{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9992073178291321, "class": 1 } ], "prob": 0.9992073, "class": 1, "oprob": 0.9992073, "models": [ { "m": "az", "prob": 0.95621526, "class": 0 }, { "m": "az/native", "prob": 0.9989808, "class": 0 }, { "m": "az/pe", "prob": 0.9992073, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T00:56:07Z" }, "path": "62312", "raw": { "v": "4", "fs": [ { "f": "KO₄(As₈C₅Er₂S)H(Po₂)Md₄(Bi₅PtSi)", "x": 84, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "RegCloseKey", "ReplaceTextW", "VariantCopy", "CharNextA" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 18432.0, "subsystem": 2.0, "timestamp": 708992537.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.83, "entry_section": "UPX1", "size_of_image": 385024.0, "timestamp_day": 19.0, "file_alignment": 512.0, "resource_count": 4.0, "timestamp_year": 1992.0, "characteristics": 33167.0, "entry_point_rva": 362208.0, "size_of_headers": 4096.0, "timestamp_month": 6.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 5.0, "computed_checksum": 277359.0, "dos_stub_modified": true, "section_alignment": 4096.0, "number_of_sections": 3.0, "resource_timestamp": 1089951342.0, "timestamp_pre_2000": true, "linker_major_version": 2.0, "linker_minor_version": 25.0, "api_hashing_indicators": 1.0, "resource_timestamp_day": 16.0, "resource_timestamp_year": 2004.0, "export_timestamp_present": false, "resource_timestamp_month": 7.0, "resource_timestamp_present": true, "entry_in_nonstandard_section": true }, "binary": { "code_size": 211456.0, "file_size": 231936.0, "entry_point": 362208.0, "has_overlay": true, "wx_sections": 2.0, "code_entropy": 3.94, "import_count": 10.0, "overlay_size": 1024.0, "string_count": 257.0, "overlay_ratio": 0.0, "section_count": 3.0, "avg_complexity": 23.5, "function_count": 2.0, "import_density": 0.05, "max_complexity": 42.0, "string_density": 1.24, "overall_entropy": 4.24, "overlay_entropy": 7.8, "avg_basic_blocks": 37.5, "avg_section_size": 76629.34, "dependency_count": 5.0, "entropy_variance": 3.25, "function_density": 0.01, "avg_function_size": 31372.5, "avg_string_length": 5.96, "complexity_per_kb": 0.11, "max_string_length": 40.0, "wide_string_count": 4.0, "writable_sections": 3.0, "avg_string_entropy": 1.8, "code_to_data_ratio": 11.47, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.08, "total_basic_blocks": 75.0, "executable_sections": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 3.61, "largest_section_ratio": 0.91, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "behavioral_import_ratio": 0.4, "function_analysis_depth": 2.0, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 80, "This program must be run under Win32\r\n$7" ], [ 504, "UPX0" ], [ 544, "UPX1" ], [ 584, ".rsrc" ], [ 987, "3.08" ], [ 1034, "StringX" ], [ 1083, "System" ], [ 1101, "rface" ], [ 1202, "plNNNNhd" ], [ 1217, "\\XTNNNNPLHDNNNN@\u003c84NNNN" ], [ 5953, "SOFTWARE\\Borland\\Delphi\\" ], [ 5985, "FPUMaskValue" ], [ 6605, "CGG7" ], [ 7027, "ZTUWVSpP" ], [ 7186, "r6t0" ], [ 10768, "xkernel32" ], [ 10781, ".dll" ], [ 10786, "GetLongPathNameA'+" ], [ 11056, "cales27" ], [ 12752, "fMemory" ], [ 12848, "Zero" ], [ 12879, "verflowPc" ], [ 12912, "cfv0i" ], [ 