{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.080213904, "class": 0 }, { "m": "az/pe", "prob": 0.044354837, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-30T17:04:37Z" }, "path": "9d2c2adc3c4b2af4a713da06361c4407e864b7f50e77d81195ef70e628b772d9.exe", "raw": { "v": "5", "fs": [ { "f": "O(C)H₂(CmOs)", "x": 5, "ff": { "i": [ [ "mfc42", "ORDINAL 2390" ], [ "mfc42", "ORDINAL 3059" ], [ "mfc42", "ORDINAL 5100" ], [ "mfc42", "ORDINAL 5104" ], [ "mfc42", "ORDINAL 4467" ], [ "mfc42", "ORDINAL 4303" ], [ "mfc42", "ORDINAL 3351" ], [ "mfc42", "ORDINAL 5012" ], [ "mfc42", "ORDINAL 976" ], [ "mfc42", "ORDINAL 5472" ], [ "mfc42", "ORDINAL 3403" ], [ "mfc42", "ORDINAL 2879" ], [ "mfc42", "ORDINAL 2878" ], [ "mfc42", "ORDINAL 4152" ], [ "mfc42", "ORDINAL 6055" ], [ "mfc42", "ORDINAL 4077" ], [ "mfc42", "ORDINAL 1776" ], [ "mfc42", "ORDINAL 4407" ], [ "mfc42", "ORDINAL 5237" ], [ "mfc42", "ORDINAL 2382" ], [ "mfc42", "ORDINAL 5163" ], [ "mfc42", "ORDINAL 6374" ], [ "mfc42", "ORDINAL 4353" ], [ "mfc42", "ORDINAL 5283" ], [ "mfc42", "ORDINAL 2649" ], [ "mfc42", "ORDINAL 1665" ], [ "mfc42", "ORDINAL 3798" ], [ "mfc42", "ORDINAL 4837" ], [ "mfc42", "ORDINAL 4436" ], [ "mfc42", "ORDINAL 2648" ], [ "mfc42", "ORDINAL 2055" ], [ "mfc42", "ORDINAL 6376" ], [ "mfc42", "ORDINAL 3749" ], [ "mfc42", "ORDINAL 5065" ], [ "mfc42", "ORDINAL 1727" ], [ "mfc42", "ORDINAL 2445" ], [ "mfc42", "ORDINAL 2124" ], [ "mfc42", "ORDINAL 5277" ], [ "mfc42", "ORDINAL 2982" ], [ "mfc42", "ORDINAL 3147" ], [ "mfc42", "ORDINAL 3259" ], [ "mfc42", "ORDINAL 4465" ], [ "mfc42", "ORDINAL 3136" ], [ "mfc42", "ORDINAL 3262" ], [ "mfc42", "ORDINAL 2985" ], [ "mfc42", "ORDINAL 3081" ], [ "mfc42", "ORDINAL 2976" ], [ "mfc42", "ORDINAL 3830" ], [ "mfc42", "ORDINAL 3831" ], [ "mfc42", "ORDINAL 3825" ], [ "mfc42", "ORDINAL 3079" ], [ "mfc42", "ORDINAL 4080" ], [ "mfc42", "ORDINAL 4627" ], [ "mfc42", "ORDINAL 4427" ], [ "mfc42", "ORDINAL 401" ], [ "mfc42", "ORDINAL 825" ], [ "mfc42", "ORDINAL 674" ], [ "mfc42", "ORDINAL 5254" ], [ "mfc42", "ORDINAL 1859" ], [ "mfc42", "ORDINAL 4246" ], [ "mfc42", "ORDINAL 3869" ], [ "mfc42", "ORDINAL 2127" ], [ "mfc42", "ORDINAL 2391" ], [ "mfc42", "ORDINAL 5102" ], [ "mfc42", "ORDINAL 5105" ], [ "mfc42", "ORDINAL 4468" ], [ "mfc42", "ORDINAL 3350" ], [ "mfc42", "ORDINAL 975" ], [ "mfc42", "ORDINAL 2880" ], [ "mfc42", "ORDINAL 4153" ], [ "mfc42", "ORDINAL 2383" ], [ "mfc42", "ORDINAL 5284" ], [ "mfc42", "ORDINAL 4437" ], [ "mfc42", "ORDINAL 2446" ], [ "mfc42", "ORDINAL 4428" ], [ "mfc42", "ORDINAL 796" ], [ "mfc42", "ORDINAL 554" ], [ "mfc42", "ORDINAL 529" ], [ "mfc42", "ORDINAL 402" ], [ "mfc42", "ORDINAL 807" ], [ "mfc42", "ORDINAL 5255" ], [ "mfc42", "ORDINAL 4615" ], [ "mfc42", "ORDINAL 4612" ], [ "mfc42", "ORDINAL 4610" ], [ "mfc42", "ORDINAL 4274" ], [ "mfc42", "ORDINAL 6375" ], [ "mfc42", "ORDINAL 4486" ], [ "mfc42", "ORDINAL 2554" ], [ "mfc42", "ORDINAL 2512" ], [ "mfc42", "ORDINAL 5731" ], [ "mfc42", "ORDINAL 3922" ], [ "mfc42", "ORDINAL 1089" ], [ "mfc42", "ORDINAL 5199" ], [ "mfc42", "ORDINAL 2396" ], [ "mfc42", "ORDINAL 3346" ], [ "mfc42", "ORDINAL 5300" ], [ "mfc42", "ORDINAL 5302" ], [ "mfc42", "ORDINAL 2725" ], [ "mfc42", "ORDINAL 2723" ], [ "mfc42", "ORDINAL 4698" ], [ "mfc42", "ORDINAL 5307" ], [ "mfc42", "ORDINAL 5289" ], [ "mfc42", "ORDINAL 5714" ], [ "mfc42", "ORDINAL 