{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997846484184265, "class": 2 } ], "prob": 0.99978465, "class": 2, "models": [ { "m": "az", "prob": 0.9997651, "class": 2 }, { "m": "az/native", "prob": 0.99978465, "class": 0 }, { "m": "az/pe", "prob": 0.9997286, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T10:25:23Z" }, "path": "35157", "raw": { "v": "4", "fs": [ { "f": "KO₆(As₅C₅Er₂Dy₂AlP)H₃(Cm₂F₃Hf)Md₃(Bi₇He₂Si)", "k": { "pe.timestamp": 1085911951, "hashes.imphash": "47e71805c2d5d63e459077138913dc0f", "build.target_arch": "x86", "pe.linker_version": "4.1", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.rich_header.xor_key": "0x6f3e767b", "hashes.rich_header_hash": "933873a3e07de46b78eef707e281b16108c5e6001222772b57e60669d4484577", "pe.inflated_sections[0]": ".data", "pe.inflated_sections[1]": "xwjlyqn", "pe.version_info.company_name": "Macromedia, Inc.", "pe.version_info.file_version": "8,0,22,0", "pe.version_info.product_name": "Shockwave Flash", "pe.version_info.internal_name": "Macromedia Flash Player 8.0", "pe.version_info.legal_copyright": "Copyright © 1996-2005 Macromedia, Inc.", "pe.version_info.product_version": "8,0,22,0", "binary.top_complex_unnamed[0].cc": 25, "binary.top_complex_unnamed[1].cc": 10, "binary.top_complex_unnamed[2].cc": 9, "pe.version_info.file_description": "Shockwave Flash 8.0 r22", "pe.version_info.legal_trademarks": "Macromedia Flash Player", "binary.top_complex_unnamed[0].bbs": 44, "binary.top_complex_unnamed[1].bbs": 14, "binary.top_complex_unnamed[2].bbs": 17, "pe.version_info.original_filename": "npswf32.dll", "binary.top_complex_unnamed[0].addr": "0x4012b4", "binary.top_complex_unnamed[0].size": 543, "binary.top_complex_unnamed[1].addr": "0x41472c", "binary.top_complex_unnamed[1].size": 459, "binary.top_complex_unnamed[2].addr": "0x427880", "binary.top_complex_unnamed[2].size": 582, "pe.rich_header.entries[0].use_count": 2, "pe.rich_header.entries[1].use_count": 320, "pe.rich_header.entries[2].use_count": 29, "pe.rich_header.entries[3].use_count": 1, "pe.rich_header.entries[4].use_count": 34, "pe.rich_header.entries[5].use_count": 12, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 29, "pe.rich_header.entries[1].product_id": 16, "pe.rich_header.entries[2].product_id": 90, "pe.rich_header.entries[3].product_id": 95, "pe.rich_header.entries[4].product_id": 95, "pe.rich_header.entries[5].product_id": 93, "pe.rich_header.entries[6].product_id": 94, "pe.rich_header.entries[0].build_number": 63846, "pe.rich_header.entries[0].product_name": "Cpp_VS2005", "pe.rich_header.entries[1].build_number": 1872, "pe.rich_header.entries[1].product_name": "C_VS6", "pe.rich_header.entries[2].build_number": 45930, "pe.rich_header.entries[2].product_name": "C_VS2005_LTCG", "pe.rich_header.entries[3].build_number": 4626, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].build_number": 4035, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 57293, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].build_number": 1139, "pe.rich_header.entries[6].product_name": "unknown", "pe.dll_characteristics.terminal_server_aware": true }, "x": 120, "id": 0, "is": [ "VerQueryValueA", "GetFileVersionInfoSizeA", "GetFileVersionInfoA", "GetFileAttributesA", "lstrcmpA", "GlobalLock", "DefineDosDeviceW", "GetSystemDirectoryA", "IsDBCSLeadByte", "SetConsoleMenuClose", "SetConsoleTextAttribute", "GetSystemDefaultUILanguage", "lstrcpyA", "lopen", "lstrlenA", "GetWindowsDirectoryA", "CreateDirectoryA", "lclose", "ExitThread", "FindFirstFileA", "LocalFree", "lstrcatA", "CompareFileTime", "GetShortPathNameA", "ExpandEnvironmentStringsA", "UnhandledExceptionFilter", "GetCurrentProcess", "WritePrivateProfileStringA", "GetPrivateProfileIntA", "RemoveDirectoryA", "GlobalAlloc", "lstrcatA", "SetFileAttributesA", "lstrcpyW", "GetModuleFileNameA", "GetComputerNameExW", "DeleteFileA", "FindNextFileA", "GlobalUnlock", "SearchPathA", "GetProcAddress", "lstrcmpiA", "GetLogicalDrives", "GetPrivateProfileStringA", "FindClose", "OutputDebugStringW", "llseek", "GetDeviceCaps", "LoadStringA", "GetSystemMetrics", "MessageBeep", "SetDlgItemTextA", "GetDesktopWindow", "EndDialog" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 2560.0, "subsystem": 2.0, "timestamp": 1085911951.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.03, "entry_section": ".text", "size_of_image": 282624.0, "timestamp_day": 30.0, "file_alignment": 512.0, "resource_count": 3.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON", "RT_VERSION" ], "timestamp_year": 2004.0, "characteristics": 271.0, "entry_point_rva": 4408.0, "size_of_headers": 1024.0, "timestamp_month": 5.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 4.0, "computed_checksum": 181505.0, "section_alignment": 4096.0, "number_of_sections": 6.0, "resource_timestamp": 0.0, "dll_characteristics": 32768.0, "rich_header_present": true, "linker_major_version": 4.0, "linker_minor_version": 1.0, "version_info_present": true, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false, "max_section_inflation_ratio": 8.43 }, "file": { "size": 122368.0 }, "binary": { "code_size": 114067.0, "func_count": 4.0, "entry_point": 4408.0, "wx_sections": 4.0, "code_entropy": 2.94, "data_entropy": 3.85, "func_density": 0.04, "import_count": 54.0, "string_count": 260.0, "avg_func_size": 423.5, "section_count": 6.0, "avg_complexity": 11.5, "import_density": 0.48, "max_complexity": 25.0, "string_density": 2.33, "overall_entropy": 3.27, "avg_basic_blocks": 19.5, "avg_section_size": 20205.83, "dependency_count": 4.0, "entropy_variance": 2.47, "avg_string_length": 10.32, "complexity_per_kb": 0.1, "max_string_length": 224.0, "wide_string_count": 30.0, "writable_sections": 5.0, "avg_string_entropy": 2.54, "code_to_data_ratio": 15.91, "data_to_file_ratio": 0.04, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.07, "total_basic_blocks": 78.0, "executable_sections": 4.0, "func_analysis_depth": 2.0, "string_length_stddev": 15.98, "largest_section_ratio": 0.83, "sentence_string_count": 7.0, "sentence_string_ratio": 0.03, "behavioral_import_ratio": 0.02, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 162, "dofv\u003eoidaozv\u003eo" ], [ 480, ".text" ], [ 520, ".data" ], [ 560, ".rsrc" ], [ 599, "@.rdata" ], [ 640, "xwjlyqn" ], [ 680, "ncxxyac" ], [ 1683, "FEOCD" ], [ 2479, "CA740G1" ], [ 2842, "VerQueryValueA" ], [ 2859, "GetFileVersionInfoSizeA" ], [ 2885, "GetFileVersionInfoA" ], [ 2905, "VERSION.dll" ], [ 2919, "GetFileAttributesA" ], [ 2940, "lstrcmpA" ], [ 2951, "GlobalLock" ], [ 2964, "DefineDosDeviceW" ], [ 2983, "GetSystemDirectoryA" ], [ 3005, "IsDBCSLeadByte" ], [ 3022, "SetConsoleMenuClose" ], [ 3044, "SetConsoleTextAttribute" ], [ 3070, "GetSystemDefaultUILanguage" ], [ 3099, "lstrcpyA" ], [ 3110, "_lopen" ], [ 3119, "lstrlenA" ], [ 3130, "GetWindowsDirectoryA" ], [ 3153, "CreateDirectoryA" ], [ 3172, "_lclose" ], [ 3182, "ExitThread" ], [ 3195, "FindFirstFileA" ], [ 3212, "LocalFree" ], [ 3224, "lstrcatA" ], [ 3235, "CompareFileTime" ], [ 3253, "GetShortPathNameA" ], [ 