{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.998638927936554, "class": 1 } ], "prob": 0.9986389, "class": 1, "oprob": 0.9986389, "models": [ { "m": "az", "prob": 0.99664897, "class": 0 }, { "m": "az/native", "prob": 0.9986389, "class": 0 }, { "m": "az/pe", "prob": 0.9984798, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T06:50:39Z" }, "path": "5485", "raw": { "v": "4", "fs": [ { "f": "O₆(As₇AlC₄CoEr₂I)H₄(MgPo₃CmDs)Md₃(Bi₅HeSi)", "k": { "pe.timestamp": 1107786765, "hashes.imphash": "0895dc55235ee0e12aa792670ee956dc", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.rich_header.xor_key": "0xd5665254", "hashes.rich_header_hash": "f6775023c08a3270a807e4a8851e8ffeb805b2faae551ce66256f1bfe5720d3c", "binary.top_complex_unnamed[0].cc": 47, "binary.top_complex_unnamed[1].cc": 47, "binary.top_complex_unnamed[2].cc": 41, "binary.top_complex_unnamed[3].cc": 38, "binary.top_complex_unnamed[4].cc": 27, "binary.top_complex_unnamed[5].cc": 20, "binary.top_complex_unnamed[6].cc": 19, "binary.top_complex_unnamed[7].cc": 15, "binary.top_complex_unnamed[0].bbs": 33, "binary.top_complex_unnamed[1].bbs": 33, "binary.top_complex_unnamed[2].bbs": 71, "binary.top_complex_unnamed[3].bbs": 65, "binary.top_complex_unnamed[4].bbs": 48, "binary.top_complex_unnamed[5].bbs": 31, "binary.top_complex_unnamed[6].bbs": 34, "binary.top_complex_unnamed[7].bbs": 29, "binary.top_complex_unnamed[0].addr": "0x402810", "binary.top_complex_unnamed[0].size": 821, "binary.top_complex_unnamed[1].addr": "0x4038e0", "binary.top_complex_unnamed[1].size": 821, "binary.top_complex_unnamed[2].addr": "0x40199f", "binary.top_complex_unnamed[2].size": 436, "binary.top_complex_unnamed[3].addr": "0x402ed9", "binary.top_complex_unnamed[3].size": 777, "binary.top_complex_unnamed[4].addr": "0x402bae", "binary.top_complex_unnamed[4].size": 811, "binary.top_complex_unnamed[5].addr": "0x40351e", "binary.top_complex_unnamed[5].size": 548, "binary.top_complex_unnamed[6].addr": "0x40220a", "binary.top_complex_unnamed[6].size": 409, "binary.top_complex_unnamed[7].addr": "0x401671", "binary.top_complex_unnamed[7].size": 321, "pe.rich_header.entries[0].use_count": 22, "pe.rich_header.entries[1].use_count": 9, "pe.rich_header.entries[2].use_count": 9, "pe.rich_header.entries[3].use_count": 44, "pe.rich_header.entries[4].use_count": 1, "pe.rich_header.entries[5].use_count": 3, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 10, "pe.rich_header.entries[1].product_id": 14, "pe.rich_header.entries[2].product_id": 19, "pe.rich_header.entries[3].product_id": 1, "pe.rich_header.entries[4].product_id": 29, "pe.rich_header.entries[5].product_id": 11, "pe.rich_header.entries[6].product_id": 6, "pe.rich_header.entries[0].build_number": 8168, "pe.rich_header.entries[0].product_name": "Linker_v6", "pe.rich_header.entries[1].build_number": 7299, "pe.rich_header.entries[1].product_name": "Export_VC2003", "pe.rich_header.entries[2].build_number": 8034, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[4].build_number": 8830, "pe.rich_header.entries[4].product_name": "Cpp_VS2005", "pe.rich_header.entries[5].build_number": 8168, "pe.rich_header.entries[5].product_name": "Cvt_Omf", "pe.rich_header.entries[6].build_number": 1720, "pe.rich_header.entries[6].product_name": "Cvt_Pgo_VS_v6_or_earlier" }, "x": 81, "id": 0, "is": [ "WideCharToMultiByte", "FreeLibrary", "GetProcAddress", "LoadLibraryA", "GetEnvironmentStringsW", "SetHandleCount", "GetEnvironmentStrings", "MultiByteToWideChar", "GetStringTypeW", "GetStringTypeA", "LCMapStringW", "LCMapStringA", "GetModuleHandleA", "GetStartupInfoA", "GetCommandLineA", "GetVersion", "ExitProcess", "TerminateProcess", "GetCurrentProcess", "UnhandledExceptionFilter", "GetModuleFileNameA", "FreeEnvironmentStringsA", "FreeEnvironmentStringsW", "OutputDebugStringA", "RtlUnwind", "HeapFree", "GetStdHandle", "GetFileType", "HeapDestroy", "HeapCreate", "VirtualFree", "HeapReAlloc", "WriteFile", "GetCPInfo", "GetACP", "GetOEMCP", "HeapAlloc", "VirtualAlloc", "MessageBoxA", "ShellExecuteA", "CoInitialize", "CoCreateInstance", "CoUninitialize" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 40960.0, "subsystem": 2.0, "timestamp": 1107786765.