{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999490976333618, "class": 2 } ], "prob": 0.9999491, "class": 2, "models": [ { "m": "az", "prob": 0.99710435, "class": 0 }, { "m": "az/native", "prob": 0.99991775, "class": 0 }, { "m": "az/pe", "prob": 0.9999491, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T04:04:57Z" }, "path": "2299", "raw": { "v": "4", "fs": [ { "f": "O(As₃)H₂(CmDb)Md₃(Bi₅HeSi)", "k": { "hash.imp": "ba80b668682b766ddce15676f9ae2778", "pe.timestamp": 1135709353, "hash.authenti": "e21ec43dd4e755034fa7004cecc36638b70fe76433c125a4abd60cf2cf491541", "hash.rich_header": "2f3906d066a873f6af3a69253ca9d82558f7f7c354f8eab1fff7c9a48ab5ec28", "build.target_arch": "x86", "pe.linker_version": "7.10", "pe.resource_types[0]": "RT_DIALOG", "pe.resource_types[1]": "RT_240", "pe.rich_header.xor_key": "0x7db6624b", "pe.data_directories[0].rva": 850729, "pe.data_directories[1].rva": 827392, "pe.data_directories[2].rva": 850790, "pe.data_directories[3].rva": 850769, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 160, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.rich_header_compids[0].count": 33, "pe.rich_header_compids[1].count": 1, "pe.rich_header_compids[2].count": 6, "pe.rich_header_compids[3].count": 6, "pe.rich_header_compids[4].count": 2, "pe.rich_header_compids[5].count": 17, "pe.rich_header_compids[6].count": 320, "pe.rich_header_compids[7].count": 131, "pe.rich_header_compids[8].count": 52, "pe.rich_header_compids[9].count": 1, "pe.rich_header_compids[0].compid": 986117, "pe.rich_header_compids[10].count": 1, "pe.rich_header_compids[1].compid": 335848, "pe.rich_header_compids[2].compid": 1647610, "pe.rich_header_compids[3].compid": 6228099, "pe.rich_header_compids[4].compid": 6096915, "pe.rich_header_compids[5].compid": 6097027, "pe.rich_header_compids[6].compid": 65536, "pe.rich_header_compids[7].compid": 6228997, "pe.rich_header_compids[8].compid": 6294533, "pe.rich_header_compids[9].compid": 6163436, "pe.rich_header_compids[10].compid": 5901317, "pe.rich_header_compids[6].product": "Unknown", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.section_characteristics[4].name": ".reloc", "pe.rich_header.entries[0].use_count": 33, "pe.rich_header.entries[1].use_count": 1, "pe.rich_header.entries[2].use_count": 6, "pe.rich_header.entries[3].use_count": 6, "pe.rich_header.entries[4].use_count": 2, "pe.rich_header.entries[5].use_count": 17, "pe.rich_header.entries[6].use_count": 320, "pe.rich_header.entries[7].use_count": 131, "pe.rich_header.entries[8].use_count": 52, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 15, "pe.rich_header.entries[10].use_count": 1, "pe.rich_header.entries[1].product_id": 5, "pe.rich_header.entries[2].product_id": 25, "pe.rich_header.entries[3].product_id": 95, "pe.rich_header.entries[4].product_id": 93, "pe.rich_header.entries[5].product_id": 93, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 95, "pe.rich_header.entries[8].product_id": 96, "pe.rich_header.entries[9].product_id": 94, "pe.rich_header.entries[10].product_id": 90, "pe.rich_header.entries[0].build_number": 3077, "pe.rich_header.entries[0].product_name": "Imp_VC2003", "pe.rich_header.entries[1].build_number": 8168, "pe.rich_header.entries[1].product_name": "Cvt_Pgd_VS_v6_or_earlier", "pe.rich_header.entries[2].build_number": 9210, "pe.rich_header.entries[2].product_name": "C_VS2005_BTA", "pe.rich_header.entries[3].build_number": 2179, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 2067, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 2179, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 3077, "pe.rich_header.entries[7].product_name": "unknown", "pe.rich_header.entries[8].build_number": 3077, "pe.rich_header.entries[8].product_name": "unknown", "pe.rich_header.entries[9].build_number": 3052, "pe.rich_header.entries[9].product_name": "unknown", "pe.section_characteristics[0].raw_size": 157192, "pe.section_characteristics[1].raw_size": 20548, "pe.section_characteristics[2].raw_size": 163056, "pe.section_characteristics[3].raw_size": 