{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9434438943862915 } ], "prob": 0.9434439, "models": [ { "m": "az", "prob": 0.9434439, "class": 0 }, { "m": "az/native", "prob": 0.99908924, "class": 0 }, { "m": "az/pe", "prob": 0.872093, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-01T23:16:29Z" }, "path": "a077d38903221c844f9f20a8c6e022a3242445b85faa55e8e650b7a727e048ae.exe", "raw": { "v": "6", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 5, "ff": { "i": [ [ "msvbvm60", "CIcos" ], [ "msvbvm60", "adj_fptan" ], [ "msvbvm60", "vbaVarMove" ], [ "msvbvm60", "ORDINAL 693" ], [ "msvbvm60", "vbaFreeVar" ], [ "msvbvm60", "vbaStrVarMove" ], [ "msvbvm60", "vbaFreeVarList" ], [ "msvbvm60", "adj_fdiv_m64" ], [ "msvbvm60", "adj_fprem1" ], [ "msvbvm60", "ORDINAL 519" ], [ "msvbvm60", "vbaStrCat" ], [ "msvbvm60", "ORDINAL 552" ], [ "msvbvm60", "ORDINAL 553" ], [ "msvbvm60", "ORDINAL 554" ], [ "msvbvm60", "vbaHresultCheckObj" ], [ "msvbvm60", "ORDINAL 557" ], [ "msvbvm60", "ORDINAL 664" ], [ "msvbvm60", "ORDINAL 558" ], [ "msvbvm60", "adj_fdiv_m32" ], [ "msvbvm60", "vbaAryDestruct" ], [ "msvbvm60", "ORDINAL 593" ], [ "msvbvm60", "vbaBoolStr" ], [ "msvbvm60", "vbaExitProc" ], [ "msvbvm60", "vbaObjSet" ], [ "msvbvm60", "vbaOnError" ], [ "msvbvm60", "ORDINAL 595" ], [ "msvbvm60", "adj_fdiv_m16i" ], [ "msvbvm60", "vbaObjSetAddref" ], [ "msvbvm60", "adj_fdivr_m16i" ], [ "msvbvm60", "ORDINAL 704" ], [ "msvbvm60", "vbaCyStr" ], [ "msvbvm60", "ORDINAL 520" ], [ "msvbvm60", "ORDINAL 705" ], [ "msvbvm60", "ORDINAL 707" ], [ "msvbvm60", "ORDINAL 523" ], [ "msvbvm60", "CIsin" ], [ "msvbvm60", "ORDINAL 709" ], [ "msvbvm60", "ORDINAL 525" ], [ "msvbvm60", "ORDINAL 632" ], [ "msvbvm60", "vbaChkstk" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "ORDINAL 528" ], [ "msvbvm60", "vbaGenerateBoundsError" ], [ "msvbvm60", "vbaStrCmp" ], [ "msvbvm60", "vbaVarTstEq" ], [ "msvbvm60", "vbaAryConstruct2" ], [ "msvbvm60", "vbaObjVar" ], [ "msvbvm60", "ORDINAL 562" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "vbaCastObjVar" ], [ "msvbvm60", "adj_fpatan" ], [ "msvbvm60", "ORDINAL 568" ], [ "msvbvm60", "ORDINAL 569" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "ORDINAL 679" ], [ "msvbvm60", "ORDINAL 600" ], [ "msvbvm60", "vbaUI1I2" ], [ "msvbvm60", "CIsqrt" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "ORDINAL 710" ], [ "msvbvm60", "vbaFpCmpCy" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 713" ], [ "msvbvm60", "adj_fprem" ], [ "msvbvm60", "adj_fdivr_m64" ], [ "msvbvm60", "ORDINAL 607" ], [ "msvbvm60", "vbaI2Str" ], [ "msvbvm60", "ORDINAL 531" ], [ "msvbvm60", "vbaFPException" ], [ "msvbvm60", "vbaStrVarVal" ], [ "msvbvm60", "CIlog" ], [ "msvbvm60", "ORDINAL 647" ], [ "msvbvm60", "vbaNew2" ], [ "msvbvm60", "ORDINAL 570" ], [ "msvbvm60", "adj_fdiv_m32i" ], [ "msvbvm60", "ORDINAL 572" ], [ "msvbvm60", "adj_fdivr_m32i" ], [ "msvbvm60", "vbaStrCopy" ], [ "msvbvm60", "vbaFreeStrList" ], [ "msvbvm60", "adj_fdivr_m32" ], [ "msvbvm60", "ORDINAL 684" ], [ "msvbvm60", "adj_fdiv_r" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "vbaVarTstNe" ], [ "msvbvm60", "ORDINAL 689" ], [ "msvbvm60", "ORDINAL 610" ], [ "msvbvm60", "vbaVarDup" ], [ "msvbvm60", "ORDINAL 613" ], [ "msvbvm60", "vbaVarLateMemCallLd" ], [ "msvbvm60", "vbaFpI4" ], [ "msvbvm60", "ORDINAL 617" ], [ "msvbvm60", "CIatan" ], [ "msvbvm60", "vbaStrMove" ], [ "msvbvm60", "ORDINAL 542" ], [ "msvbvm60", "allmul" ], [ "msvbvm60", "ORDINAL 544" ], [ "msvbvm60", "ORDINAL 545" ], [ "msvbvm60", "CItan" ], [ "msvbvm60", "ORDINAL 547" ], [ "msvbvm60", "vbaFPInt" ], [ "msvbvm60", "CIexp" ], [ "msvbvm60", "vbaFreeObj" ], [ "msvbvm60", "vbaFreeStr" ], [ "msvbvm60", "ORDINAL 580" ], [ "msvbvm60", "ORDINAL 581" ] ], "m": { "pe": { "checksum": 113105.0, "icon_count": 2.0, "checksum_valid": 1.0, "resource_count": 3.0, "has_version_info": 1.0, "computed_checksum": 113105.0, "bound_import_count": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 2622450629.0 }, "file": { "size": 90112.0, "entropy": 3.39, "size_bytes": 90112.0 }, "binary": { "is_pie": 0.0, "code_entropy": 3.71, "data_entropy": 0.0, "string_count": 392.0, "overall_entropy": 3.39, "entropy_variance": 2.3, "avg_string_length": 8.54, "max_string_length": 59.0, "code_to_data_ratio": 0.95, "string_length_stddev": 5.01, "largest_section_ratio": 0.86, "sentence_string_count": 4.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 105.0 }, "sections": { "count": 3.0, "code_size": 77824.0, "entropy_max": 3.71, "entropy_mean": 1.89, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 168, "u8", "RichSM" ], [ 440, "u8", ".text" ], [ 520, "u8", ".rsrc" ], [ 576, "u8", "MSVBVM60.DLL" ], [ 5492, "u8", "Tredv" ], [ 5604, "u8", "Gemsesto" ], [ 5617, "u8", "Mervrdi" ], [ 5671, "u8", "Ectiris7" ], [ 5684, "u8", "Menighe" ], [ 5713, "u8", "Sagewood6" ], [ 5727, "u8", "Stjernetaa1" ], [ 5760, "u8", "Dsigstesma2" ], [ 5776, "u8", "enrol" ], [ 5803, "u8", "Indu5" ], [ 5813, "u8", "Spotmarked" ], [ 5845, "u8", "Nonint8" ], [ 5857, "u8", "SPIRITU" ], [ 5886, "u8", "Urmennes2" ], [ 5900, "u8", "HEMIBE" ], [ 5928, "u8", "Bygnings4" ], [ 5942, "u8", "thyreocoll" ], [ 5974, "u8", "duologindl" ], [ 5989, "u8", "ARCHAE" ], [ 6017, "u8", "Isak" ], [ 6026, "u8", "Cableg" ], [ 6054, "u8", "CLOGGI" ], [ 6065, "u8", "Redpollsl1" ], [ 6097, "u8", "Fountf" ], [ 6108, "u8", "outfencef" ], [ 6148, "u8", "Rena8" ], [ 6175, "u8", "BREVSTEMM" ], [ 6189, "u8", "dermatom" ], [ 6219, "u8", "Retsvidn6" ], [ 6233, "u8", "MATTISOBL" ], [ 6264, "u8", "INTERFERE" ], [ 6278, "u8", "pudi" ], [ 6304, "u8", "svirreflue" ], [ 6319, "u8", "ARCHEG" ], [ 6347, "u8", "Smlse9" ], [ 6358, "u8", "TOWNFOLKDU" ], [ 6390, "u8", "investitu" ], [ 6404, "u8", "honningka" ], [ 6435, "u8", "Sekstisemi4" ], [ 6451, "u8", "TELEFONIST" ], [ 