4622" ], [ "mfc42", "ORDINAL 4424" ], [ "mfc42", "ORDINAL 3738" ], [ "mfc42", "ORDINAL 561" ], [ "mfc42", "ORDINAL 815" ], [ "mfc42", "ORDINAL 6215" ], [ "mfc42", "ORDINAL 617" ], [ "mfc42", "ORDINAL 5301" ], [ "mfc42", "ORDINAL 5214" ], [ "mfc42", "ORDINAL 296" ], [ "mfc42", "ORDINAL 986" ], [ "mfc42", "ORDINAL 411" ], [ "mfc42", "ORDINAL 4159" ], [ "mfc42", "ORDINAL 6117" ], [ "mfc42", "ORDINAL 2621" ], [ "mfc42", "ORDINAL 1134" ], [ "mfc42", "ORDINAL 5265" ], [ "mfc42", "ORDINAL 4376" ], [ "mfc42", "ORDINAL 4853" ], [ "mfc42", "ORDINAL 4998" ], [ "mfc42", "ORDINAL 4710" ], [ "mfc42", "ORDINAL 2514" ], [ "mfc42", "ORDINAL 6052" ], [ "mfc42", "ORDINAL 4078" ], [ "mfc42", "ORDINAL 1775" ], [ "mfc42", "ORDINAL 5241" ], [ "mfc42", "ORDINAL 2385" ], [ "mfc42", "ORDINAL 5280" ], [ "mfc42", "ORDINAL 4441" ], [ "mfc42", "ORDINAL 5261" ], [ "mfc42", "ORDINAL 4425" ], [ "mfc42", "ORDINAL 3597" ], [ "mfc42", "ORDINAL 324" ], [ "mfc42", "ORDINAL 641" ], [ "mfc42", "ORDINAL 4234" ], [ "mfc42", "ORDINAL 1825" ], [ "mfc42", "ORDINAL 4238" ], [ "mfc42", "ORDINAL 4696" ], [ "mfc42", "ORDINAL 3058" ], [ "mfc42", "ORDINAL 3065" ], [ "mfc42", "ORDINAL 6336" ], [ "mfc42", "ORDINAL 2510" ], [ "mfc42", "ORDINAL 2542" ], [ "mfc42", "ORDINAL 5243" ], [ "mfc42", "ORDINAL 5740" ], [ "mfc42", "ORDINAL 1746" ], [ "mfc42", "ORDINAL 5577" ], [ "mfc42", "ORDINAL 3172" ], [ "mfc42", "ORDINAL 5653" ], [ "mfc42", "ORDINAL 4420" ], [ "mfc42", "ORDINAL 4953" ], [ "mfc42", "ORDINAL 4858" ], [ "mfc42", "ORDINAL 2399" ], [ "mfc42", "ORDINAL 4387" ], [ "mfc42", "ORDINAL 3454" ], [ "mfc42", "ORDINAL 3198" ], [ "mfc42", "ORDINAL 6080" ], [ "mfc42", "ORDINAL 6175" ], [ "mfc42", "ORDINAL 4623" ], [ "mfc42", "ORDINAL 4426" ], [ "mfc42", "ORDINAL 338" ], [ "mfc42", "ORDINAL 652" ], [ "mfc42", "ORDINAL 4823" ], [ "mfc42", "ORDINAL 4614" ], [ "mfc42", "ORDINAL 4613" ], [ "mfc42", "ORDINAL 1945" ], [ "mfc42", "ORDINAL 4273" ], [ "mfc42", "ORDINAL 4589" ], [ "mfc42", "ORDINAL 4899" ], [ "mfc42", "ORDINAL 5076" ], [ "mfc42", "ORDINAL 4341" ], [ "mfc42", "ORDINAL 4349" ], [ "mfc42", "ORDINAL 4723" ], [ "mfc42", "ORDINAL 4890" ], [ "mfc42", "ORDINAL 4531" ], [ "mfc42", "ORDINAL 4545" ], [ "mfc42", "ORDINAL 4543" ], [ "mfc42", "ORDINAL 4526" ], [ "mfc42", "ORDINAL 4529" ], [ "mfc42", "ORDINAL 4524" ], [ "mfc42", "ORDINAL 4964" ], [ "mfc42", "ORDINAL 4961" ], [ "mfc42", "ORDINAL 4108" ], [ "mfc42", "ORDINAL 5240" ], [ "mfc42", "ORDINAL 5290" ], [ "mfc42", "ORDINAL 3748" ], [ "mfc42", "ORDINAL 1726" ], [ "mfc42", "ORDINAL 4432" ], [ "mfc42", "ORDINAL 560" ], [ "mfc42", "ORDINAL 813" ], [ "mfc42", "ORDINAL 5260" ], [ "mfc42", "ORDINAL 2535" ], [ "mfc42", "ORDINAL 1576" ], [ "mfc42", "ORDINAL 2101" ], [ "mfc42", "ORDINAL 5101" ], [ "mfc42", "ORDINAL 4245" ], [ "mfc42", "ORDINAL 1858" ], [ "mfc42", "ORDINAL 4079" ], [ "mfc42", "ORDINAL 823" ], [ "mfc42", "ORDINAL 1168" ], [ "msvcrt", "initterm" ], [ "msvcrt", "setusermatherr" ], [ "msvcrt", "adjust_fdiv" ], [ "msvcrt", "p__commode" ], [ "msvcrt", "p__fmode" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "except_handler3" ], [ "msvcrt", "controlfp" ], [ "msvcrt", "acmdln" ], [ "msvcrt", "exit" ], [ "msvcrt", "XcptFilter" ], [ "msvcrt", "exit" ], [ "msvcrt", "onexit" ], [ "msvcrt", "dllonexit" ], [ "msvcrt", "CxxFrameHandler" ], [ "msvcrt", "setmbcp" ], [ "msvcrt", "getmainargs" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "Sleep" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetStartupInfoA" ], [ "kernel32", "LoadLibraryA" ], [ "user32", "UpdateWindow" ], [ "user32", "EnumWindows" ], [ "user32", "EnableWindow" ] ], "m": { "pe": { "checksum": 0.0, "icon_count": 2.0, "checksum_valid": 0.0, "resource_count": 9.