{ "ml": { "l": 0, "v": "6", "fs": [ { "l": 0, "id": 0, "prob": 0.9993787407875061 } ], "prob": 0.99937874, "models": [ { "m": "az", "raw": 0.6976834, "prob": 0.6976834, "class": 0 }, { "m": "az/source", "raw": 0.99937874, "prob": 0.99937874, "class": 2 }, { "m": "az/csharp", "raw": 0.9997033, "prob": 0.9997033, "class": 2 } ], "version": "v18.18", "analyzed_at": "2026-06-09T12:56:01Z" }, "path": "RunPE.cs", "raw": { "v": "6", "fs": [ { "f": "O(Er)H(Po₂)", "x": 38, "ff": { "i": [ [ "", "GetProcAddress" ], [ "", "LoadLibraryA" ], [ "", "CreateProcessA" ], [ "", "GetThreadContext" ], [ "", "Wow64GetThreadContext" ], [ "", "ReadProcessMemory" ], [ "", "ZwUnmapViewOfSection" ], [ "", "VirtualAllocEx" ], [ "", "WriteProcessMemory" ], [ "", "WriteProcessMemory" ], [ "", "WriteProcessMemory" ], [ "", "SetThreadContext" ], [ "", "Wow64SetThreadContext" ], [ "", "ResumeThread" ], [ "", "System" ], [ "", "System.ComponentModel" ], [ "", "System.Diagnostics" ], [ "", "System.Runtime.InteropServices" ], [ "", "System.Security" ], [ "", "System.Security.AccessControl" ], [ "", "System.Security.Principal" ] ], "m": { "ast": { "op.eq": 5.0, "op.lt": 2.0, "op.ne": 2.0, "op.add": 14.0, "op.bor": 1.0, "max_depth": 22.0, "bind_count": 3.0, "call_count": 55.0, "node_count": 2137.0, "member_count": 21.0, "op_density.eq": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.01, "op_density.bor": 0.0, "identifier_count": 132.0, "member_depth_max": 3.0, "string_literal_count": 22.0, "array_literal_max_length": 1.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 8890.0, "entropy": 4.61, "size_bytes": 8890.0 }, "text": { "digit_ratio": 0.03, "space_count": 2379.0, "total_lines": 152.0, "char_entropy": 4.61, "unique_chars": 80.0, "string_density": 0.14, "avg_line_length": 57.49, "high_byte_ratio": 0.0, "max_line_length": 177.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.09, "last_line_length": 1.0, "whitespace_ratio": 0.28, "most_common_ratio": 0.08, "identifier_density": 2.48, "line_length_stddev": 47.33, "encoded_string_ratio": 0.14, "normalized_string_count": 1.78, "repeated_char_sequences": 80.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 18.21 }, "binds": { "count": 3.0 }, "calls": { "count": 55.0 }, "binary": { "overall_entropy": 4.61 }, "source": { "class_count": 3.0, "function_count": 4.0 }, "imports": { "count": 7.0, "unique_modules": 7.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "members": { "count": 21.0 }, "strings": { "total": 22.0, "avg_length": 11.91, "max_length": 21.0, "avg_entropy": 3.06, "total_bytes": 262.0, "entropy_stddev": 0.48, "base64_candidates": 3.0 }, "functions": { "count": 7.0 }, "identifiers": { "count": 132.0, "total": 377.0, "avg_length": 11.09, "max_length": 29.0, "min_length": 1.0, "avg_entropy": 2.87, "reuse_ratio": 0.35, "unique_count": 132.0, "length_stddev": 6.13, "has_digit_ratio": 0.07, "sequential_names": 2.0, "base64_like_names": 7.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 19.0, "high_entropy_ratio": 0.14, "all_lowercase_ratio": 0.14, "all_uppercase_ratio": 0.01, "numeric_suffix_count": 5.0 } }, "s": [ [ 1667, "u8", "kernel32" ], [ 1668, "u8", "kernel32" ], [ 1679, "u8", "ResumeThread" ], [ 1680, "u8", "ResumeThread" ], [ 1821, "u8", "kernel32" ], [ 1822, "u8", "kernel32" ], [ 1833, "u8", "Wow64SetThreadContext" ], [ 1834, "u8", "Wow64SetThreadContext" ], [ 1969, "u8", "kernel32" ], [ 1970, "u8", "kernel32" ], [ 1981, "u8", "SetThreadContext" ], [ 1982, "u8", "SetThreadContext" ], [ 2127, "u8", "kernel32" ], [ 2128, "u8", "kernel32" ], [ 2139, "u8", "Wow64GetThreadContext" ], [ 2140, "u8", "Wow64GetThreadContext" ], [ 2275, "u8", "kernel32" ], [ 2276, "u8", "kernel32" ], [ 2287, "u8", "GetThreadContext" ], [ 2288, "u8", "GetThreadContext" ], [ 2412, "u8", "kernel32" ], [ 2413, "u8", "kernel32" ], [ 2424, "u8", "VirtualAllocEx" ], [ 2425, "u8", "VirtualAllocEx" ], [ 