{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.5646388, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T11:29:30Z" }, "path": "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe", "raw": { "v": "5", "fs": [ { "f": "Md(Bi₃)", "x": 4, "ff": { "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 2232828.0, "bss_like_section_count": 0.0, "section_overflow_count": 3.0, "misaligned_section_count": 0.0 }, "file": { "size": 2214475.0, "entropy": 7.97, "size_bytes": 2214475.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.97, "string_count": 42531.0, "entropy_variance": 14.13, "avg_string_length": 4.94, "max_string_length": 352.0, "code_to_data_ratio": 1.0, "string_length_stddev": 3.56, "largest_section_ratio": 2.14, "sentence_string_count": 3.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "sections": { "count": 3.0, "code_size": 4729856.0, "entropy_max": 7.97, "entropy_mean": 2.66, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 2536, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 2693, "u8", "PADPADP" ], [ 2748, "wide", "oldplayer" ], [ 2802, "wide", "sÉeso'm5x0osqesogm5x0osñe" ], [ 2928, "wide", "x0os" ], [ 2978, "wide", "suesobo5x" ], [ 3038, "wide", "x0osqusogm5" ], [ 3082, "wide", "x0osq" ], [ 3094, "wide", "Hãgm5x0osqesogm" ], [ 3130, "wide", "osqesogm5" ], [ 3154, "wide", "sqesogm5x0osq" ], [ 3242, "wide", "sqesogmu" ], [ 3303, "u8", "aDao" ], [ 3322, "wide", "x0osqe3" ], [ 3394, "wide", "Wsqesogm5x0ï" ], [ 3442, "wide", "Iesogm58" ], [ 3482, "wide", "Wsqesog-" ], [ 3504, "wide", "osaesV" ], [ 3620, "wide", "esogm5x0osqesogm5x0osqesogm5x0osqesogm5x0osqesogm5x0osqesogm5x0osqesogm5x0osqesogm5x0osqesogm5x0" ], [ 4012, "u8", "rtHf" ], [ 4165, "u8", "DW 9" ], [ 6170, "u8", "qHTEsH" ], [ 7663, "u8", "TWH9" ], [ 7740, "u8", "/1oH" ], [ 7887, "u8", "LAH2" ], [ 11600, "u8", "/NrH" ], [ 12888, "u8", "/1nf" ], [ 13744, "u8", "ofhohKY8x" ], [ 15466, "u8", "tAaf" ], [ 15899, "u8", "8ofh" ], [ 18772, "u8", "8V H" ], [ 19081, "u8", "DW89" ], [ 19235, "u8", "TWX9" ], [ 19704, "u8", "S O ZlCdYtmH" ], [ 19744, "u8", "D8eEB" ], [ 20029, "u8", "Hyfjb" ], [ 21892, "u8", "780A" ], [ 21914, "u8", "680H" ], [ 22560, "u8", "at8vl" ], [ 24532, "u8", "/VcH" ], [ 24818, "u8", "I80H" ], [ 24902, "u8", "TMouq" ], [ 24980, "u8", "rHmHJ" ], [ 25059, "u8", "t5HSBSHr" ], [ 25308, "u8", "48qET" ], [ 25380, "u8", "JM5I" ], [ 25556, "u8", "KM5H" ], [ 25719, "u8", "t6ISKSLr" ], [ 26020, "u8", "8V4H" ], [ 26468, "u8", "S80E" ], [ 26792, "u8", "bGG85H" ], [ 28128, "u8", "pSK8o" ], [ 29685, "u8", "LWH8" ], [ 29716, "u8", ":A1A8AaW.Sx" ], [ 32135, "u8", "Dnck" ], [ 34181, "u8", "LKxcA" ], [ 35108, "u8", "jIp85M" ], [ 37846, "u8", "FLWH" ], [ 38087, "u8", "DK87" ], [ 38617, "u8", "DWTJCq" ], [ 39211, "u8", "DW85" ], [ 41282, "u8", "ZTAX" ], [ 41855, "u8", "DA03" ], [ 43258, "u8", "jUB8q" ], [ 44346, "u8", "JMJ8mH" ], [ 44590, "u8", "Z A85" ], [ 46029, "u8", "9ouy" ], [ 46038, "u8", "OAotnH" ], [ 46186, "u8", "veW8eH" ], [ 48260, "wide", "sogm5x0osqesogm5x0osqesogm5x0osqesogm5x0osqesogm?x0osqesogm5x0os" ], [ 48550, "wide", "gm5x0osqesogm5x" ], [ 48660, "u8", "/KPK" ], [ 49418, "wide", "osqesogm5x0os" ], [ 49746, "wide", "³osqesogm" ], [ 