{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9969948530197144, "class": 1 }, { "id": 1, "prob": 0.19194792211055756, "class": 0 }, { "id": 2, "prob": 0.0393291600048542, "class": 0 } ], "prob": 0.99699485, "class": 1, "oprob": 0.99699485, "models": [ { "m": "az", "prob": 0.99293596, "class": 0 }, { "m": "az/native", "prob": 0.99386084, "class": 0 }, { "m": "az/pe", "prob": 0.99699485, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9958679, 0.99937946 ], "analyzed_at": "2026-05-05T11:21:40Z" }, "path": "41630", "raw": { "v": "4", "fs": [ { "f": "KO₉(Al₂As₁₇C₇CoDy₂Er₇IPS)H₈(Os₅Db₂DsF₇Po₈UCm₂Cr)Md₃(BkBi₇Si)", "k": { "pe.checksum": "0x00099df6", "pe.timestamp": 1260053452, "hashes.imphash": "808c62c9bf1d68ec870c7870ef5c697e", "signing.issuer": "GlobalSign CodeSigning CA - SHA256 - G2", "signing.serial": "112179d435052eeaf0af4a60c93cf0595346", "signing.catalog": "authenticode", "signing.subject": "Click Yes", "build.target_arch": "x86", "pe.linker_version": "6.0", "signing.is_signed": true, "signing.not_after": 1445511612, "signing.not_before": 1413889212, "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.resource_types[4]": "RT_MANIFEST", "pe.rich_header.xor_key": "0x69ead975", "hashes.rich_header_hash": "3af60ee3a00303af57238645f1800db5946ac9c7000762e815c4089f1dff9a38", "pe.inflated_sections[0]": ".data", "pe.manifest.description": "Nullsoft Install System v2.46", "signing.thumbprint_sha1": "8be97d5f5cbd4cf2792732ce3cabfdf0b6c0c0d4", "pe.version_info.product_name": "Installation", "pe.version_info.product_version": "1.26.12.1", "binary.top_complex_unnamed[0].cc": 248, "binary.top_complex_unnamed[1].cc": 117, "binary.top_complex_unnamed[2].cc": 54, "binary.top_complex_unnamed[3].cc": 37, "binary.top_complex_unnamed[4].cc": 32, "binary.top_complex_unnamed[5].cc": 30, "binary.top_complex_unnamed[6].cc": 27, "binary.top_complex_unnamed[7].cc": 26, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.manifest.supported_os[0].guid": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.manifest.supported_os[0].name": "win7", "pe.manifest.supported_os[1].guid": "{e2011457-1546-43c5-a5fe-008deee3d3f0}", "pe.manifest.supported_os[1].name": "vista", "binary.top_complex_unnamed[0].bbs": 361, "binary.top_complex_unnamed[1].bbs": 189, "binary.top_complex_unnamed[2].bbs": 90, "binary.top_complex_unnamed[3].bbs": 66, "binary.top_complex_unnamed[4].bbs": 54, "binary.top_complex_unnamed[5].bbs": 49, "binary.top_complex_unnamed[6].bbs": 47, "binary.top_complex_unnamed[7].bbs": 40, "binary.top_complex_unnamed[0].addr": "0x401434", "binary.top_complex_unnamed[0].size": 5225, "binary.top_complex_unnamed[1].addr": "0x405e08", "binary.top_complex_unnamed[1].size": 2639, "binary.top_complex_unnamed[2].addr": "0x4046f9", "binary.top_complex_unnamed[2].size": 1537, "binary.top_complex_unnamed[3].addr": "0x4068ff", "binary.top_complex_unnamed[3].size": 827, "binary.top_complex_unnamed[4].addr": "0x4041fc", "binary.top_complex_unnamed[4].size": 821, "binary.top_complex_unnamed[5].addr": "0x405a2e", "binary.top_complex_unnamed[5].size": 576, "binary.top_complex_unnamed[6].addr": "0x402e5b", "binary.top_complex_unnamed[6].size": 546, "binary.top_complex_unnamed[7].addr": "0x405331", "binary.top_complex_unnamed[7].size": 462, "pe.manifest.assembly_identity.name": "Nullsoft.NSIS.exehead", "pe.manifest.assembly_identity.type": "win32", "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.rich_header.entries[0].use_count": 2, "pe.rich_header.entries[1].use_count": 155, "pe.rich_header.entries[2].use_count": 17, "pe.rich_header.entries[3].use_count": 10, "pe.rich_header.entries[4].use_count": 1, "pe.manifest.dependencies[0].language": "*", "pe.rich_header.entries[0].product_id": 95, "pe.rich_header.entries[1].product_id": 1, "pe.rich_header.entries[2].product_id": 93, "pe.rich_header.entries[3].product_id": 48, "pe.rich_header.entries[4].product_id": 6, "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "requireAdministrator", "pe.rich_header.entries[0].build_number": 4035, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[2].build_number": 4035, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 9044, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 1735, "pe.rich_header.entries[4].product_name": "Cvt_Pgo_VS_v6_or_earlier", "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.manifest.dependencies[0].processor_architecture": "X86", "pe.manifest.assembly_identity.processor_architecture": "X86" }, "x": 207, "id": 0, "is": [ "CompareFileTime", "SearchPathA", "GetShortPathNameA", "GetFullPathNameA", "MoveFileA", "SetCurrentDirectoryA", "GetFileAttributesA", "GetLastError", "CreateDirectoryA", "SetFileAttributesA", "Sleep", "GetTickCount", "GetFileSize", "GetModuleFileNameA", "GetCurrentProcess", "CopyFileA", "ExitProcess", "GetWindowsDirectoryA", "SetFileTime", "GetCommandLineA", "SetErrorMode", "LoadLibraryA", "lstrcpynA", "GetDiskFreeSpaceA", "GlobalUnlock", "GlobalLock", "CreateThread", "CreateProcessA", "RemoveDirectoryA", "CreateFileA", "GetTempFileNameA", "lstrlenA", "lstrcatA", "GetSystemDirectoryA", "GetVersion", "CloseHandle", "lstrcmpiA", "lstrcmpA", "ExpandEnvironmentStringsA", "GlobalFree", "GlobalAlloc", "WaitForSingleObject", "GetExitCodeProcess", "GetModuleHandleA", "LoadLibraryExA", "GetProcAddress", "FreeLibrary", "MultiByteToWideChar", "WritePrivateProfileStringA", "GetPrivateProfileStringA", "WriteFile", "ReadFile", "MulDiv", "SetFilePointer", "FindClose", "FindNextFileA", "FindFirstFileA", "DeleteFileA", "GetTempPathA", "EndDialog", "ScreenToClient", "GetWindowRect", "EnableMenuItem", "GetSystemMenu", "SetClassLongA", "IsWindowEnabled", "SetWindowPos", "GetSysColor", "GetWindowLongA", "SetCursor", "LoadCursorA", "CheckDlgButton", "GetMessagePos", "LoadBitmapA", "CallWindowProcA", "IsWindowVisible", "CloseClipboard", "SetClipboardData", "EmptyClipboard", "RegisterClassA", "TrackPopupMenu", "AppendMenuA", "CreatePopupMenu", "GetSystemMetrics", "SetDlgItemTextA", "GetDlgItemTextA", "MessageBoxIndirectA", "CharPrevA", "DispatchMessageA", "PeekMessageA", "DestroyWindow", "CreateDialogParamA", "SetTimer", "SetWindowTextA", "PostQuitMessage", "SetForegroundWindow", "wsprintfA", "SendMessageTimeoutA", "FindWindowExA", "SystemParametersInfoA", "CreateWindowExA", "GetClassInfoA", "DialogBoxParamA", "CharNextA", "OpenClipboard", "ExitWindowsEx", "IsWindow", "GetDlgItem", "SetWindowLongA", "LoadImageA", "GetDC", "EnableWindow", "InvalidateRect", "SendMessageA", "DefWindowProcA", "BeginPaint", "GetClientRect", "FillRect", "DrawTextA", "EndPaint", "ShowWindow", "SetBkColor", "GetDeviceCaps", "DeleteObject", "CreateBrushIndirect", "CreateFontIndirectA", "SetBkMode", "SetTextColor", "SelectObject", "SHGetPathFromIDListA", "SHBrowseForFolderA", "SHGetFileInfoA", "ShellExecuteA", "SHFileOperationA", "SHGetSpecialFolderLocation", "RegQueryValueExA", "RegSetValueExA", "RegEnumKeyA", "RegEnumValueA", "RegOpenKeyExA", "RegDeleteKeyA", "RegDeleteValueA", "RegCloseKey", "RegCreateKeyExA", "ImageList_AddMasked", "ImageList_Destroy", "ORDINAL 17", "ImageList_Create", "CoTaskMemFree", "OleInitialize", "OleUninitialize", "CoCreateInstance", "GetFileVersionInfoSizeA", "GetFileVersionInfoA", "VerQueryValueA" ], "ms": { "pe": { "signer": "GlobalSign, GlobalSign CodeSigning CA - SHA256 - G2, Click Yes", "machine": 332.0, "checksum": 630262.0, "rsrc_size": 8704.0, "subsystem": 2.0, "timestamp": 1260053452.0, "icon_count": 2.0, "image_base": 4194304.0, "leaf_issuer": "GlobalSign CodeSigning CA - SHA256 - G2", "leaf_serial": "112179d435052eeaf0af4a60c93cf0595346", "leaf_subject": "Click Yes", "rsrc_entropy": 4.24, "entry_section": ".text", "has_signature": true, "size_of_image": 241664.0, "timestamp_day": 5.0, "checksum_valid": true, "file_alignment": 512.0, "leaf_not_after": 1445511612.0, "primary_signer": "Click Yes", "resource_count": 5.0, "resource_types": [ "RT_ICON", "RT_DIALOG", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST" ], "signature_type": "developer", "timestamp_year": 2009.0, "characteristics": 271.0, "entry_point_rva": 12538.0, "leaf_not_before": 1413889212.0, "size_of_headers": 1024.0, "timestamp_month": 12.0, "cert_chain_depth": 2.