{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8731111884117126, "class": 0 } ], "prob": 0.8731112, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T01:24:00Z" }, "path": "71149", "raw": { "v": "4", "fs": [ { "f": "KO₃(As₈C₅I)H₂(OsPo)Md₂(Bi₆Si)", "x": 126, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "RegCloseKey", "BitBlt", "CoInitialize", "ORDINAL 6", "PathAppendW", "GetDC", "VerQueryValueW", "ORDINAL 15" ], "ms": { "pe": { "signer": "VeriSign Class 3 Code Signing 2010 CA, appbundler.com, VeriSign Class 3 Public Primary Certification Authority - G5, VeriSignMPKI-2-8", "machine": 332.0, "checksum": 394589.0, "rsrc_size": 7680.0, "subsystem": 2.0, "timestamp": 1349800480.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.73, "entry_section": "UPX1", "has_signature": true, "size_of_image": 770048.0, "timestamp_day": 9.0, "checksum_valid": true, "file_alignment": 512.0, "primary_signer": "appbundler.com", "resource_count": 8.0, "signature_type": "developer", "timestamp_year": 2012.0, "characteristics": 259.0, "entry_point_rva": 758880.0, "size_of_headers": 4096.0, "timestamp_month": 10.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 9.0, "manifest_present": true, "certificate_count": 1.0, "computed_checksum": 394589.0, "section_alignment": 4096.0, "number_of_sections": 3.0, "resource_timestamp": 0.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 10.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 3760.0, "export_timestamp_present": false, "resource_timestamp_present": false, "entry_in_nonstandard_section": true }, "binary": { "code_size": 321536.0, "file_size": 334000.0, "entry_point": 758880.0, "wx_sections": 2.0, "code_entropy": 3.96, "import_count": 14.0, "string_count": 284.0, "has_signature": true, "section_count": 3.0, "avg_complexity": 17.5, "function_count": 2.0, "import_density": 0.04, "max_complexity": 30.0, "string_density": 0.9, "overall_entropy": 4.21, "avg_basic_blocks": 30.0, "avg_section_size": 109738.66, "dependency_count": 9.0, "entropy_variance": 3.25, "function_density": 0.01, "avg_function_size": 300.0, "avg_string_length": 9.97, "complexity_per_kb": 0.06, "max_string_length": 364.0, "wide_string_count": 12.0, "writable_sections": 3.0, "avg_string_entropy": 2.43, "code_to_data_ratio": 41.87, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "total_basic_blocks": 60.0, "executable_sections": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 23.48, "largest_section_ratio": 0.96, "sentence_string_count": 8.0, "sentence_string_ratio": 0.03, "behavioral_import_ratio": 0.29, "function_analysis_depth": 2.0, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 224, "Rich" ], [ 496, "UPX0" ], [ 536, "UPX1" ], [ 576, ".rsrc" ], [ 987, "3.03" ], [ 1214, "LYY]QSVW3" ], [ 4059, "P79Z" ], [ 5759, "CJTP" ], [ 8075, "VRP9" ], [ 8736, "TRWT" ], [ 10993, "FVHWW" ], [ 15024, "6AVW" ], [ 17315, "PM4TA" ], [ 17819, "Nmuxu" ], [ 18520, "RAQIF" ], [ 21110, "IM8Y" ], [ 21494, "6E I" ], [ 24160, "5FL4H" ], [ 24976, "A76X" ], [ 26254, "t3j1" ], [ 27647, "/407" ], [ 27786, "Akeq" ], [ 27884, "Y887" ], [ 28965, "NMHI" ], [ 29905, "FNAXD" ], [ 29959, "e3pk" ], [ 30064, "VPQS" ], [ 32400, "LDDL9" ], [ 38008, "a3g1" ], [ 38709, "Fclfl" ], [ 