{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.008559201, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T16:37:23Z" }, "path": "VirusShare_7ffec8ac0dbec1f745b4ccf2f95d4341", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "94f330c788995d4d6d0ac4ec19ff6bf3", "pe.checksum": "0x0001d567", "pe.timestamp": 1478027036, "hash.authenti": "eb10c8672dc659a023aaa1a1a7346880d177d5a62befd7b22cf90e9d423de395", "debug.pdb_path": "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\mfbt\\tests\\TestArray.pdb", "pe.codeview.age": 2, "hash.rich_header": "dc899480c4e58615fb72c6f4a41c9f2705e6c3ced7c0a48d2aef5a6e99ce020a", "pe.codeview.guid": "2E428EFD-08A9-4C32-BACD-708EC88B577F", "build.target_arch": "x86", "pe.linker_version": "14.0", "pe.rich_header.xor_key": "0xd6ecdca1", "pe.debug_entries[0].size": 123, "pe.debug_entries[0].type": "codeview", "pe.debug_entries[1].size": 20, "pe.debug_entries[1].type": "vc_feature", "pe.debug_entries[2].size": 628, "pe.debug_entries[2].type": "pogo", "pe.data_directories[0].rva": 80656, "pe.data_directories[1].rva": 84312, "pe.data_directories[2].rva": 98304, "pe.data_directories[3].rva": 79168, "pe.data_directories[4].rva": 79256, "pe.data_directories[5].rva": 69632, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 3656, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 180, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 2380, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 84, "pe.data_directories[4].name": "load_config", "pe.data_directories[4].size": 64, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 376, "pe.debug_directory_types[0]": 2, "pe.debug_directory_types[1]": 12, "pe.debug_directory_types[2]": 13, "pe.debug_entries[0].timestamp": 1478027036, "pe.debug_entries[1].timestamp": 1478027036, "pe.debug_entries[2].timestamp": 1478027036, "pe.load_config.security_cookie": "0x413720", "pe.rich_header_compids[0].count": 10, "pe.rich_header_compids[1].count": 10, "pe.rich_header_compids[2].count": 24, "pe.rich_header_compids[3].count": 13, "pe.rich_header_compids[4].count": 4, "pe.rich_header_compids[5].count": 3, "pe.rich_header_compids[6].count": 86, "pe.rich_header_compids[7].count": 4, "pe.rich_header_compids[8].count": 1, "pe.rich_header_compids[9].count": 1, "binary.top_complex_unnamed[0].cc": 105, "binary.top_complex_unnamed[1].cc": 41, "binary.top_complex_unnamed[2].cc": 39, "binary.top_complex_unnamed[3].cc": 38, "binary.top_complex_unnamed[4].cc": 35, "binary.top_complex_unnamed[5].cc": 35, "binary.top_complex_unnamed[6].cc": 33, "binary.top_complex_unnamed[7].cc": 29, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 9664521, "pe.rich_header_compids[1].compid": 16997947, "pe.rich_header_compids[2].compid": 17129019, "pe.rich_header_compids[3].compid": 17063483, "pe.rich_header_compids[4].compid": 16866875, "pe.rich_header_compids[5].compid": 16866669, "pe.rich_header_compids[6].compid": 65536, "pe.rich_header_compids[7].compid": 17129109, "pe.rich_header_compids[8].compid": 16801429, "pe.rich_header_compids[9].compid": 16932501, "binary.top_complex_unnamed[0].bbs": 153, "binary.top_complex_unnamed[1].bbs": 77, "binary.top_complex_unnamed[2].bbs": 63, "binary.top_complex_unnamed[3].bbs": 43, "binary.top_complex_unnamed[4].bbs": 59, "binary.top_complex_unnamed[5].bbs": 56, "binary.top_complex_unnamed[6].bbs": 52, "binary.top_complex_unnamed[7].bbs": 43, "pe.rich_header_compids[6].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x40b6f6", "binary.top_complex_unnamed[0].size": 2288, "binary.top_complex_unnamed[1].addr": "0x401005", "binary.top_complex_unnamed[1].size": 1177, "binary.top_complex_unnamed[2].addr": "0x40618b", "binary.top_complex_unnamed[2].size": 769, "binary.top_complex_unnamed[3].addr": "0x40afa4", "binary.top_complex_unnamed[3].size": 428, "binary.top_complex_unnamed[4].addr": "0x4024c2", "binary.top_complex_unnamed[4].size": 819, "binary.top_complex_unnamed[5].addr": "0x405ea6", "binary.top_complex_unnamed[5].size": 741, "binary.top_complex_unnamed[6].addr": "0x402a24", "binary.top_complex_unnamed[6].size": 756, "binary.top_complex_unnamed[7].addr": "0x405595", "binary.top_complex_unnamed[7].size": 406, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".gfids", "pe.section_characteristics[4].