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 8.0, "manifest_present": true, "certificate_count": 1.0, "computed_checksum": 630262.0, "section_alignment": 4096.0, "cert_validity_days": 366.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "dll_characteristics": 32768.0, "rich_header_present": true, "leaf_thumbprint_sha1": "8be97d5f5cbd4cf2792732ce3cabfdf0b6c0c0d4", "linker_major_version": 6.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 2952.0, "export_timestamp_present": false, "resource_timestamp_present": false, "max_section_inflation_ratio": 151.09 }, "file": { "size": 572440.0 }, "binary": { "code_size": 24064.0, "func_count": 37.0, "entry_point": 12538.0, "has_overlay": true, "code_entropy": 6.44, "data_entropy": 3.28, "func_density": 1.57, "import_count": 155.0, "overlay_size": 529552.0, "string_count": 447.0, "avg_func_size": 498.03, "has_signature": true, "overlay_ratio": 0.93, "section_count": 5.0, "avg_complexity": 21.14, "import_density": 6.6, "max_complexity": 248.0, "string_density": 19.02, "overall_entropy": 4.1, "overlay_entropy": 8.0, "avg_basic_blocks": 33.54, "avg_section_size": 7782.4, "dependency_count": 8.0, "entropy_variance": 2.18, "avg_string_length": 12.45, "complexity_per_kb": 0.9, "max_string_length": 958.0, "wide_string_count": 17.0, "writable_sections": 2.0, "avg_string_entropy": 2.62, "code_to_data_ratio": 1.62, "data_to_file_ratio": 0.0, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.04, "total_basic_blocks": 1241.0, "embedded_file_count": 1.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "string_length_stddev": 46.49, "high_complexity_funcs": 3.0, "largest_section_ratio": 0.04, "sentence_string_count": 13.0, "sentence_string_ratio": 0.03, "embedded_archive_count": 1.0, "behavioral_import_ratio": 0.03, "unnamed_complex_func_count": 3.0, "nonstandard_section_name_count": 1.0 }, "consistency": { "cert_issued_after_build": true, "manifest_product_version_mismatch": true } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 464, ".text" ], [ 543, "@.data" ], [ 584, ".ndata" ], [ 624, ".rsrc" ], [ 1703, "s495" ], [ 5720, "PSWV" ], [ 5939, "SQSSSPW" ], [ 6106, "VQSPW" ], [ 6225, "QVPW" ], [ 6243, "SQVPW" ], [ 9176, "t39u" ], [ 9472, "SUV3" ], [ 11294, "SUVW" ], [ 11548, "UUUUW" ], [ 19527, "PWVU" ], [ 19597, "PPPU" ], [ 19850, "SVW3" ], [ 21170, "HtVHtHH" ], [ 23912, "M 9D" ], [ 24354, "M 9M" ], [ 25740, "RichEdit" ], [ 25788, ".DEFAULT\\Control Panel\\International" ], [ 25828, "Control Panel\\Desktop\\ResourceLocale" ], [ 25868, "[Rename]" ], [ 25884, "Software\\Microsoft\\Windows\\CurrentVersion" ], [ 25928, "\\Microsoft\\Internet Explorer\\Quick Launch" ], [ 27132, "DeleteFileA" ], [ 27146, "FindFirstFileA" ], [ 27164, "FindNextFileA" ], [ 27180, "FindClose" ], [ 27192, "SetFilePointer" ], [ 27210, "ReadFile" ], [ 27222, "WriteFile" ], [ 27234, "GetPrivateProfileStringA" ], [ 27262, "WritePrivateProfileStringA" ], [ 27292, "MultiByteToWideChar" ], [ 27314, "FreeLibrary" ], [ 27328, "GetProcAddress" ], [ 27346, "LoadLibraryExA" ], [ 27364, "GetModuleHandleA" ], [ 27384, "GetExitCodeProcess" ], [ 27406, "WaitForSingleObject" ], [ 27428, "GlobalAlloc" ], [ 27442, "GlobalFree" ], [ 27456, "ExpandEnvironmentStringsA" ], [ 27484, "lstrcmpA" ], [ 27496, "lstrcmpiA" ], [ 27508, "CloseHandle" ], [ 27522, "SetFileTime" ], [ 27536, "CompareFileTime" ], [ 27554, "SearchPathA" ], [ 27568, "GetShortPathNameA" ], [ 27588, "GetFullPathNameA" ], [ 27620, "SetCurrentDirectoryA" ], [ 27644, "GetFileAttributesA" ], [ 27666, "GetLastError" ], [ 27682, "CreateDirectoryA" ], [ 27702, "SetFileAttributesA" ], [ 27724, "Sleep" ], [ 27732, "GetTickCount" ], [ 27748, "GetFileSize" ], [ 27762, "GetModuleFileNameA" ], [ 27784, "GetCurrentProcess" ], [ 27816, "ExitProcess" ], [ 27830, "GetWindowsDirectoryA" ], [ 27854, "GetTempPathA" ], [ 27870, "GetCommandLineA" ], [ 27888, "SetErrorMode" ], [ 27904, "LoadLibraryA" ], [ 27920, "lstrcpynA" ], [ 27932, "GetDiskFreeSpaceA" ], [ 27952, "GlobalUnlock" ], [ 27968, "GlobalLock" ], [ 27982, "CreateThread" ], [ 27998, "CreateProcessA" ], [ 28016, "RemoveDirectoryA" ], [ 28036, "CreateFileA" ], [ 28050, "GetTempFileNameA" ], [ 28070, "lstrlenA" ], [ 28082, "lstrcatA" ], [ 28094, "GetSystemDirectoryA" ], [ 28116, "GetVersion" ], [ 28128, "KERNEL32.dll" ], [ 28144, "EndPaint" ], [ 28168, "FillRect" ], [ 28180, "GetClientRect" ], [ 28196, "BeginPaint" ], [ 28210, "DefWindowProcA" ], [ 28228, "SendMessageA" ], [ 28244, "InvalidateRect" ], [ 28262, "EnableWindow" ], [ 28286, "LoadImageA" ], [ 28300, "SetWindowLongA" ], [ 28332, "IsWindow" ], [ 28344, "FindWindowExA" ], [ 28360, "SendMessageTimeoutA" ], [ 28382, "wsprintfA" ], [ 28394, "ShowWindow" ], [ 28408, "SetForegroundWindow" ], [ 28430, "PostQuitMessage" ], [ 28448, "SetWindowTextA" ], [ 28466, "SetTimer" ], [ 28478, "CreateDialogParamA" ], [ 28500, "DestroyWindow" ], [ 28516, "ExitWindowsEx" ], [ 28544, "DialogBoxParamA" ], [ 28562, "GetClassInfoA" ], [ 28578, "CreateWindowExA" ], [ 28596, "SystemParametersInfoA" ], [ 28620, "RegisterClassA" ], [ 28638, "EndDialog" ], [ 28650, "ScreenToClient" ], [ 28668, "GetWindowRect" ], [ 28684, "EnableMenuItem" ], [ 28702, "GetSystemMenu" ], [ 28718, "SetClassLongA" ], [ 28734, "IsWindowEnabled" ], [ 28752, "SetWindowPos" ], [ 28768, "GetSysColor" ], [ 28782, "GetWindowLongA" ], [ 28800, "SetCursor" ], [ 28812, "LoadCursorA" ], [ 28826, "CheckDlgButton" ], [ 28844, "GetMessagePos" ], [ 28860, "LoadBitmapA" ], [ 28874, "CallWindowProcA" ], [ 28892, "IsWindowVisible" ], [ 28910, "CloseClipboard" ], [ 28928, "SetClipboardData" ], [ 28948, "EmptyClipboard" ], [ 28966, "OpenClipboard" ], [ 28982, "TrackPopupMenu" ], [ 29000, "AppendMenuA" ], [ 29014, "CreatePopupMenu" ], [ 29032, "GetSystemMetrics" ], [ 29052, "SetDlgItemTextA" ], [ 29070, "GetDlgItemTextA" ], [ 29088, "MessageBoxIndirectA" ], [ 29122, "DispatchMessageA" ], [ 29142, "PeekMessageA" ], [ 29156, "USER32.dll" ], [ 29170, "SelectObject" ], [ 29186, "SetTextColor" ], [ 29214, "CreateFontIndirectA" ], [ 29236, "CreateBrushIndirect" ], [ 29258, "DeleteObject" ], [ 29274, "GetDeviceCaps" ], [ 29302, "GDI32.dll" ], [ 29314, "SHFileOperationA" ], [ 29334, "ShellExecuteA" ], [ 29350, "SHGetFileInfoA" ], [ 29368, "SHBrowseForFolderA" ], [ 29390, "SHGetPathFromIDListA" ], [ 29414, "SHGetSpecialFolderLocation" ], [ 29442, "SHELL32.dll" ], [ 29456, "RegEnumValueA" ], [ 29486, "RegQueryValueExA" ], [ 29506, "RegSetValueExA" ], [ 29524, "RegCreateKeyExA" ], [ 29542, "RegCloseKey" ], [ 29556, "RegDeleteValueA" ], [ 29574, "RegDeleteKeyA" ], [ 29590, "RegOpenKeyExA" ], [ 29604, "ADVAPI32.dll" ], [ 29620, "ImageList_Destroy" ], [ 29640, "ImageList_AddMasked" ], [ 29662, "ImageList_Create" ], [ 29680, "COMCTL32.dll" ], [ 29696, "CoCreateInstance" ], [ 29716, "OleUninitialize" ], [ 29734, "OleInitialize" ], [ 29750, "CoTaskMemFree" ], [ 29764, "ole32.dll" ], [ 29776, "VerQueryValueA" ], [ 29794, "GetFileVersionInfoA" ], [ 29816, "GetFileVersionInfoSizeA" ], [ 29840, "VERSION.dll" ], [ 30232, "verifying installer: %d%%" ], [ 30264, "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho" ], [ 30324, "incomplete download and damaged media. Contact the" ], [ 30375, "installer's author to obtain a new copy." ], [ 30417, "More information at:" ], [ 30438, "http://nsis.sf.net/NSIS_Error" ], [ 30468, "Error launching installer" ], [ 30508, "SeShutdownPrivilege" ], [ 30548, "NSIS Error" ], [ 30560, "Error writing temporary file. Make sure your temp folder is valid." ], [ 30652, ".exe" ], [ 30660, "open" ], [ 30668, "%u.