57652, "wide", "esogm5x0csqe{ogm5x0osqesggm5p0osqesogm5x.osqgsogm5x0osqe{ogm=x0osqesogm5Z0ospesogm5x0osqmsoge5x0osqesogm-x0oqqesogm5x0osyesoom5x" ], [ 58182, "wide", "sogo5x0osqesogm=x0o{qesogm5x0osŃesoem5x0osqesoge5x0gsqesogm5x0ooqesmgm5x0osqesoom5x8osqesogm5x0Usqeqogm5x0osqesggm5p0osqesogm5x" ], [ 58438, "wide", "osqgsogm5x0osqe{ogm=x0osqesogm5d0ossesogm5x0osqmsoge5x0osqesogmLJx0oqqesogm5x0osyesoom5x0osqesogq5x0msqesogm5x0o{qesggm5x0osqeso" ], [ 59142, "wide", "osqgsogm5x0osqe{ogm=x0osqesogm5r0osyesogm5x0osqmsoge5x0osqesogm}x0oqqesogm5x0osyesoom5x0osqesogq5x0msqesogm5x0o{qesggm5x0osqeso" ], [ 59398, "wide", "m5x2osqesogm5x0gsqe{ogm5x0osqesegm5p0osqesogm5x8osqmsogm5x0osqe" ], [ 60901, "u8", "61KW" ], [ 62248, "u8", "aO.zcIK" ], [ 63383, "u8", "FmnIrqjoq" ], [ 64220, "u8", "tRCtIW" ], [ 64840, "u8", "GOL2" ], [ 64886, "u8", "OFTR" ], [ 65915, "u8", "rHeYE" ], [ 66424, "u8", "O3OC" ], [ 66725, "u8", "rOkr" ], [ 66948, "u8", "OVjk3k" ], [ 67499, "u8", "z2wlT" ], [ 67538, "u8", "pjGp" ], [ 67627, "u8", "9QxQP" ], [ 69497, "u8", "aLrf" ], [ 69564, "u8", "ACtSf" ], [ 70495, "u8", "tK8]1W.H6B5" ], [ 71785, "u8", "jBzYI" ], [ 73042, "u8", "3i6v" ], [ 73307, "u8", "Z4AL0" ], [ 76833, "u8", "FY2I" ], [ 76839, "u8", "tCkvT" ], [ 77747, "u8", "/GhdK" ], [ 77845, "u8", "KT8A" ], [ 79375, "u8", "aFhm" ], [ 79585, "u8", "yVlDK" ], [ 79808, "u8", "TB0LX" ], [ 81528, "u8", "NGP6" ], [ 81585, "u8", "wBkq1" ], [ 81962, "u8", "6ZciK" ], [ 82465, "u8", "yBlZK" ], [ 83055, "u8", "58XH" ], [ 83840, "u8", "ngFl" ], [ 84400, "u8", "DL2E_" ], [ 85569, "u8", "yVlHK" ], [ 87587, "u8", "88JE" ], [ 89256, "u8", "lrGzC" ], [ 90217, "u8", "/4BI" ], [ 90641, "u8", "LCkBp" ], [ 90658, "u8", "PHFrOk" ], [ 90961, "u8", "ADOU" ], [ 91151, "u8", "58 EB" ], [ 91416, "u8", "NG26" ], [ 91773, "u8", "JBPpi" ], [ 91922, "u8", "83DA" ], [ 92419, "u8", "gZVwd" ], [ 93850, "u8", "kfLj" ], [ 95600, "u8", "ZdbXI" ], [ 98030, "u8", "4aFhOB" ], [ 99238, "u8", "U0_4" ], [ 100557, "u8", "Yopw" ], [ 100720, "u8", "Boak9" ], [ 100736, "u8", "Saal" ], [ 100848, "u8", "Foykm" ], [ 101041, "u8", "oNkx" ], [ 101072, "u8", "Ro2ku" ], [ 101200, "u8", "Voekp" ], [ 101248, "u8", "Sail8" ], [ 101345, "u8", "aila" ], [ 101376, "u8", "FaglS" ], [ 101408, "u8", "Qa6lz" ], [ 101504, "u8", "a9l3" ], [ 101728, "u8", "Yailz" ], [ 101889, "u8", "ail8" ], [ 101904, "u8", "Qoikm" ], [ 102080, "u8", "PaYln" ], [ 102192, "u8", "Hoik" ], [ 102256, "u8", "poPkL" ], [ 102512, "u8", "VAzk6yf" ], [ 102608, "u8", "HAPkjyz" ], [ 102979, "u8", "l rOk" ], [ 109009, "u8", "hFkJpXb" ], [ 109185, "u8", "fFlf" ], [ 109251, "u8", "lrCGV" ], [ 109513, "u8", "tvuQx" ], [ 109647, "u8", "f9sbkC" ], [ 110883, "u8", "lfr8k5k(z+xla" ], [ 110897, "u8", "h1k1pwbncIr?" ], [ 111625, "u8", "qw8QxT" ], [ 112225, "u8", "fCllb" ], [ 112793, "u8", "cMr0tCtuw" ], [ 113583, "u8", "afkGk" ], [ 113810, "u8", "Cket" ], [ 114293, "u8", "pYbj" ], [ 114375, "u8", "kykCz" ], [ 116927, "u8", "t2BGl" ], [ 116933, "u8", "rJkSO" ], [ 117021, "u8", "eCtNC" ], [ 117061, "u8", "rOkhNFz" ], [ 117367, "u8", "bVDMr" ], [ 117373, "u8", "eCtdA" ], [ 117455, "u8", "avLGk" ], [ 117543, "u8", "kKNCz" ], [ 117895, "u8", "ksLCz" ], [ 118426, "u8", "Lrde" ], [ 118447, "u8", "a6hT45" ], [ 118492, "u8", "Mevt" ], [ 