{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.31724137, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T01:08:28Z" }, "path": "8e0ab7b7cceb52d65aa48d610eaf7e7fecab025f88876bdcd72f7cd773dac182.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)", "x": 5, "ff": { "i": [ [ "mfc42", "ORDINAL 2976" ], [ "mfc42", "ORDINAL 3401" ], [ "mfc42", "ORDINAL 3830" ], [ "mfc42", "ORDINAL 3831" ], [ "mfc42", "ORDINAL 3825" ], [ "mfc42", "ORDINAL 3079" ], [ "mfc42", "ORDINAL 4080" ], [ "mfc42", "ORDINAL 4622" ], [ "mfc42", "ORDINAL 4424" ], [ "mfc42", "ORDINAL 3670" ], [ "mfc42", "ORDINAL 561" ], [ "mfc42", "ORDINAL 825" ], [ "mfc42", "ORDINAL 3952" ], [ "mfc42", "ORDINAL 2724" ], [ "mfc42", "ORDINAL 1168" ], [ "mfc42", "ORDINAL 6467" ], [ "mfc42", "ORDINAL 823" ], [ "mfc42", "ORDINAL 1877" ], [ "mfc42", "ORDINAL 4249" ], [ "mfc42", "ORDINAL 2486" ], [ "mfc42", "ORDINAL 2687" ], [ "mfc42", "ORDINAL 6364" ], [ "mfc42", "ORDINAL 3326" ], [ "mfc42", "ORDINAL 6365" ], [ "mfc42", "ORDINAL 4472" ], [ "mfc42", "ORDINAL 5498" ], [ "mfc42", "ORDINAL 3278" ], [ "mfc42", "ORDINAL 3353" ], [ "mfc42", "ORDINAL 3681" ], [ "mfc42", "ORDINAL 446" ], [ "mfc42", "ORDINAL 743" ], [ "mfc42", "ORDINAL 1177" ], [ "mfc42", "ORDINAL 1226" ], [ "mfc42", "ORDINAL 1210" ], [ "mfc42", "ORDINAL 2439" ], [ "mfc42", "ORDINAL 1693" ], [ "mfc42", "ORDINAL 5618" ], [ "mfc42", "ORDINAL 994" ], [ "mfc42", "ORDINAL 4342" ], [ "mfc42", "ORDINAL 4687" ], [ "mfc42", "ORDINAL 4639" ], [ "mfc42", "ORDINAL 5674" ], [ "mfc42", "ORDINAL 2156" ], [ "mfc42", "ORDINAL 4856" ], [ "mfc42", "ORDINAL 4920" ], [ "mfc42", "ORDINAL 6002" ], [ "mfc42", "ORDINAL 2137" ], [ "mfc42", "ORDINAL 1963" ], [ "mfc42", "ORDINAL 5213" ], [ "mfc42", "ORDINAL 2953" ], [ "mfc42", "ORDINAL 3868" ], [ "mfc42", "ORDINAL 5150" ], [ "mfc42", "ORDINAL 4705" ], [ "mfc42", "ORDINAL 4707" ], [ "mfc42", "ORDINAL 2876" ], [ "mfc42", "ORDINAL 2998" ], [ "mfc42", "ORDINAL 5649" ], [ "mfc42", "ORDINAL 4113" ], [ "mfc42", "ORDINAL 4661" ], [ "mfc42", "ORDINAL 4660" ], [ "mfc42", "ORDINAL 4650" ], [ "mfc42", "ORDINAL 4903" ], [ "mfc42", "ORDINAL 4548" ], [ "mfc42", "ORDINAL 4521" ], [ "mfc42", "ORDINAL 4594" ], [ "mfc42", "ORDINAL 4988" ], [ "mfc42", "ORDINAL 4925" ], [ "mfc42", "ORDINAL 4930" ], [ "mfc42", "ORDINAL 4935" ], [ "mfc42", "ORDINAL 4659" ], [ "mfc42", "ORDINAL 4909" ], [ "mfc42", "ORDINAL 4908" ], [ "mfc42", "ORDINAL 4668" ], [ "mfc42", "ORDINAL 4667" ], [ "mfc42", "ORDINAL 4666" ], [ "mfc42", "ORDINAL 4648" ], [ "mfc42", "ORDINAL 4689" ], [ "mfc42", "ORDINAL 5023" ], [ "mfc42", "ORDINAL 4654" ], [ "mfc42", "ORDINAL 4643" ], [ "mfc42", "ORDINAL 4354" ], [ "mfc42", "ORDINAL 4780" ], [ "mfc42", "ORDINAL 4649" ], [ "mfc42", "ORDINAL 4637" ], [ "mfc42", "ORDINAL 4636" ], [ "mfc42", "ORDINAL 5060" ], [ "mfc42", "ORDINAL 4584" ], [ "mfc42", "ORDINAL 4371" ], [ "mfc42", "ORDINAL 4361" ], [ "mfc42", "ORDINAL 4356" ], [ "mfc42", "ORDINAL 4739" ], [ "mfc42", "ORDINAL 4741" ], [ "mfc42", "ORDINAL 4738" ], [ "mfc42", "ORDINAL 4409" ], [ "mfc42", "ORDINAL 4603" ], [ "mfc42", "ORDINAL 5008" ], [ "mfc42", "ORDINAL 4415" ], [ "mfc42", "ORDINAL 4992" ], [ "mfc42", "ORDINAL 4979" ], [ "mfc42", "ORDINAL 2488" ], [ "mfc42", "ORDINAL 3404" ], [ "mfc42", "ORDINAL 4539" ], [ "mfc42", "ORDINAL 2954" ], [ "mfc42", "ORDINAL 