%u%s%s" ], [ 30792, "SHGetFolderPathA" ], [ 30812, "SHFOLDER" ], [ 30824, "SHAutoComplete" ], [ 30840, "SHLWAPI" ], [ 30848, "GetUserDefaultUILanguage" ], [ 30876, "AdjustTokenPrivileges" ], [ 30900, "LookupPrivilegeValueA" ], [ 30924, "OpenProcessToken" ], [ 30944, "RegDeleteKeyExA" ], [ 30960, "ADVAPI32" ], [ 30984, "GetDiskFreeSpaceExA" ], [ 31004, "KERNEL32" ], [ 36100, "333A" ], [ 36707, "Ahhh" ], [ 37182, "wide", "MS Shell Dlg" ], [ 37784, "wide", "msctls_progress32" ], [ 37880, "wide", "SysListView32" ], [ 38072, "wide", "Please wait while Setup is loading..." ], [ 38198, "wide", "VS_VERSION_INFO" ], [ 38290, "wide", "StringFileInfo" ], [ 38350, "wide", "Comments" ], [ 38378, "wide", "CompanyName" ], [ 38414, "wide", "FileDescription" ], [ 38458, "wide", "LegalCopyright" ], [ 38498, "wide", "LegalTrademarks" ], [ 38542, "wide", "ProductName" ], [ 38568, "wide", "Installation" ], [ 38602, "wide", "ProductVersion" ], [ 38632, "wide", "1.26.12.1" ], [ 38658, "wide", "VarFileInfo" ], [ 38690, "wide", "Translation" ], [ 38720, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 39944, "NullsoftInst" ], [ 41305, "e8sp" ], [ 45215, "Gipc" ], [ 45972, "Ijre" ], [ 46077, "SS_Z" ], [ 46748, "ZYCQ" ], [ 46839, "7DG3E" ], [ 54388, "Kp f" ], [ 62278, "/9Z\thf1" ], [ 66539, "94H5OV" ], [ 67000, "HE5I" ], [ 70481, "X931" ], [ 73897, "Qodi" ], [ 75339, "/afd" ], [ 82581, "/ Hi" ], [ 90505, "9SPD" ], [ 99717, "vFxVqRN#7gbh9;" ], [ 101944, "2426" ], [ 103460, "XCJ4" ], [ 103626, "/RWQ" ], [ 104156, "r92\u003e" ], [ 105508, "RTTV" ], [ 105531, "T99N" ], [ 108596, "Gkyc" ], [ 109154, "Qjkdb_" ], [ 110835, "Hwqd" ], [ 111255, "7 5t" ], [ 111845, "P2NC" ], [ 114915, "ia.m" ], [ 118455, "UMB1" ], [ 121378, "Ufrjly" ], [ 122783, "T5GZ" ], [ 124969, "86EE" ] ], "sz": 572440, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: GlobalSign", "e": [ "GlobalSign" ], "i": "metadata/signed/developer::globalsign", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: GlobalSign CodeSigning CA - SHA256 - G2", "e": [ "GlobalSign CodeSigning CA - SHA256 - G2" ], "i": "metadata/signed/developer::globalsign-codesigning-ca---sha256---g2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Click Yes", "e": [ "Click Yes" ], "i": "metadata/signed/developer::click-yes", "l": 2 }, { "c": 1.0, "d": "Signed by Click Yes", "e": [ "Click Yes" ], "i": "metadata/signed/leaf::click-yes", "l": 3 }, { "a": "T1059", "c": 1.0, "d": "NSIS self-extracting installer", "e": [ "NSIS marker found, extracted" ], "i": "file/sfx/nsis", "l": 3 }, { "c": 0.800000011920929, "d": "Data before JAR/ZIP header", "e": [ "50 4B 03 04" ], "i": "objectives/anti-static/polyglot/format::jar-polyglot-prefix", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "c": 0.9300000071525574, "d": "unzip 0.15 library banner", "e": [ "unzip 0.15 Copyright 1998 Gilles Vollant" ], "i": "well-known/lib/zlib::unzip-015-banner", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 75.00", "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "129.1.19.5:5893" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.00", "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetSystemTimeAsFileTime", "GetModuleFileNameA", "UnhandledExceptionFilter", "GetCurrentProcessId", "WideCharToMultiByte", "InitializeCriticalSection", "GetUserObjectInformationW", "MultiByteToWideChar", "SetUnhandledExceptionFilter", "GetModuleFileNameW", "InterlockedDecrement", "InitializeCriticalSectionAndSpinCount", "InterlockedIncrement" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.57)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "HeapCreate", "CreateFileA", "CreateDirectoryA", "CreateFileW" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-3", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.91", "binary.overall_entropy = 4.14" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 369.00", "binary.func_count = 30.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.9900000095367432, "d": "MSVC C++ runtime strerror diagnostic string", "e": [ "Visual C++ CRT: Not enough memory to complete call to strerror." ], "i": "objectives/evasion/process/injection::msvc-crt-strerror-string", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 369.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.91", "binary.overall_entropy = 4.14" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.75, "d": "High entropy encrypted data", "e": [ ".rdata (entropy: 7.22)" ], "i": "micro-behaviors/data/encode/payload::payload-blob-metrics", "l": 3 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 3 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.949999988079071, "d": "links USER32.dll (MessageBoxA, DispatchMessageA, TranslateMessage, PeekMessageA, CharPrevA, ... +4 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 33.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 7.22)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesA" ], "i": "objectives/evasion/process/injection::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Too many links" ], "i": "objectives/evasion/masquerade/file/suspicious-path::exe-in-media-folder--rx-6", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 320.00" ], "i": "metadata/hardening::no-aslr-bit", "l": 1 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.26" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetSystemTimeAsFileTime", "GetUserDefaultLCID", "GetEnvironmentStringsW", "EnumSystemLocalesA", "GetCommandLineA", "FreeEnvironmentStringsW", "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "spanish-dominican republic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 75.00", "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 369.00", "binary.func_count = 30.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00", "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload::zip-magic", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "nsisunz.dll", "bb.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 369.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4f", "41", "48", "46", "49" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload::unusual-alignment-pe", "l": 4 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "GetTickCount", "QueryPerformanceCounter" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Timing-based anti-debugging pattern", "e": [ "QueryPerformanceCounter", "GetTickCount", "IsDebuggerPresent", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug", "l": 4, "m": "B0003.003" }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1121262082.00", "pe.timestamp = 1413873554.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetStringTypeW", "GetEnvironmentStringsW", "invalid string position", "FreeEnvironmentStringsW", "string too long", "LCMapStringW" ], "i": "micro-behaviors/communications/http/client::webclient--rx-7", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8600000143051147, "d": "High entropy rdata section", "e": [ ".rdata (entropy: 7.22)" ], "i": "metadata/binary/section/metrics::high-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "GetLocaleInfoW", "GetLocaleInfoA", "EnumSystemLocalesA", "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 33.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Too many links" ], "i": "objectives/evasion/process::exe-in-media-folder--rx-6", "l": 1 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetUserObjectInformationW", "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 40960.00", "pe.size_of_image = 139264.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (DeleteCriticalSection, InitializeCriticalSection, CreateDirectoryA, lstrcpyA, lstrcmpA, ... +19 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 33.00", "binary.import_count = 75.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "nsisunz.dll", "bb.dll" ], "i": "objectives/evasion/masquerade/dll::dll-basename", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 75.00", "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00", "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)", ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.26", "binary.sentence_string_ratio = 0.21" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 4575.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Error writing output file(s)", "Input/output error", "Error opening output file(s)" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 416.00", "binary.string_count = 103.