{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.0021164021, "class": 0 }, { "m": "az/pe", "prob": 0.0028985508, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T21:50:39Z" }, "path": "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "build.target_arch": "x86", "pe.linker_version": "3.0", "pe.inflated_sections[0]": "UPX2", "pe.data_directories[0].rva": 12095488, "pe.data_directories[1].rva": 12095624, "pe.overflowing_sections[0]": "UPX1", "pe.overflowing_sections[1]": "UPX2", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 136, "pe.data_directories[1].name": "base_relocation", "pe.data_directories[1].size": 12, "pe.dll_characteristics.nx_compat": true, "pe.section_characteristics[0].name": "UPX0", "pe.section_characteristics[1].name": "UPX1", "pe.section_characteristics[2].name": "UPX2", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[1].raw_size": 3287552, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[0].virtual_size": 8802304, "pe.section_characteristics[1].virtual_size": 3289088, "pe.section_characteristics[2].virtual_size": 4096, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 8806400, "pe.section_characteristics[2].virtual_address": 12095488, "pe.section_characteristics[0].characteristics_hex": "e0000080", "pe.section_characteristics[1].characteristics_hex": "e0000040", "pe.section_characteristics[2].characteristics_hex": "c0000040" }, "x": 6, "id": 0, "ms": { "pe": { "entry": 12090912.0, "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "image_base": 4194304.0, "entry_section": "UPX1", "size_of_image": 12099584.0, "file_alignment": 512.0, "characteristics": 258.0, "size_of_headers": 512.0, "export_timestamp": 0.0, "computed_checksum": 1652676.0, "section_alignment": 4096.0, "timestamp_anomaly": true, "timestamp_is_zero": true, "resource_timestamp": 0.0, "dll_characteristics": 33088.0, "has_export_timestamp": false, "linker_major_version": 3.0, "bss_like_section_count": 1.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "section_raw_overflow_count": 2.0, "max_section_inflation_ratio": 8.0, "entry_in_nonstandard_section": true }, "file": { "size": 1637856.0 }, "binary": { "code_size": 3287552.0, "func_count": 1.0, "code_entropy": 4.0, "func_density": 0.0, "string_count": 635.0, "avg_func_size": 15.0, "section_count": 3.0, "avg_complexity": 1.0, "max_complexity": 1.0, "string_density": 0.2, "overall_entropy": 2.67, "avg_basic_blocks": 1.0, "avg_section_size": 1096021.38, "entropy_variance": 3.77, "wx_section_count": 2.0, "avg_string_length": 4.37, "complexity_per_kb": 0.0, "max_string_length": 40.0, "avg_string_entropy": 2.02, "code_to_data_ratio": 6421.0, "total_basic_blocks": 1.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 1.6, "largest_section_ratio": 2.01, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "writable_section_count": 3.0, "entry_in_writable_region": true, "executable_section_count": 2.0, "nonstandard_section_count": 3.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, "UPX0" ], [ 416, "UPX1" ], [ 456, "UPX2" ], [ 496, "4.10" ], [ 585, "Glze" ], [ 5799, "XRV5T" ], [ 10874, "DTJN" ], [ 10942, "ATSQ" ], [ 11065, "XU_7" ], [ 16301, "XNYW3" ], [ 28834, "HY_D" ], [ 28951, "RP77" ], [ 29069, "KHCJ" ], [ 29893, "Nrjk" ], [ 33381, "F_WR" ], [ 34927, "X4UI" ], [ 35560, "/5nW" ], [ 36065, "IBMHQ" ], [ 38337, "Haft" ], [ 41104, "n8ao2" ], [ 42165, "2\u003ed2L" ], [ 51930, "e4ex" ], [ 59700, "2no3a" ], [ 60362, "LVYT" ], [ 61064, "S43B" ], [ 61403, "7n6om" ], [ 72793, "Fnwc" ], [ 75760, "Pkan" ], [ 77008, "H65A" ], [ 79457, "/Ixe" ], [ 80199, "x8nK.jR" ], [ 81083, "U7R4" ], [ 84660, "Qige" ], [ 92989, "SN5R" ], [ 93750, "6u9i" ], [ 94533, "/8 Wp" ], [ 96241, "Glly" ], [ 97106, "Hldt" ], [ 97548, "YBIA" ], [ 97924, "..mk" ], [ 99422, "Zqmo" ], [ 101103, "t9v2" ], [ 107932, "MLS8" ], [ 108793, "clo6p" ], [ 108960, "e6t1" ], [ 115243, "2jro" ], [ 121382, "ZQFX" ], [ 122556, "Bv e" ], [ 123999, "z35q" ], [ 124352, "P3NV" ], [ 129342, "G33T" ], [ 131863, "x3 n" ], [ 133864, "67 J" ], [ 134111, "y4p0" ], [ 136184, "Qrgt" ], [ 137241, "Rgem" ], [ 139079, "004O" ], [ 147181, "wjz.q" ], [ 148572, "OWVZ" ], [ 150257, "KMOT" ], [ 155254, "6ahe" ], [ 156562, "/G1k" ], [ 158415, "8 oc" ], [ 159785, "ioit" ], [ 160870, "M4YG" ], [ 162710, "DZIM" ], [ 163748, "IZNP" ], [ 168193, "I2FW" ], [ 174507, "z 15" ], [ 176109, "YFHR" ], [ 