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 10, "pe.rich_header.entries[1].use_count": 10, "pe.rich_header.entries[2].use_count": 24, "pe.rich_header.entries[3].use_count": 13, "pe.rich_header.entries[4].use_count": 4, "pe.rich_header.entries[5].use_count": 3, "pe.rich_header.entries[6].use_count": 86, "pe.rich_header.entries[7].use_count": 4, "pe.rich_header.entries[8].use_count": 1, "pe.rich_header.entries[9].use_count": 1, "pe.rich_header.entries[0].product_id": 147, "pe.rich_header.entries[1].product_id": 259, "pe.rich_header.entries[2].product_id": 261, "pe.rich_header.entries[3].product_id": 260, "pe.rich_header.entries[4].product_id": 257, "pe.rich_header.entries[5].product_id": 257, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 261, "pe.rich_header.entries[8].product_id": 256, "pe.rich_header.entries[9].product_id": 258, "pe.rich_header.entries[0].build_number": 30729, "pe.rich_header.entries[0].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[1].build_number": 24123, "pe.rich_header.entries[1].product_name": "Cvtres_VS2013", "pe.rich_header.entries[2].build_number": 24123, "pe.rich_header.entries[2].product_name": "Cpp_VS2015", "pe.rich_header.entries[3].build_number": 24123, "pe.rich_header.entries[3].product_name": "C_VS2015", "pe.rich_header.entries[4].build_number": 24123, "pe.rich_header.entries[4].product_name": "Linker_VS2013", "pe.rich_header.entries[5].build_number": 23917, "pe.rich_header.entries[5].product_name": "Linker_VS2013", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 24213, "pe.rich_header.entries[7].product_name": "Cpp_VS2015", "pe.rich_header.entries[8].build_number": 24213, "pe.rich_header.entries[8].product_name": "Cpp_VS2013", "pe.rich_header.entries[9].build_number": 24213, "pe.rich_header.entries[9].product_name": "Linker_VS2013_LTCG", "pe.section_characteristics[0].raw_size": 62976, "pe.section_characteristics[1].raw_size": 18432, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[3].raw_size": 512, "pe.section_characteristics[4].raw_size": 2560, "pe.section_characteristics[0].virtual_size": 62552, "pe.section_characteristics[1].virtual_size": 18000, "pe.section_characteristics[2].virtual_size": 1116, "pe.section_characteristics[3].virtual_size": 84, "pe.section_characteristics[4].virtual_size": 2380, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 69632, "pe.section_characteristics[2].virtual_address": 90112, "pe.section_characteristics[3].virtual_address": 94208, "pe.section_characteristics[4].virtual_address": 98304, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 5, "id": 0, "is": [ "TerminateProcess", "GetCurrentProcess", "GetSystemInfo", "VirtualAlloc", "VirtualFree", "GetStartupInfoW", "IsDebuggerPresent", "InitializeSListHead", "GetSystemTimeAsFileTime", "GetCurrentThreadId", "GetCurrentProcessId", "QueryPerformanceCounter", "IsProcessorFeaturePresent", "SetUnhandledExceptionFilter", "UnhandledExceptionFilter", "GetModuleHandleW", "?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z", "?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ", "?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ", "?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z", "?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z", "?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ", "?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ", "?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ", "?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z", "?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z", "?_BADOFF@std@@3_JB", "??_7ios_base@std@@6B@", "??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@", "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z", "??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ", "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z", "?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ", "??