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "DispatchMessageA" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-4", "l": 1, "m": "F0004" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetEnvironmentStringsW", "GetLocaleInfoA", "EnumSystemLocalesA", "FreeEnvironmentStringsW", "GetUserDefaultLCID", "GetLocaleInfoW" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassA" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "a": "T1195", "c": 0.949999988079071, "d": "NSIS installer manifest identity", "e": [ "Nullsoft Install System v2.46" ], "i": "well-known/malware/dropper/dragonbreath::nsis-manifest-identity", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.800000011920929, "d": "Convert Shell folder ID to path (ANSI)", "e": [ "SHGetPathFromIDListA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-path-from-idlist-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 3 }, { "c": 0.6499999761581421, "d": "Close clipboard", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard", "l": 3 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 6.60" ], "i": "metadata/binary/metrics::high-import-density", "l": 3 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with dense string corpus", "e": [ "binary.string_density = 19.02" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-string-density-large-pe", "l": 1, "m": "B0032" }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.8500000238418579, "d": "NSIS marker in low-string binary", "e": [ "…e=\"win32\"/\u003e\u003cdescription\u003eNullsoft Install System v2.46\u003c/description\u003e\u003cdep…" ], "i": "objectives/anti-static/obfuscation/imports::low-string-fp-nsis", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho", "incomplete download and damaged media. Contact the" ], "i": "micro-behaviors/communications/http/client::webclient--rx-5", "l": 1 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], "i": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration-cond-4--inline-3578", "l": 1 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.93" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 3 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is enabled", "e": [ "IsWindowEnabled" ], "i": "micro-behaviors/ui/window/manage::is-window-enabled", "l": 2 }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.9100000262260437, "d": "Regex component marker", "e": [ "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], "i": "micro-behaviors/process/enumerate/snapshot::toolhelp-module-enumeration-cond-4--inline-3572", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.800000011920929, "d": "Write data to clipboard", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "l": 3 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 3 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "SHFOLDER" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1027,T1112,T1059.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "RegSetValueExA" ], "i": "objectives/command-and-control/dropper/staging/embedded::registry-powershell-byte-payload--rx-4", "l": 1 }, { "c": 0.9800000190734863, "d": "NSIS exehead assembly manifest", "e": [ "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], "i": "metadata/binary/installer/script::nsis-manifest-exehead", "l": 1 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M" ], "i": "objectives/anti-static/obfuscation/payload::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Issued by GlobalSign Code Signing CA", "e": [ "GlobalSign CodeSigning CA - SHA256 - G2" ], "i": "metadata/signed::pe-cert-issuer-globalsign", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.699999988079071, "d": "Add masked image", "e": [ "ImageList_AddMasked" ], "i": "micro-behaviors/ui/controls/widget::image-list-add-masked", "l": 2 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 0.699999988079071, "d": "Get message cursor position", "e": [ "GetMessagePos" ], "i": "micro-behaviors/ui/window/manage::get-message-pos", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.6600000262260437, "d": "Copy files (Windows API ANSI)", "e": [ "CopyFileA" ], "i": "micro-behaviors/fs/file/copy::copyfile-a", "l": 3 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"assembly_identity\":{\"version\":\"1.0.0.0\",\"processor_architecture\":\"X86\",\"name\":\"Nullsoft.NSIS.exehead\",\"type\":\"win32\"},\"descrip" ], "i": "metadata/build::pe-has-manifest", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "41630" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.overlay_ratio = 0.93" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080", "l": 1 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 155.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "c": 1.0, "d": "NSIS runtime error URL in data", "e": [ "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho", "http://nsis.sf.net/NSIS_Error" ], "i": "metadata/binary/installer/script::nsis-error-url-data", "l": 1 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Compare file modification times", "e": [ "CompareFileTime" ], "i": "micro-behaviors/fs/sync/fsync::compare-file-time", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 0.7799999713897705, "d": "Perform file operation through shell ANSI", "e": [ "SHFileOperationA" ], "i": "micro-behaviors/fs/shell-ops::shell-file-operation-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], "i": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration-symbol-cond-4--inline-3575", "l": 1 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileA" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.699999988079071, "d": "Create image list", "e": [ "ImageList_Create" ], "i": "micro-behaviors/ui/controls/widget::image-list-create", "l": 2 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "incomplete download and damaged media. Contact the", "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "c": 0.699999988079071, "d": "Create brush object", "e": [ "CreateBrushIndirect" ], "i": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 0.6499999761581421, "d": "Check/uncheck dialog button", "e": [ "CheckDlgButton" ], "i": "micro-behaviors/ui/dialog/prompt::check-dialog-button", "l": 2 }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 529552.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 3 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "80 70 40 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops::shell-get-special-folder-location", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy image list", "e": [ "ImageList_Destroy" ], "i": "micro-behaviors/ui/controls/widget::image-list-destroy", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegQueryValueEx API", "e": [ "RegQueryValueExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-query-value", "l": 3, "m": "B0032" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.8999999761581421, "d": "Get process exit code", "e": [ "GetExitCodeProcess" ], "i": "micro-behaviors/process/create/spawn::get-exit-code-process", "l": 2 }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"processor_architecture\":\"X86\",\"public_key_token" ], "i": "metadata/build::pe-common-controls-v6", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 3 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 21.14" ], "i": "metadata/binary/metrics/markers::high-complexity-marker", "l": 1 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 0.75, "d": "Build temporary file name via GetTempFileName", "e": [ "GetTempFileNameA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-file-name", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceA", "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 1.0, "d": "NSIS runtime error title in data", "e": [ "NSIS Error" ], "i": "metadata/binary/installer/script::nsis-error-title-data", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 155.