6055" ], [ "mfc42", "ORDINAL 5302" ], [ "mfc42", "ORDINAL 1776" ], [ "mfc42", "ORDINAL 4407" ], [ "mfc42", "ORDINAL 5241" ], [ "mfc42", "ORDINAL 3081" ], [ "mfc42", "ORDINAL 5163" ], [ "mfc42", "ORDINAL 6370" ], [ "mfc42", "ORDINAL 4353" ], [ "mfc42", "ORDINAL 5290" ], [ "mfc42", "ORDINAL 3798" ], [ "mfc42", "ORDINAL 4837" ], [ "mfc42", "ORDINAL 4441" ], [ "mfc42", "ORDINAL 2648" ], [ "mfc42", "ORDINAL 2055" ], [ "mfc42", "ORDINAL 6376" ], [ "mfc42", "ORDINAL 3749" ], [ "mfc42", "ORDINAL 5065" ], [ "mfc42", "ORDINAL 1727" ], [ "mfc42", "ORDINAL 5261" ], [ "mfc42", "ORDINAL 2446" ], [ "mfc42", "ORDINAL 2124" ], [ "mfc42", "ORDINAL 5277" ], [ "mfc42", "ORDINAL 2983" ], [ "mfc42", "ORDINAL 3148" ], [ "mfc42", "ORDINAL 3260" ], [ "mfc42", "ORDINAL 4466" ], [ "mfc42", "ORDINAL 3269" ], [ "mfc42", "ORDINAL 2986" ], [ "mfc42", "ORDINAL 3080" ], [ "mfc42", "ORDINAL 4081" ], [ "mfc42", "ORDINAL 4624" ], [ "mfc42", "ORDINAL 723" ], [ "mfc42", "ORDINAL 3946" ], [ "mfc42", "ORDINAL 423" ], [ "mfc42", "ORDINAL 3692" ], [ "mfc42", "ORDINAL 3573" ], [ "mfc42", "ORDINAL 3626" ], [ "mfc42", "ORDINAL 2414" ], [ "mfc42", "ORDINAL 5787" ], [ "mfc42", "ORDINAL 1641" ], [ "mfc42", "ORDINAL 4023" ], [ "mfc42", "ORDINAL 5791" ], [ "mfc42", "ORDINAL 3663" ], [ "mfc42", "ORDINAL 5332" ], [ "mfc42", "ORDINAL 2541" ], [ "mfc42", "ORDINAL 5825" ], [ "mfc42", "ORDINAL 2801" ], [ "mfc42", "ORDINAL 2740" ], [ "mfc42", "ORDINAL 6030" ], [ "mfc42", "ORDINAL 4949" ], [ "mfc42", "ORDINAL 641" ], [ "mfc42", "ORDINAL 2514" ], [ "mfc42", "ORDINAL 324" ], [ "mfc42", "ORDINAL 4025" ], [ "mfc42", "ORDINAL 6261" ], [ "mfc42", "ORDINAL 758" ], [ "mfc42", "ORDINAL 3502" ], [ "mfc42", "ORDINAL 2158" ], [ "mfc42", "ORDINAL 475" ], [ "mfc42", "ORDINAL 5575" ], [ "mfc42", "ORDINAL 2452" ], [ "mfc42", "ORDINAL 3525" ], [ "mfc42", "ORDINAL 1656" ], [ "mfc42", "ORDINAL 434" ], [ "mfc42", "ORDINAL 6281" ], [ "mfc42", "ORDINAL 4768" ], [ "mfc42", "ORDINAL 1892" ], [ "mfc42", "ORDINAL 4252" ], [ "mfc42", "ORDINAL 1212" ], [ "mfc42", "ORDINAL 4570" ], [ "mfc42", "ORDINAL 4672" ], [ "mfc42", "ORDINAL 4843" ], [ "mfc42", "ORDINAL 5011" ], [ "mfc42", "ORDINAL 5265" ], [ "mfc42", "ORDINAL 4376" ], [ "mfc42", "ORDINAL 4853" ], [ "mfc42", "ORDINAL 4998" ], [ "mfc42", "ORDINAL 4713" ], [ "mfc42", "ORDINAL 6052" ], [ "mfc42", "ORDINAL 1775" ], [ "mfc42", "ORDINAL 2385" ], [ "mfc42", "ORDINAL 6371" ], [ "mfc42", "ORDINAL 5286" ], [ "mfc42", "ORDINAL 4438" ], [ "mfc42", "ORDINAL 3279" ], [ "mfc42", "ORDINAL 4625" ], [ "mfc42", "ORDINAL 4425" ], [ "mfc42", "ORDINAL 449" ], [ "mfc42", "ORDINAL 746" ], [ "mfc42", "ORDINAL 2278" ], [ "mfc42", "ORDINAL 2294" ], [ "mfc42", "ORDINAL 2362" ], [ "mfc42", "ORDINAL 2282" ], [ "mfc42", "ORDINAL 1176" ], [ "mfc42", "ORDINAL 1243" ], [ "mfc42", "ORDINAL 1578" ], [ "mfc42", "ORDINAL 600" ], [ "mfc42", "ORDINAL 826" ], [ "mfc42", "ORDINAL 269" ], [ "mfc42", "ORDINAL 5300" ], [ "mfc42", "ORDINAL 3346" ], [ "mfc42", "ORDINAL 2396" ], [ "mfc42", "ORDINAL 5199" ], [ "mfc42", "ORDINAL 1089" ], [ "mfc42", "ORDINAL 3922" ], [ "mfc42", "ORDINAL 5731" ], [ "mfc42", "ORDINAL 2985" ], [ "mfc42", "ORDINAL 3262" ], [ "mfc42", "ORDINAL 3136" ], [ "mfc42", "ORDINAL 4465" ], [ "mfc42", "ORDINAL 3259" ], [ "mfc42", "ORDINAL 3147" ], [ "mfc42", "ORDINAL 2982" ], [ "mfc42", "ORDINAL 5714" ], [ "mfc42", "ORDINAL 5289" ], [ "mfc42", "ORDINAL 5307" ], [ "mfc42", "ORDINAL 4698" ], [ "mfc42", "ORDINAL 2384" ], [ "mfc42", "ORDINAL 4079" ], [ "mfc42", "ORDINAL 2512" ], [ "mfc42", "ORDINAL 2554" ], [ "mfc42", "ORDINAL 4486" ], [ "mfc42", "ORDINAL 6375" ], [ "mfc42", "ORDINAL 4078" ], [ "mfc42", "ORDINAL 815" ], [ "mfc42", "ORDINAL 1576" ], [ "msvcrt", "p__commode" ], [ "msvcrt", "setmbcp" ], [ "msvcrt", "printf" ], [ "msvcrt", "p__fmode" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "except_handler3" ], [ "msvcrt", "??1type_info@@UAE@XZ" ], [ "msvcrt", "controlfp" ], [ "msvcrt", "memcpy" ], [ "msvcrt", "strlen" ], [ "msvcrt", "CxxFrameHandler" ], [ "msvcrt", "adjust_fdiv" ], [ "msvcrt", "setusermatherr" ], [ "msvcrt", "initterm" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "acmdln" ], [ "msvcrt", "exit" ], [ "msvcrt", "XcptFilter" ], [ "msvcrt", "exit" ], [ "msvcrt", "onexit" ], [ "msvcrt", "dllonexit" ], [ "msvcrt", "EH_prolog" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "LocalAlloc" ], [ "kernel32", "LocalFree" ], [ "kernel32", "GlobalAlloc" ], [ "kernel32", "GlobalLock" ], [ "kernel32", "GlobalFree" ], [ "kernel32", "LoadLibraryExA" ], [ "kernel32", "FindResourceA" ], [ "kernel32", "LoadResource" ], [ "kernel32", "SizeofResource" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "GetStartupInfoA" ], [ "user32", "EnableWindow" ], [ "user32", "ReleaseDC" ], [ "user32", "GetDC" ], [ "gdi32", "UnrealizeObject" ], [ "gdi32", "CreateSolidBrush" ], [ "gdi32", "GetObjectA" ], [ "gdi32", "RealizePalette" ], [ "gdi32", "GetStockObject" ], [ "gdi32", "ResizePalette" ], [ "gdi32", "CreateBitmap" ], [ "gdi32", "GetDeviceCaps" ], [ "gdi32", "GetPaletteEntries" ], [ "gdi32", "SetPaletteEntries" ], [ "gdi32", "CreatePalette" ], [ "gdi32", "PatBlt" ], [ "oleaut32", "ORDINAL 162" ], [ "msvcp60", "?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z" ], [ "msvcp60", "?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z" ], [ "msvcp60", "?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB" ], [ "msvcp60", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ" ], [ "msvcp60", "??1_Winit@std@@QAE@XZ" ], [ "msvcp60", "??0_Winit@std@@QAE@XZ" ], [ "msvcp60", "??1Init@ios_base@std@@QAE@XZ" ], [ "msvcp60", "??0Init@ios_base@std@@QAE@XZ" ] ], "m": { "pe": { "checksum": 131963.0, "icon_count": 2.0, "checksum_valid": 1.0, "resource_count": 7.0, "has_version_info": 1.0, "computed_checksum": 131963.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 90112.0, "entropy": 6.59, "size_bytes": 90112.0 }, "binary": { "is_pie": 0.0, "code_entropy": 4.7, "data_entropy": 0.79, "string_count": 791.0, "entropy_variance": 6.02, "avg_string_length": 6.54, "max_string_length": 89.0, "code_to_data_ratio": 0.86, "string_length_stddev": 7.3, "largest_section_ratio": 0.55, "sentence_string_count": 19.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 288.0 }, "sections": { "count": 4.0, "code_size": 24576.0, "entropy_max": 7.71, "entropy_mean": 4.4, "name_entropy": 2.93, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 7.