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 66186.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 36864.0, "entropy": 3.27, "size_bytes": 36864.0 }, "binary": { "is_pie": 0.0, "code_entropy": 3.83, "data_entropy": 0.41, "string_count": 400.0, "entropy_variance": 1.91, "avg_string_length": 15.67, "max_string_length": 308.0, "code_to_data_ratio": 0.67, "string_length_stddev": 25.22, "largest_section_ratio": 0.33, "sentence_string_count": 87.0, "sentence_string_ratio": 0.22, "high_entropy_string_count": 0.0 }, "imports": { "count": 228.0 }, "sections": { "count": 4.0, "code_size": 8192.0, "entropy_max": 3.83, "entropy_mean": 2.77, "name_entropy": 2.93, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 4.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 208, "u8", "RichA" ], [ 472, "u8", ".text" ], [ 551, "u8", "@.data" ], [ 592, "u8", ".rsrc" ], [ 8433, "u8", "XPVSS" ], [ 16556, "u8", "MFC42.DLL" ], [ 16568, "u8", "__CxxFrameHandler" ], [ 16586, "u8", "MSVCRT.dll" ], [ 16600, "u8", "__dllonexit" ], [ 16614, "u8", "_onexit" ], [ 16632, "u8", "_XcptFilter" ], [ 16646, "u8", "exit" ], [ 16654, "u8", "_acmdln" ], [ 16664, "u8", "__getmainargs" ], [ 16680, "u8", "_initterm" ], [ 16692, "u8", "__setusermatherr" ], [ 16712, "u8", "_adjust_fdiv" ], [ 16728, "u8", "__p__commode" ], [ 16744, "u8", "__p__fmode" ], [ 16758, "u8", "__set_app_type" ], [ 16776, "u8", "_except_handler3" ], [ 16796, "u8", "_controlfp" ], [ 16810, "u8", "GetProcAddress" ], [ 16828, "u8", "LoadLibraryA" ], [ 16844, "u8", "Sleep" ], [ 16852, "u8", "GetModuleHandleA" ], [ 16872, "u8", "GetStartupInfoA" ], [ 16888, "u8", "KERNEL32.dll" ], [ 16904, "u8", "EnumWindows" ], [ 16918, "u8", "UpdateWindow" ], [ 16934, "u8", "EnableWindow" ], [ 16948, "u8", "USER32.dll" ], [ 16962, "u8", "_setmbcp" ], [ 20512, "u8", "CChildFrame" ], [ 20524, "u8", "4235436451232@4356344122324324235423" ], [ 20800, "u8", "CMainFrame" ], [ 20824, "u8", "101.32.177.84" ], [ 20840, "u8", "Local AppWizard-Generated Applications" ], [ 20880, "u8", "CWzdDoc" ], [ 20888, "u8", "CWzdView" ], [ 26596, "u8", "DDLLDDDL" ], [ 26612, "u8", "LLDDLD" ], [ 26646, "u8", "DDLDLD" ], [ 26660, "u8", "LDDDDDDD" ], [ 28472, "u8", "wwtGwwwwwwwwwwwwwwwtDDDD" ], [ 28544, "u8", "wwGtwDwwwwwtDDDDw" ], [ 28576, "u8", "pwwwwppwwww" ], [ 28616, "u8", "wwGttwGwwwwt" ], [ 28632, "u8", "p884" ], [ 28760, "u8", "wwtDtwGwp" ], [ 28832, "u8", "wwwttDwwp" ], [ 28937, "u8", "wwwwpppwww" ], [ 29062, "u8", "OGp888888" ], [ 29120, "u8", "wwwppwwwp" ], [ 29204, "u8", "DDGwp8" ], [ 29318, "u8", "wwwwwwpwppp0wwww" ], [ 29580, "wide", "P\u0026rint Setup..." ], [ 29622, "wide", "Recent File" ], [ 29708, "wide", "\u0026Status Bar" ], [ 29750, "wide", "\u0026About Wzd..." ], [ 29918, "wide", "Save \u0026As..." ], [ 29990, "wide", "Print Pre\u0026view" ], [ 30338, "wide", "\u0026New Window" ], [ 30404, "wide", "\u0026Arrange Icons" ], [ 30614, "wide", "About Wzd" ], [ 30636, "wide", "MS Sans Serif" ], [ 