316, "pe.section_characteristics[4].raw_size": 19314, "pe.rich_header.entries[10].build_number": 3077, "pe.rich_header.entries[10].product_name": "C_VS2005_LTCG", "pe.section_characteristics[0].virtual_size": 374790, "pe.section_characteristics[1].virtual_size": 43082, "pe.section_characteristics[2].virtual_size": 398712, "pe.section_characteristics[3].virtual_size": 480, "pe.section_characteristics[4].virtual_size": 32636, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 380928, "pe.section_characteristics[2].virtual_address": 425984, "pe.section_characteristics[3].virtual_address": 827392, "pe.section_characteristics[4].virtual_address": 831488, "pe.section_characteristics[0].characteristics_hex": "e0000020", "pe.section_characteristics[1].characteristics_hex": "e0000040", "pe.section_characteristics[2].characteristics_hex": "e0000040", "pe.section_characteristics[3].characteristics_hex": "e0000040", "pe.section_characteristics[4].characteristics_hex": "e2000040" }, "x": 111, "id": 0, "is": [ "ORDINAL 17" ], "ms": { "pe": { "entry": 4212.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 316.0, "subsystem": 2.0, "timestamp": 1135709353.0, "image_base": 4194304.0, "rsrc_entropy": 4.98, "entry_section": ".text", "size_of_image": 864256.0, "file_alignment": 512.0, "resource_count": 2.0, "resource_types": [ "RT_DIALOG", "RT_240" ], "characteristics": 270.0, "has_rich_header": true, "overlay_padding": 1436.0, "size_of_headers": 4096.0, "export_timestamp": 0.0, "import_dll_count": 1.0, "computed_checksum": 392463.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 7.0, "linker_minor_version": 10.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true }, "file": { "size": 365958.0 }, "binary": { "code_size": 360426.0, "func_count": 2.0, "has_overlay": true, "code_entropy": 7.39, "func_density": 0.01, "import_count": 1.0, "overlay_size": 20.0, "string_count": 144.0, "avg_func_size": 6751.0, "overlay_ratio": 0.0, "section_count": 5.0, "avg_complexity": 1.0, "import_density": 0.0, "max_complexity": 1.0, "string_density": 0.41, "overall_entropy": 7.39, "avg_basic_blocks": 1.0, "avg_section_size": 72085.2, "dependency_count": 1.0, "entropy_variance": 1.21, "wx_section_count": 5.0, "avg_string_length": 5.04, "complexity_per_kb": 0.0, "max_string_length": 40.0, "avg_string_entropy": 2.1, "code_to_data_ratio": 65.15, "data_to_file_ratio": 0.45, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.43, "total_basic_blocks": 2.0, "func_analysis_depth": 2.0, "high_entropy_regions": 4.0, "string_length_stddev": 3.83, "largest_section_ratio": 0.45, "sentence_string_count": 1.0, "sentence_string_ratio": 0.01, "writable_section_count": 5.0, "entry_in_writable_region": true, "executable_section_count": 5.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 512, ".text" ], [ 552, ".rdata" ], [ 592, ".data" ], [ 632, ".rsrc" ], [ 672, ".reloc" ], [ 8574, "PKW7" ], [ 9643, "H_TC" ], [ 9707, "/2lI" ], [ 11756, "RDRZ" ], [ 17975, "8r18i" ], [ 18113, "BO0J" ], [ 19758, "S_ZB" ], [ 20138, "Oprl" ], [ 24092, "oHePEPB" ], [ 42365, "k0i9" ], [ 51715, "HTA7" ], [ 54024, "/uGc" ], [ 55620, "KI5A" ], [ 56109, "Gx.a" ], [ 56686, "T1FV" ], [ 57851, "WH7J" ], [ 58609, "Z83X" ], [ 61300, "J7GU" ], [ 67512, "DEMM5" ], [ 69717, "/GDt" ], [ 71571, "22dw" ], [ 73156, "vaQ1c./G" ], [ 76636, "98u6o" ], [ 77352, "YN0L" ], [ 77609, "PH52" ], [ 88009, "Jxdo" ], [ 92443, "veeg" ], [ 93368, "XU30N" ], [ 94507, "p45t" ], [ 95411, "FZ7H" ], [ 100359, "Cmaf" ], [ 105069, "OYMP" ], [ 105099, "X4 F" ], [ 111090, "u a9" ], [ 113498, "v4i8" ], [ 115754, "6kvi" ], [ 118925, "CJV5" ], [ 118993, "RZNZ" ], [ 122157, "6LZS" ], [ 123017, "2d0n" ], [ 128471, "/2Y9g" ], [ 128722, "caur" ], [ 134564, "E1UU" ], [ 138019, "2mtas" ], [ 138402, "v;mX\u003c\u003c" ], [ 138671, "H ca" ], [ 143783, "Gjuc" ], [ 145710, "G3OG" ], [ 146907, "A_YH" ], [ 150660, "Dnzy" ], [ 151457, "4 78w" ], [ 152126, "ia2z" ], [ 154578, "E6Z2" ], [ 155884, "/Y1wg" ], [ 157259, "/UxI2\u003e.T" ], [ 160324, "JGGK0M" ], [ 