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 216, "u8", "Rich" ], [ 496, "u8", ".text" ], [ 575, "u8", "@.data" ], [ 616, "u8", ".rsrc" ], [ 20914, "u8", "QQSVW" ], [ 21253, "u8", "QPWS" ], [ 26937, "u8", "XPVSS" ], [ 30368, "u8", "PAL.PalCtrl.1" ], [ 31192, "u8", "PAL.PalPropPage.1" ], [ 33836, "u8", "MFC42.DLL" ], [ 33848, "u8", "printf" ], [ 33858, "u8", "memcpy" ], [ 33868, "u8", "strlen" ], [ 33878, "u8", "__CxxFrameHandler" ], [ 33898, "u8", "_EH_prolog" ], [ 33912, "u8", "__dllonexit" ], [ 33926, "u8", "_onexit" ], [ 33934, "u8", "MSVCRT.dll" ], [ 33956, "u8", "_XcptFilter" ], [ 33970, "u8", "exit" ], [ 33978, "u8", "_acmdln" ], [ 33988, "u8", "__getmainargs" ], [ 34004, "u8", "_initterm" ], [ 34016, "u8", "__setusermatherr" ], [ 34036, "u8", "_adjust_fdiv" ], [ 34052, "u8", "__p__commode" ], [ 34068, "u8", "__p__fmode" ], [ 34082, "u8", "__set_app_type" ], [ 34100, "u8", "_except_handler3" ], [ 34120, "u8", "??1type_info@@UAE@XZ" ], [ 34144, "u8", "_controlfp" ], [ 34158, "u8", "GetCurrentProcess" ], [ 34178, "u8", "SizeofResource" ], [ 34196, "u8", "LoadResource" ], [ 34212, "u8", "FindResourceA" ], [ 34228, "u8", "LoadLibraryExA" ], [ 34246, "u8", "GlobalFree" ], [ 34260, "u8", "GlobalLock" ], [ 34274, "u8", "GlobalAlloc" ], [ 34288, "u8", "LocalFree" ], [ 34300, "u8", "LocalAlloc" ], [ 34314, "u8", "GetModuleHandleA" ], [ 34334, "u8", "GetStartupInfoA" ], [ 34350, "u8", "KERNEL32.dll" ], [ 34366, "u8", "EnableWindow" ], [ 34382, "u8", "ReleaseDC" ], [ 34394, "u8", "GetDC" ], [ 34400, "u8", "USER32.dll" ], [ 34414, "u8", "PatBlt" ], [ 34424, "u8", "UnrealizeObject" ], [ 34442, "u8", "CreateSolidBrush" ], [ 34462, "u8", "GetObjectA" ], [ 34476, "u8", "RealizePalette" ], [ 34494, "u8", "GetStockObject" ], [ 34512, "u8", "ResizePalette" ], [ 34528, "u8", "CreateBitmap" ], [ 34544, "u8", "GetDeviceCaps" ], [ 34560, "u8", "GetPaletteEntries" ], [ 34580, "u8", "SetPaletteEntries" ], [ 34600, "u8", "CreatePalette" ], [ 34614, "u8", "GDI32.dll" ], [ 34624, "u8", "OLEAUT32.dll" ], [ 34640, "u8", "??0Init@ios_base@std@@QAE@XZ" ], [ 34672, "u8", "??1Init@ios_base@std@@QAE@XZ" ], [ 34752, "u8", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ" ], [ 34826, "u8", "?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB" ], [ 34918, "u8", "?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z" ], [ 35006, "u8", "?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z" ], [ 35084, "u8", "MSVCP60.dll" ], [ 35098, "u8", "_setmbcp" ], [ 36916, "u8", "Lincoln" ], [ 36936, "u8", "My name is %s" ], [ 36968, "u8", "WerFault.exe" ], [ 36984, "u8", "1ADdpwyF" ], [ 36996, "u8", "438lo77oQYpKG6zYOdrbakPrElMlTfq6ZGLHPGtX" ], [ 37056, "u8", "AboutBox" ], [ 37068, "u8", "Handle" ], [ 37080, "u8", "Entry" ], [ 37088, "u8", "Picture" ], [ 37096, "u8", "Length" ], [ 37104, "u8", "CPalCtrl" ], [ 37116, "u8", "CPalPropPage" ], [ 37144, "u8", ".?AVCNoTrackObject@@" ], [ 37176, "u8", ".?AVAFX_MODULE_STATE@@" ], [ 37208, "u8", ".?AV_AFX_DLL_MODULE_STATE@@" ], [ 37256, "u8", ".?AVtype_info@@" ], [ 42513, "u8", "rnQGN" ], [ 43628, "u8", "up5Qsw" ], [ 44256, "u8", "h12\u003eK" ], [ 44790, "u8", "9OVR" ], [ 45695, "u8", "eQuv" ], [ 47917, "u8", "syM0G" ], [ 51141, "u8", "s07c3" ], [ 51985, "u8", "Y\u003c\u003cwm" ], [ 52549, "u8", "/6Cap" ], [ 53349, "u8", "/q3p" ], [ 55520, "u8", "sIPVTa" ], [ 55799, "u8", "Tdbf" ], [ 57114, "u8", "bytMu" ], [ 57292, "u8", "86.1" ], [ 60615, "u8", "/GQ3" ], [ 60690, "u8", "kX0mb" ], [ 