12979, "Poiu" ], [ 13112, "Varian" ], [ 13263, "TThread" ], [ 14111, "ud5r" ], [ 14206, "Fals" ], [ 14258, "p5p5" ], [ 16102, "INFNAN" ], [ 16460, "0()(2)" ], [ 19137, "9SAM/PM" ], [ 20264, "PLDJ" ], [ 20384, "OTNR" ], [ 22998, "XF_Z" ], [ 25475, "oleaut" ], [ 25510, "AddSub/MulDi" ], [ 25526, "vIdivod_n" ], [ 25934, "Dispatch" ], [ 26146, "K3SV" ], [ 28432, "Empty" ], [ 28447, "Smag" ], [ 28478, "Doub" ], [ 28488, "urrencO" ], [ 28539, "nowDeci" ], [ 28572, "Word" ], [ 28796, "o02j" ], [ 29513, "Open" ], [ 29719, "sAdapXr" ], [ 30108, "TRegGroupy" ], [ 35006, "Wnnnn" ], [ 37195, "/BZy0" ], [ 38250, "677w" ], [ 40701, "Pize" ], [ 41728, "V6774" ], [ 42523, "8DQA" ], [ 43599, "Gssssb" ], [ 44287, "KN8V" ], [ 45053, "l7777" ], [ 45573, "v1ku" ], [ 45762, "N774" ], [ 46447, "7777P" ], [ 46557, "6777" ], [ 46792, "t677" ], [ 47192, "`vJ`" ], [ 47376, "/Hpb" ], [ 47844, "/DQ2" ], [ 49022, "Zgsss" ], [ 49714, "t77775" ], [ 49729, "m46777" ], [ 49860, "Q3ZL" ], [ 51429, "7777R" ], [ 51694, "Annnn" ], [ 59719, "/40CC" ], [ 59753, "Xsss" ], [ 62840, "Oyssss" ], [ 64353, ".ssssYX" ], [ 64710, "Kgsss" ], [ 64892, "/hNVK" ], [ 66611, "Pssss" ], [ 67805, "Cssss" ], [ 69187, "Lxssss" ], [ 69843, "Prpz" ], [ 69973, "z677" ], [ 70252, "l09p" ], [ 70625, "Buss" ], [ 71196, "Cnnnn" ], [ 71769, "7777w" ], [ 72759, "ssssWVb" ], [ 73032, "Dssss" ], [ 75929, "Knnn" ], [ 76381, "X le" ], [ 77143, "677T" ], [ 77206, "Msss" ], [ 77719, "07777" ], [ 81617, "xn.x" ], [ 81781, "Gnic" ], [ 82427, "67777" ], [ 83618, "Jnnnn" ], [ 83814, "Y7777" ], [ 84240, "6777t" ], [ 85001, "/RssC" ], [ 85224, "K7777" ], [ 85764, "nnnnDnZ" ], [ 86458, "Llnn" ], [ 90225, "ssssULG" ], [ 92568, "Fgss" ], [ 93761, "znnnna" ], [ 94354, "P7777A" ], [ 94586, "Nssss" ], [ 96011, "Zsss" ], [ 97221, "JuHNnnnnw" ], [ 99540, "77XR" ], [ 101860, "1777" ], [ 103503, "w0.7" ], [ 104781, "79BJ" ], [ 106860, "/unn" ], [ 106997, "ST3L" ], [ 107407, "ssssu0" ], [ 108361, "7777O" ], [ 109321, "Jsss" ], [ 111303, "TRI7" ], [ 112662, "MTssssI" ], [ 113511, "6777p" ], [ 113875, ".nnnnv" ], [ 114619, "o7777" ], [ 114755, "777W" ], [ 115393, "esssSua" ], [ 116006, "B861V" ], [ 116073, "nnnn.@TbZ" ], [ 116087, "i%lnnn" ], [ 119129, "Ggsss" ], [ 122317, "177777" ], [ 122985, "Esss" ], [ 123826, "27777mr" ], [ 128137, "7777i" ], [ 128730, "A7777" ], [ 128945, "V8I0" ], [ 129037, "/x67" ], [ 132616, "oprh0" ], [ 132660, "Cnnn" ], [ 133861, "ssssCAa" ], [ 134211, "BJCU" ], [ 135563, "ff57" ], [ 138157, "H777" ], [ 139279, "170ZI" ], [ 139473, "ZNN6" ], [ 139715, "Hsss" ], [ 141271, "7777u" ], [ 142038, "H777W" ], [ 142088, "7777ee" ], [ 142845, "5m4enn" ], [ 143928, "Rnnn" ], [ 144197, "G7777" ], [ 144606, "Wwoj" ], [ 144869, "6777VV" ], [ 145176, "U7777G" ], [ 145617, "6777PR" ], [ 145790, "BPolssss" ], [ 146017, "6777nl" ], [ 147483, "x677" ], [ 147553, "77778" ], [ 149806, "6777o" ], [ 152248, "Evpft" ], [ 152448, "Sssss%" ], [ 152531, "D6T4" ], [ 152640, "DLN7" ], [ 153349, "DSNJ" ], [ 153638, "8777" ], [ 153991, "MA8X" ], [ 154964, "/bWD" ], [ 156381, "Nass" ], [ 157009, "vn67" ], [ 157559, "az67" ], [ 158347, "o877" ], [ 158774, "6777H" ], [ 159030, "X2\u003e6" ], [ 159537, "Znnn" ], [ 160322, "u677w" ], [ 161229, "Elnn" ], [ 