{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.07450331, "class": 0 }, { "m": "az/pe", "prob": 0.000115273775, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-30T15:02:21Z" }, "path": "9a49dd105bc43fae0c1226c4920b7ba024640cb45f155472b4059c09500a2441.dll", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 6, "ff": { "i": [ [ "mscoree", "CorDllMain" ] ], "m": { "pe": { "checksum": 219361.0, "checksum_valid": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "computed_checksum": 219361.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 196984.0, "entropy": 5.4, "size_bytes": 196984.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.3, "overlay_size": 6520.0, "string_count": 2783.0, "overlay_ratio": 0.03, "overlay_entropy": 7.33, "entropy_variance": 4.5, "avg_string_length": 23.78, "max_string_length": 208.0, "code_to_data_ratio": 1.0, "string_length_stddev": 13.92, "largest_section_ratio": 0.95, "sentence_string_count": 51.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 187904.0, "entropy_max": 5.3, "entropy_mean": 2.7, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 608, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 765, "u8", "PADPADP" ], [ 924, "wide", "AuditServer" ], [ 986, "wide", "EvaluationServerD" ], [ 1046, "wide", "LiveMonitoro" ], [ 1142, "wide", "Reconstruction¾" ], [ 1196, "wide", "StatusMonitorServerØ" ], [ 1284, "wide", "TemplateDesignerĢ" ], [ 1491, "u8", "Monitor" ], [ 1558, "u8", "Organizer" ], [ 1570, "u8", "Reconstruction" ], [ 1586, "u8", "Reporter" ], [ 1596, "u8", "Status Monitor Server" ], [ 1670, "u8", "Template Designer" ], [ 2927, "u8", "CXufD" ], [ 2981, "u8", "d7NKLBN" ], [ 4598, "wide", "AddedPartialA" ], [ 4676, "wide", "AnnotationVideoUpdatedÃ" ], [ 4774, "wide", "ArchiveCreateStartedı" ], [ 4868, "wide", "ArchiveDeleteStartedƍ" ], [ 4960, "wide", "ArchiveLoadCancelledǯ" ], [ 5046, "wide", "ArchiveSettingsChangedɋ" ], [ 5140, "wide", "AttachmentAdded" ], [ 5212, "wide", "AttachmentPrinted" ], [ 5286, "wide", "AttachmentViewed" ], [ 5362, "wide", "AttachmentsPrinted΍" ], [ 5440, "wide", "AttachmentsViewedϛ" ], [ 5520, "wide", "AudioResourcesImportedЮ" ], [ 5614, "wide", "BackupArchiveModeChangedҫ" ], [ 5740, "wide", "BackupChannelsChanged" ], [ 5830, "wide", "BackupMediaEjected" ], [ 5936, "wide", "BasicUserAdded" ], [ 6006, "wide", "BookmarkAdded2" ], [ 6082, "wide", "CLSReplicationDeleted" ], [ 6176, "wide", "CallDeletionSettingsUpdated" ], [ 6270, "wide", "CodeBaseHashUpdated" ], [ 6366, "wide", "ConsumerAccountAdded" ], [ 6460, "wide", "ConsumerAccountUpdated" ], [ 6540, "wide", "CryptRDiagnosticsSaved" ], [ 6636, "wide", "CyberTechAudioResourceAdded" ], [ 6762, "wide", "DataRetentionServerAdded" ], [ 6888, "wide", "DataRetentionServerRemoved" ], [ 7002, "wide", "DataSourceConnectionFailure" ], [ 7120, "wide", "DatabaseBackupComplete" ], [ 7210, "wide", "DatabaseBackupFailed" ], [ 7310, "wide", "DatabaseBackupPerformed" ], [ 7424, "wide", "DatabaseBackupScheduleDeleted" ], [ 7538, "wide", "DatabaseConnectionRecovered" ], [ 7650, "wide", "EMCAdded" ], [ 7696, "wide", "EMCUpdated" ], [ 7760, "wide", "EvaluationFormCreated" ], [ 7854, "wide", "EvaluationFormDetailsChanged" ], [ 7978, "wide", "EvaluationQuestionTypeDeleted" ], [ 8082, "wide", "FailedLoginAttemptAccountKnown" ], [ 8188, "wide", "GeneralServerSettingsUpdated" ], [ 8316, "wide", "IMSStorageSettingsDeleted" ], [ 8426, "wide", "IMSStorageSettingsUpdated2" ], [ 8528, "wide", "ImportExternalAttachment" ], [ 8624, "wide", "IncidentAdded" ], [ 8690, "wide", "IncidentExported" ], [ 8778, "wide", "IncidentFolderAdded" ], [ 8868, "wide", "IncidentFolderUpdated" ], [ 8952, "wide", "IncidentItemDeleted" ], [ 9038, "wide", "IncidentSecurityAdded" ], [ 9136, "wide", "IncidentSecurityUpdated" ], [ 9238, "wide", "IncidentSnapshotDeleted" ], [ 