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "c": 1.0, "d": "Cert chain has only 2 entries", "e": [ "pe.cert_chain_depth = 2.00" ], "i": "metadata/signed::pe-cert-shallow-chain", "l": 3 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry values via import", "e": [ "RegEnumValueA" ], "i": "micro-behaviors/os/registry/access::reg-enum-value-a-symbol", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 3 }, { "c": 1.0, "d": "requestedExecutionLevel is requireAdministrator", "e": [ "requireAdministrator" ], "i": "metadata/build::pe-requires-admin", "l": 3 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.7200000286102295, "d": "Write INI string value", "e": [ "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::write-private-profile-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "SearchPathA", "GetTempPathA", "SHGetFolderPathA", "GetShortPathNameA", "GetFullPathNameA", "SHGetPathFromIDListA" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "c": 0.949999988079071, "d": "PE overlay exceeds ninety percent", "e": [ "binary.overlay_ratio = 0.93" ], "i": "metadata/binary/layout::overlay-over-90pct", "l": 3 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 3 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "c": 0.8500000238418579, "d": "Shutdown/restart system", "e": [ "ExitWindowsEx" ], "i": "micro-behaviors/ui/window/manage::exit-windows-ex", "l": 3 }, { "c": 0.75, "d": "Open clipboard access", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard", "l": 3 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "EmptyClipboard", "OpenClipboard", "SetClipboardData", "CloseClipboard" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload::reg-open-key", "l": 3, "m": "B0032" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.75, "d": "Clear clipboard contents", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.93" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1071", "c": 1.0, "d": "IsWindowVisible / IsWindowEnabled import", "e": [ "IsWindowVisible", "IsWindowEnabled" ], "i": "objectives/command-and-control/backdoor/binary::is-window-state-import", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 155.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Manifest declares only Vista support", "e": [ "[{\"guid\":\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\",\"name\":\"win7\"}, {\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\",\"name\":\"vista" ], "i": "metadata/build::pe-vista-only-manifest", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Delete registry key via import", "e": [ "RegDeleteKeyA" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-key-a-symbol", "l": 3 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/binary::get-window-rect-import", "l": 1, "m": "B0025" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE manifest version != VERSIONINFO product version", "e": [ "consistency.manifest_product_version_mismatch = 1.00" ], "i": "metadata/build::manifest-version-mismatch", "l": 4 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "78 70 40 00", "5c 71 40 00", "40 71 40 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.03" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1134.001", "c": 0.7799999713897705, "d": "Shutdown privilege name string", "e": [ "SeShutdownPrivilege" ], "i": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "l": 4 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 3 }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 529552.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, ... +4 more)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, ... +3 more)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, ... +1 more)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMCTL32.dll (ImageList_AddMasked, ImageList_Destroy, ORDINAL 17, ImageList_Create)", "e": [ "COMCTL32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindNextFileA", "FindFirstFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "c": 0.800000011920929, "d": "Thread synchronization via message queue", "e": [ "PeekMessageA", "CreateThread" ], "i": "micro-behaviors/process/threading/async::thread-message-sync", "l": 2 }, { "c": 0.8199999928474426, "d": "Reads and writes INI via ANSI", "e": [ "WritePrivateProfileStringA", "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle-ansi", "l": 3 }, { "c": 0.800000011920929, "d": "Small DLL with disproportionate import surface", "e": [ "binary.import_density = 6.60", "binary.export_count = 1.00", "binary.import_count = 155.00" ], "i": "metadata/binary/metrics::small-dll-heavy-imports", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "ReadFile", "GetModuleFileNameA", "CreateFileA", "GetFileSize" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 155.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection::msvc-crt-full-linkage", "l": 1 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempFileNameA", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 2, "m": "F0007" }, { "c": 0.800000011920929, "d": "Clipboard read/write API context", "e": [ "SetClipboardData", "OpenClipboard", "SetClipboardData", "CloseClipboard", "EmptyClipboard" ], "i": "objectives/collection/clipboard/capture::ethereum-address", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyExA", "RegCreateKeyExA", "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "c": 0.949999988079071, "d": "Nullsoft NSIS installer marker", "e": [ "NSIS Error", "http://nsis.sf.net/NSIS_Error", "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller's autho", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], "i": "metadata/binary/installer/script::nsis", "l": 3 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "SetClipboardData", "SetClipboardData", "CloseClipboard", "EmptyClipboard", "OpenClipboard" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 }, { "a": "T1622", "c": 0.8799999952316284, "d": "Installer binary with embedded anti-analysis techniques", "e": [ "QueryPerformanceCounter", "IsDebuggerPresent", "GetTickCount" ], "i": "objectives/anti-analysis/debugger-detect/check::installer-anti-analysis-suite", "l": 2, "m": "B0001" }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetTickCount", "GetSystemMetrics", "GetDiskFreeSpaceA", "GetDiskFreeSpaceExA" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "a": "T1105", "c": 0.9200000166893005, "d": "NSIS dominant encrypted overlay", "e": [ "binary.overlay_ratio = 0.93", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e", "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::nsis-dominant-encrypted-overlay", "l": 4, "m": "B0022" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "CreateFileA", "ReadFile", "GetModuleFileNameA", "binary.has_overlay = 1.00", "GetFileSize" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 4, "m": "B0032" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegOpenKeyExA", "RegOpenKeyExA", "RegSetValueExA", "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "c": 0.949999988079071, "d": "wsprintfA import present", "e": [ "wsprintfA" ], "i": "well-known/malware/worm/mydoom::wsprintfa-import", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load::load-library-w", "l": 3 } ], "sha": "9120688aa30cb57fced03a5247fecf9d14e59ff4c807dcd06f4f82b83d74256c", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/41630", "type": "pe" }, { "f": "KO₄(As₆C₃DyEr₄)H₂(DbCm)Md₃(SiBi₂Pa)", "x": 41, "dp": 1, "id": 1, "is": [ "DeleteCriticalSection", "InitializeCriticalSection", "CreateDirectoryA", "lstrcpyA", "lstrcmpA", "lstrcmpiA", "GlobalFree", "lstrcpynA", "GlobalAlloc", "lstrcatA", "lstrlenA", "GetVersion", "LeaveCriticalSection", "EnterCriticalSection", "GetStdHandle", "HeapAlloc", "GetProcessHeap", "HeapFree", "GetLastError", "CreateFileA", "WriteFile", "ReadFile", "CloseHandle", "SetFilePointer", "MessageBoxA", "DispatchMessageA", "TranslateMessage", "PeekMessageA", "CharPrevA", "wsprintfA", "SendMessageA", "GetDlgItem", "FindWindowExA" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "timestamp": 1121262082.0, "image_base": 268435456.0, "entry_section": ".text", "size_of_image": 40960.0, "timestamp_day": 13.0, "file_alignment": 4096.0, "timestamp_year": 2005.0, "characteristics": 8462.0, "entry_point_rva": 17930.0, "size_of_headers": 4096.0, "timestamp_month": 7.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 1121262082.0, "import_dll_count": 2.0, "computed_checksum": 102358.0, "section_alignment": 4096.0, "unusual_alignment": true, "number_of_sections": 4.0, "resource_timestamp": 0.0, "rich_header_present": true, "export_timestamp_day": 13.0, "linker_major_version": 6.0, "export_timestamp_year": 2005.0, "export_timestamp_month": 7.