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 7.61, "entry_section": ".text", "size_of_image": 65536.0, "timestamp_day": 7.0, "file_alignment": 4096.0, "resource_count": 2.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON" ], "timestamp_year": 2005.0, "characteristics": 271.0, "entry_point_rva": 4096.0, "size_of_headers": 4096.0, "timestamp_month": 2.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 4.0, "computed_checksum": 101451.0, "section_alignment": 4096.0, "unusual_alignment": true, "number_of_sections": 4.0, "resource_timestamp": 0.0, "rich_header_present": true, "linker_major_version": 6.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 65536.0 }, "binary": { "code_size": 12288.0, "func_count": 17.0, "entry_point": 4096.0, "wx_sections": 1.0, "code_entropy": 6.5, "data_entropy": 2.62, "func_density": 1.42, "import_count": 43.0, "string_count": 123.0, "avg_func_size": 403.41, "section_count": 4.0, "avg_complexity": 18.76, "import_density": 3.58, "max_complexity": 47.0, "string_density": 10.25, "overall_entropy": 4.84, "avg_basic_blocks": 27.29, "avg_section_size": 15360.0, "dependency_count": 4.0, "entropy_variance": 2.34, "avg_string_length": 18.13, "complexity_per_kb": 1.56, "max_string_length": 50.0, "writable_sections": 2.0, "avg_string_entropy": 3.19, "code_to_data_ratio": 0.25, "data_to_file_ratio": 0.06, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.63, "text_to_file_ratio": 0.19, "total_basic_blocks": 464.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 12.32, "largest_section_ratio": 0.63, "sentence_string_count": 36.0, "sentence_string_ratio": 0.29, "behavioral_import_ratio": 0.09 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 200, "RichTRf" ], [ 472, ".text" ], [ 512, ".rdata" ], [ 551, "@.data" ], [ 592, ".rsrc" ], [ 4357, "\"JZJJ\"JJKJ J" ], [ 4473, "OJJJJ" ], [ 4501, "xor", "\\linkinfo.d" ], [ 4619, "zJJHJJ\"JJJ" ], [ 6409, "QQS3" ], [ 6473, "PSSW" ], [ 8042, "SVWU" ], [ 8766, "90tr" ], [ 16684, "runtime error" ], [ 16704, "TLOSS error" ], [ 16720, "SING error" ], [ 16736, "DOMAIN error" ], [ 16752, "R6028\r\n- unable to initialize heap" ], [ 16759, "- unable to initialize heap" ], [ 16792, "R6027\r\n- not enough space for lowio initialization" ], [ 16799, "- not enough space for lowio initialization" ], [ 16848, "R6026\r\n- not enough space for stdio initialization" ], [ 16855, "- not enough space for stdio initialization" ], [ 16904, "R6025\r\n- pure virtual function call" ], [ 16911, "- pure virtual function call" ], [ 16944, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 16951, "- not enough space for _onexit/atexit table" ], [ 17000, "R6019\r\n- unable to open console device" ], [ 17007, "- unable to open console device" ], [ 17044, "R6018\r\n- unexpected heap error" ], [ 17051, "- unexpected heap error" ], [ 17080, "R6017\r\n- unexpected multithread lock error" ], [ 17087, "- unexpected multithread lock error" ], [ 17128, "R6016\r\n- not enough space for thread data" ], [ 17135, "- not enough space for thread data" ], [ 17172, "abnormal program termination" ], [ 17208, "R6009\r\n- not enough space for environment" ], [ 17215, "- not enough space for environment" ], [ 17252, "R6008\r\n- not enough space for arguments" ], [ 17259, "- not enough space for arguments" ], [ 17296, "R6002\r\n- floating point not loaded" ], [ 17303, "- floating point not loaded" ], [ 17336, "Microsoft Visual C++ Runtime Library" ], [ 17380, "Runtime Error!\n\nProgram:" ], [ 17412, "\u003cprogram name unknown\u003e" ], [ 17436, "GetLastActivePopup" ], [ 17456, "GetActiveWindow" ], [ 17472, "MessageBoxA" ], [ 17484, "user32.dll" ], [ 17830, "OutputDebugStringA" ], [ 17852, "FreeLibrary" ], [ 17866, "GetProcAddress" ], [ 17884, "LoadLibraryA" ], [ 17898, "KERNEL32.dll" ], [ 17926, "USER32.dll" ], [ 17940, "ShellExecuteA" ], [ 17954, "SHELL32.dll" ], [ 17968, "CoUninitialize" ], [ 17986, "CoCreateInstance" ], [ 18006, "CoInitialize" ], [ 18020, "ole32.dll" ], [ 18032, "GetModuleHandleA" ], [ 18052, "GetStartupInfoA" ], [ 18070, "GetCommandLineA" ], [ 18088, "GetVersion" ], [ 18102, "ExitProcess" ], [ 18116, "TerminateProcess" ], [ 18136, "GetCurrentProcess" ], [ 18156, "UnhandledExceptionFilter" ], [ 18184, "GetModuleFileNameA" ], [ 18206, "FreeEnvironmentStringsA" ], [ 18232, "FreeEnvironmentStringsW" ], [ 18258, "WideCharToMultiByte" ], [ 