161495, "Ennnn" ], [ 163628, "B hh" ], [ 164574, "Nnnnn" ], [ 164818, "k47777" ], [ 165055, "NF87" ], [ 165277, "nnnnje" ], [ 165679, "T677" ], [ 166545, "Tgsss" ], [ 166733, "FP7Z" ], [ 167393, "Mxnn" ], [ 169055, "7777z" ], [ 169794, "TUDH" ], [ 170161, "m7777" ], [ 170801, "Mziz" ], [ 171478, "tu677" ], [ 171689, "Snnn" ], [ 172706, "57777" ], [ 173786, "hNgsss/" ], [ 174539, "/DXP" ], [ 174709, "k77776" ], [ 175150, "Lssss" ], [ 177340, "6777A" ], [ 178017, "Jgss" ], [ 179123, "Vssss" ], [ 181543, "ssss.7M" ], [ 182349, "Tnnn" ], [ 183034, "lnnnSB-" ], [ 184401, "Unnnn_" ], [ 187012, "xi7777" ], [ 187287, "z679" ], [ 188396, ".sssss." ], [ 188491, "7777v" ], [ 190893, "SW77" ], [ 191382, "Tnnnn" ], [ 191498, "2q l" ], [ 192637, "877b" ], [ 193484, "5567" ], [ 194278, "w.rx" ], [ 196010, "}677-{" ], [ 196986, "Bpnnnn" ], [ 198920, "cs.67" ], [ 199167, "B5ZT" ], [ 200823, "TQVG" ], [ 203620, "6777u" ], [ 204557, "7777E" ], [ 204933, "7JWX" ], [ 205248, "Xgsss" ], [ 208443, "WG_X" ], [ 208664, "o\u003e0123456789ABCDEF_" ], [ 209352, "wide", "List" ], [ 209420, "SFrvfWpbbm." ], [ 209812, "4.:E?:c" ], [ 210106, "sop7j" ], [ 210315, "g16a" ], [ 210677, "KWindows" ], [ 210713, "eXDMJsagT" ], [ 210745, "Sleep" ], [ 210780, "rtualQueryzetW" ], [ 211542, "TCODE" ], [ 212092, "XPTPSW" ], [ 213122, "wide", "DVCLAL" ], [ 213136, "wide", "PACKAGEINFO" ], [ 213160, "wide", "MAINICON" ], [ 230320, "KERNEL32.DLL" ], [ 230333, "advapi32.dll" ], [ 230346, "Comdlg32.dll" ], [ 230359, "oleaut32.dll" ], [ 230372, "user32.dll" ], [ 230384, "LoadLibraryA" ], [ 230398, "GetProcAddress" ], [ 230414, "VirtualProtect" ], [ 230430, "VirtualAlloc" ], [ 230444, "VirtualFree" ], [ 230458, "ExitProcess" ], [ 230472, "RegCloseKey" ], [ 230486, "ReplaceTextW" ] ], "sz": 231936, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.24" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 1.80" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Native runtime has huge functions", "e": [ "binary.avg_function_size = 31372.50" ], "i": "metadata/lang/compiler/aot::huge-runtime-average-function", "l": 2 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 0.8600000143051147, "d": "Extremely large average function size", "e": [ "binary.avg_function_size = 31372.50" ], "i": "metadata/binary/metrics::giant-average-function", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "Copy COM automation variant", "e": [ "VariantCopy" ], "i": "micro-behaviors/os/com/invoke::variant-copy", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8500000238418579, "d": "PE linked with binutils 2.x (MinGW/GCC)", "e": [ "pe.linker_major_version = 2.00" ], "i": "metadata/lang/compiler/native::linker-binutils-2x", "l": 3 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 23.50" ], "i": "metadata/binary/metrics/markers::high-complexity-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 385024.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.function_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 231936.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 257.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics::no-functions", "l": 2 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.24" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "PACKAGEINFO", "MAINICON" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 708992537.