6483, "u8", "perip" ], [ 6493, "u8", "Sommer" ], [ 6521, "u8", "NONDETER" ], [ 6560, "u8", "ROUT" ], [ 6569, "u8", "hierati" ], [ 6598, "u8", "MAALINGERN" ], [ 6613, "u8", "arbe" ], [ 6639, "u8", "Anti8" ], [ 6649, "u8", "Hebraizedm" ], [ 6681, "u8", "Pulsel6" ], [ 6693, "u8", "Lnko5" ], [ 6720, "u8", "MISFIL" ], [ 6731, "u8", "Primig8" ], [ 6760, "u8", "Affra" ], [ 6770, "u8", "Stamkund3" ], [ 6801, "u8", "prospects" ], [ 6815, "u8", "Wettabili" ], [ 6846, "u8", "TAFFELE" ], [ 6858, "u8", "nonunit" ], [ 6896, "u8", "UNCOM" ], [ 6923, "u8", "Cycl" ], [ 6932, "u8", "Grundvand" ], [ 6963, "u8", "diquatypp" ], [ 6977, "u8", "Upaith" ], [ 7005, "u8", "Indd8" ], [ 7015, "u8", "Turanismja8" ], [ 7048, "u8", "nona" ], [ 7057, "u8", "RAFTAGE" ], [ 7086, "u8", "Vedfje" ], [ 7097, "u8", "Spildevan" ], [ 7128, "u8", "audient" ], [ 7140, "u8", "Colume7" ], [ 7169, "u8", "Stning3" ], [ 7181, "u8", "kassedamer" ], [ 7213, "u8", "Rokke" ], [ 7223, "u8", "Klbede7" ], [ 7252, "u8", "Husedeshrg" ], [ 7267, "u8", "NONCOMMONA" ], [ 7299, "u8", "FLINTWORK" ], [ 7313, "u8", "STRKS" ], [ 7340, "u8", "Crudesblom6" ], [ 7356, "u8", "IDENTI" ], [ 7384, "u8", "aroph" ], [ 7394, "u8", "Blennothor7" ], [ 7427, "u8", "Partivi3" ], [ 7440, "u8", "PITEOUSNE" ], [ 7471, "u8", "assigne" ], [ 7483, "u8", "Graduate" ], [ 7513, "u8", "Elektro3" ], [ 7526, "u8", "ekstratoge" ], [ 7558, "u8", "aflggelse" ], [ 7572, "u8", "INJU" ], [ 7598, "u8", "Sikkerhed" ], [ 7638, "u8", "Sammensvrg" ], [ 7653, "u8", "Saksnbb6" ], [ 7683, "u8", "Endemisk1" ], [ 7723, "u8", "Rentablem" ], [ 7737, "u8", "TWISTESP" ], [ 7767, "u8", "Bund9" ], [ 7777, "u8", "Bibringend3" ], [ 7810, "u8", "Pancre8" ], [ 7822, "u8", "Cytop" ], [ 7849, "u8", "Natakaru" ], [ 7862, "u8", "Dyrehos8" ], [ 7892, "u8", "MAJK" ], [ 7901, "u8", "PYKNIKERA" ], [ 7932, "u8", "Selebukser7" ], [ 7948, "u8", "Poppyf9" ], [ 7977, "u8", "Signalman" ], [ 7991, "u8", "OSMONDFO" ], [ 8021, "u8", "Meadowle9" ], [ 8035, "u8", "auktioner" ], [ 8066, "u8", "Flapp" ], [ 8076, "u8", "duperinge" ], [ 8107, "u8", "Erklaer" ], [ 8119, "u8", "subcontra" ], [ 8159, "u8", "ARBEJDSLS" ], [ 8190, "u8", "epimorp" ], [ 8202, "u8", "ORIGIN" ], [ 8230, "u8", "repulsepro" ], [ 8245, "u8", "Kons" ], [ 8271, "u8", "Anadromou" ], [ 8285, "u8", "CEREBR" ], [ 8313, "u8", "Untolerab" ], [ 8327, "u8", "HALSRE" ], [ 8355, "u8", "faxesma" ], [ 10493, "u8", "wXrx" ], [ 16837, "u8", "WQpTT" ], [ 20847, "u8", "raso" ], [ 23213, "u8", "WPjDWxv" ], [ 24827, "u8", "RCWWRC" ], [ 25791, "u8", "/4USrU" ], [ 36329, "u8", "Whra" ], [ 60164, "u8", "over" ], [ 61200, "u8", "Hafsu7" ], [ 61208, "u8", "Eksperi" ], [ 61216, "u8", "REFRESHENA" ], [ 61228, "u8", "Uddan" ], [ 61236, "u8", "adminic" ], [ 61348, "u8", "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], [ 61704, "u8", "Form" ], [ 62144, "u8", "advapi32" ], [ 62160, "u8", "RegOpenKeyExA" ], [ 62232, "u8", "RegQueryValueExA" ], [ 