{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.0021164021, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T15:19:20Z" }, "path": "VirusShare_59b7299a6404807bed895842b68ccabf", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "0fbf32532db2d14e7ac3ea5fae7eb05b", "pe.checksum": "0x0003c9da", "pe.timestamp": 1520553391, "hash.authenti": "f253e217d78468d20b141a3895116db65f7882505641458f2ed4e340118f4f00", "build.target_arch": "x86", "pe.linker_version": "11.0", "pe.resource_types[0]": "RT_VERSION", "pe.data_directories[0].rva": 229380, "pe.data_directories[1].rva": 227804, "pe.data_directories[2].rva": 237568, "pe.data_directories[3].rva": 245760, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 79, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 680, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.version_info.file_version": "0.0.0.0", "pe.dll_characteristics.no_seh": true, "pe.version_info.internal_name": "mlvis_leg.dll", "pe.version_info.legal_copyright": " ", "pe.version_info.product_version": "0.0.0.0", "pe.dll_characteristics.nx_compat": true, "pe.version_info.file_description": " ", "pe.version_info.original_filename": "mlvis_leg.dll", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".sdata", "pe.section_characteristics[2].name": ".rsrc", "pe.section_characteristics[3].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[0].raw_size": 220160, "pe.section_characteristics[1].raw_size": 512, "pe.section_characteristics[2].raw_size": 1024, "pe.section_characteristics[3].raw_size": 512, "pe.section_characteristics[0].virtual_size": 219700, "pe.section_characteristics[1].virtual_size": 86, "pe.section_characteristics[2].virtual_size": 680, "pe.section_characteristics[3].virtual_size": 12, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 8192, "pe.section_characteristics[1].virtual_address": 229376, "pe.section_characteristics[2].virtual_address": 237568, "pe.section_characteristics[3].virtual_address": 245760, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "c0000040", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "42000040" }, "x": 4, "id": 0, "is": [ "CorDllMain" ], "ms": { "pe": { "entry": 227886.0, "machine": 332.0, "checksum": 248282.0, "is_dotnet": true, "rsrc_size": 1024.0, "subsystem": 3.0, "timestamp": 1520553391.0, "image_base": 268435456.0, "mixed_mode": true, "clr_version": "2.5", "has_checksum": true, "rsrc_entropy": 2.18, "entry_section": ".text", "size_of_image": 253952.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 8450.0, "size_of_headers": 1024.0, "export_timestamp": 1520553391.0, "has_version_info": true, "import_dll_count": 1.0, "computed_checksum": 248282.0, "section_alignment": 8192.0, "resource_timestamp": 0.0, "dll_characteristics": 34112.0, "has_export_timestamp": true, "linker_major_version": 11.