40046, "KXVQ" ], [ 42782, "s70a" ], [ 45089, "W9AB" ], [ 50007, "WPOC9" ], [ 53095, "GBVP" ], [ 56916, "p551" ], [ 59230, "CTA9" ], [ 64761, "/oS1tS" ], [ 65858, "V 8Y2" ], [ 67739, "TSPN" ], [ 67816, "VSVU" ], [ 68680, "MVB2" ], [ 70407, "OYC7" ], [ 70814, "R28L" ], [ 72193, "FFF6" ], [ 73467, "ds90" ], [ 75733, "GSCD" ], [ 76132, "4YZT" ], [ 76605, "ED 3" ], [ 77419, "PW2V" ], [ 84341, "HK8WD" ], [ 85774, "/XJP" ], [ 87018, "OPQI" ], [ 89161, "r8vo" ], [ 93049, "64 M" ], [ 93403, "PX2L" ], [ 94139, "Ximnt" ], [ 94303, "COPD" ], [ 94528, "XSF8" ], [ 94865, "Zw n" ], [ 96084, "JJXB" ], [ 97995, "Pcvu" ], [ 99809, "s6t2" ], [ 101830, "Pvnh" ], [ 102445, "OWN8" ], [ 102784, "14dv" ], [ 105060, "WVQS" ], [ 117117, "t0h8" ], [ 122164, "571A" ], [ 126255, "6VYJ" ], [ 126414, "C306" ], [ 127373, "HLPTrrr" ], [ 127383, "\\`drrrrhlpt" ], [ 130187, "PLPW" ], [ 130728, "S4LL" ], [ 131415, "KHFK4" ], [ 137533, "8S2P" ], [ 138205, "PSC82" ], [ 139366, "pzJKKhT" ], [ 139648, "8l w" ], [ 142310, "P3UU" ], [ 145743, "Kpvna" ], [ 147450, "ITIB" ], [ 148051, "d allocation8Se" ], [ 148071, "re*StackGuarantee" ], [ 148409, "qpnGcjGp" ], [ 148738, "Huqf" ], [ 149163, "Decembe" ], [ 149205, "Apri" ], [ 149360, "+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJ" ], [ 149396, "KLMNO" ], [ 149420, "abcdefghijklmnopq" ], [ 149535, "exp10" ], [ 149847, "16LE" ], [ 149856, "UNICODe" ], [ 149924, "ageBoxbU" ], [ 150182, "/new" ], [ 150205, "RTTI" ], [ 150288, "/efa" ], [ 152247, "/LYo" ], [ 152449, "W_FD" ], [ 153181, "8IZM" ], [ 153289, "ance" ], [ 153508, "V.if" ], [ 153741, "G O3" ], [ 154821, "ditcoddI/" ], [ 155704, "%s%02d." ], [ 156098, "Sfbm" ], [ 156338, "/j7L" ], [ 156434, "ovqKSM_E" ], [ 156482, "KYFC" ], [ 156700, "ax_oJxhd" ], [ 156935, "F2_A" ], [ 158096, "56cs" ], [ 159906, "/fL1" ], [ 160119, "ur985" ], [ 160735, "o77k" ], [ 161139, "quoc" ], [ 161229, "ific" ], [ 161461, "CSIDIS" ], [ 161900, "[CDATA[ ]]\u003e" ], [ 162283, "m.od" ], [ 162364, "Fail" ], [ 166948, "wzx GNr" ], [ 168738, "o7rb" ], [ 173870, "/90DQv" ], [ 177837, "HMXB" ], [ 178344, "_$_MODULE70?" ], [ 178372, "CT@\\SAIApp@a" ], [ 178612, "Cf.rtyHR" ], [ 178692, "aunchto" ], [ 179083, "minWOSZSupC" ], [ 179586, "Qkkbal" ], [ 180430, "ZEvtSyncSockZ" ], [ 180553, "d0778b_ac99_4c58" ], [ 180611, "2UIA" ], [ 181077, "Poly" ], [ 181583, "4@.Md;P" ], [ 183330, "PQWJ" ], [ 185043, "RBF0" ], [ 185340, "jo0d" ], [ 185516, "6HPT" ], [ 185971, "84bp" ], [ 186509, "JWI5" ], [ 190639, "EG99" ], [ 191502, "UMCV" ], [ 192584, "MCDQ" ], [ 192761, "TI://%P-LKI" ], [ 194048, "f930u" ], [ 194172, "QE0A" ], [ 194492, "FWC5" ], [ 195284, "S 4L" ], [ 197608, "NFIFX" ], [ 200474, "c/SOFTWARE\\Goo2o.K" ], [ 200528, "_Micros" ], [ 200540, "\\Is\\Cur.nta" ], [ 200594, "-CF10577473F" ], [ 200613, "2318C2B" ], [ 200638, "09027" ], [ 200644, "CD4F" ], [ 200685, "985BA" ], [ 200717, "813C" ], [ 200745, "GTAPI" ], [ 201881, ".dyd" ], [ 201898, "SDS1" ], [ 201943, "Studioj" ], [ 203096, "7OEM" ], [ 204048, "3orsk" ], [ 204453, "152Y2s2\u003e3D3L" ], [ 205230, "3.343=3B3Q3x3" ], [ 205318, "73898" ], [ 205324, "i8o8" ], [ 206396, "s182u2" ], [ 206941, "P7T7X7\\7`7p7t" ], [ 208608, "67E Z" ], [ 209522, "M 4BY" ], [ 212034, "`A1DG`" ], [ 213593, "G5RZ" ], [ 