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ", "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ", "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z", "?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z", "?_Xout_of_range@std@@YAXPBD@Z", "?_Xbad_alloc@std@@YAXXZ", "?_Xlength_error@std@@YAXPBD@Z", "memset", "memmove", "except_handler4_common", "std_exception_copy", "std_type_info_destroy_list", "std_exception_destroy", "CxxThrowException", "memcpy", "p__commode", "stdio_common_vfprintf", "fflush", "acrt_iob_func", "set_fmode", "callnewh", "set_new_mode", "calloc", "free", "malloc", "cexit", "c_exit", "register_thread_local_exe_atexit_callback", "p___argv", "p___argc", "invalid_parameter_noinfo_noreturn", "seh_filter_dll", "initialize_onexit_table", "register_onexit_function", "execute_onexit_table", "crt_atexit", "crt_at_quick_exit", "controlfp_s", "terminate", "seh_filter_exe", "initialize_narrow_environment", "exit", "exit", "initterm_e", "initterm", "get_initial_narrow_environment", "configure_narrow_argv", "set_app_type", "except1", "dtest", "setusermatherr", "ceil", "configthreadlocale" ], "ms": { "pe": { "entry": 63321.0, "machine": 332.0, "checksum": 120167.0, "has_pogo": true, "pdb_path": "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\mfbt\\tests\\TestArray.pdb", "subsystem": 3.0, "timestamp": 1478027036.0, "image_base": 4194304.0, "codeview_age": 2.0, "has_checksum": true, "codeview_guid": "2E428EFD-08A9-4C32-BACD-708EC88B577F", "entry_section": ".text", "size_of_image": 102400.0, "cfg_func_count": 256.0, "checksum_valid": true, "file_alignment": 512.0, "has_vc_feature": true, "characteristics": 290.0, "has_rich_header": true, "security_cookie": 4273952.0, "size_of_headers": 1024.0, "export_timestamp": 1478027036.0, "import_dll_count": 8.0, "se_handler_count": 4264312.0, "computed_checksum": 120167.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1478027036.0, "debug_timestamp_min": 1478027036.0, "dll_characteristics": 33088.0, "has_export_timestamp": true, "linker_major_version": 14.0, "debug_directory_types": [ 2.0, 12.0, 13.0 ], "has_resource_timestamp": false, "debug_directory_entries": 3.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_consistent": true, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 3.0 }, "file": { "size": 86016.0 }, "binary": { "code_size": 62976.0, "func_count": 334.0, "code_entropy": 6.6, "data_entropy": 3.8, "export_count": 63.0, "func_density": 5.43, "import_count": 86.0, "string_count": 323.0, "avg_func_size": 203.36, "section_count": 5.0, "avg_complexity": 6.5, "import_density": 1.4, "max_complexity": 105.0, "string_density": 5.25, "overall_entropy": 4.21, "avg_basic_blocks": 10.07, "avg_section_size": 16998.4, "dependency_count": 8.0, "entropy_variance": 2.58, "avg_string_length": 34.81, "complexity_per_kb": 0.11, "max_string_length": 114.0, "avg_string_entropy": 3.66, "code_to_data_ratio": 2.86, "data_to_file_ratio": 0.01, "text_to_file_ratio": 0.73, "total_basic_blocks": 3365.0, "func_analysis_depth": 2.0, "string_length_stddev": 27.71, "debug_reference_count": 3.0, "largest_section_ratio": 0.73, "sentence_string_count": 37.0, "sentence_string_ratio": 0.11, "writable_section_count": 1.0, "behavioral_import_ratio": 0.01, "executable_section_count": 1.0, "nonstandard_section_count": 1.0, "high_complexity_func_count": 1.0, "unnamed_complex_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 224, "Rich" ], [ 496, ".text" ], [ 575, "@.data" ], [ 616, ".gfids" ], [ 655, "@.reloc" ], [ 11692, "rYSVPRQ" ], [ 17625, "SVW3" ], [ 18773, "VQPW" ], [ 18796, "PWPW" ], [ 22978, "xxxxwwww" ], [ 24762, "QQSVW" ], [ 28663, "QSVW" ], [ 29515, "SVW9U" ], [ 30178, "XPWS" ], [ 30883, "ZRQP" ], [ 31782, "VWQSP" ], [ 36793, "SVWP" ], [ 38806, "QSVW3" ], [ 39871, "QQSV" ], [ 48644, "SHPV" ], [ 62873, "5ntel" ], [ 64432, "Assertion failure: %s, at %s:%d" ], [ 64472, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/Array.h" ], [ 64576, "aIndex \u003c Length" ], [ 64592, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/Compression.cpp" ], [ 64676, "inputSizeChecked.isValid()" ], [ 64704, "maxOutputSizeChecked.isValid()" ], [ 