118636, "u8", "gxYez" ], [ 120966, "wide", "qesogm5x0osqeso" ], [ 122671, "u8", "aFhJP" ], [ 123616, "u8", "jBflC" ], [ 123652, "u8", "JrMkfkfz`x:anh" ], [ 123667, "u8", "kJprbzcNrbertcf.l" ], [ 123700, "u8", "ApKbgc?rDe\u0026tzfilarzklkDzTxha(hYk+pibqc8rBe1tSf\u0026lAr" ], [ 124369, "u8", "hCkud" ], [ 126729, "u8", "kPzRx@aJhQkMp" ], [ 126747, "u8", "rYe_t[fXlFrZk" ], [ 126821, "u8", "rZkwkbz`x7alh" ], [ 126835, "u8", "ktpwbqcUreeztkf" ], [ 126881, "u8", "fClmrrkrk}zmxua5h" ], [ 126901, "u8", "pobsc(rpeothf}lxr\u0026kqk#z+x]aQhRk!pkbkcwr(eet fyl" ], [ 126957, "u8", "xHaqh+kzp9bdcsrGewt}fyl" ], [ 126987, "u8", "z1xmaLhkkupHbscmr;e)tif$l" ], [ 127021, "u8", "xEa}hrk\"pTb0cerheptofplhrtknk,z" ], [ 127053, "u8", "x\\aKhikmp_b" ], [ 127065, "u8", "cxrxe.tVf" ], [ 127081, "u8", "k@zhxsayhBkzp/bnc rxent" ], [ 127107, "u8", "l1r;k9k4zax:avh" ], [ 127129, "u8", "cCrye`tkf4ler+kokJztxdaeh" ], [ 127155, "u8", "kBplb\u003ecSr!ertwf2l8rzkzkcz\txYa" ], [ 127189, "u8", "pWbqc{rjeptGfql6r{k.kqzpxuabh" ], [ 127219, "u8", "k^p`bxc5rre*tkfhlvr?k7k[z*x!ath;krp0b;c:r-e0t4f4lQr?kqk)zGxva`hEkxptb,c{r?elt}f\u003clArgkek$zyxbayh.k~p+b*cxrleetufnlbrrk=k!zTx" ], [ 127349, "u8", "pTbxcwrre/tuf\"lprOktk~zrxmauhsk\"p" ], [ 127387, "u8", "reePtofnl{r-k/k1zex/a" ], [ 127417, "u8", "cFrmeqt2f~l rakQkgzlxza" ], [ 127443, "u8", "kHp4bsc" ], [ 127467, "u8", "zPxDa1hskeplbcc~rAeqt|f5lbr%kmk" ], [ 127499, "u8", "z$x'a2h2k%p+bec" ], [ 127521, "u8", "fTlwr{kEkyzex\u003caBh-k{ptb" ], [ 127553, "u8", "fJl4rck2kkz{x|abhikrpab" ], [ 128809, "u8", "nBJKIWQ" ], [ 128925, "u8", "T-D V26\u0026" ], [ 128934, "u8", "8C3M" ], [ 128985, "u8", "pX o" ], [ 129856, "u8", "7v0b" ], [ 130728, "u8", "DR9R" ], [ 130906, "u8", "61JT" ], [ 131889, "u8", "{D)OAAR" ], [ 132223, "u8", "sFCyV" ], [ 132601, "u8", "2shuiO" ], [ 132972, "u8", "eh3o" ], [ 133084, "u8", "\u0026S0A U'[1B ZQ[MKZH" ], [ 133188, "u8", "GP2fZb2" ], [ 133276, "u8", "Q){s" ], [ 133641, "u8", "kGzyxdamh5kIp" ], [ 133798, "u8", "KltWM" ], [ 135542, "wide", "5x0osqe" ], [ 137041, "u8", "7zoo" ], [ 137820, "u8", "AFPal6" ], [ 138345, "u8", "@XVCJd!')I*CQZ" ], [ 140279, "u8", "VMT A" ], [ 140359, "u8", "KRY/}[O" ], [ 143296, "u8", "PZFZ" ], [ 143833, "u8", "CS4C" ], [ 145411, "u8", "prKg" ], [ 145554, "u8", "Be\u003eq E/" ], [ 146962, "u8", "HMTL" ], [ 147929, "u8", "/oZx" ], [ 149353, "u8", "QUC7" ], [ 149520, "u8", "8m6w" ], [ 149589, "u8", "6o f" ], [ 149960, "u8", "wu2RG" ], [ 150135, "u8", "A2FS" ], [ 151209, "u8", "x7ZEA" ], [ 151700, "u8", "w4MZggbW" ], [ 152138, "u8", "EIjCw" ], [ 152217, "u8", "KlxFl" ], [ 152370, "u8", "V 8 @4g" ], [ 152452, "u8", "ixEt" ], [ 154955, "u8", "e7dq" ], [ 155558, "u8", "hNmVB" ], [ 155797, "u8", "Hr2vk" ], [ 156966, "u8", "jCLII5" ], [ 157919, "u8", "NQCT" ], [ 158672, "u8", "yd57" ] ], "v": { "file.stem": "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1683141638, "file.basename": "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe", "pe.image_base": 4194304, "pe.image_size": 4759552, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4737694, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.linker_major_version": 11, "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 4737608, "pe.data_directories[1].rva": 