30714, "wide", "Wzd Version 1.0" ], [ 30770, "wide", "Copyright (C) 1998" ], [ 30854, "wide", "VS_VERSION_INFO" ], [ 30946, "wide", "StringFileInfo" ], [ 30982, "wide", "040904B0" ], [ 31006, "wide", "CompanyName" ], [ 31038, "wide", "FileDescription" ], [ 31072, "wide", "Wzd MFC Application" ], [ 31118, "wide", "FileVersion" ], [ 31174, "wide", "InternalName" ], [ 31214, "wide", "LegalCopyright" ], [ 31290, "wide", "LegalTrademarks" ], [ 31330, "wide", "OriginalFilename" ], [ 31364, "wide", "Wzd.EXE" ], [ 31386, "wide", "ProductName" ], [ 31412, "wide", "Wzd Application" ], [ 31450, "wide", "ProductVersion" ], [ 31510, "wide", "VarFileInfo" ], [ 31542, "wide", "Translation" ], [ 31578, "wide", "Wzd$\nWzd\nWzd\n\n\nWzd.Document\nWzd Document" ], [ 31698, "wide", "Ready" ], [ 31762, "wide", "SCRL" ], [ 31810, "wide", "Create a new document\nNew" ], [ 31862, "wide", "Open an existing document\nOpen" ], [ 31924, "wide", "Close the active document\nClose" ], [ 31988, "wide", "Save the active document\nSave0Save the active document with a new name\nSave As\u0026Change the printing options\nPage Setup3Change the" ], [ 32328, "wide", "Print the active document\nPrint" ], [ 32392, "wide", "Display full pages\nPrint Preview" ], [ 32472, "wide", "?Display program information, version number and copyright\nAbout4Quit the application; prompts to save documents\nExit" ], [ 32738, "wide", "Open this document" ], [ 33308, "wide", "Open this document(Switch to the next window pane\nNext Pane5Switch back to the previous window pane\nPrevious Pane" ], [ 34210, "wide", "Erase the selection\nErase" ], [ 34262, "wide", "Erase everything\nErase All3Copy the selection and put it on the Clipboard\nCopy1Cut the selection and put it on the Clipboard\nCut" ], [ 34520, "wide", "Find the specified text\nFind" ], [ 34578, "wide", "Insert Clipboard contents\nPaste" ], [ 34646, "wide", "Repeat the last action\nRepeat1Replace specific text with different text\nReplace%Select the entire document\nSelect All" ], [ 34882, "wide", "Undo the last action\nUndo\u0026Redo the previously undone action\nRedo" ], [ 35218, "wide", "Change the window size" ], [ 35264, "wide", "Change the window position" ], [ 35318, "wide", "Reduce the window to an icon" ], [ 35376, "wide", "Enlarge the window to full size\"Switch to the next document window\u0026Switch to the previous document window9Close the active windo" ], [ 35724, "wide", "!Restore the window to normal size" ], [ 35794, "wide", "Activate Task List" ], [ 35854, "wide", "Activate this window" ] ], "v": { "file.stem": "9d2c2adc3c4b2af4a713da06361c4407e864b7f50e77d81195ef70e628b772d9", "pe.imphash": "e4a3c84f48d5f8c9367f61680c9e3a6b", "pe.machine": "i386", "pe.rich.key": 4046652481, "pe.rich.hash": "c719929a19f7476651c4b3ab3b987217", "pe.subsystem": "windows_gui", "pe.timestamp": 1650269787, "file.basename": "9d2c2adc3c4b2af4a713da06361c4407e864b7f50e77d81195ef70e628b772d9.exe", "pe.image_base": 4194304, "pe.image_size": 2035712, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 8142, "pe.headers_size": 