64736, "outputSizeChecked.isValid()" ], [ 64768, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/CheckedInt.h" ], [ 64880, "mIsValid (Invalid checked integer (division by zero or integer overflow))" ], [ 64960, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\decimal\\Decimal.h" ], [ 65048, "isFinite()" ], [ 65064, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\double-conversion\\utils.h" ], [ 65160, "!is_finalized() \u0026\u0026 position_ \u003c buffer_.length()" ], [ 65208, "strlen(buffer_.start()) == static_cast\u003csize_t\u003e(position_)" ], [ 65344, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/decimal/Decimal.cpp" ], [ 65432, "false (MOZ_ASSERT_UNREACHABLE: moz-decimal-utils.h)" ], [ 65484, "divisor" ], [ 65500, "n \u003c= Precision" ], [ 65516, "lhs.isFinite()" ], [ 65532, "rhs.isFinite()" ], [ 65548, "-Infinity" ], [ 65560, "Infinity" ], [ 65588, "bufLength \u003e 0" ], [ 65604, "0 \u003c= index \u0026\u0026 index \u003c length_" ], [ 65636, "len == 0 || (len \u003e 0 \u0026\u0026 data != 0)" ], [ 65672, "string too long" ], [ 65688, "invalid string position" ], [ 65712, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/Casting.h" ], [ 65864, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/FloatingPoint.h" ], [ 65976, "signbit == 0 || signbit == 1" ], [ 66008, "(significand \u0026 ~Traits::kSignificandBits) == 0" ], [ 66056, "significand \u0026 Traits::kSignificandBits" ], [ 66408, "Hit MOZ_CRASH(%s) at %s:%d" ], [ 66440, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/HashFunctions.h" ], [ 66568, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla\\utils.h" ], [ 66684, "!is_finalized() \u0026\u0026 position_ + n \u003c buffer_.length()" ], [ 66736, "static_cast\u003csize_t\u003e(n) \u003c= strlen(s)" ], [ 66776, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\dist\\include\\mozilla/double-conversion.h" ], [ 66896, "((flags \u0026 EMIT_TRAILING_DECIMAL_POINT) != 0) || !((flags \u0026 EMIT_TRAILING_ZERO_AFTER_POINT) != 0)" ], [ 67000, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/Poison.cpp" ], [ 67080, "no usable poison region identified" ], [ 67120, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/SHA1.cpp" ], [ 67204, "!mDone (SHA1Sum can only be used to compute a single hash.)" ], [ 67360, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\double-conversion\\bignum.h" ], [ 67456, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\double-conversion\\diy-fp.h" ], [ 67552, "e_ == other.e_" ], [ 67568, "f_ \u003e= other.f_" ], [ 67592, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\mfbt\\double-conversion\\ieee.h" ], [ 67684, "Sign() \u003e 0" ], [ 67696, "!IsSpecial()" ], [ 67712, "value() \u003e 0.0" ], [ 67728, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/bignum-dtoa.cc" ], [ 67828, "significand != 0" ], [ 67856, "!Double(v).IsSpecial()" ], [ 67972, "*decimal_point == -requested_digits" ], [ 68008, "estimated_power \u003e= 0" ], [ 68032, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/bignum.cc" ], [ 68156, "IsClamped()" ], [ 68168, "other.IsClamped()" ], [ 68188, "bigit_pos \u003e= 0" ], [ 68204, "LessEqual(other, *this)" ], [ 68260, "exponent \u003e= 0" ], [ 68276, "accumulator == 0" ], [ 68308, "power_exponent \u003e= 0" ], [ 68328, "other.used_digits_ \u003e 0" ], [ 68352, "other.bigits_[other.used_digits_ - 1] \u003e= ((1 \u003c\u003c kBigitSize) / 16)" ], [ 68420, "BigitLength() == other.BigitLength()" ], [ 68488, "a.IsClamped()" ], [ 68504, "b.IsClamped()" ], [ 68520, "c.IsClamped()" ], [ 68536, "used_digits_ \u003e= 0" ], [ 68556, "exponent_ \u003e= 0" ], [ 68572, "shift_amount \u003c kBigitSize" ], [ 68600, "shift_amount \u003e= 0" ], [ 68620, "exponent_ \u003c= other.exponent_" ], [ 70048, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/cached-powers.cc" ], [ 70152, "0 \u003c= index \u0026\u0026 index \u003c kCachedPowersLength" ], [ 70196, "min_exponent \u003c= cached_power.binary_exponent" ], [ 70244, "cached_power.binary_exponent \u003c= max_exponent" ], [ 70292, "kMinDecimalExponent \u003c= requested_exponent" ], [ 