60749, "u8", "cyVFo" ], [ 62968, "u8", "52zx" ], [ 65295, "u8", "zgIp" ], [ 66148, "u8", "ea1WO" ], [ 67229, "u8", "oP(]" ], [ 68675, "u8", "XtZ62" ], [ 73524, "u8", "EXYNxD" ], [ 75628, "u8", "84WC" ], [ 80296, "u8", "BvtmT" ], [ 82508, "u8", "qXjv" ], [ 82611, "u8", "zLZny" ], [ 84263, "u8", "QNZO" ], [ 84724, "u8", "SMBR" ], [ 85990, "wide", "About Pal Control" ], [ 86032, "wide", "MS Sans Serif" ], [ 86124, "wide", "Pal Control, Version 1.0" ], [ 86204, "wide", "© 1992 - 2001 Microsoft Corporation. All rights reserved." ], [ 86494, "wide", "VS_VERSION_INFO" ], [ 86586, "wide", "StringFileInfo" ], [ 86622, "wide", "040904B0" ], [ 86646, "wide", "CompanyName" ], [ 86678, "wide", "FileDescription" ], [ 86712, "wide", "PAL OLE Control DLL" ], [ 86758, "wide", "FileVersion" ], [ 86784, "wide", "1.0.001" ], [ 86806, "wide", "InternalName" ], [ 86846, "wide", "LegalCopyright" ], [ 86876, "wide", "Copyright © 1998, Microsoft Corporation" ], [ 86962, "wide", "LegalTrademarks" ], [ 87002, "wide", "OriginalFilename" ], [ 87036, "wide", "PAL.DLL" ], [ 87058, "wide", "ProductName" ], [ 87098, "wide", "ProductVersion" ], [ 87150, "wide", "OLESelfRegister" ], [ 87190, "wide", "VarFileInfo" ], [ 87222, "wide", "Translation" ], [ 87260, "wide", "Pal Control" ], [ 87284, "wide", "Pal Property Page" ], [ 87356, "wide", "General" ], [ 87418, "wide", "Can't resize palette" ] ], "v": { "file.stem": "8e0ab7b7cceb52d65aa48d610eaf7e7fecab025f88876bdcd72f7cd773dac182", "pe.imphash": "b15e5d82a7b6d1bb8a0c330f9b7e2344", "pe.machine": "i386", "pe.rich.key": 4282616525, "pe.rich.hash": "49f0d0ec13c9add6fae8e40ba05cdbed", "pe.subsystem": "windows_gui", "pe.timestamp": 1591131051, "file.basename": "8e0ab7b7cceb52d65aa48d610eaf7e7fecab025f88876bdcd72f7cd773dac182.exe", "pe.image_base": 4194304, "pe.image_size": 94208, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 26646, "pe.headers_size": 4096, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "c884fd2582c80e8b216d291d69562c60136a47dd", "pe.image_hash.sha256": "a368448b351a842c03b1c0a9a18d02d807d0ba0801e905280e77686ac070be1f", "pe.image_hash.sha384": "22f6b55f1b11c779aac37677ce36624a1927f48725f805a3912e29dde7f8e4c5810a806f454299f512c28a5b7a73da23", "pe.image_hash.sha512": "3c2b304311ad9630967b2b895752df0271567fe8bb2b3747eddfc1e621f9319a039433e76ff7e0af5c48d1d5f88f3d6e8a7618636bd80314ec613c3489bf73a7", "pe.resource_types[0]": "RT_BITMAP", "pe.resource_types[1]": "RT_ICON", "pe.resource_types[2]": "RT_DIALOG", "pe.resource_types[3]": "RT_STRING", "pe.resource_types[4]": "RT_RCDATA", "pe.resource_types[5]": "RT_GROUP_ICON", "pe.resource_types[6]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright © 1998, Microsoft Corporation", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.version.description": "PAL OLE Control DLL", "pe.linker_major_version": 6, "pe.version.file_version": "1.0.001", "pe.version.product_name": "PAL", "build.toolchain.compiler": "msvc", "pe.version.internal_name": "PAL", "pe.data_directories[0].rva": 32496, "pe.data_directories[1].rva": 45056, "pe.data_directories[2].rva": 28672, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1.0.001", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 160, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 