215276, "R71PGUP" ], [ 215635, "mp.qp" ], [ 218158, "g 50" ], [ 222483, "60jx" ], [ 224581, "HBQJ" ], [ 225470, "/bN{4Udx" ], [ 227420, "/JwQjF" ], [ 230243, "/0Hp" ], [ 231050, "bm17" ], [ 231234, "E0IRG" ], [ 232052, "j33l" ], [ 234041, "AD_C" ], [ 235558, "LTUD" ], [ 238332, "`W~=`" ], [ 244554, "N1G8" ], [ 247085, "2GI2R" ], [ 250064, "/CGy" ], [ 253572, "pn92" ], [ 267323, "\\2\u003eN" ], [ 270082, "/Kdw" ], [ 270876, "wi1b" ], [ 288153, "n\u003c\u003c0" ], [ 289450, "ua4o" ], [ 289989, "07IZ" ], [ 293814, "g82c" ], [ 295900, "YUVR" ], [ 296772, "SSJH" ], [ 300449, "X5VT" ], [ 306036, "8Y7S" ], [ 306294, "Y2DS" ], [ 308086, "/Y6v" ], [ 308626, "/t6i" ], [ 313561, "FX78" ], [ 315380, "WkV21TSav^8{3" ], [ 316454, "QTVTSkllZTTXRTUiH@" ], [ 316540, "vrrwsqpon" ], [ 316868, "MNOLO" ], [ 316897, "JHHG" ], [ 318713, "NOMR" ], [ 320421, "SC7W" ], [ 321610, "A0BB" ], [ 322037, "XPTPSW" ], [ 323826, "wide", "BINARY" ], [ 323840, "wide", "JPEG" ], [ 323850, "wide", "SDJT" ], [ 325919, "wwwwwwwxp" ], [ 327415, "X1CC" ], [ 328594, "wide", "VS_VERSION_INFO" ], [ 328686, "wide", "StringFileInfo" ], [ 328746, "wide", "FileDescription" ], [ 328780, "wide", "Setup" ], [ 328798, "wide", "FileVersion" ], [ 328824, "wide", "3.0.106.1" ], [ 328850, "wide", "ProductVersion" ], [ 328906, "wide", "VarFileInfo" ], [ 328938, "wide", "Translation" ], [ 328972, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e\u003cse" ], [ 329338, "\u003capplication\u003e" ], [ 329357, "\u003csupportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"\u003e\u003c/supportedOS\u003e" ], [ 329436, "\u003csupportedOS Id=\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\"\u003e\u003c/supportedOS\u003e" ], [ 329515, "\u003c/application\u003e" ], [ 329535, "\u003c/compatibility\u003e\u003c/assembly\u003e" ], [ 329856, "KERNEL32.DLL" ], [ 329869, "ADVAPI32.dll" ], [ 329882, "GDI32.dll" ], [ 329892, "ole32.dll" ], [ 329902, "OLEAUT32.dll" ], [ 329915, "SHLWAPI.dll" ], [ 329927, "USER32.dll" ], [ 329938, "VERSION.dll" ], [ 329950, "WS2_32.dll" ], [ 329962, "LoadLibraryA" ], [ 329976, "GetProcAddress" ], [ 329992, "VirtualProtect" ], [ 330008, "VirtualAlloc" ], [ 330022, "VirtualFree" ], [ 330036, "ExitProcess" ] ], "sz": 334000, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Code Signing 2010 CA", "e": [ "VeriSign Class 3 Code Signing 2010 CA" ], "i": "metadata/signed/developer::verisign-class-3-code-signing-2010-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: appbundler.com", "e": [ "appbundler.com" ], "i": "metadata/signed/developer::appbundler.com", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Public Primary Certification Authority - G5", "e": [ "VeriSign Class 3 Public Primary Certification Authority - G5" ], "i": "metadata/signed/developer::verisign-class-3-public-primary-certification-authority---g5", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSignMPKI-2-8", "e": [ "VeriSignMPKI-2-8" ], "i": "metadata/signed/developer::verisignmpki-2-8", "l": 2 }, { "c": 1.0, "d": "Signed by appbundler.com", "e": [ "appbundler.com" ], "i": "metadata/signed/leaf::appbundler.com", "l": 3 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Append child path via Shlwapi", "e": [ "PathAppendW" ], "i": "micro-behaviors/fs/path/construct::path-append", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1349800480.