70336, "requested_exponent \u003c kMaxDecimalExponent + kDecimalExponentDistance" ], [ 70404, "*found_exponent \u003c= requested_exponent" ], [ 70448, "requested_exponent \u003c *found_exponent + kDecimalExponentDistance" ], [ 70512, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/double-conversion.cc" ], [ 70620, "length != 0" ], [ 70632, "exponent \u003c 1e4" ], [ 70648, "length \u003c= digits_after_point - (-decimal_point)" ], [ 70696, "digits_after_point \u003e 0" ], [ 70720, "length - decimal_point \u003c= digits_after_point" ], [ 70768, "mode == SHORTEST || mode == SHORTEST_SINGLE" ], [ 70812, "decimal_rep_length \u003c= requested_digits + 1" ], [ 70856, "decimal_rep_length \u003c= precision" ], [ 70888, "mode == SHORTEST || mode == SHORTEST_SINGLE || requested_digits \u003e= 0" ], [ 70960, "**current == *substring" ], [ 70984, "buffer_pos \u003c kBufferSize" ], [ 71012, "-max_exponent / 2 \u003c= exponent \u0026\u0026 exponent \u003c= max_exponent / 2" ], [ 71076, "tail_pointer != 0" ], [ 71096, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/fast-dtoa.cc" ], [ 71196, "rest \u003c= unsafe_interval" ], [ 71220, "rest \u003c ten_kappa" ], [ 71283, ";number \u003c (1u \u003c\u003c (number_bits + 1))" ], [ 71392, "kMinimalTargetExponent \u003c= w.e() \u0026\u0026 w.e() \u003c= kMaximalTargetExponent" ], [ 71476, "fractionals \u003c one.f()" ], [ 71504, "(((static_cast\u003cuint64_t\u003e(0xFFFFFFFF) \u003c\u003c 32) + 0xFFFFFFFFu)) / 10 \u003e= one.f()" ], [ 71580, "mode == FAST_DTOA_SHORTEST_SINGLE" ], [ 71616, "boundary_plus.e() == w.e()" ], [ 71800, "scaled_w.e() == boundary_plus.e() + ten_mk.e() + DiyFp::kSignificandSize" ], [ 71880, "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/fixed-dtoa.cc" ], [ 71980, "(accumulator \u003e\u003e 32) == 0" ], [ 72008, "-64 \u003c= shift_amount \u0026\u0026 shift_amount \u003c= 64" ], [ 72052, "-128 \u003c= exponent \u0026\u0026 exponent \u003c= 0" ], [ 72088, "fractionals \u003e\u003e 56 == 0" ], [ 72112, "64 \u003c -exponent \u0026\u0026 -exponent \u003c= 128" ], [ 72335, "Dc:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/strtod.cc" ], [ 72432, "buffer[buffer.length() - 1] != '0'" ], [ 72468, "space_size \u003e= kMaxSignificantDecimalDigits" ], [ 72512, "read_digits == trimmed.length()" ], [ 72544, "0 \u003c exponent" ], [ 72560, "exponent \u003c PowersOfTenCache::kDecimalExponentDistance" ], [ 72616, "exponent \u003c= PowersOfTenCache::kMaxDecimalExponent" ], [ 72668, "precision_digits_count \u003c 64" ], [ 72696, "buffer.length() + exponent \u003c= kMaxDecimalPower + 1" ], [ 72748, "buffer.length() + exponent \u003e kMinDecimalPower" ], [ 72796, "buffer.length() \u003c= kMaxSignificantDecimalDigits" ], [ 72992, "to \u003c= length_" ], [ 73032, "number \u003e 0" ], [ 73044, "current != end" ], [ 73060, "number \u003c ((int64_t)1 \u003c\u003c kSignificandSize)" ], [ 73104, "static_cast\u003cint64_t\u003e(static_cast\u003cdouble\u003e(number)) == number" ], [ 73164, "number != 0" ], [ 73440, "Unknown exception" ], [ 73472, "bad allocation" ], [ 73500, "bad array new length" ], [ 74020, "RSDS" ], [ 74044, "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\mfbt\\tests\\TestArray.pdb" ], [ 74452, ".rdata" ], [ 74488, ".rdata$sxdata" ], [ 74512, ".rdata$zzzdbg" ], [ 74636, ".edata" ], [ 74732, ".data" ], [ 74764, ".bss" ], [ 75694, "TestArray.exe" ], [ 75708, "??0Decimal@blink@@QAE@ABV01@@Z" ], [ 75739, "??0Decimal@blink@@QAE@ABVEncodedData@01@@Z" ], [ 75782, "??0Decimal@blink@@QAE@H@Z" ], [ 75846, "??0SHA1Sum@mozilla@@QAE@XZ" ], [ 75873, "??4Decimal@blink@@QAEAAV01@ABV01@@Z" ], [ 75909, "??8Decimal@blink@@QBE_NABV01@@Z" ], [ 75941, "??9Decimal@blink@@QBE_NABV01@@Z" ], [ 75973, "??DDecimal@blink@@QBE?AV01@ABV01@@Z" ], [ 76009, "??GDecimal@blink@@QBE?AV01@ABV01@@Z" ], [ 76045, "??GDecimal@blink@@QBE?AV01@XZ" ], [ 76075, "??HDecimal@blink@@QBE?AV01@ABV01@@Z" ], [ 76111, "??KDecimal@blink@@QBE?AV01@ABV01@@Z" ], [ 76147, "??MDecimal@blink@@QBE_NABV01@@Z" ], [ 76179, "??NDecimal@blink@@QBE_NABV01@@Z" ], [ 76211, "??ODecimal@blink@@QBE_NABV01@@Z" ], [ 76243, "??PDecimal@blink@@QBE_NABV01@@Z" ], [ 76275, "??XDecimal@blink@@QAEAAV01@ABV01@@Z" ], [ 76311, "??YDecimal@blink@@QAEAAV01@ABV01@@Z" ], [ 76347, "??ZDecimal@blink@@QAEAAV01@ABV01@@Z" ], [ 76383, "??