62308, "u8", "RegCloseKey" ], [ 62372, "u8", "StartSysInfo" ], [ 62388, "u8", "reascent" ], [ 62400, "u8", "Ahmadi" ], [ 62408, "u8", "resweeping" ], [ 62420, "u8", "skifrenes" ], [ 62448, "wide", "Nonflu5" ], [ 62552, "wide", "LSNINGEN" ], [ 62576, "wide", "Automatisering" ], [ 62612, "wide", "dybbjergarterne" ], [ 62648, "wide", "mandsmod" ], [ 62672, "wide", "chickenbill" ], [ 62700, "wide", "Wadmal2" ], [ 62804, "wide", "Kostgnger" ], [ 62852, "wide", "RETTIGHEDSTABETS" ], [ 62904, "u8", "VBA6.DLL" ], [ 62928, "u8", "__vbaFPInt" ], [ 62940, "u8", "__vbaObjSetAddref" ], [ 62992, "u8", "__vbaFpCmpCy" ], [ 63008, "u8", "__vbaStrMove" ], [ 63024, "u8", "__vbaStrVarVal" ], [ 63076, "u8", "__vbaVarTstNe" ], [ 63092, "u8", "__vbaFreeStr" ], [ 63148, "u8", "__vbaStrCopy" ], [ 63164, "u8", "__vbaVarMove" ], [ 63180, "u8", "__vbaFreeObj" ], [ 63196, "u8", "__vbaHresultCheckObj" ], [ 63244, "u8", "__vbaFreeVar" ], [ 63260, "u8", "__vbaExitProc" ], [ 63276, "u8", "__vbaFreeVarList" ], [ 63308, "u8", "__vbaOnError" ], [ 63344, "wide", "16:16:1" ], [ 63468, "wide", "Eleut" ], [ 63484, "wide", "Graphiter4" ], [ 63512, "wide", "ecologically" ], [ 63560, "wide", "Undslippelse" ], [ 63620, "wide", "Opgavefordelingens8" ], [ 63660, "wide", "icon" ], [ 63676, "wide", "enhedsskolens" ], [ 63704, "u8", "__vbaBoolStr" ], [ 63720, "u8", "__vbaCastObjVar" ], [ 63736, "u8", "__vbaFreeStrList" ], [ 63768, "u8", "__vbaVarLateMemCallLd" ], [ 63792, "u8", "__vbaAryDestruct" ], [ 63812, "u8", "__vbaStrVarMove" ], [ 63828, "u8", "__vbaGenerateBoundsError" ], [ 63856, "u8", "__vbaAryConstruct2" ], [ 63876, "u8", "__vbaVarTstEq" ], [ 73904, "u8", "MOSENS" ], [ 73912, "u8", "TEACHABLY" ], [ 73924, "u8", "indoneseren" ], [ 73936, "u8", "Outmalaprop" ], [ 73948, "u8", "strmmen" ], [ 73956, "u8", "KOMMANDOFELTS" ], [ 73972, "u8", "Lydtryks" ], [ 73984, "u8", "Thanes2" ], [ 73992, "u8", "LEVERINGSGARANTIERS" ], [ 74012, "u8", "sadelgjorden" ], [ 74028, "u8", "XENONETS" ], [ 74040, "u8", "Waspnesting6" ], [ 79662, "u8", "_adj_fptan" ], [ 79746, "u8", "_adj_fdiv_m64" ], [ 79762, "u8", "_adj_fprem1" ], [ 79814, "u8", "_adj_fdiv_m32" ], [ 79912, "u8", "_adj_fdiv_m16i" ], [ 79950, "u8", "_adj_fdivr_m16i" ], [ 79992, "u8", "__vbaChkstk" ], [ 80006, "u8", "EVENT_SINK_AddRef" ], [ 80120, "u8", "DllFunctionCall" ], [ 80156, "u8", "_adj_fpatan" ], [ 80170, "u8", "EVENT_SINK_Release" ], [ 80206, "u8", "_CIsqrt" ], [ 80216, "u8", "EVENT_SINK_QueryInterface" ], [ 80260, "u8", "__vbaExceptHandler" ], [ 80282, "u8", "_adj_fprem" ], [ 80296, "u8", "_adj_fdivr_m64" ], [ 80328, "u8", "__vbaFPException" ], [ 80388, "u8", "_adj_fdiv_m32i" ], [ 80406, "u8", "_adj_fdivr_m32i" ], [ 80460, "u8", "_adj_fdivr_m32" ], [ 80478, "u8", "_adj_fdiv_r" ], [ 80558, "u8", "_CIatan" ], [ 80584, "u8", "_allmul" ], [ 86358, "wide", "VS_VERSION_INFO" ], [ 86450, "wide", "VarFileInfo" ], [ 86482, "wide", "Translation" ], [ 