3273, "ExpandEnvironmentStringsA" ], [ 3301, "UnhandledExceptionFilter" ], [ 3328, "GetCurrentProcess" ], [ 3348, "WritePrivateProfileStringA" ], [ 3377, "GetPrivateProfileIntA" ], [ 3401, "RemoveDirectoryA" ], [ 3420, "GlobalAlloc" ], [ 3445, "SetFileAttributesA" ], [ 3466, "lstrcpyW" ], [ 3477, "GetModuleFileNameA" ], [ 3498, "GetComputerNameExW" ], [ 3519, "DeleteFileA" ], [ 3533, "FindNextFileA" ], [ 3549, "GlobalUnlock" ], [ 3564, "SearchPathA" ], [ 3578, "GetProcAddress" ], [ 3595, "lstrcmpiA" ], [ 3607, "GetLogicalDrives" ], [ 3626, "GetPrivateProfileStringA" ], [ 3653, "FindClose" ], [ 3665, "OutputDebugStringW" ], [ 3686, "_llseek" ], [ 3694, "KERNEL32.dll" ], [ 3709, "GetDeviceCaps" ], [ 3723, "GDI32.dll" ], [ 3735, "LoadStringA" ], [ 3749, "GetSystemMetrics" ], [ 3768, "MessageBeep" ], [ 3782, "SetDlgItemTextA" ], [ 3800, "GetDesktopWindow" ], [ 3819, "EndDialog" ], [ 3829, "USER32.dll" ], [ 3857, "KNNL" ], [ 3863, "B5CA" ], [ 3884, "7AC6D" ], [ 3911, "4658NG1" ], [ 3971, "145N" ], [ 4022, "5KDL" ], [ 4154, "34JM" ], [ 4192, "12\u003eD" ], [ 4216, "DOKB0" ], [ 4254, "GDN3" ], [ 4439, "FJKE" ], [ 4472, "BNHK" ], [ 4507, "EIM1" ], [ 4690, "HJKK357" ], [ 4698, "O1JN3" ], [ 4755, "1B1ICBDJN" ], [ 4833, "JKC14" ], [ 4912, "NBD6DA" ], [ 4951, "3312B" ], [ 4988, "JBG5L" ], [ 5083, "NFGO2" ], [ 5243, "E45N" ], [ 5248, "7J3B" ], [ 5361, "3NDF3D" ], [ 5386, "4NOGJ" ], [ 5418, "2548J" ], [ 5450, "AGIG" ], [ 5516, "0108O" ], [ 5525, "KGO6" ], [ 5600, "65FH" ], [ 5640, "wide", "D78C" ], [ 5749, "CEJ31" ], [ 5798, "1OKOF:\u003c\u003c32" ], [ 5885, "J7CJ8" ], [ 5894, "LGGH" ], [ 5941, "CA19" ], [ 6025, "64753" ], [ 6031, "A517IE0" ], [ 6122, "wide", "7565" ], [ 6153, "D4KA" ], [ 6162, "NA7O2" ], [ 6178, "B41446" ], [ 6258, "8F2L" ], [ 6365, "J15N" ], [ 6404, "DJJ8IN" ], [ 6436, "HBNFOF" ], [ 6475, "74K9G" ], [ 6505, "A0O9C" ], [ 6558, "121JB7K" ], [ 6588, "wide", "E54H" ], [ 6693, "LH:9E2\u003eLGG04L" ], [ 6887, "NLNKJ" ], [ 6906, "6HLAJ" ], [ 6927, "IC072M8" ], [ 7071, "H76K" ], [ 7076, "E74G" ], [ 7086, "EHNF" ], [ 7101, "MF5F" ], [ 7253, "IE23" ], [ 7395, "56OE2955D" ], [ 7410, "CEB1F" ], [ 7431, "D704K" ], [ 7512, "LGB44JILG" ], [ 7541, "8262" ], [ 7546, "0958" ], [ 7580, "FN40BK9" ], [ 7646, "CNDH" ], [ 7743, "LA1GF" ], [ 7871, "KOE8H" ], [ 7937, "C571" ], [ 7987, "JFD8362K681" ], [ 8034, "IHGAOGF23H0N" ], [ 8124, "E48A" ], [ 8211, "JAHL" ], [ 8268, "H3E2" ], [ 8522, "BNK2" ], [ 8536, "A5E5F" ], [ 8666, "NB66" ], [ 8851, "KDOG" ], [ 8895, ";D\u003cEMM2\u003c\u003c" ], [ 8990, "FCHCA5A" ], [ 9019, "CNL4" ], [ 9194, "CI9A1" ], [ 9235, "HAJG2ML9" ], [ 9256, "G90::2" ], [ 9331, "K48M" ], [ 9622, "85J5B" ], [ 9729, "3041" ], [ 9734, "233324" ], [ 9743, "0033" ], [ 9775, "211341" ], [ 9835, "0404102" ], [ 9849, "3321" ], [ 9855, "44432" ], [ 9873, "401432" ], [ 9880, "14243" ], [ 9903, "4043" ], [ 9914, "213441" ], [ 9921, "hex", "\u0014\u0014$C\u00114\"$B" ], [ 9989, "hex", "\u0012D\u00132D210A\u0011$@A\u0014" ], [ 10075, "4424" ], [ 10093, "0043" ], [ 10130, "1300" ], [ 10137, "444344" ], [ 10144, "0112403" ], [ 10163, "13042" ], [ 10180, "341114" ], [ 10193, "0222332" ], [ 10230, "3000" ], [ 10245, "140401" ], [ 10253, "hex", "4!3\u0012\u0013\u0002C\u0002\"A\u0001" ], [ 10296, "342223d" ], [ 11950, "222242" ], [ 11957, "3240032" ], [ 11966, "2404" ], [ 11975, "hex", "0\u0012\u0014C\u0002\u0010D\u0004\u0010" ], [ 11994, "4223123" ], [ 12003, "hex", "\u0004\u0001AA\u0003\u00011@" ], [ 15338, "wide", "VS_VERSION_INFO" ], [ 15430, "wide", "StringFileInfo" ], [ 15490, "wide", "CompanyName" ], [ 