176128, "/Dqw" ], [ 176776, "28az" ], [ 178055, "qUguPMG" ], [ 180071, "B067" ], [ 182060, "H2SH" ], [ 184976, "8ADH" ], [ 187468, "RWGU" ], [ 190037, "-tdkj%" ], [ 195411, "/zNi" ], [ 196937, "n1ew" ], [ 197981, "B31B" ], [ 202768, "/oG9" ], [ 207338, "FOFQW" ], [ 207755, "86zf" ], [ 209355, "COW0" ], [ 211371, "/5lG" ], [ 219408, "2\u003e*W" ], [ 222442, "TNO2" ], [ 224315, "Halx" ], [ 224462, "Gwbo" ], [ 228658, "MJQF" ], [ 229418, "B9FM" ], [ 231788, "dq/hvt" ], [ 232316, "UFAW" ], [ 232901, "hYdwofr" ], [ 235296, "SO24" ], [ 237678, "9 ob" ], [ 239024, "Ggak" ], [ 240135, "Bzup" ], [ 240475, "HMW8" ], [ 240944, "f4eu" ], [ 241106, "Alna" ], [ 241648, "36QE" ], [ 243674, "IOPV" ], [ 246326, "aulw" ], [ 246346, "HZSA" ], [ 249350, "3derts" ], [ 252463, "9URW" ], [ 252621, "K9NO" ], [ 252941, "iavp" ], [ 255516, "Obfa" ], [ 256239, "/RzG" ], [ 256721, "FZC0" ], [ 259351, "N0PO" ], [ 263264, "I62A" ], [ 263654, "ty26" ], [ 264644, "D4K7K" ], [ 267827, "Poxh" ], [ 268877, "Helm" ], [ 274184, "Adjn" ], [ 276517, "Trxe" ], [ 277989, "V0 Z" ], [ 278429, "DZR6" ], [ 284950, "q2\u003e4" ], [ 285396, "TYL8" ], [ 286192, "BG3X" ], [ 286911, "b2il" ], [ 289175, "PIVU" ], [ 291187, "GJUS" ], [ 296909, "X 30" ], [ 301744, "I1LA" ], [ 303725, "4tsa" ], [ 305700, "/Ilu" ], [ 306368, "c.fi" ], [ 311405, "/sG6" ], [ 319177, "Wbbp" ], [ 319929, "OFM6" ], [ 321214, "5LGX" ], [ 325852, "2 6yc" ], [ 326770, "7thaa" ], [ 326899, "p533" ], [ 327310, "Rxxe" ], [ 330382, "Wpyc" ], [ 332554, "APLV" ], [ 333338, "Nktu" ], [ 334780, "J914" ], [ 341868, "bp51" ], [ 344356, "E xb" ], [ 346130, "@8)8.Nj" ], [ 347119, "2ubs" ], [ 349010, "O68D" ], [ 350427, "RVQX" ], [ 362564, "83bg" ], [ 365476, "/ HS" ], [ 368048, "XVJ0" ], [ 368086, "i2jg" ], [ 379300, "I_2Y" ], [ 381143, "TFHF" ], [ 386103, "9adp" ], [ 387268, "r5j8" ], [ 387804, "2T7Q" ], [ 387826, "Gkgt" ], [ 389432, "Hunzd" ], [ 391269, "zC.JbLob4" ], [ 391668, "/LWjp" ], [ 391706, "Pvse" ], [ 392768, "ek2zz7" ], [ 395564, "8X1Q" ], [ 396690, "KMQP" ], [ 398152, "XFWM" ], [ 400742, "j4ew" ], [ 408861, "QS 9" ], [ 411109, "OL_X" ], [ 412735, ".cocf" ], [ 416363, "yTYocfd" ], [ 424068, "i24w" ], [ 425045, "XEN4" ], [ 425723, "Lwon" ], [ 425781, "Aclwh" ], [ 426815, "PEOC" ], [ 427053, "WGK9" ], [ 429831, "xu7p" ], [ 434122, "TN4E" ], [ 435338, "H t%__" ], [ 437232, "e76k" ], [ 440658, "7c9x" ], [ 443266, "f.65" ], [ 446598, "YIUS1" ], [ 446973, "GI1P" ], [ 455288, "Q9OJM" ], [ 458838, "xoou" ], [ 459435, "/n\tu" ], [ 466659, "DSV5" ], [ 469586, "y5d8" ], [ 471936, "K.pm" ], [ 475408, "/PKX" ], [ 475458, "bi1b" ], [ 476485, "4OSR" ], [ 476807, "PX6E" ], [ 479638, "23ZBF" ], [ 483720, "48ed" ], [ 484085, "Akao" ], [ 488977, "Wduoe" ], [ 490482, "rhJQOna" ], [ 492865, "v l9i" ], [ 494634, "TF7V" ], [ 497415, "YW52" ], [ 500485, "OBT4" ], [ 501246, "UVPW" ], [ 505916, "8vab" ], [ 507854, "Bkyy" ], [ 512468, "I.ya" ], [ 513530, "/tT8" ], [ 517281, "PPGPS" ], [ 517608, "HNRG" ], [ 522761, "QGP4W" ], [ 525612, "40WH" ], [ 525880, "EDPN" ], [ 526708, "X''-iw" ], [ 526956, "w.qz" ], [ 527884, "JVKF" ], [ 529943, "5BUE" ], [ 531308, "n3up" ], [ 533282, "Vzae" ], [ 538447, "@(.-hy-x" ], [ 538485, "81PE" ], [ 538631, "/a0Q" ], [ 539286, "/5ou" ], [ 541762, "M_2G" ], [ 542758, "Butd" ], [ 543663, "Vehx" ], [ 545319, "SKGX" ], [ 549634, "ZN1B" ], [ 557828, "y8og" ], [ 560264, "/LKR" ], [ 561366, "un04" ], [ 563225, "/oZp" ], [ 564344, "c1q4" ], [ 569577, "EA21" ], [ 570053, "SJnmt-x" ], [ 571405, "2QESX" ], [ 572596, "ax9b" ], [ 573043, "Vngmz" ], [ 573725, "q0w3" ], [ 575276, "t5f5" ], [ 576018, "DH_X" ], [ 578358, "rvpu5" ], [ 580151, "wy46" ], [ 581697, "3LXO" ], [ 591123, "/ywl" ], [ 592096, "ac4l" ], [ 596022, "R cbm" ], [ 598173, "9SKG" ], [ 600157, "KGT4" ], [ 602456, "q7ju" ] ], "sz": 1637856, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 1.0, "d": "Binary is packed with UPX", "i": "anti-static/packer/upx", "l": 3 }, { "c": 1.0, "d": "UPX decompression failed: IO error: No such file or directory (os error 2)", "i": "anti-static/packer/upx/decompression-failed", "l": 3 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "PE header timestamp is zero", "e": [ "pe.timestamp_is_zero = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::zero-header-timestamp", "l": 1 }, { "c": 0.9200000166893005, "d": "Large binary with few functions", "e": [ "binary.func_count = 