9348, "wide", "IncidentStorageWarningLevel" ], [ 9442, "wide", "IncidentUpdated2" ], [ 9522, "wide", "InformPositionDeleted" ], [ 9626, "wide", "InformPositionSourcesDeleted" ], [ 9734, "wide", "InformPositionWorkstationsAdded" ], [ 9872, "wide", "InformServerAdded" ], [ 9954, "wide", "InformServerResourcesImported" ], [ 10060, "wide", "InformServerStopped" ], [ 10146, "wide", "InformSystemAdded" ], [ 10228, "wide", "InformSystemUpdated" ], [ 10304, "wide", "LicenseGracePeriodActivated" ], [ 10426, "wide", "LicenseGracePeriodExpired" ], [ 10516, "wide", "LimitedLicenseResourceChanged" ], [ 10646, "wide", "LiveMonitoringChannels" ], [ 10766, "wide", "LoggerChannelSettingsUpdated" ], [ 10886, "wide", "LoggerOnlineStorageAvailableAcceptable" ], [ 11034, "wide", "MapViewAdded" ], [ 11094, "wide", "MapViewDeleted" ], [ 11162, "wide", "MapViewUpdated" ], [ 11226, "wide", "! MapViewsImported" ], [ 11326, "wide", "MasterServerMismatchDetected" ], [ 11438, "wide", "MediaLibraryServerAssignmentUpdated" ], [ 11568, "wide", "MediaLibraryServerUpdated" ], [ 11714, "wide", "MovedPartial" ], [ 11800, "wide", "MultiMediaAnnotationUpdated2" ], [ 11898, "wide", "OrganizerAttachmentOpened" ], [ 12010, "wide", "OrganizerAttachmentSaved" ], [ 12118, "wide", "OrganizerAttachmentsOpened" ], [ 12234, "wide", "OrganizerAttachmentsSaved" ], [ 12346, "wide", "OrganizerVoicePlaybackStarted" ], [ 12470, "wide", "PairedChannelCheckingStarted" ], [ 12592, "wide", "PairedChannelCheckingTimeSynchFailure" ], [ 12724, "wide", "ProfileAdded" ], [ 12828, "wide", "ProfileApplicationPrivilegesUpdated2" ], [ 12992, "wide", "ProfileApplicationsUpdated" ], [ 13082, "wide", "ProfileUpdated" ], [ 13154, "wide", "ProfileUsersRemoved" ], [ 13246, "wide", "RadarReplayDeviceChannelMappingUpdated" ], [ 13380, "wide", "RadarReplayDeviceUpdated" ], [ 13474, "wide", "RadarResourcesImported" ], [ 13568, "wide", "RecordingSystemDeleted" ], [ 13720, "wide", "RecordingSystemUpdated" ], [ 13802, "wide", "RemovedUserAsUserGroupManager" ], [ 13896, "wide", "ReportDeleted" ], [ 13954, "wide", "ReportPrinted" ], [ 14008, "wide", "ReportSaved" ], [ 14066, "wide", "ReporterWarehouseDataCollectionSettingsUpdated" ], [ 14248, "wide", "ResourceAdded" ], [ 14314, "wide", "ResourceGroupAdded" ], [ 14400, "wide", "ResourceGroupMembersAdded" ], [ 14514, "wide", "ResourceGroupUpdated" ], [ 14624, "wide", "ResourceGroupsRemovedFromUserGroup" ], [ 14732, "wide", "ResourcesAddedToUserGroup" ], [ 14856, "wide", "0 ResourcesDeleted" ], [ 14972, "wide", "ResourcesRemovedFromUserGroup" ], [ 15066, "wide", "ScheduleAdded" ], [ 15132, "wide", "ScreenPlaybackStarted" ], [ 15222, "wide", "SealDistributionFolder" ], [ 15326, "wide", "SearchDeleted" ], [ 15388, "wide", "SearchSaved" ], [ 15500, "wide", "SecurityDataTamperDetectionReset" ], [ 15642, "wide", "SecurityDataTamperDetectionStopped" ], [ 15778, "wide", "SecurityKeyServerAdded" ], [ 15880, "wide", "SecurityKeyServerUpdated" ], [ 15986, "wide", "SensorConfigurationDeleted" ], [ 16100, "wide", "ServerResilienceErrorCleared" ], [ 16224, "wide", "SetUserAsAgent" ], [ 16312, "wide", "ShiftStarted" ], [ 16388, "wide", "SituatorResourcesImported" ], [ 16508, "wide", "SpeechAddedToAnnotation2" ], [ 16610, "wide", "StorageCenterPathUpdated" ], [ 16714, "wide", "StorageCenterPathsDeleted" ], [ 16808, "wide", "StorageGroupUpdated" ], [ 16888, "wide", "StorageUnitDeleted" ], [ 16966, "wide", ": TestSNMPTrapSent" ], [ 17052, "wide", "TimeChangeDetectedOnAms" ], [ 17166, "wide", "TimeChangeDetectedOnCls" ], [ 17280, "wide", "TimeChangeDetectedOnLogger" ], [ 17406, "wide", "TimeChangeDetectedOnRemoteWinServer" ], [ 17568, "wide", "TimeChangeDetectedOnServer" ], [ 17694, "wide", "TimeChangeDetectedOnSituator" ], [ 17812, "wide", "TimeChangeDetectedOnZamir" ], [ 17932, "wide", "TimeMonitoredRemoteServerDeleted" ], [ 18070, "wide", "TwoFixedParametersTest" ], [ 