46504, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 1180, "pe.rich.entries[0].build_id": 19, "pe.rich.entries[2].build_id": 19, "pe.rich.entries[3].build_id": 14, "pe.rich.entries[4].build_id": 10, "pe.rich.entries[5].build_id": 4, "pe.rich.entries[6].build_id": 1, "pe.rich.entries[7].build_id": 6, "pe.rich.entries[8].build_id": 11, "pe.rich.entries[0].use_count": 3, "pe.rich.entries[1].use_count": 1, "pe.rich.entries[2].use_count": 6, "pe.rich.entries[3].use_count": 2, "pe.rich.entries[4].use_count": 11, "pe.rich.entries[5].use_count": 7, "pe.rich.entries[6].use_count": 299, "pe.rich.entries[7].use_count": 1, "pe.rich.entries[8].use_count": 9, "pe.version.original_filename": "PAL.DLL", "pe.coff.dos_header_pe_pointer": 248, "pe.rich.entries[0].product_id": 8022, "pe.rich.entries[2].product_id": 8034, "pe.rich.entries[3].product_id": 7299, "pe.rich.entries[4].product_id": 8168, "pe.rich.entries[5].product_id": 8168, "pe.rich.entries[7].product_id": 1720, "pe.rich.entries[8].product_id": 8168 }, "id": "pe", "sc": [ [ ".text", 4096, 24576, 4.7, "r-x" ], [ ".rdata", 28672, 8192, 4.4, "r--" ], [ ".data", 36864, 4096, 0.79, "rw-" ], [ ".rsrc", 40960, 49152, 7.71, "r--" ] ] }, "id": 0, "sz": 90112, "ts": [ { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2, "el": [ "0x7060" ] }, { "c": 0.949999988079071, "d": "Wynncraft installer file version", "e": [ "1.0.001" ], "i": "well-known/game/mod::installer-file-version", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x15412" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.001" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x848e" ] }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage/control::get-dc", "l": 2, "el": [ "0x7494" ] }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 49152, entropy: 7.71)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "imports.count = 288.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 288.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2, "el": [ "0x705c" ] }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "0x8660" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x15296" ] }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-a", "l": 2, "el": [ "0x7050" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 288.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x7034" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 791.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "PAL" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2, "el": [ "0x7038" ] }, { "c": 1.0, "d": "PE has RT_BITMAP in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_DIALOG, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-bitmap-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x7448" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 288.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 288.