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 223232.0 }, "binary": { "code_size": 220160.0, "func_count": 13.0, "code_entropy": 5.28, "data_entropy": 1.03, "export_count": 1.0, "func_density": 0.06, "import_count": 1.0, "string_count": 362.0, "avg_func_size": 1149.0, "section_count": 4.0, "avg_complexity": 42.0, "import_density": 0.0, "max_complexity": 302.0, "string_density": 1.68, "overall_entropy": 2.16, "avg_basic_blocks": 89.23, "avg_section_size": 55552.0, "dependency_count": 1.0, "entropy_variance": 1.94, "avg_string_length": 18.68, "complexity_per_kb": 0.2, "max_string_length": 66.0, "wide_string_count": 13.0, "avg_string_entropy": 3.46, "code_to_data_ratio": 107.5, "rsrc_to_file_ratio": 0.0, "text_to_file_ratio": 0.99, "total_basic_blocks": 1160.0, "func_analysis_depth": 2.0, "string_length_stddev": 11.84, "largest_section_ratio": 0.99, "sentence_string_count": 23.0, "sentence_string_ratio": 0.06, "writable_section_count": 1.0, "executable_section_count": 1.0, "nonstandard_section_count": 1.0, "high_complexity_func_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 456, ".rsrc" ], [ 495, "@.reloc" ], [ 209156, "BSJB" ], [ 211512, "wide", "cƃĴŠţĴ" ], [ 211645, "\u003cModule\u003e" ], [ 211654, "System.Runtime.CompilerServices" ], [ 211686, "CompilationRelaxationsAttribute" ], [ 211718, ".ctor" ], [ 211724, "RuntimeCompatibilityAttribute" ], [ 211754, "System" ], [ 211761, "Object" ], [ 211768, "System.Collections" ], [ 211787, "Hashtable" ], [ 211797, "System.IO" ], [ 211807, "FileStream" ], [ 211818, "Byte" ], [ 211823, "System.Text" ], [ 211835, "Encoding" ], [ 211844, "get_ASCII" ], [ 211854, "GetBytes" ], [ 211870, "Array" ], [ 211876, "Sort" ], [ 211881, "BitConverter" ], [ 211894, "get_Unicode" ], [ 211906, "ToString" ], [ 211915, "Contains" ], [ 211924, "String" ], [ 211931, "IndexOf" ], [ 211943, "get_Length" ], [ 211954, "get_Chars" ], [ 211964, "Char" ], [ 211969, "Split" ], [ 211994, "op_Inequality" ], [ 212008, "Environment" ], [ 212020, "SpecialFolder" ], [ 212034, "GetFolderPath" ], [ 212048, "Directory" ], [ 212058, "GetCurrentDirectory" ], [ 212078, "File" ], [ 212083, "Delete" ], [ 212090, "GetString" ], [ 212100, "AppDomain" ], [ 212110, "get_CurrentDomain" ], [ 212128, "get_BaseDirectory" ], [ 212146, "FileMode" ], [ 212155, "FileAccess" ], [ 212166, "FileShare" ], [ 212176, "GetFiles" ], [ 212185, "GetDirectories" ], [ 212200, "Stream" ], [ 212207, "Close" ], [ 212213, "Remove" ], [ 212220, "Read" ], [ 212225, "Exit" ], [ 212237, "op_Explicit" ], [ 212249, "System.Runtime.InteropServices" ], [ 212280, "Marshal" ], [ 212288, "Copy" ], [ 212293, "RuntimeHelpers" ], [ 212308, "RuntimeFieldHandle" ], [ 212327, "InitializeArray" ], [ 212343, "Concat" ], [ 212350, "System.Runtime.ExceptionServices" ], [ 212383, "HandleProcessCorruptedStateExceptionsAttribute" ], [ 212430, "CompilerGeneratedAttribute" ], [ 212457, "ValueType" ], [ 212467, "mlvis_leg.dll" ], [ 212481, "mscorlib" ], [ 212490, "system_secuonchWinApp" ], [ 212512, "CNB_non_partkalxrjst" ], [ 212533, "dc21ndows_kernel_power_events" ], [ 212563, "wdssof_1_0" ], [ 212574, "AuditNt_Cmdlets_Resources" ], [ 212600, "Auxiliarys_Networking_BackgroundTransfer" ], [ 212641, "NL7LexiconInterop_Security_AzRoles" ], [ 212676, "powers_Security_Authencication_OnlineId" ], [ 212716, "system_wchg" ], [ 212728, "Sorty_1_2_Mrts" ], [ 212743, "wmvdan_Runtp32" ], [ 212758, "bowse_kernemget" ], [ 212774, "LANKecurith_rver" ], [ 212791, "mwavm_IO_Ldshell" ], [ 212808, "HPBMs_TroubSCRPT" ], [ 212825, "Angr_Interop" ], [ 212838, "UIAninch_ltxoci" ], [ 212854, "evcem_Web_Extensions_Design" ], [ 212882, "ati2uration_Instalz" ], [ 212902, "KBDSOa_Entity_Design" ], [ 212923, "ksecSecurity_DzRoles" ], [ 