4743168, "pe.data_directories[2].rva": 4751360, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.overflowing_sections[0]": ".text", "pe.overflowing_sections[1]": ".rsrc", "pe.overflowing_sections[2]": ".reloc", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1232, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.coff.dos_header_pe_pointer": 128 }, "id": "pe", "sc": [ [ ".text", 512, 4729856, 7.97, "r-x" ], [ ".rsrc", 4730368, 1536, 0.0, "r--" ], [ ".reloc", 4731904, 512, 0.0, "r--" ] ] }, "id": 0, "sz": 2214475, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 42531.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 42531.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 2.14" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Large near-high entropy .text section", "e": [ ".text (size: 4729856, entropy: 7.97, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-large-near-high-entropy-text-raw", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.97)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 42531.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x9e8" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 2.14" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 7.97, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.97" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.97" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x1c730e" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 2.14" ], "i": "metadata/binary/metrics/structural::section-exceeds-file-size", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "c8", "c9", "c2" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014", "el": [ "0x16b69e", "0x125c7", "0x15e0d2" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x721" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x9e8" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 42531.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 2.14" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "40", "4b" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x15ab30", "0x128e87" ] }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 42531.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x9e8" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c5", "c3" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0x1eb13", "0x106c1b" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 4729856, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 42531.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 2.14" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 2.14" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 42531.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 2.14" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 42531.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.97" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.94" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 7.97, perms: r-x)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 2.14" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" } ], "sha": "882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-05/882965a5a042f18294522e73e0c8a8ecf458980189a177f4fb9546b2569a9dce.exe", "type": "pe" } ], "tv": "ca5ef" } }