86518, "wide", "StringFileInfo" ], [ 86554, "wide", "040904B0" ], [ 86578, "wide", "CompanyName" ], [ 86604, "wide", "A Basis Clap" ], [ 86638, "wide", "FileDescription" ], [ 86694, "wide", "ProductName" ], [ 86720, "wide", "Tredv" ], [ 86738, "wide", "FileVersion" ], [ 86764, "wide", "2.01" ], [ 86782, "wide", "ProductVersion" ], [ 86830, "wide", "InternalName" ], [ 86856, "wide", "over" ], [ 86874, "wide", "OriginalFilename" ], [ 86908, "wide", "over.exe" ], [ 86957, "u8", "117.16.16.16:50" ] ], "v": { "file.stem": "a077d38903221c844f9f20a8c6e022a3242445b85faa55e8e650b7a727e048ae", "pe.imphash": "e990c222471e8312be0057c4b6dbb3de", "pe.machine": "i386", "pe.rich.key": 2328776019, "pe.rich.hash": "6a9c26dc9d981f992916ebefa00fbd5a", "pe.subsystem": "windows_gui", "pe.timestamp": 1267092962, "file.basename": "a077d38903221c844f9f20a8c6e022a3242445b85faa55e8e650b7a727e048ae.exe", "pe.image_base": 4194304, "pe.image_size": 90112, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 5432, "pe.headers_size": 4096, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "b86dd726fcf5a8eb31ae1bad932528a406fdebb0", "pe.version.company": "A Basis Clap", "pe.image_hash.sha256": "4c824a8528bb04915da3516149fa45a25fe903ca0acf3f2885e116ca8d11a400", "pe.image_hash.sha384": "4c96ef932de056cca12be0c0f05bcadcb0d2897b4813a5ec2ed2be909fe5f0574b7a9869f71c2721d682ff8cc0a649e4", "pe.image_hash.sha512": "76dc35d01df2bee2b4d6e48ba325ef49f4a511984c63f563bf30e3f6cfe13ddc162f87155c4cd50cdc7393364418c7a178718dabec3edc4bbc3eb16df3d3d7af", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.resource_timestamp": 1267092962, "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 79172, "pe.data_directories[1].rva": 86016, "pe.data_directories[2].rva": 560, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 2304, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 424, "pe.rich.entries[0].build_id": 14, "pe.rich.entries[1].build_id": 9, "pe.rich.entries[2].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.rich.entries[1].use_count": 6, "pe.rich.entries[2].use_count": 1, "pe.coff.dos_header_pe_pointer": 192, "pe.rich.entries[0].product_id": 7299, "pe.rich.entries[1].product_id": 8783, "pe.rich.entries[2].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1236279235 }, "id": "pe", "sc": [ [ ".text", 4096, 77824, 3.71, "r-x" ], [ ".data", 81920, 4096, 0.0, "rw-" ], [ ".rsrc", 86016, 4096, 1.97, "r--" ] ] }, "id": 0, "sz": 90112, "ts": [ { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 392.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.39" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "a077d38903221c844f9f20a8c6e022a3242445b85faa55e8e650b7a727e048ae.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "152a6" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "1526e" ] }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "imports.count = 105.