{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.5419355, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T03:28:43Z" }, "path": "9d0b806a676f4b1da097db14f0989bc155f74daf0aa3d523ec4164f954fa417d.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 4, "ff": { "i": [ [ "msvbvm60", "ORDINAL 585" ], [ "msvbvm60", "MethCallEngine" ], [ "msvbvm60", "ORDINAL 519" ], [ "msvbvm60", "ORDINAL 660" ], [ "msvbvm60", "ORDINAL 669" ], [ "msvbvm60", "ORDINAL 595" ], [ "msvbvm60", "ORDINAL 522" ], [ "msvbvm60", "ORDINAL 631" ], [ "msvbvm60", "ORDINAL 525" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "ORDINAL 527" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "ORDINAL 600" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 712" ], [ "msvbvm60", "ORDINAL 609" ], [ "msvbvm60", "ProcCallEngine" ], [ "msvbvm60", "ORDINAL 536" ], [ "msvbvm60", "ORDINAL 537" ], [ "msvbvm60", "ORDINAL 645" ], [ "msvbvm60", "ORDINAL 571" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "ORDINAL 614" ], [ "msvbvm60", "ORDINAL 616" ], [ "msvbvm60", "ORDINAL 617" ], [ "msvbvm60", "ORDINAL 618" ], [ "msvbvm60", "ORDINAL 619" ], [ "msvbvm60", "ORDINAL 581" ] ], "m": { "pe": { "checksum": 79841.0, "checksum_valid": 1.0, "computed_checksum": 79841.0, "bound_import_count": 1.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 1243922264.0 }, "file": { "size": 49152.0, "entropy": 4.49, "size_bytes": 49152.0 }, "binary": { "is_pie": 0.0, "code_entropy": 4.99, "string_count": 334.0, "entropy_variance": 2.4, "avg_string_length": 16.49, "max_string_length": 75.0, "code_to_data_ratio": 1.0, "string_length_stddev": 13.74, "largest_section_ratio": 0.83, "sentence_string_count": 81.0, "sentence_string_ratio": 0.24, "high_entropy_string_count": 0.0 }, "imports": { "count": 30.0 }, "sections": { "count": 3.0, "code_size": 40960.0, "entropy_max": 4.99, "entropy_mean": 3.44, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 152, "u8", "Rich" ], [ 432, "u8", ".text" ], [ 512, "u8", ".rsrc" ], [ 568, "u8", "MSVBVM60.DLL" ], [ 4464, "u8", "Project1" ], [ 4584, "u8", "HYDR111M" ], [ 4597, "u8", "HYDR1110 - Normal Water Surface" ], [ 4653, "u8", "Form2" ], [ 4687, "u8", "MS Sans SerifA" ], [ 4714, "u8", "btnNext" ], [ 4726, "u8", "Next Station" ], [ 4764, "u8", "btnPrev" ], [ 4776, "u8", "Previous Station" ], [ 4818, "u8", "optMetric" ], [ 4832, "u8", "Option2" ], [ 4875, "u8", "optEnglish" ], [ 4890, "u8", "Option1" ], [ 4937, "u8", "txtRoughness" ], [ 4986, "u8", "txtElevation" ], [ 5035, "u8", "txtDistance" ], [ 5081, "u8", "VScroll1" ], [ 5120, "u8", "txtChannel" ], [ 5155, "u8", "txtDischarge" ], [ 5192, "u8", "txtPoints" ], [ 5228, "u8", "txtStation" ], [ 5263, "u8", "txtRemarks" ], [ 5298, "u8", "txtProject" ], [ 5333, "u8", "txtDesigner" ], [ 5369, "u8", "lblCount" ], [ 5419, "u8", "Label1" ], [ 5430, "u8", "Count" ], [ 5469, "u8", "Label4" ], [ 5480, "u8", "English" ], [ 5521, "u8", "Label12" ], [ 5533, "u8", "Roughness Coeff." ], [ 5600, "u8", "lblElevation" ], [ 5617, "u8", "Elevation (ft)" ], [ 5665, "u8", "lblDistance" ], [ 5681, "u8", "Distance (ft)" ], [ 5728, "u8", "lblChannel" ], [ 5743, "u8", "Channel Slope (ft/ft)" ], [ 5798, "u8", "lblDischarge" ], [ 5815, "u8", "Discharge (cfs)" ], [ 5864, "u8", "Label7" ], [ 5875, "u8", "Num Points" ], [ 5919, "u8", "Label6" ], [ 5930, "u8", "Station Number" ], [ 5978, "u8", "Label5" ], [ 5989, "u8", "Remarks" ], [ 6030, "u8", "lblMetric" ], [ 6044, "u8", "Metric" ], [ 6084, "u8", "Label3" ], [ 