18280, "GetEnvironmentStrings" ], [ 18304, "GetEnvironmentStringsW" ], [ 18330, "SetHandleCount" ], [ 18348, "GetStdHandle" ], [ 18364, "GetFileType" ], [ 18378, "HeapDestroy" ], [ 18392, "HeapCreate" ], [ 18406, "VirtualFree" ], [ 18420, "HeapFree" ], [ 18432, "RtlUnwind" ], [ 18444, "WriteFile" ], [ 18456, "GetCPInfo" ], [ 18478, "GetOEMCP" ], [ 18490, "HeapAlloc" ], [ 18502, "VirtualAlloc" ], [ 18518, "HeapReAlloc" ], [ 18532, "MultiByteToWideChar" ], [ 18554, "LCMapStringA" ], [ 18570, "LCMapStringW" ], [ 18586, "GetStringTypeA" ], [ 18604, "GetStringTypeW" ], [ 20528, "open" ], [ 20536, "arace.exe" ], [ 20548, "You must install DirectX 8.0 to play this game" ], [ 20596, "DirectX Version:" ], [ 20628, "DirectDrawCreateEx" ], [ 20648, "Couldn't create CLSID_DirectMusic" ], [ 20684, "Couldn't CreateSurface" ], [ 20712, "Couldn't Set coop level" ], [ 20740, "Couldn't GetProcAddress DInputCreate" ], [ 20780, "DirectInputCreateA" ], [ 20800, "Couldn't LoadLibrary DInput" ], [ 20832, "DINPUT.DLL" ], [ 20844, "Couldn't QI DDraw2" ], [ 20868, "Couldn't create DDraw" ], [ 20892, "Couldn't LoadLibrary DDraw" ], [ 20924, "DirectDrawCreate" ], [ 20944, "DDRAW.DLL" ], [ 30782, "s0 i" ], [ 30964, "GHGC" ], [ 38874, "Gyle" ], [ 39986, "Lxkh" ], [ 41474, "t\u003c\u003cY" ], [ 43850, "UK6T" ], [ 54084, "NS96" ], [ 54628, "G2C1" ], [ 56260, "Z0EN" ], [ 59060, "v020" ], [ 60484, "E50V" ] ], "sz": 65536, "ts": [ { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 3.58" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1107786765.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 43.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.29" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "5485" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 40960, entropy: 7.61)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.84" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 43.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 43.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "OutputDebugStringA", "LCMapStringW", "FreeEnvironmentStringsW", "GetEnvironmentStrings", "GetStringTypeA", "GetEnvironmentStringsW", "LCMapStringA", "FreeEnvironmentStringsA", "GetStringTypeW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.84" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 65536.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.19" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 43.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.50)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 464.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringA" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.52)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 123.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 43.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW", "GetEnvironmentStrings" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 17.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 4.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 43.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8999999761581421, "d": "Small DLL, high-entropy resource", "e": [ ".rsrc (entropy: 7.61)" ], "i": "metadata/binary/section/metrics::high-entropy-resource-small-dll", "l": 4 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::unusual-alignment-pe", "l": 4 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (entropy: 7.61)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 4, "m": "C0027" }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".text (size: 12288, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "WideCharToMultiByte", "GetModuleFileNameA", "MultiByteToWideChar", "UnhandledExceptionFilter" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (ShellExecuteA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (WideCharToMultiByte, FreeLibrary, GetProcAddress, LoadLibraryA, GetEnvironmentStringsW, ... +33 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (MessageBoxA)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoInitialize, CoCreateInstance, CoUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 } ], "sha": "98c485d14a910d1b4e35d5341c6771475e08cafcc9d0ad9c8a23b57b23475d36", "path": "5485", "type": "pe" } ], "tv": "84923" } }