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 105.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.39" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "RegQueryValueExA" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "f318" ] }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "imports.count = 105.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "10c0" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 105.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "1537c" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "1535a" ] }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1236279235,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2, "el": [ "f2d0" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "151f6" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 105.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "138f8" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "240" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "15156" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "a077d38903221c844f9f20a8c6e022a3242445b85faa55e8e650b7a727e048ae.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "1532e" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 105.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Microsoft Visual string", "e": [ "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" ], "i": "metadata/lang/compiler/native::ms-visual", "l": 2, "el": [ "efa4" ] }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "imports.count = 105.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "13984" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 1.0, "d": "ShellObject 117.16.16.16:50 endpoint", "e": [ "117.16.16.16:50" ], "i": "well-known/malware/trojan/shellobject/vb6-recycler::c2-117-16-16-16-50", "l": 1, "el": [ "153ad" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "15232" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "imports.count = 105.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "20e5" ] }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "117.16.16.16:50" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 1, "el": [ "153ad" ] }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "1537c" ] }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "20e5" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "a077d38903221c844f9f20a8c6e022a3242445b85faa55e8e650b7a727e048ae.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (CIcos, adj_fptan, vbaVarMove, ORDINAL 693, vbaFreeVar, ... +100 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "105 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "MSVBVM60.DLL", "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "240", "138f8" ] } ], "sha": "a077d38903221c844f9f20a8c6e022a3242445b85faa55e8e650b7a727e048ae", "path": "a077d38903221c844f9f20a8c6e022a3242445b85faa55e8e650b7a727e048ae.exe", "type": "pe" } ], "tv": "961ce" } }