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "file": { "size": 40960.0 }, "binary": { "code_size": 16384.0, "func_count": 30.0, "entry_point": 17930.0, "code_entropy": 6.25, "data_entropy": 4.46, "export_count": 4.0, "func_density": 1.88, "import_count": 33.0, "string_count": 103.0, "avg_func_size": 646.2, "section_count": 4.0, "avg_complexity": 19.47, "import_density": 2.06, "max_complexity": 187.0, "string_density": 6.44, "overall_entropy": 4.14, "avg_basic_blocks": 33.4, "avg_section_size": 9216.0, "dependency_count": 2.0, "entropy_variance": 2.62, "avg_string_length": 14.74, "complexity_per_kb": 1.22, "max_string_length": 45.0, "writable_sections": 1.0, "avg_string_entropy": 3.0, "code_to_data_ratio": 0.8, "data_to_file_ratio": 0.1, "entry_point_is_rva": true, "text_to_file_ratio": 0.4, "total_basic_blocks": 1002.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "string_length_stddev": 9.52, "high_complexity_funcs": 2.0, "largest_section_ratio": 0.4, "sentence_string_count": 27.0, "sentence_string_ratio": 0.26 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 184, "Rich" ], [ 456, ".text" ], [ 535, "@.data" ], [ 576, ".reloc" ], [ 8142, "FLRP" ], [ 8713, "FLRPQ" ], [ 8782, "FPPQ" ], [ 14690, "SSWS" ], [ 15467, "SVW3" ], [ 16714, "NLWWW" ], [ 16765, "QQSVW" ], [ 17172, "F49E" ], [ 20945, "Qkkbal" ], [ 25919, "i91k" ], [ 26895, "M8MF" ], [ 27936, "/P8i" ], [ 28577, "/yQA" ], [ 30930, "129.1.19.5:5893" ], [ 31032, "inflate 1.2.2 Copyright 1995-2004 Mark Adler" ], [ 31336, "unzip 0.15 Copyright 1998 Gilles Vollant" ], [ 31622, "DeleteCriticalSection" ], [ 31646, "InitializeCriticalSection" ], [ 31674, "CreateDirectoryA" ], [ 31694, "lstrcpyA" ], [ 31706, "lstrcmpA" ], [ 31718, "lstrcmpiA" ], [ 31730, "GlobalFree" ], [ 31744, "lstrcpynA" ], [ 31756, "GlobalAlloc" ], [ 31770, "lstrcatA" ], [ 31782, "lstrlenA" ], [ 31794, "GetVersion" ], [ 31808, "LeaveCriticalSection" ], [ 31832, "EnterCriticalSection" ], [ 31856, "GetStdHandle" ], [ 31872, "HeapAlloc" ], [ 31884, "GetProcessHeap" ], [ 31902, "HeapFree" ], [ 31914, "GetLastError" ], [ 31930, "CreateFileA" ], [ 31944, "WriteFile" ], [ 31956, "ReadFile" ], [ 31968, "CloseHandle" ], [ 31982, "SetFilePointer" ], [ 31998, "KERNEL32.dll" ], [ 32014, "MessageBoxA" ], [ 32028, "DispatchMessageA" ], [ 32048, "TranslateMessage" ], [ 32068, "PeekMessageA" ], [ 32096, "wsprintfA" ], [ 32108, "SendMessageA" ], [ 32138, "FindWindowExA" ], [ 32152, "USER32.dll" ], [ 32256, "nsisunz.dll" ], [ 32268, "Unzip" ], [ 32285, "UnzipToStack" ], [ 32298, "extract_RunDLL" ], [ 32768, "invalid literal/length code" ], [ 32796, "invalid distance code" ], [ 32820, "invalid distance too far back" ], [ 32860, "incorrect length check" ], [ 32884, "incorrect data check" ], [ 32908, "invalid distances set" ], [ 32932, "invalid literal/lengths set" ], [ 32960, "invalid bit length repeat" ], [ 32988, "invalid code lengths set" ], [ 33016, "too many length or distance symbols" ], [ 33052, "invalid stored block lengths" ], [ 33084, "invalid block type" ], [ 33104, "header crc mismatch" ], [ 33124, "unknown header flags set" ], [ 33152, "incorrect header check" ], [ 33176, "invalid window size" ], [ 33196, "unknown compression method" ], [ 33224, "success" ], [ 33232, "/file" ], [ 33240, "/noextractpath" ], [ 33256, "Extract: %f" ], [ 33268, "Error reading ZIP filename parameter" ], [ 33308, "Error opening ZIP file" ], [ 33332, "Error extracting from ZIP file" ], [ 33364, "Error opening output file(s)" ], [ 33396, "aborted" ], [ 33404, "Error writing output file(s)" ], [ 33436, "File not found in archive" ], [ 33472, "Error reading destination directory parameter" ], [ 33520, "file" ], [ 33528, "noextractpath" ], [ 33544, "text" ], [ 33560, "%u byte%c" ], [ 33572, "(%u byte%c)" ], [ 33588, "%d.%d%d %cB%c" ], [ 33604, "SysListView32" ], [ 33632, "incompatible version" ], [ 33656, "buffer error" ], [ 33672, "insufficient memory" ], [ 33692, "data error" ], [ 33704, "stream error" ], [ 33720, "file error" ], [ 33732, "stream end" ], [ 33744, "need dictionary" ], [ 36897, "2)202\u003e2G2\\2c2q2z2" ] ], "sz": 40960, "ts": [ { "c": 0.9300000071525574, "d": "unzip 0.15 library banner", "e": [ "unzip 0.15 Copyright 1998 Gilles Vollant" ], "i": "well-known/lib/zlib::unzip-015-banner", "l": 2 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.26" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.14" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload::zip-magic", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 30.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.00" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.75, "d": "High entropy encrypted data", "e": [ ".rdata (entropy: 7.22)" ], "i": "micro-behaviors/data/encode/payload::payload-blob-metrics", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "nsisunz.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "nsisunz.dll" ], "i": "objectives/evasion/masquerade/dll::dll-basename", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 33.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 103.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.8600000143051147, "d": "High entropy rdata section", "e": [ ".rdata (entropy: 7.22)" ], "i": "metadata/binary/section/metrics::high-entropy-rdata-section", "l": 1 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 7.22)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 40960.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1121262082.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "DispatchMessageA" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-4", "l": 1, "m": "F0004" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Error opening output file(s)", "Error writing output file(s)" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "CreateDirectoryA", "CreateFileA" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-3", "l": 1, "m": "B0024" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "4f" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 30.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.14" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeCriticalSection" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Data before JAR/ZIP header", "e": [ "50 4B 03 04" ], "i": "objectives/anti-static/polyglot/format::jar-polyglot-prefix", "l": 1 }, { "c": 0.949999988079071, "d": "wsprintfA import present", "e": [ "wsprintfA" ], "i": "well-known/malware/worm/mydoom::wsprintfa-import", "l": 1 }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload::unusual-alignment-pe", "l": 4 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "129.1.19.5:5893" ], "i": "micro-behaviors/communications/ip::external-ipv4-port-binary-literal", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 33.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 33.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (DeleteCriticalSection, InitializeCriticalSection, CreateDirectoryA, lstrcpyA, lstrcmpA, ... +19 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (MessageBoxA, DispatchMessageA, TranslateMessage, PeekMessageA, CharPrevA, ... +4 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 } ], "sha": "6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/41630!!$PLUGINSDIR/nsisunz.dll", "type": "pe" }, { "f": "KO₅(Al₂Dy₂Er₅As₈C₃)H₅(DsPo₂CmCrDb)Md₃(Bi₄SiPa)", "x": 47, "dp": 1, "id": 2, "is": [ "GlobalFree", "lstrcpyA", "SetEndOfFile", "GetCurrentThreadId", "DecodePointer", "GetCommandLineA", "RaiseException", "GetLastError", "HeapFree", "EnterCriticalSection", "LeaveCriticalSection", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "HeapAlloc", "EncodePointer", "IsProcessorFeaturePresent", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "InterlockedIncrement", "GetModuleHandleW", "SetLastError", "InterlockedDecrement", "GetProcAddress", "Sleep", "ExitProcess", "SetHandleCount", "GetStdHandle", "InitializeCriticalSectionAndSpinCount", "GetFileType", "GetStartupInfoW", "DeleteCriticalSection", "GetModuleFileNameA", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStringsW", "HeapCreate", "HeapDestroy", "QueryPerformanceCounter", "GetTickCount", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "ReadFile", "SetFilePointer", "WriteFile", "GetConsoleCP", "GetConsoleMode", "FlushFileBuffers", "CloseHandle", "GetModuleFileNameW", "RtlUnwind", "HeapSize", "GetCPInfo", "GetACP", "GetOEMCP", "IsValidCodePage", "HeapReAlloc", "LoadLibraryW", "GetLocaleInfoW", "MultiByteToWideChar", "SetStdHandle", "WriteConsoleW", "LCMapStringW", "GetStringTypeW", "CreateFileW", "GetUserDefaultLCID", "GetLocaleInfoA", "EnumSystemLocalesA", "IsValidLocale", "InitializeCriticalSection", "GetProcessHeap" ], "ms": { "pe": { "machine": 332.0, "checksum": 135051.0, "rsrc_size": 1024.0, "subsystem": 3.0, "timestamp": 1413873554.0, "image_base": 268435456.0, "rsrc_entropy": 4.77, "entry_section": ".text", "size_of_image": 139264.0, "timestamp_day": 21.