78f949ae3cfcee9094434297a35ff0318791ef87bf3e.dll" ], "i": "objectives/evasion/masquerade/dll/name::dll-basename", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2, "el": [ "0x1194" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2, "el": [ "0x1128" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x10e4" ] }, { "a": "T1005", "d": "fseek API string", "e": [ "fseek" ], "i": "micro-behaviors/fs/file/binary::fseek-text", "l": 2, "el": [ "0x36d0" ] }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "0x485bc" ] }, { "a": "T1027", "c": 0.4000000059604645, "d": "RC4 S-box initialization pattern (64-byte sequential table)", "e": [ "00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A" ], "i": "objectives/anti-static/obfuscation/encoding/stream::rc4-sbox-init", "l": 1, "m": "C0027.001", "el": [ "0x4988" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x1160" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2, "el": [ "0x1124" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0x1174", "0x11c8" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Left.dll" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2, "el": [ "0x489da", "0x4896a" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "49", "42", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014", "el": [ "0x171e1", "0x2996c", "0x35f91" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 120.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2, "el": [ "0x116c" ] }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2, "el": [ "0x480ba" ] }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2, "el": [ "0x1198" ] }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2, "el": [ "0x1134", "0x10d8" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x49260" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x10f0" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x58b0" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x486b2" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 120.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "F:\\RTM\\vctools\\crt_bld\\SELF_X86\\crt\\src\\xstring", "_CrtDbgReport: String too long or Invalid characters in String", "(\"_Pstring == NULL || _Ptr != NULL \u0026\u0026 ((_Mystring *)_Pstring)-\u003e_Myptr() \u003c= _Ptr \u0026\u0026 _Ptr \u003c= (((_Mystring *)_Pstring)-\u003e_Myptr() + ", "invalid string position", "std::_String_const_iterator\u003cchar,struct std::char_traits\u003cchar\u003e,class std::allocator\u003cchar\u003e \u003e::operator *", "std::_String_const_iterator\u003cchar,struct std::char_traits\u003cchar\u003e,class std::allocator\u003cchar\u003e \u003e::_String_const_iterator", "_CrtDbgReport: String too long or IO Error", "string iterator not dereferencable", "string too long", "__crtLCMapStringW_stat", "string != NULL \u0026\u0026 sizeInBytes \u003e 0", "wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", "strcpy_s(szaFormat, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", "strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x1468", "0x2904", "0x15d8", "0x1a14", "0x1350", "0x14f0", "0x2d78", "0x1420", "0x19ec", "0x4f24", "0x5370", "0x2dd0", "0x2948", "0x5508" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x10e0" ] }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2, "el": [ "0x11d4" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "0x111c" ] }, { "d": "password keyword", "e": [ "SetClusterServiceAccountPassword" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1, "el": [ "0x48154" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x6d98" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x1118" ] }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2, "el": [ "0x1144" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "839aee5f9b2423c3be1f78f949ae3cfcee9094434297a35ff0318791ef87bf3e.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "0x10ac" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2297.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 120.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.34" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 120.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x4c0fe" ] }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-user-default-lcid", "l": 2, "el": [ "0x11c4" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2, "el": [ "0x48606" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x11e0" ] }, { "c": 0.44999998807907104, "d": "PDB in numbered directory (build artifacts)", "e": [ "e:\\28\\35\\What\\Cross\\53\\4\\7\\Experiment\\44\\truck\\vary\\77\\Consonant\\Blue\\Left.pdb" ], "i": "metadata/binary/debug::pdb-numbered-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2, "el": [ "0x11d8" ] }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringA", "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001", "el": [ "0x487d6", "0x4880a" ] }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "0x1138" ] }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Extended memory protection modification", "e": [ "VirtualProtectEx" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect-ex", "l": 2, "el": [ "0x1084" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x58b0" ] }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "0x10b8" ] }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2, "el": [ "0x11a8" ] }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2, "el": [ "0x4899e" ] }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2, "el": [ "0x1168" ] }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info-import", "l": 2, "el": [ "0x11cc" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x4895c" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "0x10b0" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2297.