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 284.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics/markers::low-function-count-marker", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1071", "c": 1.0, "d": "oleaut32 ordinal 15", "e": [ "ORDINAL 15" ], "i": "objectives/command-and-control/backdoor/binary::oleaut-ordinal-15", "l": 1, "m": "B0025" }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.21" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics::no-functions", "l": 2 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 7680.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 334000.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.21" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.43" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 770048.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 0.9800000190734863, "d": "AppBundler certificate subject", "e": [ "appbundler.com1\u003e0\u003c", "appbundler.com0" ], "i": "well-known/malware/trojan/appbundler::appbundler-cert-subject", "l": 1 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.function_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 2 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 321536, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 14.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.96" ], "i": "metadata/binary/metrics::dominant-section", "l": 3 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.949999988079071, "d": "links GDI32.dll (BitBlt)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 6)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (PathAppendW)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueW)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetDC)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (ORDINAL 15)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "FileVersion", "VS_VERSION_INFO", "ProductVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "well-known/malware/trojan/shellobject/markers::misleading-upx-sections", "l": 1 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "a": "T1105", "c": 0.9800000190734863, "d": "AppBundler signed UPX admin loader", "e": [ "UPX1", "VirtualFree", "WS2_32.dll", "VirtualAlloc", "UPX0", "VirtualProtect", "binary.function_count = 2.00", "appbundler.com0", "\u003crequestedExecutionLevel level=\"requireAdministrator", "binary.entry_in_nonstandard_section = 1.00", "appbundler.com1\u003e0\u003c", "appbundler.com", "GetProcAddress" ], "i": "well-known/malware/trojan/appbundler::signed-upx-admin-loader", "l": 5 }, { "a": "T1027.002", "c": 0.949999988079071, "d": "UPX dynamic loader stub", "e": [ "UPX0", "VirtualProtect", "VirtualAlloc", "GetProcAddress", "UPX1", "binary.entry_in_nonstandard_section = 1.00", "binary.function_count = 2.00", "VirtualFree" ], "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub", "l": 3, "m": "F0001" }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload::minimal-pe-dynamic-load", "l": 3, "m": "B0032" } ], "sha": "9817ccd1024e2be0af780a0cb7b99d5479a21b4c9c39d8addcb85369233635ec", "path": "71149", "type": "pe" } ], "tv": "2a0fe" } }