18156, "wide", "UploadedIncidentAttachmentFile" ], [ 18270, "wide", "@ UserAccountAdded" ], [ 18352, "wide", "UserAccountDisabled" ], [ 18436, "wide", "UserAccountEnabledByAdministrator" ], [ 18548, "wide", "UserEvaluationCreated" ], [ 18642, "wide", "UserEvaluationDetailsChanged" ], [ 18760, "wide", "UserEvaluationNoteAdded" ], [ 18866, "wide", "UserEvaluationProgressStateChanged" ], [ 19006, "wide", "UserEvaluationsCreatedBySchedule" ], [ 19104, "wide", "D UserGroupDeleted" ], [ 19182, "wide", "UserLoggedIn" ], [ 19242, "wide", "UserLoggedOutAutomatically" ], [ 19350, "wide", "UserPasswordChanged" ], [ 19440, "wide", "UsersAddedToWorkstation" ], [ 19546, "wide", "UsersRemovedFromWorkstation" ], [ 19664, "wide", "VerifyAnnotationVideoUpdated" ], [ 19770, "wide", "VerifyBookmarkAdded" ], [ 19880, "wide", "VerifyMultiMediaAnnotationUpdated" ], [ 20014, "wide", "VerifySpeechAnnotationAdded" ], [ 20128, "wide", "VerifyVideoAnnotationAdded" ], [ 20242, "wide", "VideoAnnotationAdded2" ], [ 20322, "wide", "VideoPlaybackStarted" ], [ 20408, "wide", "VideoResourcesImported" ], [ 20502, "wide", "WAVFileSaved" ], [ 20572, "wide", "WarehouseDatabaseFullCleared" ], [ 20706, "wide", "WarehouseDatabaseFullStoppedInserting" ], [ 20834, "wide", "WorkstationRadarReplayDeviceAssignmentChanged" ], [ 20980, "wide", "WorkstationsRemovedFromUser" ], [ 21080, "wide", "ZamirResourcesImported" ], [ 23140, "u8", "NiceCLS" ], [ 23821, "u8", "CryptR" ], [ 23936, "u8", "NICE Recording" ], [ 25354, "u8", "EMC Centera" ], [ 30192, "u8", "Media Player" ], [ 31209, "u8", "Perform" ], [ 35015, "u8", "Situator" ], [ 35813, "u8", "NICE Storage Center" ], [ 36242, "u8", "SNMP" ], [ 36997, "u8", "SkyRec" ], [ 40245, "u8", "NiceVision" ], [ 41068, "u8", "Zamir" ], [ 41440, "wide", "AudioManipulation'" ], [ 41494, "wide", "Distribution^" ], [ 41546, "wide", "Flags" ], [ 41588, "wide", "Organizer±" ], [ 41632, "wide", "RelatedMaterialþ" ], [ 41788, "wide", "TemplateDesignerŷ" ], [ 42654, "wide", "AvailableIncidentsTitle#" ], [ 42748, "wide", "AvailableResourcesTitles" ], [ 42852, "wide", "GroupHeading_LoadingSuffixÓ" ], [ 42980, "wide", "GroupHeading_Situatorď" ], [ 43086, "wide", "GroupHeading_SituatorIncidentsħ" ], [ 43194, "wide", "SelectedIncidentsTitleŞ" ], [ 43284, "wide", "SelectedResourcesTitleƮ" ], [ 44178, "wide", "FailedOverK" ], [ 44230, "wide", "NotFailedOverµ" ], [ 44805, "u8", "PADPADPR" ], [ 44900, "wide", "Live" ], [ 44946, "wide", "Replicatingl" ], [ 44996, "wide", "StandingBy¿" ], [ 45506, "wide", "RecordingLane" ], [ 45556, "wide", "UnknownJ" ], [ 45920, "wide", "Core" ], [ 45956, "wide", "ScreenRecorderm" ], [ 46618, "wide", "DataSourceTypeLong_NIM:" ], [ 46716, "wide", "DataSourceTypeLong_NiceInformServerm" ], [ 46858, "wide", "DataSourceTypeLong_NiceVision9·" ], [ 46994, "wide", "DataSourceTypeLong_SituatorÑ" ], [ 47122, "wide", "DataSourceTypeLong_Zamiró" ], [ 47244, "wide", "DataSourceTypeShort_LoggersOnlyſ" ], [ 47364, "wide", "DataSourceTypeShort_NIMƵ" ], [ 47484, "wide", "DataSourceTypeShort_NiceVision9Ǜ" ], [ 47624, "wide", "DataSourceTypeShort_Situatorǵ" ], [ 47756, "wide", "DataSourceTypeShort_Zamirȗ" ], [ 47872, "wide", "DataSourceType_PerformXȮ" ], [ 47972, "u8", "NiceLog" ], [ 47982, "u8", "NICE Interaction Management" ], [ 48011, "u8", "NICE Perform eXpress" ], [ 48081, "u8", "NiceCLS 8.9/9.0 NiceLog" ], [ 48119, "u8", "NICE Perform" ], [ 48354, "u8", "MML 9" ], [ 48482, "u8", "NICE Perform/NICE Perform eXpress" ], [ 48693, "u8", "PADPADPqS" ], [ 48806, "wide", "LoggersOnly" ], [ 48846, "wide", "NiceLogCls89{" ], [ 48902, "wide", "PerformDataHubÉ" ], [ 48956, "wide", "SkySoftSkyRecĄ" ], [ 49501, "u8", "PADPADPA" ], [ 49576, "wide", "informAvailableSelection1.AvailableListTitle+" ], [ 49760, "wide", "label1.Text" ], [ 50141, "u8", "fSystem.Drawing.Size, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3alo" ], [ 50306, "wide", "mainDescription.Size¤" ], [ 50396, "wide", "privilegeList.SizeȄ" ], [ 50459, "u8", "QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" ], [ 50547, "u8", "System.Drawing.Size" ], [ 50577, "u8", "height" ], [ 50939, "u8", "NICE Inform.