_0Decimal@blink@@QAEAAV01@ABV01@@Z" ], [ 76420, "??_FDecimal@blink@@QAEXXZ" ], [ 76446, "?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z" ], [ 76550, "?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z" ], [ 76657, "?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z" ], [ 76749, "?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ" ], [ 76824, "?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z" ], [ 76916, "?HashBytes@mozilla@@YAIPBXI@Z" ], [ 76946, "?IsFloat32Representable@mozilla@@YA_NN@Z" ], [ 76987, "?ToExponential@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z" ], [ 77074, "?ToFixed@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z" ], [ 77155, "?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPA_NPAVStringBuilder@2@@Z" ], [ 77244, "?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z" ], [ 77351, "?Unused@mozilla@@3Uunused_t@1@B" ], [ 77383, "?abs@Decimal@blink@@QBE?AV12@XZ" ], [ 77415, "?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z" ], [ 77479, "?ceil@Decimal@blink@@QBE?AV12@XZ" ], [ 77512, "?compareTo@Decimal@blink@@ABE?AV12@ABV12@@Z" ], [ 77556, "?compress@LZ4@Compression@mozilla@@SAIPBDIPAD@Z" ], [ 77604, "?compressLimitedOutput@LZ4@Compression@mozilla@@SAIPBDIPADI@Z" ], [ 77666, "?decompress@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z" ], [ 77721, "?decompress@LZ4@Compression@mozilla@@SA_NPBDPADI@Z" ], [ 77772, "?finish@SHA1Sum@mozilla@@QAEXAAY0BE@E@Z" ], [ 77812, "?floor@Decimal@blink@@QBE?AV12@XZ" ], [ 77846, "?fromDouble@Decimal@blink@@SA?AV12@N@Z" ], [ 77885, "?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z" ], [ 77987, "?gChaosFeatures@detail@mozilla@@3W4ChaosFeature@2@A" ], [ 78039, "?gChaosModeCounter@detail@mozilla@@3V?$Atomic@I$01X@2@A" ], [ 78095, "?gTwoCharEscapes@detail@mozilla@@3QBDB" ], [ 78134, "?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z" ], [ 78180, "?kBase10MaximalLength@DoubleToStringConverter@double_conversion@@2HB" ], [ 78249, "?nan@Decimal@blink@@SA?AV12@XZ" ], [ 78280, "?remainder@Decimal@blink@@QBE?AV12@ABV12@@Z" ], [ 78324, "?round@Decimal@blink@@QBE?AV12@XZ" ], [ 78358, "?toDouble@Decimal@blink@@QBENXZ" ], [ 78390, "?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ" ], [ 78485, "?toString@Decimal@blink@@QBE_NPADI@Z" ], [ 78522, "?update@SHA1Sum@mozilla@@QAEXPBXI@Z" ], [ 78600, "gMozillaPoisonBase" ], [ 78619, "gMozillaPoisonSize" ], [ 78638, "gMozillaPoisonValue" ], [ 78658, "mozPoisonValueInit" ], [ 79238, "TerminateProcess" ], [ 79258, "GetCurrentProcess" ], [ 79278, "GetSystemInfo" ], [ 79294, "VirtualAlloc" ], [ 79310, "VirtualFree" ], [ 79322, "KERNEL32.dll" ], [ 79338, "?_Xbad_alloc@std@@YAXXZ" ], [ 79364, "?_Xlength_error@std@@YAXPBD@Z" ], [ 79396, "?_Xout_of_range@std@@YAXPBD@Z" ], [ 79428, "?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z" ], [ 79472, "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ" ], [ 79532, "??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ" ], [ 79592, "?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ" ], [ 79658, "??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z" ], [ 79764, "??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ" ], [ 79822, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z" ], [ 79886, "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z" ], [ 79950, "?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z" ], [ 79996, "?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ" ], [ 80060, "?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ" ], [ 80126, "?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z" ], [ 80202, "?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z" ], [ 80276, "?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ" ], [ 80344, "?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ" ], [ 80406, "?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ" ], [ 80470, "?