15516, "wide", "Macromedia, Inc." ], [ 15558, "wide", "FileDescription" ], [ 15592, "wide", "Shockwave Flash 8.0 r22" ], [ 15650, "wide", "FileExtents" ], [ 15676, "wide", "swf|spl|mfp" ], [ 15706, "wide", "FileOpenName" ], [ 15732, "wide", "Macromedia Flash movie (*.swf)|FutureSplash movie (*.spl)|Macromedia Flash Paper (*.mfp)" ], [ 15918, "wide", "MIMEType" ], [ 15936, "wide", "application/x-shockwave-flash|application/futuresplash" ], [ 16054, "wide", "ProductName" ], [ 16080, "wide", "Shockwave Flash" ], [ 16118, "wide", "FileVersion" ], [ 16170, "wide", "InternalName" ], [ 16196, "wide", "Macromedia Flash Player 8.0" ], [ 16258, "wide", "LegalCopyright" ], [ 16288, "wide", "Copyright © 1996-2005 Macromedia, Inc." ], [ 16374, "wide", "LegalTrademarks" ], [ 16408, "wide", "Macromedia Flash Player" ], [ 16462, "wide", "OriginalFilename" ], [ 16496, "wide", "npswf32.dll" ], [ 16526, "wide", "ProductVersion" ], [ 16582, "wide", "Debugger" ], [ 16610, "wide", "VarFileInfo" ], [ 16642, "wide", "Translation" ], [ 16672, "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ], [ 16961, "J454" ], [ 16972, "MMLE" ], [ 16978, "82DNHO" ], [ 19578, "80PQ" ], [ 20023, "j1o2" ], [ 21787, "B5VJ" ], [ 23015, "Pysm" ], [ 23274, "IC6M" ], [ 27507, "R4O0" ], [ 27822, "CMYI" ], [ 34576, "Vzhn" ], [ 36690, "\u0026*2\u003ej7\u003e" ], [ 36810, "Hxthh" ], [ 37407, "6KHE" ], [ 39670, "132.202.196.213:16162" ], [ 42816, "197.19.56.245:41280" ], [ 43937, "_S21KWZ" ], [ 45460, "95uz" ], [ 45637, "3SLX" ], [ 47900, "/0c0" ], [ 49698, "YDK2" ], [ 50084, "Ofio" ], [ 56311, "Uazf" ], [ 56741, "Xcab" ], [ 57433, "5OY8F" ], [ 58721, "4PYD" ], [ 59569, "@XzX.X" ], [ 59930, "+ES::crQ}\u003c7-5iVN1DRf=-y[}g%s5.C" ], [ 60065, "Su.z\u003c*eDI;DIe-EbQs(0i7nyY(RQ %elQ|`fa+I[J1\\Xrk o]Q\u003e'e+s" ], [ 60336, "oGu/w2vdYP^7qo(dV]r/%r!A5\u003c" ], [ 60363, "RIP;oyut96e+s5\u003c" ], [ 60800, "SHE6" ], [ 90597, "OAHE" ], [ 93136, "t97e" ], [ 93340, "ONDU" ], [ 97968, "Qiwn" ], [ 100710, "Y_Z1" ], [ 102152, "TCVHS" ], [ 103925, "Q063" ], [ 105818, "/Qul" ], [ 106578, "MHYP" ], [ 108505, "zi5d" ], [ 110488, "]-.ZKz[" ] ], "sz": 122368, "ts": [ { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDING", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "c": 0.7200000286102295, "d": "Write INI string value", "e": [ "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::write-private-profile-ansi", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 282624.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027", "c": 0.9200000166893005, "d": ".NET XOR CA payload key", "e": [ "202" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-xor-ca-payload-key", "l": 4, "m": "C0025" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Canonicalize Windows 8.3 short path", "e": [ "GetShortPathNameA" ], "i": "micro-behaviors/fs/path/check::get-short-path-name", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "d": "COMPUTERNAME environment variable", "e": [ "GetComputerNameExW" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.func_count = 4.00" ], "i": "metadata/binary/metrics/structural::few-functions", "l": 3 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 3 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 260.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "FindClose", "_lclose", "SetConsoleMenuClose" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 0.8199999928474426, "d": "Medium entropy rdata section", "e": [ ".rdata (entropy: 6.46)" ], "i": "metadata/binary/section/metrics::medium-entropy-rdata-section", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 4.