163040, "EX7A" ], [ 163304, ".mvk" ], [ 165406, "/XFuR" ], [ 165618, "48.227.169.215:37497" ], [ 166420, "B0VC" ], [ 167013, "125.137.79.160:10038" ], [ 175647, "7tga" ], [ 176747, "91HE" ], [ 178830, "a627" ], [ 182049, "/kMO" ], [ 182828, "jpubmq" ], [ 186896, "roiu" ], [ 188524, "mqoa" ], [ 188816, "/RaC" ], [ 190915, "/r4H" ], [ 191538, "S47L" ], [ 193819, "za3q" ], [ 194384, "so5y" ], [ 196197, "zm)YQn%sd" ], [ 199431, "`mR`" ], [ 203155, "luho5" ], [ 207568, "f35s" ], [ 208363, "wemo" ], [ 210022, "/X0mRd" ], [ 210750, "u6lt" ], [ 215954, "ivery" ], [ 216640, "Qlmo" ], [ 218107, "/ORM" ], [ 220682, "Jguo" ], [ 220898, "Kblt" ], [ 223873, "CSV1" ], [ 224941, "45jd" ], [ 225346, "eh8p" ], [ 229115, "4V60W" ], [ 230117, "Wf t" ], [ 237503, "5MTK" ], [ 240459, "SLLZ" ], [ 241079, "GAP3" ], [ 246655, "/mys" ], [ 248001, "8G7L" ], [ 252639, "ETRW" ], [ 253173, "JY8C0" ], [ 258147, "/nD7" ], [ 261746, "ejur" ], [ 264729, "j0oq" ], [ 271238, "Ilkx" ], [ 272885, "58.186.170.101:53823" ], [ 275823, "QPLIO" ], [ 278443, "DTM5" ], [ 279255, "U66D" ], [ 279828, "Q45K" ], [ 282113, "ca45" ], [ 283598, "k42u" ], [ 284806, "Jufp" ], [ 293138, "A959" ], [ 293400, "Bxes" ], [ 297855, "7HYI" ], [ 298766, "Quma" ], [ 302167, "J byma" ], [ 309010, "Gzds" ], [ 312029, "19vx" ], [ 314521, "O2\u003eZ" ], [ 315665, "Y7NB4" ], [ 317936, "IYXG" ], [ 318877, "v%ZiD.8" ], [ 319338, "T1UY" ], [ 327629, "/kRo" ], [ 332541, "S%2\u003e" ], [ 332904, "q91n" ], [ 333983, "DBZJ8B" ], [ 335803, "/Uot" ], [ 337759, "/Xg8" ], [ 339191, "NXFWW" ], [ 339984, "P8CS" ], [ 342025, "z76k" ], [ 349417, "M2\u003eqO?:/" ], [ 353349, "NV91" ], [ 354068, "Y6V8" ], [ 359497, "2\u003e:g" ], [ 360754, "7sew" ], [ 365612, "/EQr" ], [ 365913, "KERNEL32.DLL" ] ], "sz": 365958, "ts": [ { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "High entropy .rdata section (likely encrypted)", "e": [ ".rdata (entropy: 7.99)" ], "i": "metadata/binary/section/names::high-entropy-rdata", "l": 3 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1135709353.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c7" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 0.00" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.39" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.39" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.75, "d": "High entropy encrypted data", "e": [ ".rdata (entropy: 7.99)" ], "i": "micro-behaviors/data/encode/payload::payload-blob-metrics", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 7.39" ], "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 144.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 316.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 8.00, perms: rwx)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "2299" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "c": 0.8600000143051147, "d": "High entropy rdata section", "e": [ ".rdata (entropy: 7.99)" ], "i": "metadata/binary/section/metrics::high-entropy-rdata-section", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 4.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.8500000238418579, "d": "High-entropy read-only .rdata section", "e": [ ".rdata (size: 20548, entropy: 7.99)" ], "i": "metadata/binary/anomaly/signing::high-entropy-rdata-section", "l": 3 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 8.00)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.10" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.4000000059604645, "d": "Very few basic blocks (analysis-limited or sparse)", "e": [ "binary.total_basic_blocks = 2.00" ], "i": "metadata/binary/metrics/structural::few-basic-blocks", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High overall file entropy", "e": [ "binary.overall_entropy = 7.39" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-overall-entropy", "l": 4, "m": "B0032" }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "c": 0.949999988079071, "d": "Three or more writable executable sections", "e": [ "binary.wx_section_count = 