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 2.0, "resource_types": [ "RT_VERSION", "RT_MANIFEST" ], "timestamp_year": 2014.0, "characteristics": 8450.0, "entry_point_rva": 21323.0, "security_cookie": 268536368.0, "size_of_headers": 1024.0, "timestamp_month": 10.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 1413873554.0, "import_dll_count": 1.0, "manifest_present": true, "computed_checksum": 135051.0, "section_alignment": 4096.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "dll_characteristics": 320.0, "rich_header_present": true, "export_timestamp_day": 21.0, "linker_major_version": 10.0, "version_info_present": true, "export_timestamp_year": 2014.0, "api_hashing_indicators": 1.0, "export_timestamp_month": 10.0, "export_timestamp_present": true, "resource_timestamp_present": false }, "file": { "size": 116224.0 }, "binary": { "code_size": 79872.0, "func_count": 369.0, "entry_point": 21323.0, "code_entropy": 6.57, "data_entropy": 4.11, "export_count": 1.0, "func_density": 4.73, "import_count": 75.0, "string_count": 416.0, "avg_func_size": 257.37, "section_count": 5.0, "avg_complexity": 8.26, "import_density": 0.96, "max_complexity": 384.0, "string_density": 5.33, "overall_entropy": 4.91, "avg_basic_blocks": 12.4, "avg_section_size": 23040.0, "dependency_count": 1.0, "entropy_variance": 1.02, "avg_string_length": 19.59, "complexity_per_kb": 0.11, "max_string_length": 437.0, "wide_string_count": 52.0, "writable_sections": 1.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 2.26, "data_to_file_ratio": 0.05, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.69, "total_basic_blocks": 4575.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_strings": 3.0, "string_length_stddev": 27.19, "high_complexity_funcs": 4.0, "largest_section_ratio": 0.69, "sentence_string_count": 88.0, "sentence_string_ratio": 0.21, "behavioral_import_ratio": 0.03 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".rsrc" ], [ 647, "@.reloc" ], [ 5808, "PQVW" ], [ 7188, "L983" ], [ 7878, "9q8u" ], [ 9134, "SVWP" ], [ 10672, "CHVW9" ], [ 10751, "KTPVWQ" ], [ 11176, "VPRQ" ], [ 11328, "PQSVW" ], [ 26928, "f90u" ], [ 35810, "UVWS" ], [ 39905, "QSVP" ], [ 45433, "UQPXY]Y[" ], [ 52922, ".t|PVj@" ], [ 69094, "QSVW" ], [ 71275, "YYPV" ], [ 77686, "SW9E" ], [ 78128, "SVW3" ], [ 81348, "Unknown exception" ], [ 81400, "bad allocation" ], [ 81460, "wide", "KERNEL32.DLL" ], [ 81488, "FlsFree" ], [ 81496, "FlsSetValue" ], [ 81508, "FlsGetValue" ], [ 81520, "FlsAlloc" ], [ 81532, "CorExitProcess" ], [ 81548, "wide", "mscoree.dll" ], [ 81736, "wide", "runtime error" ], [ 81776, "wide", "TLOSS error" ], [ 81804, "wide", "SING error" ], [ 81832, "wide", "DOMAIN error" ], [ 81864, "wide", "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 82360, "wide", "R6032\r\n- not enough space for locale information" ], [ 82464, "wide", "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 82664, "wide", "R6030\r\n- CRT not initialized" ], [ 82728, "wide", "R6028\r\n- unable to initialize heap" ], [ 82808, "wide", "R6027\r\n- not enough space for lowio initialization" ], [ 82920, "wide", "R6026\r\n- not enough space for stdio initialization" ], [ 83032, "wide", "R6025\r\n- pure virtual function call" ], [ 83112, "wide", "R6024\r\n- not enough space for _onexit/atexit table" ], [ 83224, "wide", "R6019\r\n- unable to open console device" ], [ 83312, "wide", "R6018\r\n- unexpected heap error" ], [ 83384, "wide", "R6017\r\n- unexpected multithread lock error" ], [ 83480, "wide", "R6016\r\n- not enough space for thread data" ], [ 83568, "wide", "R6010\r\n- abort() has been called" ], [ 83640, "wide", "R6009\r\n- not enough space for environment" ], [ 83728, "wide", "R6008\r\n- not enough space for arguments" ], [ 83816, "wide", "R6002\r\n- floating point support not loaded" ], [ 84088, "wide", "Microsoft Visual C++ Runtime Library" ], [ 84180, "wide", "\u003cprogram name unknown\u003e" ], [ 84228, "wide", "Runtime Error!\n\nProgram:" ], [ 84280, "Complete Object Locator'" ], [ 84308, "Class Hierarchy Descriptor'" ], [ 84340, "Base Class Array'" ], [ 84360, "Base Class Descriptor at (" ], [ 84388, "Type Descriptor'" ], [ 84408, "`local static thread guard'" ], [ 84436, "`managed vector copy constructor iterator'" ], [ 84480, "`vector vbase copy constructor iterator'" ], [ 84524, "`vector copy constructor iterator'" ], [ 84560, "`dynamic atexit destructor for '" ], [ 84596, "`dynamic initializer for '" ], [ 84624, "`eh vector vbase copy constructor iterator'" ], [ 84668, "`eh vector copy constructor iterator'" ], [ 84708, "`managed vector destructor iterator'" ], [ 84748, "`managed vector constructor iterator'" ], [ 84788, "`placement delete[] closure'" ], [ 84820, "`placement delete closure'" ], [ 84848, "`omni callsig'" ], [ 84864, "delete[]" ], [ 84884, "`local vftable constructor closure'" ], [ 84920, "`local vftable'" ], [ 84948, "`udt returning'" ], [ 84964, "`copy constructor closure'" ], [ 84992, "`eh vector vbase constructor iterator'" ], [ 85032, "`eh vector destructor iterator'" ], [ 85064, "`eh vector constructor iterator'" ], [ 85100, "`virtual displacement map'" ], [ 85128, "`vector vbase constructor iterator'" ], [ 85164, "`vector destructor iterator'" ], [ 85196, "`vector constructor iterator'" ], [ 85228, "`scalar deleting destructor'" ], [ 85260, "`default constructor closure'" ], [ 85292, "`vector deleting destructor'" ], [ 85324, "`vbase destructor'" ], [ 85356, "`local static guard'" ], [ 85548, "operator" ], [ 85588, "delete" ], [ 85604, "__unaligned" ], [ 85616, "__restrict" ], [ 85636, "__eabi" ], [ 85644, "__clrcall" ], [ 85656, "__fastcall" ], [ 85668, "__thiscall" ], [ 85680, "__stdcall" ], [ 85692, "__pascal" ], [ 85704, "__cdecl" ], [ 86136, "wide", "dddd, MMMM dd, yyyy" ], [ 86176, "wide", "MM/dd/yy" ], [ 86212, "wide", "December" ], [ 86232, "wide", "November" ], [ 86252, "wide", "October" ], [ 86268, "wide", "September" ], [ 86288, "wide", "August" ], [ 86304, "wide", "July" ], [ 86316, "wide", "June" ], [ 86328, "wide", "April" ], [ 86340, "wide", "March" ], [ 86352, "wide", "February" ], [ 86372, "wide", "January" ], [ 86484, "wide", "Saturday" ], [ 86504, "wide", "Friday" ], [ 86520, "wide", "Thursday" ], [ 86540, "wide", "Wednesday" ], [ 86560, "wide", "Tuesday" ], [ 86576, "wide", "Monday" ], [ 86592, "wide", "Sunday" ], [ 86676, "dddd, MMMM dd, yyyy" ], [ 86696, "MM/dd/yy" ], [ 86716, "December" ], [ 86728, "November" ], [ 86740, "October" ], [ 86748, "September" ], [ 86760, "August" ], [ 86768, "July" ], [ 86776, "June" ], [ 86784, "April" ], [ 86792, "March" ], [ 86800, "February" ], [ 86812, "January" ], [ 86868, "Saturday" ], [ 86880, "Friday" ], [ 86888, "Thursday" ], [ 86900, "Wednesday" ], [ 86912, "Tuesday" ], [ 86920, "Monday" ], [ 86928, "Sunday" ], [ 86964, "GetProcessWindowStation" ], [ 86988, "GetUserObjectInformationW" ], [ 87016, "GetLastActivePopup" ], [ 87036, "GetActiveWindow" ], [ 87052, "MessageBoxW" ], [ 87062, "wide", "WUSER32.DLL" ], [ 87858, "wide", "h(((( H" ], [ 88536, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 88920, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 89160, "LC_TIME" ], [ 89168, "LC_NUMERIC" ], [ 89180, "LC_MONETARY" ], [ 89192, "LC_CTYPE" ], [ 89204, "LC_COLLATE" ], [ 89216, "LC_ALL" ], [ 89327, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 89448, "united-states" ], [ 89464, "united-kingdom" ], [ 89480, "trinidad \u0026 tobago" ], [ 89500, "south-korea" ], [ 89512, "south-africa" ], [ 89528, "south korea" ], [ 89540, "south africa" ], [ 89556, "slovak" ], [ 89564, "puerto-rico" ], [ 89576, "pr-china" ], [ 89588, "pr china" ], [ 89604, "new-zealand" ], [ 89616, "hong-kong" ], [ 89628, "holland" ], [ 89636, "great