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.699999988079071, "d": "Compare file modification times", "e": [ "CompareFileTime" ], "i": "micro-behaviors/fs/sync/fsync::compare-file-time", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.8199999928474426, "d": "rdata over 2.5 times text size", "e": [ ".rdata", ".rdata = 1163.5% of .text (101267 / 8704 bytes)" ], "i": "metadata/binary/section/metrics::rdata-ratio-over-2pt5x", "l": 1 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "a": "T1546.012", "c": 0.8999999761581421, "d": "IFEO Debugger registry value", "e": [ "Debugger" ], "i": "objectives/persistence/login/ifeo/debugger::ifeo-debugger-value", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 3, "m": "C0014" }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4608)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1083", "c": 0.8999999761581421, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives", "l": 3, "m": "E1083" }, { "a": "T1112", "c": 0.8999999761581421, "d": "GetComputerName API", "e": [ "GetComputerNameExW" ], "i": "objectives/anti-static/obfuscation/payload/registry::get-computer-name", "l": 3, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.27" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.27" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "GetComputerName P/Invoke string for hostname recon", "e": [ "GetComputerNameExW" ], "i": "objectives/discovery/host::getcomputername-text", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 4.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 3 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "d": "VERSION word (uppercase)", "e": [ "VERSION" ], "i": "metadata/package/versioning::version-upper", "l": 2 }, { "c": 0.800000011920929, "d": "rdata over five times text size", "e": [ ".rdata", ".rdata = 1163.5% of .text (101267 / 8704 bytes)" ], "i": "metadata/binary/section/metrics::rdata-ratio-over-5x", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 1.0, "d": "GetFileVersionInfoSizeA import", "e": [ "GetFileVersionInfoSizeA" ], "i": "well-known/malware/trojan/hijack-gen::padodor-get-file-version-info-size-a-import", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 4.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 54.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 4.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LoadStringA", "StringFileInfo", "GetPrivateProfileStringA", "ExpandEnvironmentStringsA", "WritePrivateProfileStringA", "OutputDebugStringW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.54" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1083", "c": 0.8799999952316284, "d": "Enumerate logical drive letters", "e": [ "GetLogicalDrives" ], "i": "micro-behaviors/fs/traversal/drives::get-logical-drives-text", "l": 3, "m": "E1083" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "35157" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 11.50" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system default UI language", "e": [ "GetSystemDefaultUILanguage" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-system-default-ui-language", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 2560.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1085911951.