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1, "el": [ "0x150bc" ] }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2, "el": [ "0x703c" ] }, { "c": 0.9800000190734863, "d": "GetStockObject import symbol", "e": [ "GetStockObject" ], "i": "metadata/binary/symbols/imports::getstockobject-import", "l": 1, "el": [ "0x7010" ] }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage/control::release-dc", "l": 2, "el": [ "0x7490" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x1535c" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x15316" ] }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025", "el": [ "0x8740" ] }, { "c": 0.8500000238418579, "d": "Links legacy MFC42 runtime", "e": [ "MFC42.DLL" ], "i": "micro-behaviors/dylib/library/legacy::mfc42-ref", "l": 2, "el": [ "0x842c" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2, "el": [ "0x7058" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x153da" ] }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2, "el": [ "0x8736" ] }, { "c": 1.0, "d": "PE has RT_DIALOG in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_DIALOG, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-dialog-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "PAL OLE Control DLL" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 288.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "String length", "e": [ "strlen" ], "i": "micro-behaviors/data/string/library::strlen", "l": 2, "el": [ "0x744c" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x151de" ] }, { "c": 0.8999999761581421, "d": "Formatted console output", "e": [ "printf" ], "i": "micro-behaviors/os/stdio::printf", "l": 2, "el": [ "0x7430" ] }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 288.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z", "StringFileInfo", "??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ", "?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB", "?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x88be", "0x1523a", "0x87c0", "0x880a", "0x8866" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "47" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x51be" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "imports.count = 288.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x9068" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_DIALOG, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 1998, Microsoft Corporation" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "8e0ab7b7cceb52d65aa48d610eaf7e7fecab025f88876bdcd72f7cd773dac182.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "8e0ab7b7cceb52d65aa48d610eaf7e7fecab025f88876bdcd72f7cd773dac182.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x15276" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 288.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2, "el": [ "0x7054" ] }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2, "el": [ "0x701c" ] }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage/control::enable-window", "l": 2, "el": [ "0x748c" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 288.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_DIALOG, RT_STRING, RT_RCDATA, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "8e0ab7b7cceb52d65aa48d610eaf7e7fecab025f88876bdcd72f7cd773dac182.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation", "Microsoft Corporation." ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1, "el": [ "0x1535c", "0x150bc" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x6ba2" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x9068" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "imports.count = 288.