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 12288)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1, "el": [ "0x49a8" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x4c066" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VC\\include\\xstring", "C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VC\\includeÞbug", "C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VC\\include\\xlocnum", "C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VC\\include\\xutility", "Microsoft Visual C++ Runtime Library, Error R6035 - A module in this application is initializing the module's global security co", "C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VC\\include\\xlocale", "Microsoft Visual C++ Debug Library", "Microsoft Visual C++ Runtime Library" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0xd908", "0xd8c0", "0xda40", "0x9a60", "0x6a60", "0x9b40", "0x2d30", "0x7208" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "4.5.5.938" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x10ec" ] }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "0x10c0" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2, "el": [ "0x1120" ] }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2, "el": [ "0x1188" ] }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x1104" ] }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2, "el": [ "0x11dc" ] }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2, "el": [ "0x4872a" ] }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadReadPtr anti-debug style probe", "e": [ "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-read-ptr", "l": 1, "m": "B0001", "el": [ "0x10d4" ] }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2, "el": [ "0x1088" ] }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2, "el": [ "0x58a0" ] }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "Left.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024", "el": [ "0xe1f8" ] }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2, "el": [ "0x10dc" ] }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2, "el": [ "0x11ac" ] }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2, "el": [ "0x117c" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2, "el": [ "0x1148" ] }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2, "el": [ "0x119c" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0x108c" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x4c13e" ] }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2, "el": [ "0x114c" ] }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "_woutput_s_l", "strcpy_s(output, sizeInChars, cacheout)", "_output_s_l", "strcpy_s(output, sizeInChars, \"C\")", "f:\\rtm\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1, "el": [ "0x9974", "0x3d30", "0x88dc", "0x3e00", "0x87b4" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 2297.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "VirtualProtectEx/NtProtectVirtualMemory symbol", "e": [ "VirtualProtectEx" ], "i": "objectives/evasion/fileless/memory::protect-memory-sym", "l": 1, "el": [ "0x1084" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2, "el": [ "0x115c" ] }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2, "el": [ "0x118c" ] }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2, "el": [ "0x11d0" ] }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2, "el": [ "0x10f8" ] }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 120.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2, "el": [ "0x10fc" ] }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "strcpy_s(output, sizeInChars, cacheout)", "strncpy_s(cachein, cacheinSize, source, charactersInSource + 1)" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "0x3d30", "0x3d80" ] }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x48a2e" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x4400" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2297.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "c": 0.8500000238418579, "d": "PDB path nests two numeric directories", "e": [ "e:\\28\\35\\What\\Cross\\53\\4\\7\\Experiment\\44\\truck\\vary\\77\\Consonant\\Blue\\Left.pdb" ], "i": "metadata/binary/debug::pdb-multi-numeric-path", "l": 3, "el": [ "value:pe.debug.pdb.path" ] }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "04 11 00 10" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1, "el": [ "0x26f57" ] }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x1114" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1, "el": [ "0x48778" ] }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033", "el": [ "0x10bc" ] }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2, "el": [ "0x1140" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetUserObjectInformationW", "GetSystemDirectoryW", "CloseClusterNetInterface", "InitializeCriticalSectionAndSpinCount", "GetCurrentDirectoryW", "SetClusterServiceAccountPassword", "AddClusterResourceNode", "CreateClusterResourceType", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetUserObjectInformationA", "AddClusterResourceDependency", "GetClusterFromNetwork", "GetProcessWindowStation", "GetClusterFromGroup", "SunMonTueWedThuFriSat", "GetClusterFromNetInterface" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x67bc", "0x480ba", "0x48228", "0x88f4", "0x480d8", "0x48154", "0x48126", "0x481c6", "0x9464", "0x8980", "0x48178", "0x481f8", "0x67a4", "0x48198", "0x944c", "0x4825a" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x891c" ] }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001", "el": [ "0x48588" ] }, { "a": "T1036.005", "c": 0.8500000238418579, "d": "PE stem disagrees with embedded PDB stem", "e": [ "file.stem != pe.debug.pdb.stem (\"839aee5f9b2423c3be1f78f949ae3cfcee9094434297a35ff0318791ef87bf3e\" != \"left\")" ], "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "l": 3, "el": [ "value:file.stem" ] }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales callback API", "e": [ "EnumSystemLocalesA" ], "i": "objectives/evasion/process/injection/callback::enum-locale-callback", "l": 1, "m": "E1106", "el": [ "0x11c0" ] }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "std::_String_const_iterator\u003cchar,struct std::char_traits\u003cchar\u003e,class std::allocator\u003cchar\u003e \u003e::operato...", "\u003cfile unknown\u003e", "strcpy_s(progname, progname_size, \"\u003cprogram name unknown\u003e\")", "\u003cprogram name unknown\u003e", "wcscpy_s(szExeName, 260, L\"\u003cprogram name unknown\u003e\")", "strcpy_s(szExeName, 260, \"\u003cprogram name unknown\u003e\")", "std::_String_const_iterator\u003cchar,struct std::char_traits\u003cchar\u003e,class std::allocator\u003cchar\u003e \u003e::_String..." ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1, "el": [ "0x1350", "0x6408", "0x73d0", "0x30f4", "0x3128", "0x5758", "0x14f0" ] }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1, "el": [ "0x10bc" ] }, { "c": 0.949999988079071, "d": "links clusapi (ChangeClusterResourceGroup, CloseClusterGroup, EvictClusterNodeEx, SetClusterNetworkPriorityOrder, DeleteClusterGroup, ... +26 more)", "e": [ "clusapi" ], "i": "metadata/dylib::clusapi", "l": 2, "el": [ "31 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (CreateSemaphoreW, VirtualProtectEx, GetCurrentDirectoryW, Sleep, GetSystemDirectoryW, ... +84 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "89 symbols" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetLocaleInfoW", "GetLocaleInfoA", "GetUserDefaultLCID", "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::locale-environment-fingerprint", "l": 2, "el": [ "0x489da", "0x4896a", "0x11c4", "0x4899e" ] }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2, "el": [ "0x1188", "0x118c" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x1114", "0x1118" ] }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "Seasonconsonant © 2017", "Left.dll", "imports.count = 120.00", "Seasonconsonant" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2, "el": [ "value:pe.version.copyright", "value:pe.version.product_name", "", "value:pe.version.description" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "4.5.5.938" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "4.5.5.938" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "ReadFile", "fseek" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 1, "el": [ "0x11dc", "0x36d0" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "FreeEnvironmentStringsW", "GetLocaleInfoA", "EnumSystemLocalesA", "GetEnvironmentStringsW", "GetLocaleInfoW", "GetUserDefaultLCID" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082", "el": [ "0x1188", "0x4896a", "0x4899e", "0x118c", "0x489da", "0x11c4" ] }, { "a": "T1622", "c": 0.8999999761581421, "d": "SEH with bad pointer debug probes", "e": [ "SetUnhandledExceptionFilter", "OutputDebugStringA", "IsBadReadPtr", "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::seh-pointer-probe-anti-debug", "l": 2, "m": "B0001", "el": [ "0x10c8", "0x487d6", "0x10d4", "0x4880a" ] }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2, "el": [ "0x10c8", "0x10c4" ] }, { "a": "T1497", "c": 0.8500000238418579, "d": "Adaptive behavior based on environment", "e": [ "GetEnvironmentStrings", "SetUnhandledExceptionFilter", "imports.count = 120.00", "IsDebuggerPresent", "GetEnvironmentStringsW", "e:\\28\\35\\What\\Cross\\53\\4\\7\\Experiment\\44\\truck\\vary\\77\\Consonant\\Blue\\Left.pdb", "IsBadReadPtr", "FreeEnvironmentStringsW", "IsDebuggerPresent", "OutputDebugStringW", "OutputDebugStringA", "Sleep" ], "i": "objectives/anti-analysis/environment-detect/runtime::environment-adaptive-behavior", "l": 2, "m": "B0001", "el": [ "0x1184", "0x10c8", "", "0x48588", "0x118c", "value:pe.debug.pdb.path", "0x10d4", "0x1188", "0x10cc", "0x4880a", "0x487d6", "0x108c" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetSystemTimeAsFileTime", "GetLocaleInfoW", "GetLocaleInfoA", "GetEnvironmentStringsW", "GetUserDefaultLCID", "GetCommandLineA", "EnumSystemLocalesA", "FreeEnvironmentStringsW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082", "el": [ "0x119c", "0x489da", "0x4896a", "0x118c", "0x11c4", "0x10e0", "0x4899e", "0x1188" ] } ], "sha": "839aee5f9b2423c3be1f78f949ae3cfcee9094434297a35ff0318791ef87bf3e", "path": "839aee5f9b2423c3be1f78f949ae3cfcee9094434297a35ff0318791ef87bf3e.dll", "type": "pe" } ], "tv": "176d6" } }