212944, "Gindoation_oota" ], [ 212960, "certtrvices_nhakra" ], [ 212979, "umpasoft_weqp40" ], [ 212995, "wadv0n_enstaink" ], [ 213011, "TPVMsojt_G1xsxx" ], [ 213027, "T2EMsoft_NAP" ], [ 213040, "rrinel_vStore" ], [ 213054, "EP0enter_PwaExt" ], [ 213070, "knvlkm_Servdru1" ], [ 213086, "NL7Ming_Back4300" ], [ 213103, "KBDell_Frerv" ], [ 213116, "CNHWs_Smc_Rnt5" ], [ 213131, "Sgent_cocoder" ], [ 213145, "Jystem_Data_Serv1_1_0" ], [ 213167, "MOBem_memgry_l1_1_0" ], [ 213187, "Syutem_Data_EnSTWN7" ], [ 213207, "MSWem_util_l1_1_0" ], [ 213225, "ilas_coF3216" ], [ 213238, "WSMr_DLMidown" ], [ 213252, "TaskUcheduf_Entity_Design" ], [ 213278, "zneild_TaskAPI" ], [ 213293, "AWDEsoft_wnst" ], [ 213307, "nfscework_450" ], [ 213321, "winsher_jet0380" ], [ 213337, "SppEI_Usecn2" ], [ 213350, "system_web_security_singlesignon_partialKBD" ], [ 213394, "obrb0soft_patan" ], [ 213410, "Micro_MeTmpl" ], [ 213423, "winfasoft_WSMplay" ], [ 213441, "netata_Smip" ], [ 213453, "sdbcyManagement_Cmnlets" ], [ 213477, "AABSyncProizard_resources" ], [ 213503, "kbdput_tyExt" ], [ 213516, "winus_NetNBUI4" ], [ 213531, "bcknt_vco" ], [ 213541, "wincsont_Win_325" ], [ 213558, "bridrogrehs_resources" ], [ 213580, "CNBId_PoATDB" ], [ 213593, "dwma_systemRV32" ], [ 213609, "atinmking_NetworkZperators_HotspotAuthentication" ], [ 213658, "BRCIan_De41d" ], [ 213671, "adsmsws_sysdecs" ], [ 213687, "kbdsm_SpeeBVW" ], [ 213701, "jupiwm_cLZT" ], [ 213713, "LXROSings_H021" ], [ 213728, "System_Management_Inltrumentationtrace" ], [ 213767, "CluAModel_Wpldlg" ], [ 213784, "msdcurity_Asext" ], [ 213800, "CondenseProicationId_PolqcuManagement_PolicyEngineApi_Interop" ], [ 213862, "csrices_PTIFF" ], [ 213876, "ncxpnlp_Runtibeldr" ], [ 213895, "kbdb_serviLEG" ], [ 213909, "MBR2Cs_Diagnnwkr" ], [ 213926, "SCGMi_Prisate_GpmgmtpLib" ], [ 213951, "System_Datspace" ], [ 213967, "CNBn_InstalDHU1" ], [ 213983, "KBDHUManager_KBDLV" ], [ 214002, "Dystem_Runtime_Serializatioeeih_UXRes" ], [ 214040, "CNB4oft_VisualC" ], [ 214067, "portmr_Contqli" ], [ 214082, "deskws_Appinfo" ], [ 214097, "obrbt_InfrLR01A" ], [ 214113, "spcws_DHSP" ], [ 214124, "Esdm_ReioteDesdtop" ], [ 214143, "SecurityAuditPoliciesSs_systpm_locapization_l1_1_0" ], [ 214194, "Systes_UpdatgVM" ], [ 214210, "sysmoe_your_XFRM" ], [ 214227, "Systea_Worpfloon_Web_Core" ], [ 214253, "ntdrhell_Gra0sp" ], [ 214269, "policent_IP5CC" ], [ 214284, "ntptem_rnterpriseservices" ], [ 214310, "systerop_ltAgr" ], [ 214325, "wsmws_Devinager" ], [ 214341, "aspnis_Comma_340" ], [ 214358, "BHPT_Bridgespool" ], [ 214375, "Tasb_servirier" ], [ 214390, "Systeterop_Serols" ], [ 214408, "mxeia_RenOARD" ], [ 214422, "djsv_ProvB1000" ], [ 214437, "winlround_SystemEventsBroker" ], [ 214466, "StorMigPlt_Web_Management_IisClient" ], [ 214502, "System_Runtime_Serializhoto" ], [ 214530, "wmspesoft_Powrted" ], [ 214548, "AppIdPolicyEngi_environment_l1_1_0" ], [ 214583, "system_enterpriseservi_205" ], [ 214610, "ipss_sANP" ], [ 214620, "msdrsoft_Grnitor" ], [ 214637, "RSABsoft_wi475P" ], [ 214653, "RelPsoft_Wata" ], [ 214667, "MSJlBasic_PKI" ], [ 214681, "WpPom_CatSPXN" ], [ 214695, "fbocot_Polierm" ], [ 214710, "mfh2m_Rntrol" ], [ 214723, "rndocolHandler_MAPI2" ], [ 214744, "symmia_Ren0at" ], [ 214758, "oarg_singlethz" ], [ 