@" ], [ 52022, "wide", "Assessment_Licensed" ], [ 52116, "wide", "Audit_LicensedI" ], [ 52190, "wide", "Codecs_AMBE2400" ], [ 52256, "wide", "Evaluator_Licensedª" ], [ 52366, "wide", "Evaluator_MaximumPSOperatorUsersĭ" ], [ 52484, "wide", "General_ApplicationVersionƔ" ] ], "v": { "file.stem": "9a49dd105bc43fae0c1226c4920b7ba024640cb45f155472b4059c09500a2441", "pe.imphash": "dae02f32a21e03ce65412f6e56942daa", "pe.machine": "i386", "pe.subsystem": "windows_cui", "pe.timestamp": 1612878455, "file.basename": "9a49dd105bc43fae0c1226c4920b7ba024640cb45f155472b4059c09500a2441.dll", "pe.image_base": 268435456, "pe.image_size": 212992, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 195774, "pe.headers_size": 512, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 6520, "pe.image_hash.sha1": "fbcdbdc6705b3885d04157baa52e2e5434086ee8", "pe.version.company": "NICE Ltd", "pe.version.comments": "Common Library for NICE Inform Client Applications", "pe.image_hash.sha256": "526c7cdf6dd479d03b57ee80b4cfc53c0d54c0b605d61d3d411fe101cda32b49", "pe.image_hash.sha384": "e81214056d9b26bb513e563b274a3c3cff0896dc4d98b0e71b768eec94bc51d6ae67a398f3214b5095093677308f17ad", "pe.image_hash.sha512": "b5fc3cad2365564534e3a6537b2c515ebae48b6027605b86d54962499045385e446b5a340f90ceb2f4d4c44419cd48a2cf65c0716ac68756b6bb1ded3d80ce99", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright © 2021 NICE Ltd", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.version.trademarks": "NICE", "pe.characteristics_raw": 8450, "pe.clr.runtime_version": "2.5", "pe.version.description": "Nice.Inform.Client.Common", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "pe.signatures[0].serial": "0e5bdf331b46675123fd9040c9ae3595", "pe.version.file_version": "10.0.2.417", "pe.version.product_name": "NICE Inform", "pe.signatures[0].subject": "CN=NICE SYSTEMS UK LIMITED,OU=PO20933582,O=NICE SYSTEMS UK LIMITED,L=SOUTHAMPTON,C=GB", "pe.version.internal_name": "Nice.Inform.Client.Common.resources.dll", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 195684, "pe.data_directories[1].rva": 196608, "pe.data_directories[2].rva": 190464, "pe.data_directories[3].rva": 204800, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2022-12-21T12:00:00Z", "pe.version.product_version": "10.0.2.417", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1192, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 6520, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.signatures[0].not_before": "2019-12-13T00:00:00Z", "pe.version.original_filename": "Nice.Inform.Client.Common.resources.dll", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "73a54f4b03b322f7fe4037d9b191c3ce595d4dc4", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "fbcdbdc6705b3885d04157baa52e2e5434086ee8", "pe.signatures[0].thumbprint_sha256": "cda3217d9a43f4a375031e06d822057abce00793f5b55c540c5f6e445e4cad5c", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1" }, "id": "pe", "sc": [ [ ".text", 512, 187904, 5.3, "r-x" ], [ ".rsrc", 188416, 1536, 2.71, "r--" ], [ ".reloc", 189952, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 196984, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x2cd24" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x2cd24" ] }, { "c": 1.0, "d": "Authenticode chain CN: NICE SYSTEMS UK LIMITED", "e": [ "NICE SYSTEMS UK LIMITED" ], "i": "metadata/signed/unknown::nice-systems-uk-limited", "l": 2 }, { "c": 1.0, "d": "Signed by NICE SYSTEMS UK LIMITED", "e": [ "NICE SYSTEMS UK LIMITED" ], "i": "metadata/signed/leaf::nice-systems-uk-limited", "l": 3 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2783.