4096, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "7701db6cae93742b3193c6fc9ed8b6713d4c28e7", "pe.image_hash.sha256": "9160e7037da37fa7ecb6ab18c6667b84f373fcac4c4aa2edac813fcf362cc5ec", "pe.image_hash.sha384": "ce6cd1723ca0e89f0b6145051d49f4848359cd166635d55165add5dce23762c4b7220553f00ebb12006d4d5baf7e8c66", "pe.image_hash.sha512": "a3d1b260e42bf4bdb6b472486247633625ea1527efcbe78bf80645085e33f433b01e74e3b9c9459cc3c4e1c77951affad90aad8be6b6c66362a536b3e34d1045", "pe.resource_types[0]": "RT_BITMAP", "pe.resource_types[1]": "RT_ICON", "pe.resource_types[2]": "RT_MENU", "pe.resource_types[3]": "RT_DIALOG", "pe.resource_types[4]": "RT_STRING", "pe.resource_types[5]": "RT_ACCELERATOR", "pe.resource_types[6]": "RT_GROUP_ICON", "pe.resource_types[7]": "RT_VERSION", "pe.resource_types[8]": "RT_UNKNOWN", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright (C) 1998", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.version.description": "Wzd MFC Application", "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 6, "pe.version.file_version": "1, 0, 0, 1", "pe.version.product_name": "Wzd Application", "build.toolchain.compiler": "msvc", "pe.version.internal_name": "Wzd", "pe.data_directories[0].rva": 15528, "pe.data_directories[1].rva": 2023424, "pe.data_directories[2].rva": 12288, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1, 0, 0, 1", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 100, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 11472, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 928, "pe.rich.entries[0].build_id": 19, "pe.rich.entries[1].build_id": 14, "pe.rich.entries[2].build_id": 10, "pe.rich.entries[3].build_id": 4, "pe.rich.entries[4].build_id": 4, "pe.rich.entries[5].build_id": 1, "pe.rich.entries[6].build_id": 11, "pe.rich.entries[7].build_id": 6, "pe.rich.entries[0].use_count": 4, "pe.rich.entries[1].use_count": 1, "pe.rich.entries[2].use_count": 11, "pe.rich.entries[3].use_count": 2, "pe.rich.entries[4].use_count": 3, "pe.rich.entries[5].use_count": 228, "pe.rich.entries[6].use_count": 9, "pe.rich.entries[7].use_count": 1, "pe.version.original_filename": "Wzd.EXE", "pe.coff.dos_header_pe_pointer": 224, "pe.rich.entries[0].product_id": 8034, "pe.rich.entries[1].product_id": 7299, "pe.rich.entries[2].product_id": 8047, "pe.rich.entries[3].product_id": 8047, "pe.rich.entries[4].product_id": 9782, "pe.rich.entries[6].product_id": 9782, "pe.rich.entries[7].product_id": 1735 }, "id": "pe", "sc": [ [ ".text", 4096, 8192, 3.83, "r-x" ], [ ".rdata", 12288, 8192, 3.22, "r--" ], [ ".data", 20480, 4096, 0.41, "rw-" ], [ ".rsrc", 24576, 12288, 3.63, "r--" ] ] }, "id": 0, "sz": 36864, "ts": [ { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x793e" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON, RT_VERSION, RT_UNKNOWN]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1, 0, 0, 1" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "imports.count = 228.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2, "el": [ "0x300c" ] }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 228.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x7886" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x7832" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0x3004" ] }, { "c": 0.7799999713897705, "d": "PE MFC template description", "e": [ "Wzd MFC Application" ], "i": "metadata/package/versioning::pe-mfc-template-description", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage/enumerate::enum-windows", "l": 2, "el": [ "0x3394" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x41aa" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Wzd MFC Application" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 228.