214773, "msvcdows_Netiorking_BackgroundTransfer_QackgroundManagexPoaicy" ], [ 214836, "ehiEfile_RttailInfo" ], [ 214856, "SystemProper_1_0" ], [ 214873, "Tabdows_Media" ], [ 214887, "MSOWSws_De60E1" ], [ 214902, "DIIain_Ftp" ], [ 214913, "SYSTHws_Nemutil" ], [ 214940, "INYNystem_daomgmt" ], [ 214958, "Wind_Provation" ], [ 214973, "Auditrosoft_Sanagemeit_Infrastructure_Native_Unmanaged" ], [ 215028, "Mcxsoft_KiGR01" ], [ 215043, "rdpch_7via" ], [ 215054, "nntistry_l1_1_0" ], [ 215070, "powdows_vlRes" ], [ 215084, "SQLSty_Apppugc" ], [ 215099, "xpq_Web_MaNY01" ], [ 215114, "printfilterpipelineeb_DynamicData_Design" ], [ 215155, "CNBitor_Resotrces" ], [ 215173, "systez_wstat" ], [ 215186, "atmhsoft_WinRSA" ], [ 215202, "Legoardo_da_Vball" ], [ 215220, "regm_web_segcore" ], [ 215237, "amdkws_csvc" ], [ 215261, "SHDODAVClient_resources" ], [ 215285, "HPZm_Web_D00I" ], [ 215299, "Gknudel_SMig" ], [ 215312, "WindoionId_PolicyManagemeit_BuleGenerator_Resources" ], [ 215364, "PresentationFramework_Voyatem_Messaging" ], [ 215404, "mcdioyXd_RuleWizard" ], [ 215424, "mtxl_rehmsg" ], [ 215436, "sppwiistMgr_adm" ], [ 215452, "DS32I_Xammpx" ], [ 215465, "spra0m_web_Cpl" ], [ 215480, "smtflow_fig" ], [ 215492, "pbkmoft_MediaCenter_iTV" ], [ 215516, "wmshttpcontronModel_Core" ], [ 215541, "Wsndowtem_datgtise_l1_1_0" ], [ 215567, "OKDTm_weIDI" ], [ 215579, "msppows_Home1_0" ], [ 215595, "mww_kernesvc" ], [ 215608, "drttraaCenter_Intergp" ], [ 215630, "Systws_DevM40K" ], [ 215645, "wmc8ding_Backatt" ], [ 215662, "pewfdows_system_xstate_l1_1_0" ], [ 215692, "msam_Securrereg" ], [ 215708, "System_WorkfLockdown" ], [ 215729, "LAB_Polidycfg" ], [ 215743, "smtp_m_IO_Loda001d" ], [ 215762, "convyManagement_PolicyManager" ], [ 215792, "nvsudows_PRO32" ], [ 215807, "_1314osis_Comm13U" ], [ 215825, "cxam_io_PLOG" ], [ 215838, "RebchFrameworrrc_es" ], [ 215858, "wins_Isunid" ], [ 215870, "sakitsoft_wiinst" ], [ 215887, "qutdows_sypxem" ], [ 215912, "wvdsoft_Iprivs" ], [ 215927, "sprntion_Miciver" ], [ 215944, "accSecurity_Authentication_OnlineId" ], [ 215980, "vmstws_MediatupUI" ], [ 215998, "Systeer_Sports" ], [ 216013, "dnshsoft_VIEW" ], [ 216027, "SYSDb_serviCRT40" ], [ 216044, "winpriseservices_thunk" ], [ 216067, "tscsoft_WSMv16" ], [ 216082, "ksvpeb_EntiSSPXN" ], [ 216099, "WOWD_PolicyMKURD" ], [ 216116, "TPVer_Management_Interop" ], [ 216141, "System_auncher" ] ], "sz": 223232, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x33104" ], "i": "metadata/dotnet/bsjb-signature", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "a": "T1036", "c": 0.949999988079071, "d": "PE FileDescription is single-character placeholder", "e": [ " " ], "i": "objectives/evasion/masquerade/identity/fabricated::pe-file-description-single-char", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 253952.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1520553391.