6095, "u8", "Project Number" ], [ 6143, "u8", "Label2" ], [ 6154, "u8", "Designer Name" ], [ 6202, "u8", "mnuFile" ], [ 6231, "u8", "mnuNew" ], [ 6256, "u8", "mnuOpen" ], [ 6283, "u8", "mnuSave" ], [ 6310, "u8", "mnuSaveAS" ], [ 6324, "u8", "\u0026Save As" ], [ 6342, "u8", "mnuExit" ], [ 6370, "u8", "mnuRunOK" ], [ 6397, "u8", "mnuEdit" ], [ 6426, "u8", "mnuInsert" ], [ 6440, "u8", "\u0026Insert a point" ], [ 6466, "u8", "mnuRepeatPoint" ], [ 6485, "u8", "\u0026Repeat this point" ], [ 6513, "u8", "mnuDelete" ], [ 6527, "u8", "\u0026Delete this point" ], [ 6555, "u8", "mnuInsertSta" ], [ 6572, "u8", "\u0026Insert a Station" ], [ 6599, "u8", "mnuRepeatStation" ], [ 6620, "u8", "\u0026Repeat this Station" ], [ 6650, "u8", "mnuDeleteSta" ], [ 6667, "u8", "\u0026Delete this Station" ], [ 6698, "u8", "mnuHelp1" ], [ 6728, "u8", "mnuAbout" ], [ 6757, "u8", "mnuHelp" ], [ 8040, "wide", "*\\AC:\\Glenn\\hydr2009\\hydr1110.vbp" ], [ 16084, "u8", "HYDR1110" ], [ 16096, "u8", "HYDRWINS" ], [ 16108, "u8", "opendialog" ], [ 16136, "wide", "071498" ], [ 16260, "u8", "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 16444, "u8", "Form" ], [ 17020, "wide", "Designer" ], [ 17056, "wide", "Project Number" ], [ 17128, "wide", "Distance (ft)" ], [ 17524, "wide", "Metric" ], [ 17544, "wide", "English" ], [ 17744, "wide", "* Station * Points * Discharge * Channel Slope*" ], [ 17868, "wide", "* Distance Elevation Roughness" ], [ 17972, "u8", "VBA6.DLL" ], [ 18036, "wide", "Save Changes to" ], [ 18156, "wide", "METRIC" ], [ 18192, "wide", "newfile" ], [ 18260, "wide", "HYDR1110.EXE" ], [ 18316, "wide", "HYDR1110.TMP" ], [ 18348, "wide", "HYDR1110.PRT" ], [ 18380, "wide", "HYDR111M.INI" ], [ 18420, "wide", "Channel Slope (m/m)" ], [ 18468, "wide", "HYDR1110 - Normal Water Surface -" ], [ 18564, "wide", "HYDR1110 - Normal Water Surface" ], [ 18632, "wide", "as of March 20, 2012" ], [ 18688, "wide", "hydrview HYDR1110.DOC" ], [ 18736, "wide", "Discharge (m3/s)" ], [ 18780, "wide", "HYDR1110 - Normal Water Surface - new file" ], [ 18872, "wide", "HYDR1110 Files (*.110)|*.110|All Files (*.*)|*.*" ], [ 19032, "u8", "comdlg32.dll" ], [ 19052, "u8", "GetOpenFileNameA" ], [ 19128, "u8", "GetSaveFileNameA" ], [ 19152, "wide", "Elevation (m)" ], [ 19276, "u8", "DR20" ], [ 19584, "wide", "hydrview" ], [ 19608, "wide", "Distance (m)" ], [ 19640, "wide", "Elevation (ft)" ], [ 19676, "wide", "Discharge (cfs)" ], [ 19712, "wide", "Channel Slope (ft/ft)" ], [ 19760, "wide", "METIN" ], [ 19776, "wide", "METOUT" ], [ 19804, "wide", "***** ERROR: NUMBER OF POINTS CANNOT EXCEED 25 *****" ], [ 19916, "wide", "***** INPUT ERROR: NUMBER OF POINTS SHOULD BE MORE" ], [ 20024, "wide", "THAN 2 BUT NOT MORE THAN 25 *****" ], [ 20112, "wide", "***** INPUT ERROR: DESIGN DISCHARGE SHOULD BE" ], [ 20212, "wide", "GREATER THAN ZERO *****" ], [ 20268, "wide", "LOUISIANA DEPARTMENT OF TRANSPORTATION AND DEVELOPMENT" ], [ 20400, "wide", "HYDR1110-" ], [ 20436, "wide", "HYDRAULICS SECTION" ], [ 20584, "wide", "STATE PROJECT NUMBER" ], [ 20648, "wide", "NORMAL WATER SURFACE PROGRAM" ], [ 20880, "wide", "STATION" ], [ 20912, "wide", "NUMBER OF POINTS" ], [ 20992, "wide", "DESIGN DISCHARGE (CFS)" ], [ 21044, "wide", "CHANNEL SLOPE (FT./FT.)" ], [ 21124, "wide", "DESIGN DISCHARGE (m3/s)" ], [ 21204, "wide", "CHANNEL SLOPE (m/m)" ], [ 21256, "wide", "***** INPUT ERROR: DISTANCES SHOULD BE" ], [ 21344, "wide", "INCREASING IN ORDER. SEE DISTANCE =" ], [ 21456, "wide", "CHANNEL