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z" ], [ 80540, "?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z" ], [ 80610, "?_BADOFF@std@@3_JB" ], [ 80656, "??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@" ], [ 80706, "MSVCP140.dll" ], [ 80722, "memcpy" ] ], "sz": 86016, "ts": [ { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025" }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 86.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.60" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "d": "overflow keyword", "e": [ "mIsValid (Invalid checked integer (division by zero or integer overflow))" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize thread-safe list header", "e": [ "InitializeSListHead" ], "i": "micro-behaviors/mem/sync/mutex::initialize-slist-head", "l": 2 }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.01" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 3365.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.50" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.60)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "a": "T1016", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.export_count = 63.00" ], "i": "micro-behaviors/os/network/interface::host-network-fingerprint-surface-cond-0--inline-3605", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.21" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "High export count metric", "e": [ "binary.export_count = 63.00" ], "i": "micro-behaviors/communications/socket/route::high-export-count", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 334.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z", "value() \u003e 0.0", "gMozillaPoisonValue", "mozPoisonValueInit" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047" }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1478027036.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "TestArray.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 323.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 63.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "outputSizeChecked.isValid()" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1102", "c": 0.7200000286102295, "d": "EVM function selector literal", "e": [ "0xFFFFFFFF" ], "i": "objectives/command-and-control/infrastructure/blockchain/polygon::evm-selector-hex-literal", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.21" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.66" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 63.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.export_count = 63.00" ], "i": "objectives/command-and-control/backdoor/loader/native-reflect::runtime-loader-with-encoded-data-cond-4--inline-14359", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PGO-trained release build (POGO)", "e": [ "pe.has_pogo = 1.00" ], "i": "metadata/build/reproducible::pe-pgo-trained", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_7ffec8ac0dbec1f745b4ccf2f95d4341" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 102400.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "High export count metric", "e": [ "binary.export_count = 63.00" ], "i": "metadata/binary/metrics/anomaly::high-export-count-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 334.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48", "40", "41" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 334.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8999999761581421, "d": "Allocate zeroed memory", "e": [ "calloc" ], "i": "micro-behaviors/mem/c-runtime/functions::calloc", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 63.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 86.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.7200000286102295, "d": "Embedded absolute PDB path", "e": [ "c:\\builds\\moz2_slave\\autoland-w32-d-000000000000000\\build\\src\\obj-firefox\\mfbt\\tests\\TestArray.pdb" ], "i": "metadata/binary/debug::pdb-absolute-path", "l": 3 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "?kBase10MaximalLength@DoubleToStringConverter@double_conversion@@2HB", "string too long", "?ToExponential@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z", "**current == *substring", "?