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.91" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 7.80" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics/markers::low-function-count-marker", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 10.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.9599999785423279, "d": "Compact RWX UPX1 payload section", "e": [ "UPX1 (size: 211456, entropy: 7.89, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::compact-rwx-upx1", "l": 4 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp predates 2000", "e": [ "pe.timestamp_pre_2000 = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "l": 1 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 4.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 211456, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1027.009", "c": 0.8399999737739563, "d": "Compact high entropy overlay blob", "e": [ "binary.overlay_entropy = 7.80" ], "i": "objectives/anti-static/obfuscation/binary-metrics::compact-high-entropy-overlay", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "c": 0.949999988079071, "d": "links oleaut32.dll (VariantCopy)", "e": [ "oleaut32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links advapi32.dll (RegCloseKey)", "e": [ "advapi32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links Comdlg32.dll (ReplaceTextW)", "e": [ "Comdlg32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (CharNextA)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "well-known/malware/trojan/shellobject/markers::misleading-upx-sections", "l": 1 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": "MinGW PE with anti-analysis features", "e": [ "pe.linker_major_version = 2.00", "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/cross-compiled::mingw-with-anti-analysis", "l": 4, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High complexity but very few functions", "e": [ "binary.avg_complexity = 23.50", "binary.function_count = 2.00" ], "i": "metadata/binary/anomaly::high-complexity-decoy-dll", "l": 3 }, { "a": "T1027.002", "c": 0.949999988079071, "d": "UPX dynamic loader stub", "e": [ "GetProcAddress", "binary.function_count = 2.00", "binary.entry_in_nonstandard_section = 1.00", "UPX0", "VirtualAlloc", "VirtualProtect", "UPX1", "VirtualFree" ], "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub", "l": 3, "m": "F0001" }, { "a": "T1027", "c": 0.9200000166893005, "d": "High entropy overlay attached to packed loader", "e": [ "binary.overlay_entropy = 7.80", "UPX1 (size: 211456, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::encrypted-loader-overlay", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload::minimal-pe-dynamic-load", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 1.0, "d": "High complexity but very few functions", "e": [ "binary.function_count = 2.00", "binary.avg_complexity = 23.50" ], "i": "objectives/evasion/decoy::high-complexity-decoy-dll", "l": 2 } ], "sha": "997b9655e6c737edbca8e62323889bc735c039e6270d5194f6632bf70fc0fa2a", "path": "62312", "type": "pe" } ], "tv": "b2c18" } }