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.9900000095367432, "d": "ShellObject LDDD mutex marker", "e": [ "LDDDDDDD" ], "i": "well-known/malware/trojan/shellobject/hijack::lddd-mutex", "l": 1, "el": [ "0x6824" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 228.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 228.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage/control::enable-window", "l": 2, "el": [ "0x3398" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x3008" ] }, { "c": 1.0, "d": "PE has RT_BITMAP in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON, RT_VERSION, RT_UNKNOWN]" ], "i": "metadata/binary/resource::pe-resource-bitmap-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 228.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x7a62" ] }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0x3010" ] }, { "c": 1.0, "d": "PE has RT_ACCELERATOR resources", "e": [ "[RT_BITMAP, RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON, RT_VERSION, RT_UNKNOWN]" ], "i": "metadata/binary/resource::pe-resource-accelerator-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".EXE" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x7a84" ] }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "0x4234" ] }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.22)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 228.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x791e" ] }, { "c": 0.6000000238418579, "d": "Clipboard keyword", "e": [ "…ction and put it on the Clipboard\nCut", "…ction and put it on the Clipboard\nCopy1Cut the selection …", "Insert Clipboard contents\nPaste" ], "i": "micro-behaviors/data/text/keywords/clipboard::clipboard-token", "l": 1, "el": [ "0x85d6", "0x85d6", "0x8712" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "9d2c2adc3c4b2af4a713da06361c4407e864b7f50e77d81195ef70e628b772d9.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "PE has RT_MENU in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON, RT_VERSION, RT_UNKNOWN]" ], "i": "metadata/binary/resource::pe-resource-menu-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 228.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x40ca" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON, RT_VERSION, RT_UNKNOWN]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x7a9a" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Wzd Application" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 228.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 400.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.22" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright (C) 1998" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x79c6" ] }, { "c": 1.0, "d": "PE has RT_DIALOG in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_MENU, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_GROUP_ICON, RT_VERSION, RT_UNKNOWN]" ], "i": "metadata/binary/resource::pe-resource-dialog-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 0.8500000238418579, "d": "Links legacy MFC42 runtime", "e": [ "MFC42.DLL" ], "i": "micro-behaviors/dylib/library/legacy::mfc42-ref", "l": 2, "el": [ "0x40ac" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x78e2" ] }, { "c": 0.9900000095367432, "d": "ShellObject DDLL mutex marker", "e": [ "DDLLDDDL" ], "i": "well-known/malware/trojan/shellobject/hijack::ddll-mutex", "l": 1, "el": [ "0x67e4" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "9d2c2adc3c4b2af4a713da06361c4407e864b7f50e77d81195ef70e628b772d9.