CROSS-SECTION:" ], [ 21516, "wide", "***** INPUT ERROR: VALUE OF ROUGHNESS" ], [ 21600, "wide", "COEFFICIENT SHOULD BE BETWEEN 0.00 AND 0.25 *****" ], [ 21704, "wide", "*** DESIGN DISCHARGE OVERFLOWS CHANNEL BANKS ***" ], [ 21808, "wide", "*** MAXIMUM FLOW CONVEYED BY THIS CHANNEL IS" ], [ 21980, "wide", "NORMAL WATER SURFACE ELEVATION" ], [ 22048, "wide", "AREA OF OPENING (SQ. FT.)" ], [ 22108, "wide", "AVERAGE VELOCITY (FPS)" ], [ 22224, "wide", "AREA OF OPENING (m2)" ], [ 22284, "wide", "AVERAGE VELOCITY (m/s)" ], [ 22336, "wide", "STAGE Q" ], [ 22400, "wide", "DISTANCE" ], [ 22444, "wide", "ELEVATION" ], [ 22480, "wide", "ROUGHNESS COEFFICIENT" ], [ 22812, "wide", "HYDRWINT.PRT" ], [ 22844, "wide", "***** ERROR: DIVIDED FLOW IN THE CHANNEL *****" ], [ 23048, "wide", "HYDR2009.EXE $" ], [ 44360, "u8", "MethCallEngine" ], [ 44378, "u8", "EVENT_SINK_AddRef" ], [ 44398, "u8", "DllFunctionCall" ], [ 44416, "u8", "EVENT_SINK_Release" ], [ 44438, "u8", "EVENT_SINK_QueryInterface" ], [ 44466, "u8", "__vbaExceptHandler" ], [ 44488, "u8", "ProcCallEngine" ], [ 45398, "wide", "VS_VERSION_INFO" ], [ 45490, "wide", "VarFileInfo" ], [ 45522, "wide", "Translation" ], [ 45558, "wide", "StringFileInfo" ], [ 45594, "wide", "040904B0" ], [ 45618, "wide", "CompanyName" ], [ 45644, "wide", "Home" ], [ 45662, "wide", "ProductName" ], [ 45714, "wide", "FileVersion" ], [ 45740, "wide", "1.00" ], [ 45758, "wide", "ProductVersion" ], [ 45806, "wide", "InternalName" ], [ 45858, "wide", "OriginalFilename" ], [ 45892, "wide", "hydr1110.exe" ] ], "v": { "file.stem": "9d0b806a676f4b1da097db14f0989bc155f74daf0aa3d523ec4164f954fa417d", "pe.imphash": "6ffdda03e918ceab8071ffdb7f1336f9", "pe.machine": "i386", "pe.rich.key": 2288612339, "pe.rich.hash": "9fd14c40d4dca5e21aa54c626075766f", "pe.subsystem": "windows_gui", "pe.timestamp": 1332255056, "file.basename": "9d0b806a676f4b1da097db14f0989bc155f74daf0aa3d523ec4164f954fa417d.exe", "pe.image_base": 4194304, "pe.image_size": 53248, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4404, "pe.headers_size": 4096, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "f8d9a81275c50c3ef5ac5ed4eb78aae449a0a224", "pe.image_hash.sha256": "3ee60c2ad4619fd810429d245f258f6cef33c012252078b639870c577a003dd4", "pe.image_hash.sha384": "8b47e6819b3ade2103c0d4b0492b85fdb6af26d5fc19b3ed70c81353c7f0e6c36becd766f25f6d8631823e0e0b9be193", "pe.image_hash.sha512": "364989de7c01fb5295fadc5e0ed847cbff014b0527fc03b147b03db258607e92764dc42b68ed47f6aa11a0c2aa3a125336e1a5beec28884f0c4de863cf21deb0", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 44180, "pe.data_directories[1].rva": 49152, "pe.data_directories[2].rva": 552, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2256, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 124, "pe.rich.entries[0].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.coff.dos_header_pe_pointer": 184, "pe.rich.entries[0].product_id": 8169, "pe.bound_imports[0].time_date_stamp": 1247533676 }, "id": "pe", "sc": [ [ ".text", 4096, 40960, 4.99, "r-x" ], [ ".data", 0, 0, 0.0, "rw-" ], [ ".rsrc", 45056, 4096, 1.89, "r--" ] ] }, "id": 0, "sz": 49152, "ts": [ { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0xb25e" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x4a58" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Uses temporary .tmp staging file", "e": [ ".TMP" ], "i": "objectives/impact/infect/binary/rewrite::tmp-extension-staging", "l": 1, "el": [ "0x478c" ] }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "0x3f84" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 334.