5.00" ], "i": "metadata/hardening/memory::three-plus-wx-sections", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Loader sized encrypted .data blob", "e": [ ".data (size: 163056, entropy: 8.00, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/payload/section::loader-encrypted-dot-data", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "48.227.169.215:37497", "58.186.170.101:53823", "125.137.79.160:10038" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with single import", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted rdata section (PE crypter)", "e": [ ".rdata (entropy: 7.99)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-rdata-section", "l": 4, "m": "B0032" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 316)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports", "l": 1 }, { "a": "T1045", "c": 0.949999988079071, "d": "Multiple W+X sections (packer pattern)", "e": [ "binary.wx_section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-wx-sections", "l": 1, "m": "B0032" }, { "c": 0.7200000286102295, "d": "Writable .rdata section permissions", "e": [ ".rdata (perms: rwx)" ], "i": "metadata/binary/section/names::writable-rdata", "l": 3 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 1135709353.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.6000000238418579, "d": "High entropy in data section", "e": [ ".rdata (entropy: 7.99)", ".data (entropy: 8.00)" ], "i": "metadata/binary/metrics/structural::high-entropy-data", "l": 1 }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "48.227.169.215:37497", "125.137.79.160:10038" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-rdata-pair", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted data section (very high)", "e": [ ".rdata (entropy: 7.99)", ".data (entropy: 8.00)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-data-section", "l": 4, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Writable .text section (custom packer indicator)", "e": [ ".text (size: 157192, entropy: 8.00, perms: rwx)" ], "i": "metadata/binary/section/metrics::writable-text-section", "l": 4 }, { "c": 0.9399999976158142, "d": "High entropy .reloc section", "e": [ ".reloc (entropy: 7.99)" ], "i": "metadata/binary/section/metrics::encrypted-reloc-section", "l": 4 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".text (size: 157192, perms: rwx)", ".rsrc (size: 316, perms: rwx)", ".rdata (size: 20548, perms: rwx)", ".reloc (size: 19314, perms: rwx)", ".data (size: 163056, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".rdata (entropy: 7.99, perms: rwx)", ".data (entropy: 8.00, perms: rwx)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 0.9200000166893005, "d": "External IPv4 endpoint in data section", "e": [ "58.186.170.101:53823" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-data-literal", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 8.00, perms: rwx)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "a": "T1027.002", "c": 0.75, "d": "Small high-entropy section (encrypted stub)", "e": [ ".rsrc (size: 316, perms: rwx)" ], "i": "objectives/anti-static/pack/polymorphic::small-encrypted-section", "l": 4, "m": "F0001" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "125.137.79.160:10038", "48.227.169.215:37497" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".rdata (entropy: 7.99, perms: rwx)", ".data (entropy: 8.00, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".data (size: 163056, entropy: 8.00, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-0--inline-29193", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".data (entropy: 8.00)", ".rdata (entropy: 7.99)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-payload-section-cond-0--inline-29177", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (ORDINAL 17)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00", "binary.has_signature = 0.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "8b05ddbbb83e2f6e2feebff23403efa0cf6025d8301c9232ed9d952ddd40a62a", "path": "2299", "type": "pe" } ], "tv": "d376d" } }