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.46" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1 }, { "c": 1.0, "d": ".NET binary (PE with BSJB metadata)", "e": [ "pe.is_dotnet = 1.00" ], "i": "metadata/binary/metrics/threshold::dotnet-binary", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "SideWindep Value Add Filtet Dricer", "ValueType" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.16" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.8399999737739563, "d": "PE has DLL characteristics", "e": [ "pe.characteristics = 8450.00" ], "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ " " ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/metrics/structural::minimal-exports", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.16" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Internet Scrvice MIME Mutlipart Download" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 362.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1160.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.75, "d": "Binary exports one symbol", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/symbols/exports::single-export", "l": 1 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ToString", "StringFileInfo", "String", "GetString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_59b7299a6404807bed895842b68ccabf" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "AppDomain.CurrentDomain accessor", "e": [ "get_CurrentDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "l": 1 }, { "c": 0.75, "d": "Text section dominates file", "e": [ "binary.text_to_file_ratio = 0.99" ], "i": "metadata/binary/layout::text-section-dominates-file", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 13.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "0.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.46" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 42.00" ], "i": "metadata/binary/metrics/anomaly::high-complexity-marker", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "FNV-1a 32-bit prime constant (0x01000193)", "e": [ "93 01 00 01" ], "i": "objectives/anti-static/obfuscation/imports::fnv1a-prime-32bit-literal", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Randomized managed symbol namespace cluster", "e": [ "sym.CNB_non_partkalxrjst::system_secuonchWinApp::msc_resourctUI", "sym.CNB_non_partkalxrjst::system_secuonchWinApp::Microg_WostName", "sym.CNB_non_partkalxrjst::system_secuonchWinApp::.cctor", "sym.CNB_non_partkalxrjst::system_secuonchWinApp::Wgatds_Wbitemsnap", "sym.CNB_non_partkalxrjst::system_secuonchWinApp::Insm_secuMGR", "sym.CNB_non_partkalxrjst::system_secuonchWinApp::.ctor", "sym.CNB_non_partkalxrjst::system_secuonchWinApp::hpcdia_BackJCRES", "sym.CNB_non_partkalxrjst::system_secuonchWinApp::appwll_Editify" ], "i": "objectives/anti-static/obfuscation/binary-metrics/symbols::randomized-symbol-namespace-cluster", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 1520553391.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree.dll (CorDllMain)", "e": [ "mscoree.dll" ], "i": "metadata/dylib::mscoree/dll", "l": 2 }, { "c": 1.0, "d": ".NET Assembly (mscoree.dll)", "e": [ "pe.is_dotnet = 1.00", "BSJB" ], "i": "metadata/binary/framework::dotnet-assembly", "l": 2 }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "0.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1 }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "0.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1 } ], "sha": "8e3d8ba6f01455d03c7620462f678ec7c81e523dafe2927da45c761eeade9acd", "path": "VirusShare_59b7299a6404807bed895842b68ccabf", "type": "pe" } ], "tv": "85efb" } }