britain" ], [ 89652, "england" ], [ 89668, "china" ], [ 89676, "britain" ], [ 89684, "america" ], [ 89712, "swedish-finland" ], [ 89728, "spanish-venezuela" ], [ 89748, "spanish-uruguay" ], [ 89764, "spanish-puerto rico" ], [ 89784, "spanish-peru" ], [ 89800, "spanish-paraguay" ], [ 89820, "spanish-panama" ], [ 89836, "spanish-nicaragua" ], [ 89856, "spanish-modern" ], [ 89872, "spanish-mexican" ], [ 89888, "spanish-honduras" ], [ 89908, "spanish-guatemala" ], [ 89928, "spanish-el salvador" ], [ 89948, "spanish-ecuador" ], [ 89964, "spanish-dominican republic" ], [ 89992, "spanish-costa rica" ], [ 90012, "spanish-colombia" ], [ 90032, "spanish-chile" ], [ 90048, "spanish-bolivia" ], [ 90064, "spanish-argentina" ], [ 90084, "portuguese-brazilian" ], [ 90108, "norwegian-nynorsk" ], [ 90128, "norwegian-bokmal" ], [ 90148, "norwegian" ], [ 90160, "italian-swiss" ], [ 90176, "irish-english" ], [ 90192, "german-swiss" ], [ 90208, "german-luxembourg" ], [ 90228, "german-lichtenstein" ], [ 90248, "german-austrian" ], [ 90264, "french-swiss" ], [ 90280, "french-luxembourg" ], [ 90300, "french-canadian" ], [ 90316, "french-belgian" ], [ 90332, "english-usa" ], [ 90344, "english-us" ], [ 90356, "english-uk" ], [ 90368, "english-trinidad y tobago" ], [ 90396, "english-south africa" ], [ 90420, "english-nz" ], [ 90432, "english-jamaica" ], [ 90448, "english-ire" ], [ 90460, "english-caribbean" ], [ 90480, "english-can" ], [ 90492, "english-belize" ], [ 90508, "english-aus" ], [ 90520, "english-american" ], [ 90540, "dutch-belgian" ], [ 90556, "chinese-traditional" ], [ 90576, "chinese-singapore" ], [ 90596, "chinese-simplified" ], [ 90616, "chinese-hongkong" ], [ 90636, "chinese" ], [ 90652, "canadian" ], [ 90664, "belgian" ], [ 90672, "australian" ], [ 90684, "american-english" ], [ 90704, "american english" ], [ 90724, "american" ], [ 91468, "Norwegian-Nynorsk" ], [ 91516, "generic" ], [ 91552, "iostream" ], [ 91592, "system" ], [ 91628, "iostream stream error" ], [ 91888, "Visual C++ CRT: Not enough memory to complete call to strerror." ], [ 91968, "bad exception" ], [ 91984, "Illegal byte sequence" ], [ 92008, "Directory not empty" ], [ 92028, "Function not implemented" ], [ 92056, "No locks available" ], [ 92076, "Filename too long" ], [ 92096, "Resource deadlock avoided" ], [ 92124, "Result too large" ], [ 92144, "Domain error" ], [ 92160, "Broken pipe" ], [ 92172, "Too many links" ], [ 92188, "Read-only file system" ], [ 92212, "Invalid seek" ], [ 92228, "No space left on device" ], [ 92252, "File too large" ] ], "sz": 116224, "ts": [ { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.57)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.69" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Too many links" ], "i": "objectives/evasion/process::exe-in-media-folder--rx-6", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1106", "c": 0.699999988079071, "d": "EnumSystemLocales API", "e": [ "EnumSystemLocalesA" ], "i": "objectives/evasion/process/injection::enum-locale-callback", "l": 3, "m": "E1106" }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "spanish-dominican republic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 5632)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "GetStringTypeW", "LCMapStringW", "string too long", "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "invalid string position" ], "i": "micro-behaviors/communications/http/client::webclient--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.21" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.91" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 369.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 4575.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "Too many links" ], "i": "objectives/evasion/masquerade/file/suspicious-path::exe-in-media-folder--rx-6", "l": 1 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1024.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "bb.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoW", "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "bb.dll" ], "i": "objectives/evasion/masquerade/dll::dll-basename", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 416.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding::encoded-html-tag-fragment", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.26" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 75.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.9900000095367432, "d": "MSVC C++ runtime strerror diagnostic string", "e": [ "Visual C++ CRT: Not enough memory to complete call to strerror." ], "i": "objectives/evasion/process/injection::msvc-crt-strerror-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 139264.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1413873554.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Input/output error" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/metrics::minimal-exports", "l": 3 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameW" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesA" ], "i": "micro-behaviors/os/sysinfo/platform::enum-system-locales", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 369.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…embly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "HeapCreate", "CreateFileW" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-3", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "41", "46", "49", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 369.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount", "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.91" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8600000143051147, "d": "Query locale information", "e": [ "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetCurrentProcessId", "GetSystemTimeAsFileTime", "WideCharToMultiByte", "GetModuleFileNameW", "InitializeCriticalSection", "GetUserObjectInformationW", "MultiByteToWideChar", "SetUnhandledExceptionFilter", "GetProcessWindowStation", "InterlockedIncrement", "InterlockedDecrement", "InitializeCriticalSectionAndSpinCount", "UnhandledExceptionFilter", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 320.00" ], "i": "metadata/hardening::no-aslr-bit", "l": 1 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 75.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 369.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load::load-library-w", "l": 3 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GlobalFree, lstrcpyA, SetEndOfFile, GetCurrentThreadId, DecodePointer, ... +70 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "QueryPerformanceCounter", "GetTickCount" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Multiple Win32 locale discovery APIs", "e": [ "EnumSystemLocalesA", "GetUserDefaultLCID", "GetLocaleInfoA", "GetLocaleInfoW" ], "i": "micro-behaviors/os/sysinfo/platform::locale-environment-fingerprint", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetUserObjectInformationW", "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "a": "T1497.003", "c": 0.8999999761581421, "d": "Timing-based anti-debugging pattern", "e": [ "GetTickCount", "QueryPerformanceCounter", "IsDebuggerPresent", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug", "l": 4, "m": "B0003.003" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Windows locale fingerprinting imports", "e": [ "GetLocaleInfoW", "GetLocaleInfoA", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "EnumSystemLocalesA", "GetUserDefaultLCID" ], "i": "objectives/discovery/system/locale::windows-locale-fingerprint", "l": 3, "m": "E1082" }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Locale and environment profiling cluster", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "GetCommandLineA", "EnumSystemLocalesA", "GetUserDefaultLCID", "GetSystemTimeAsFileTime", "GetLocaleInfoA", "GetLocaleInfoW" ], "i": "objectives/discovery/system/locale::locale-and-environment-profiling", "l": 3, "m": "E1082" } ], "sha": "5796925a0ea7e39f8def61655aa2b26c8069d7e6aa7f3efbd794fba3e18ebd7e", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/41630!!$PLUGINSDIR/bb.dll", "type": "pe" } ], "tv": "27ac5" } }