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8500000238418579, "d": "Hardcoded external IPv4 address", "e": [ "101.32.177.84" ], "i": "micro-behaviors/communications/ip/literal::external-ipv4-binary", "l": 3, "el": [ "0x5158" ] }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.8500000238418579, "d": "Clipboard class or symbol reference", "e": [ "Clipboard" ], "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "l": 3, "el": [ "0x85d6" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "9d2c2adc3c4b2af4a713da06361c4407e864b7f50e77d81195ef70e628b772d9.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x22c4" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".rdata", ".rdata+.data = 150.0% of text (12288 / 8192 bytes)", ".data" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x3000" ] }, { "a": "T1106", "c": 0.6000000238418579, "d": "EnumWindows / EnumChildWindows API", "e": [ "EnumWindows" ], "i": "objectives/evasion/process/injection/callback::enum-windows-callback", "l": 1, "m": "E1106", "el": [ "0x3394" ] }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x22c4" ] }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".rdata+.data = 150.0% of text (12288 / 8192 bytes)", ".data", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data", ".rdata", ".rdata+.data = 150.0% of text (12288 / 8192 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Hardcoded external IPv4 address", "e": [ "101.32.177.84" ], "i": "objectives/command-and-control/infrastructure/ip::hardcoded-ipv4-binary", "l": 3, "m": "C0002", "el": [ "0x5158" ] }, { "c": 0.949999988079071, "d": "links kernel32 (GetProcAddress, Sleep, GetModuleHandleA, GetStartupInfoA, LoadLibraryA)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "5 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcrt (initterm, setusermatherr, adjust_fdiv, p__commode, p__fmode, ... +12 more)", "e": [ "msvcrt" ], "i": "metadata/dylib::msvcrt", "l": 2, "el": [ "17 symbols" ] }, { "c": 0.949999988079071, "d": "links mfc42 (ORDINAL 2390, ORDINAL 3059, ORDINAL 5100, ORDINAL 5104, ORDINAL 4467, ... +198 more)", "e": [ "mfc42" ], "i": "metadata/dylib::mfc42", "l": 2, "el": [ "203 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (UpdateWindow, EnumWindows, EnableWindow)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "3 symbols" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x3000", "0x3008" ] }, { "c": 0.8500000238418579, "d": "PE with version resource and broad imports", "e": [ "Copyright (C) 1998", "Wzd MFC Application", "Wzd Application", "imports.count = 228.00" ], "i": "metadata/binary/layout::import-rich-versioned-pe", "l": 2, "el": [ "value:pe.version.copyright", "value:pe.version.description", "value:pe.version.product_name", "" ] } ], "sha": "9d2c2adc3c4b2af4a713da06361c4407e864b7f50e77d81195ef70e628b772d9", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-07/9d2c2adc3c4b2af4a713da06361c4407e864b7f50e77d81195ef70e628b772d9.exe", "type": "pe" } ], "tv": "ca5ef" } }