2559, "u8", "kernel32" ], [ 2560, "u8", "kernel32" ], [ 2571, "u8", "WriteProcessMemory" ], [ 2572, "u8", "WriteProcessMemory" ], [ 2707, "u8", "kernel32" ], [ 2708, "u8", "kernel32" ], [ 2719, "u8", "ReadProcessMemory" ], [ 2720, "u8", "ReadProcessMemory" ], [ 2863, "u8", "ntdll" ], [ 2864, "u8", "ntdll" ], [ 2872, "u8", "ZwUnmapViewOfSection" ], [ 2873, "u8", "ZwUnmapViewOfSection" ], [ 3001, "u8", "kernel32" ], [ 3002, "u8", "kernel32" ], [ 3013, "u8", "CreateProcessA" ], [ 3014, "u8", "CreateProcessA" ], [ 3098, "u8", "kernel32" ], [ 3099, "u8", "kernel32" ], [ 3257, "u8", "kernel32" ], [ 3258, "u8", "kernel32" ], [ 3809, "16", "1" ], [ 4116, "16", "1" ], [ 4400, "16", "36" ], [ 4749, "10", "0" ], [ 4756, "10", "5" ], [ 4810, "16", "0" ], [ 5166, "16", "4" ], [ 5179, "16", "134217728" ], [ 5318, "16", "60" ], [ 5405, "16", "52" ], [ 5456, "16", "179" ], [ 5491, "16", "0" ], [ 5498, "16", "65538" ], [ 5546, "16", "4" ], [ 5811, "16", "41" ], [ 5856, "16", "0" ], [ 5928, "16", "8" ], [ 5950, "16", "4" ], [ 6127, "16", "0" ], [ 6237, "16", "80" ], [ 6328, "16", "84" ], [ 6479, "16", "12288" ], [ 6487, "16", "64" ], [ 6535, "16", "0" ], [ 6756, "16", "248" ], [ 6851, "16", "6" ], [ 6890, "10", "0" ], [ 7033, "16", "12" ], [ 7129, "16", "16" ], [ 7229, "16", "20" ], [ 7281, "16", "0" ], [ 7471, "16", "0" ], [ 7737, "16", "40" ], [ 7911, "16", "8" ], [ 7929, "16", "4" ], [ 8063, "16", "40" ], [ 8163, "16", "44" ], [ 8247, "16", "4" ], [ 8620, "10", "1" ], [ 1303, "xor", "17e57*\u0026 66" ], [ 1314, "xor", "117,'01 6ie" ], [ 3092, "xor", "(5*71mg. 7+ )vwgie" ], [ 3118, "xor", "77*7exe170 l" ], [ 3251, "xor", "(5*71mg. 7+ )vwgie" ], [ 3803, "xor", "$\u0026.exeu=tl" ], [ 4110, "xor", "$\u0026.exeu=tl" ], [ 4393, "xor", "*+61exeu=wql" ], [ 5112, "xor", "m5$1-ie617,+\"k" ], [ 5964, "xor", "7,1 lle1-7*2e+ 2e" ], [ 6116, "xor", "!!7 66ledxeu=ule1-7*2e+ 2e" ], [ 6672, "xor", "7,1 lle1-7*2e+ 2e" ], [ 7576, "xor", "$6 ene3,710$)" ], [ 7640, "xor", "7,1 lle1-7*2e+ 2e" ], [ 7943, "xor", "7,1 lle1-7*2e+ 2e" ], [ 8609, "xor", "$+!) lexxehtle1-7*2e+ 2e" ] ], "v": { "file.stem": "RunPE", "file.basename": "RunPE.cs", "source.language": "csharp", "source.imports[0]": "CreateProcessA", "source.imports[1]": "GetProcAddress", "source.imports[2]": "GetThreadContext", "source.imports[3]": "LoadLibraryA", "source.imports[4]": "ReadProcessMemory", "source.imports[5]": "ResumeThread", "source.imports[6]": "SetThreadContext", "source.imports[7]": "System", "source.imports[8]": "System.ComponentModel", "source.imports[9]": "System.Diagnostics", "source.strings[0]": "!!7 66ledxeu=ule1-7*2e+ 2e", "source.strings[1]": "$\u0026.exeu=tl", "source.strings[2]": "$+!) lexxehtle1-7*2e+ 2e", "source.strings[3]": "$6 ene3,710$)", "source.strings[4]": "(5*71mg. 7+ )vwgie", "source.strings[5]": "*+61exeu=wql", "source.strings[6]": "117,'01 6ie", "source.strings[7]": "134217728", "source.strings[8]": "17e57*\u0026 66", "source.strings[9]": "7,1 lle1-7*2e+ 2e", "source.has_imports": true, "source.imports[10]": "System.Runtime.InteropServices", "source.imports[11]": "System.Security", "source.imports[12]": "System.Security.AccessControl", "source.imports[13]": "System.Security.Principal", "source.imports[14]": "VirtualAllocEx", "source.imports[15]": "Wow64GetThreadContext", "source.imports[16]": "Wow64SetThreadContext", "source.imports[17]": "WriteProcessMemory", "source.imports[18]": "ZwUnmapViewOfSection", "source.strings[10]": "77*7exe170 l", "source.strings[11]": "CreateProcessA", "source.strings[12]": "GetThreadContext", "source.strings[13]": "ReadProcessMemory", "source.strings[14]": "ResumeThread", "source.strings[15]": "SetThreadContext", "source.strings[16]": "VirtualAllocEx", "source.strings[17]": "Wow64GetThreadContext", "source.strings[18]": "Wow64SetThreadContext", "source.strings[19]": "WriteProcessMemory", "source.strings[20]": "ZwUnmapViewOfSection", "source.strings[21]": "kernel32", "source.strings[22]": "m5$1-ie617,+\"k", "source.functions[0]": "GetProcAddress", "source.functions[1]": "LoadApi", "source.functions[2]": "LoadLibraryA", "source.functions[3]": "Run" }, "ct": [ "BitConverter.GetBytes", "BitConverter.ToInt16", "BitConverter.ToInt32", "Buffer.BlockCopy", "Convert.ToInt32", "Convert.ToUInt32", "CreateProcessA", "Exception", "GetProcAddress", "GetThreadContext", "LoadLibraryA", "Marshal.GetDelegateForFunctionPointer", "Marshal.SizeOf", "Process.GetProcessById", "Process.GetProcessById().Kill", "ProcessInformation", "ReadProcessMemory", "ResumeThread", "SetThreadContext", "StartupInformation", "VirtualAllocEx", "Wow64GetThreadContext", "Wow64SetThreadContext", "WriteProcessMemory", "ZwUnmapViewOfSection" ], "id": "csharp", "mc": [ "BitConverter.GetBytes", "BitConverter.ToInt16", "BitConverter.ToInt32", "Buffer.BlockCopy", "CharSet.Ansi", "Convert.ToInt32", "Convert.ToUInt32", "IntPtr.Size", "IntPtr.Zero", "LayoutKind.Sequential", "Marshal.GetDelegateForFunctionPointer", "Marshal.SizeOf", "Process.GetProcessById", "Process.GetProcessById().Kill", "UnmanagedType.ByValArray", "UnmanagedType.VBByRefStr", "pi.ProcessHandle", "pi.ProcessId", "pi.ThreadHandle", "sectionData.Length", "si.Size" ] }, "id": 0, "sz": 8890, "ts": [ { "a": "T1055.012", "c": 0.8999999761581421, "d": "C# SetThreadContext reference", "e": [ "SetThreadContext" ], "i": "objectives/evasion/process/injection/hollowing::csharp-set-thread-context-reference", "l": 1, "m": "E1055.012", "el": [ "206f" ] }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "BaseAddress" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-1", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "string" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "c": 0.6000000238418579, "d": "typeof( call reference", "e": [ "typeof(" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::typeof-call", "l": 1 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "C# GetThreadContext reference", "e": [ "GetThreadContext" ], "i": "objectives/evasion/process/injection/hollowing::csharp-get-thread-context-reference", "l": 1, "m": "E1055.012", "el": [ "15ca" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "String" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.6000000238418579, "d": "payload keyword", "e": [ "payload" ], "i": "micro-behaviors/data/text/keywords/lexicon::payload", "l": 1 }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "C# ZwUnmapViewOfSection reference", "e": [ "ZwUnmapViewOfSection" ], "i": "objectives/evasion/process/injection/hollowing::csharp-zwunmap-reference", "l": 4, "m": "E1055.012", "el": [ "17b8" ] }, { "c": 0.8999999761581421, "d": ".NET process kill call", "e": [ ".Kill()" ], "i": "micro-behaviors/process/terminate/kill::process-kill", "l": 3 }, { "c": 0.9700000286102295, "d": "Validation vocabulary object", "e": [ "object" ], "i": "metadata/file/text/format::vocab-object", "l": 1 }, { "a": "T1055.012", "c": 0.8799999952316284, "d": "C# ResumeThread reference", "e": [ "ResumeThread" ], "i": "objectives/evasion/process/injection/hollowing::csharp-thread-context-references", "l": 1, "m": "E1055.012", "el": [ "218a" ] }, { "a": "T1547.001", "c": 0.6000000238418579, "d": "Run value name string", "e": [ "Run" ], "i": "objectives/persistence/login/startup/registry::run-value-name", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Headers" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "WriteProcessMemory API reference in source", "e": [ "WriteProcessMemory" ], "i": "micro-behaviors/process/inject/runtime/call::write-process-memory-source", "l": 3, "m": "C0032", "el": [ "19bc" ] } ], "sha": "9b3565d8d2529eebf4d2e51d6a9872efcccdc21581969f098dade24a5475cf81", "path": "/data/samples/bad/projects/DcRat/Plugin/SendFile/SendFile/RunPE.cs", "type": "csharp" } ], "tv": "35641" } }