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z", "?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ", "?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z", "?ToFixed@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z", "?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z", "?toString@Decimal@blink@@QBE_NPADI@Z", "?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPA_NPAVStringBuilder@2@@Z", "invalid string position", "?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z", "?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z", "?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ", "?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.export_count = 63.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-10--inline-29172", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "0 \u003c= index \u0026\u0026 index \u003c kCachedPowersLength", "exponent \u003c PowersOfTenCache::kDecimalExponentDistance", "min_exponent \u003c= cached_power.binary_exponent", "cached_power.binary_exponent \u003c= max_exponent", "exponent \u003c= PowersOfTenCache::kMaxDecimalExponent", "c:/builds/moz2_slave/autoland-w32-d-000000000000000/build/src/mfbt/double-conversion/cached-powers.cc" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)", "e": [ "pe.export_timestamp = 1478027036.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 334.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "binary.export_count = 63.00" ], "i": "objectives/anti-static/obfuscation/payload/section::versioned-export-heavy-library-cond-1--inline-29160", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "CreateExponentialRepresentation", "DoubleToStringConverter", "UnhandledExceptionFilter", "EcmaScriptConverter", "GetSystemTimeAsFileTime", "InitializeSListHead", "SetUnhandledExceptionFilter", "GetCurrentProcessId", "CreateDecimalRepresentation" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.73" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links MSVCP140.dll (?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z, ... +19 more)", "e": [ "MSVCP140.dll" ], "i": "metadata/dylib::msvcp140/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VCRUNTIME140.dll (memset, memmove, except_handler4_common, std_exception_copy, std_type_info_destroy_list, ... +3 more)", "e": [ "VCRUNTIME140.dll" ], "i": "metadata/dylib::vcruntime140/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-math-l1-1-0.dll (except1, dtest, setusermatherr, ceil)", "e": [ "api-ms-win-crt-math-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-math-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-stdio-l1-1-0.dll (p__commode, stdio_common_vfprintf, fflush, acrt_iob_func, set_fmode)", "e": [ "api-ms-win-crt-stdio-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-stdio-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (TerminateProcess, GetCurrentProcess, GetSystemInfo, VirtualAlloc, VirtualFree, ... +11 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-heap-l1-1-0.dll (callnewh, set_new_mode, calloc, free, malloc)", "e": [ "api-ms-win-crt-heap-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-heap-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-locale-l1-1-0.dll (configthreadlocale)", "e": [ "api-ms-win-crt-locale-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-locale-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links api-ms-win-crt-runtime-l1-1-0.dll (cexit, c_exit, register_thread_local_exe_atexit_callback, p___argv, p___argc, ... +18 more)", "e": [ "api-ms-win-crt-runtime-l1-1-0.dll" ], "i": "metadata/dylib::api-ms-win-crt-runtime-l1-1-0/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 86.00", "pe.has_rich_header = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "SetUnhandledExceptionFilter", "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 1 } ], "sha": "98621b87b779d6470378c6dbf75e005d745aef01533c4cf53d832a839a1197d5", "path": "VirusShare_7ffec8ac0dbec1f745b4ccf2f95d4341", "type": "pe" } ], "tv": "85efb" } }