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x2d0bf" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x2e1ee" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 2783.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "10.0.2.417" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Issued by a DigiCert Code Signing CA", "e": [ "CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US" ], "i": "metadata/signed/certificate::pe-cert-issuer-digicert", "l": 2, "el": [ "value:pe.signatures[0].issuer" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "10.0.2.417" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x2e05e" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x2de3e" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "FolderName_MyDownloads", "ExportProgress_CouldNotDownloadAllTheVideo", "ExportProgress_DownloadedItemNOfN" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1, "el": [ "0x1779e", "0x164d0", "0x16576" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x2deae" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Nice.Inform.Client.Common" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "ToolTip_SaveToDisk" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1, "el": [ "0x1a1ae" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "UploadedIncidentAttachmentFile" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-8", "l": 1, "el": [ "0x46ec" ] }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "esupdate (eScan update host)", "e": [ "ProfileApplicationPrivilegesUpdated2" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-2", "l": 1, "m": "F0004", "el": [ "0x321c" ] }, { "d": "password keyword", "e": [ "ImportUser_PasswordFailedCom", "Login_PasswordChangingNotAllowed", "SetPassword_PasswordChangedTooRecently", "SetPassword_PasswordContainsFirstName", "Login_UsernameOrPasswordInvalid", "PasswordExpired", "SetPassword_PasswordContainsUsername", "UserPasswordChanged", "SetPassword_ErrorCheckingNewPassword", "SetPassword_InForbiddenPasswordList", "SetPassword_MatchesFirstPassword" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1, "el": [ "0x18028", "0x187a0", "0x19a88", "0x19b22", "0x18882", "0x18af2", "0x19bbe", "0x4b96", "0x198d8", "0x1996a", "0x199fc" ] }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "9a49dd105bc43fae0c1226c4920b7ba024640cb45f155472b4059c09500a2441.dll" ], "i": "objectives/evasion/masquerade/dll/name::dll-basename", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x2e37e" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0x2e8fa" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "command" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x27c52" ] }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "DataSourceConnectionFailure", "DataSourceConnectionError¥", "DatabaseConnectionRecovered", "ConnectionToRtsFailed¤", "ConnectionFailedͻ" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012", "el": [ "0x1b5a", "0x1408c", "0x1d72", "0x2b068", "0x15f10" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x260" ] }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "Regard command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1, "el": [ "0x27c52" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x2e1ba" ] }, { "c": 0.6000000238418579, "d": "Clipboard keyword", "e": [ "HeaderFormatter_Clipboard" ], "i": "micro-behaviors/data/text/keywords/clipboard::clipboard-token", "l": 1, "el": [ "0x17b74" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "10.0.2.417" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "9a49dd105bc43fae0c1226c4920b7ba024640cb45f155472b4059c09500a2441.