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code IN token (repeated)", "e": [ " IN " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-in", "l": 1, "m": "B0007.003", "el": [ "0x5360" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.24" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "a": "T1014", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".EXE" ], "i": "objectives/evasion/kernel-hide/rootkit::executable-read-patch-markers--rx-7", "l": 1, "el": [ "0x4754" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 30.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 30.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0xad6e" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0xb2ee" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0xb322" ] }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x238" ] }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1247533676,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0xb156" ] }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "STAGE Q" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-3", "l": 1, "m": "B0023", "el": [ "0x5740" ] }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler", "MethCallEngine", "ProcCallEngine" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0xadb2", "0xad48", "0xadc8" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0xb1f6" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".EXE", ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x4754", "0xb344" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x102c" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "***** INPUT ERROR: VALUE OF ROUGHNESS" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x540c" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x4317" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "9d0b806a676f4b1da097db14f0989bc155f74daf0aa3d523ec4164f954fa417d.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "9d0b806a676f4b1da097db14f0989bc155f74daf0aa3d523ec4164f954fa417d.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0xb232" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 30.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code BY token", "e": [ " BY " ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-by", "l": 1, "m": "B0007.003", "el": [ "0x5530" ] }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 30.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "9d0b806a676f4b1da097db14f0989bc155f74daf0aa3d523ec4164f954fa417d.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x1fa9" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 30.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0xb344" ] }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x1fa9" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 30.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (ORDINAL 585, MethCallEngine, ORDINAL 519, ORDINAL 660, ORDINAL 669, ... +25 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "30 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "MSVBVM60.DLL", "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x238", "0xad6e" ] } ], "sha": "9d0b806a676f4b1da097db14f0989bc155f74daf0aa3d523ec4164f954fa417d", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-03/9d0b806a676f4b1da097db14f0989bc155f74daf0aa3d523ec4164f954fa417d.exe", "type": "pe" } ], "tv": "52045" } }