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-3--inline-29165", "l": 1, "m": "B0032" }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-a", "l": 3, "el": [ "0x704c" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "imports.count = 288.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-9--inline-29171", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x6ba2" ] }, { "c": 0.949999988079071, "d": "links kernel32 (GetModuleHandleA, LocalAlloc, LocalFree, GlobalAlloc, GlobalLock, ... +7 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "12 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (EnableWindow, ReleaseDC, GetDC)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "3 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcrt (p__commode, setmbcp, printf, p__fmode, set_app_type, ... +17 more)", "e": [ "msvcrt" ], "i": "metadata/dylib::msvcrt", "l": 2, "el": [ "22 symbols" ] }, { "c": 0.949999988079071, "d": "links mfc42 (ORDINAL 2976, ORDINAL 3401, ORDINAL 3830, ORDINAL 3831, ORDINAL 3825, ... +225 more)", "e": [ "mfc42" ], "i": "metadata/dylib::mfc42", "l": 2, "el": [ "230 symbols" ] }, { "c": 0.949999988079071, "d": "links gdi32 (UnrealizeObject, CreateSolidBrush, GetObjectA, RealizePalette, GetStockObject, ... +7 more)", "e": [ "gdi32" ], "i": "metadata/dylib::gdi32", "l": 2, "el": [ "12 symbols" ] }, { "c": 0.949999988079071, "d": "links oleaut32 (ORDINAL 162)", "e": [ "oleaut32" ], "i": "metadata/dylib::oleaut32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcp60 (?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z, ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z, ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB, ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ, ??1_Winit@std@@QAE@XZ, ... +3 more)", "e": [ "msvcp60" ], "i": "metadata/dylib::msvcp60", "l": 2, "el": [ "8 symbols" ] }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "Copyright © 1998, Microsoft Corporation", "PAL OLE Control DLL", "PAL", "imports.count = 288.00" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2, "el": [ "value:pe.version.copyright", "value:pe.version.description", "value:pe.version.product_name", "" ] }, { "a": "T1027.007", "c": 1.0, "d": "Benign unsigned Microsoft binary with many imports", "e": [ "imports.count = 288.00", "Microsoft Corporation.", "Microsoft Corporation" ], "i": "objectives/anti-static/obfuscation/imports::benign-unsigned-microsoft-import-heavy-context", "l": 1, "m": "B0032.014", "el": [ "", "0x150bc", "0x1535c" ] }, { "c": 1.0, "d": "Benign unsigned Microsoft binary with many imports", "e": [ "imports.count = 288.00", "Microsoft Corporation.", "Microsoft Corporation" ], "i": "metadata/binary/vendor::benign-unsigned-microsoft-import-heavy-context", "l": 1, "el": [ "", "0x150bc", "0x1535c" ] }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource extraction API chain", "e": [ "FindResourceA", "LoadResource", "LoadLibraryExA", "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-loader-api-chain", "l": 1, "el": [ "0x7050", "0x7054", "0x704c", "0x7058" ] } ], "sha": "8e0ab7b7cceb52d65aa48d610eaf7e7fecab025f88876bdcd72f7cd773dac182", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-06/8e0ab7b7cceb52d65aa48d610eaf7e7fecab025f88876bdcd72f7cd773dac182.exe", "type": "pe" } ], "tv": "52045" } }