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.9200000166893005, "d": "External IPv4 address with port literal", "e": [ "197.19.56.245:41280", "132.202.196.213:16162", "28.36.139.68:1" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary-literal", "l": 1 }, { "c": 0.8799999952316284, "d": "Hardcoded external IPv4 port in PE binary", "e": [ "197.19.56.245:41280", "132.202.196.213:16162" ], "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe", "l": 3 }, { "a": "T1045", "c": 0.949999988079071, "d": "Multiple W+X sections (packer pattern)", "e": [ "binary.wx_sections = 4.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-wx-sections", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".data", ".data+.rdata = 1216.4% of text (105875 / 8704 bytes)", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.9399999976158142, "d": "Multiple external IPv4 endpoints in rdata", "e": [ "197.19.56.245:41280", "132.202.196.213:16162" ], "i": "objectives/command-and-control/infrastructure/ip-port::rdata-external-ipv4-port-pair", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": ".rdata significantly larger than .text", "e": [ ".rdata", ".rdata = 1163.5% of .text (101267 / 8704 bytes)" ], "i": "metadata/binary/section/metrics::oversized-rdata-ratio", "l": 3 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Zero-entropy executable section (carved/packed PE)", "e": [ "xwjlyqn (size: 4096, entropy: 0.00, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::zero-entropy-executable-section", "l": 4, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".rdata (size: 101267, perms: rwx)", ".text (size: 8704, perms: rwx)", "xwjlyqn (size: 4096, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 32768.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemDirectoryA", "GetWindowsDirectoryA", "UnhandledExceptionFilter", "WritePrivateProfileStringA", "GetModuleFileNameA", "GetPrivateProfileIntA", "GetSystemDefaultUILanguage", "SetConsoleTextAttribute", "GetPrivateProfileStringA", "SetConsoleMenuClose", "GetFileVersionInfoSizeA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Three or more writable executable sections", "e": [ "binary.wx_sections = 4.00" ], "i": "metadata/hardening/memory::three-plus-wx-sections", "l": 3 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "c": 0.7200000286102295, "d": "Writable .rdata section permissions", "e": [ ".rdata (perms: rwx)" ], "i": "metadata/binary/section/names::writable-rdata", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 54.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 4.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".data+.rdata = 1216.4% of text (105875 / 8704 bytes)", ".data", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".rdata", ".data", ".data+.rdata = 1216.4% of text (105875 / 8704 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetDeviceCaps)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetFileAttributesA, lstrcmpA, GlobalLock, DefineDosDeviceW, GetSystemDirectoryA, ... +39 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (LoadStringA, GetSystemMetrics, MessageBeep, SetDlgItemTextA, GetDesktopWindow, ... +1 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindNextFileA", "FindClose", "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "c": 0.8199999928474426, "d": "Reads and writes INI via ANSI", "e": [ "GetPrivateProfileStringA", "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle-ansi", "l": 3 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file/script::module-path-delete", "l": 4, "m": "F0007" } ], "sha": "a12c25cd2c12ae7085857318b59d1c255dfb23fe86181688b0ab8ee95e66383c", "path": "35157", "type": "pe" } ], "tv": "84923" } }