1.00" ], "i": "metadata/package/metrics::recovered-function-count-under-10", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Very low recovered function count", "e": [ "binary.func_count = 1.00" ], "i": "objectives/anti-static/pack/polymorphic::very-low-func-count", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 2.01" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.02" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.67" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.9800000190734863, "d": "Import count is exactly zero", "e": [ "binary.import_count = 0.00" ], "i": "well-known/tool/dual-use/pvz-tools::zero-import-count", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.02" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "jb\fK" ], "i": "micro-behaviors/crypto/symmetric/xor/loop::asm-loop-control-transfer", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.8999999761581421, "d": "Import count is exactly zero", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 2.01" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 0.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 8.00" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9399999976158142, "d": "Large PE with one function", "e": [ "binary.func_count = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::one-function-large-pe", "l": 1, "m": "B0032" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.67" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Code to data ratio favors text", "e": [ "binary.code_to_data_ratio = 6421.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::code-heavy-loader-ratio", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 635.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 2.01" ], "i": "metadata/binary/metrics/structural::section-exceeds-file-size", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 2.01" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX2", "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 0.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 0.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 1.0, "d": "Downgrade standalone UPX packer finding", "i": "metadata/binary/framework::upx-packer-downgrade", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "c": 0.4000000059604645, "d": "Very few basic blocks (analysis-limited or sparse)", "e": [ "binary.total_basic_blocks = 1.00" ], "i": "metadata/binary/metrics/structural::few-basic-blocks", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 2.01" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Resource section entropy is unusually low", "e": [ "pe.rsrc_entropy = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::low-entropy-rsrc", "l": 1, "m": "B0032" }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with single import", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Short max string length in large binary", "e": [ "binary.max_string_length = 40.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::sparse-strings-large-binary", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 0.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027.002", "c": 0.699999988079071, "d": "PE with very few imports", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports", "l": 1 }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.37" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Very few recovered functions in large PE", "e": [ "binary.func_count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::recovered-function-count-under-10", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX2", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 3287552, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 0.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 0.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE timestamp anomaly detected", "e": [ "pe.timestamp_anomaly = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::timestamp-anomaly", "l": 2 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 0.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX2", "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 2.01" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 } ], "sha": "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb", "path": "8bfab96a466bb01641ae40ca32064324f293f060c4b8c32ad0f1d480e4d4f9fb.exe", "type": "pe" } ], "tv": "60127" } }