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1567", "c": 1.0, "d": "Regex component marker", "e": [ "UsersAddedToWorkstation", "Organizer_MaximumConcurrentUsers", "Verify_MaximumConcurrentUsers", "UserAdministration_ImportExportUsersFromSystem", "Reports_MaximumUsers", "Monitor_MaximumConcurrentUsersRecentCallReplayӪ", "ProfileUsersRemoved", "AvailableUsersƁ", "UsersRemovedFromWorkstation", "UserAdministration_MaximumUsers", "Reporter_MaximumUsers", "UserAdministration_EditUsers", "Reporter_MaximumAdvancedConcurrentUsers", "Reconstruction_MaximumConcurrentUsers", "Evaluator_MaximumPSOperatorUsersĭ", "Monitor_MaximumUsersRecentCallReplay" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "l": 1, "el": [ "0x4bf0", "0xd2ea", "0xde74", "0x11f70", "0xd6a4", "0xd0d0", "0x3362", "0x15d3e", "0x4c5a", "0xde0e", "0xd650", "0x11ed6", "0xd5ba", "0xd44e", "0xcc8e", "0xd15e" ] }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x2d1b6" ] }, { "c": 0.949999988079071, "d": "DigiCert timestamp certificate chain", "e": [ "DigiCert Timestamp 2021", "DigiCert SHA2 Assured ID Timestamping CA" ], "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain", "l": 2, "el": [ "0x2e976", "0x2e8fa" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xc56d" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Nice.Inform.Client.Common.EnumeratedCallFieldValues.ru.resources" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x2d7e9" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x2e3f6" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "NICE Inform" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R", "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x260", "0x2d0b6" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2783.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 2021 NICE Ltd" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x2e282" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2783.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "String" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x2e0fe", "0x19f20" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x260" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "CyberTechAudioResourceAdded", "InformPositionSourcesDeleted", "IncidentStorageWarningLevel", "DataRetentionServerAdded", "DataRetentionServerRemoved", "DataSourceConnectionFailure", "EvaluationFormCreated", "EvaluationQuestionTypeDeleted", "DatabaseBackupPerformed", "GeneralServerSettingsUpdated", "DatabaseBackupScheduleDeleted", "FailedLoginAttemptAccountKnown", "EvaluationFormDetailsChanged", "ImportExternalAttachment", "CallDeletionSettingsUpdated", "DatabaseConnectionRecovered" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x19ec", "0x259a", "0x2484", "0x1a6a", "0x1ae8", "0x1b5a", "0x1e50", "0x1f2a", "0x1c8e", "0x1ffc", "0x1d00", "0x1f92", "0x1eae", "0x2150", "0x1820", "0x1d72" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 187904, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2783.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "SaveFileForm_BlankPath", "\" InvalidCharsPath", "StorageCenterPathUpdated", "StorageCenterPathsDeleted", "SaveFileForm_PathTooLong" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012", "el": [ "0x19530", "0x18392", "0x40e2", "0x414a", "0x196b6" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Android Pictures folder", "e": [ "FolderName_MyPictures" ], "i": "objectives/impact/wipe/disk/mass-delete::android-pictures", "l": 1, "el": [ "0x17872" ] }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.949999988079071, "d": "links mscoree (CorDllMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "10.0.2.417" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "10.0.2.417" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] } ], "sha": "9a49dd105bc43fae0c1226c4920b7ba024640cb45f155472b4059c09500a2441", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-10/9a49dd105bc43fae0c1226c4920b7ba024640cb45f155472b4059c09500a2441.dll", "type": "pe" } ], "tv": "ca5ef" } }