{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.2392638, "class": 0 }, { "m": "az/pe", "prob": 0.067434214, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T13:02:28Z" }, "path": "a29c151d98135393c7279dad4d7a8a95f2e6f6270b83b2a511ca4980f5c8035f.exe", "raw": { "v": "5", "fs": [ { "f": "O(I)H(F)Md", "x": 4, "ff": { "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 0.0, "overlay_padding": 3072.0, "checksum_stripped": 1.0, "computed_checksum": 130005.0, "dos_stub_modified": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 126976.0, "entropy": 5.59, "size_bytes": 126976.0 }, "binary": { "is_pie": 0.0, "code_entropy": 6.06, "data_entropy": 1.11, "string_count": 1059.0, "entropy_variance": 6.41, "avg_string_length": 16.61, "max_string_length": 253.0, "code_to_data_ratio": 0.5, "string_length_stddev": 23.18, "largest_section_ratio": 0.52, "sentence_string_count": 48.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "sections": { "count": 4.0, "code_size": 24576.0, "entropy_max": 6.78, "entropy_mean": 3.91, "name_entropy": 2.93, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 76, "u8", "!This file was created by ClamAV for internal use and should not be run." ], [ 150, "u8", "ClamAV - A GPL virus scanner - http://www.clamav.net" ], [ 216, "u8", "CLAM" ], [ 456, "u8", ".text" ], [ 535, "u8", "@.data" ], [ 576, "u8", ".rsrc" ], [ 5042, "u8", "tcHt" ], [ 5350, "u8", "F4WV" ], [ 7876, "u8", "W4VW" ], [ 9313, "u8", "SVW3" ], [ 11425, "u8", "SVWP" ], [ 11503, "u8", "u h4w@" ], [ 11725, "u8", "G0SQ" ], [ 12444, "u8", "VVPW" ], [ 13687, "u8", "NLWWW" ], [ 13738, "u8", "QQSVW" ], [ 14164, "u8", "F49E" ], [ 16485, "u8", "YYPW" ], [ 17196, "u8", "SVWjA3" ], [ 17484, "u8", "QSUVW" ], [ 17552, "u8", "USVW" ], [ 17582, "u8", "UVSW" ], [ 17856, "u8", "WWVhL" ], [ 18313, "u8", "4HYPV" ], [ 18381, "u8", "uRWWh" ], [ 18803, "u8", "PWWS" ], [ 20599, "u8", "4HYP" ], [ 20752, "u8", "SSWP" ], [ 21751, "u8", "UUWWj" ], [ 22652, "u8", "SQWP" ], [ 23364, "u8", "4HYPS" ], [ 23444, "u8", "SUVWh" ], [ 24338, "u8", "4HYW" ], [ 24942, "u8", "PVVVVV" ], [ 29369, "u8", "Qkkbal" ], [ 41352, "u8", "Worst program ever." ], [ 41372, "u8", "WikMail Installer is installing the stationery files in this directory." ], [ 41444, "u8", "Select a directory to intall the stationery." ], [ 41492, "u8", "Installing Files" ], [ 41512, "u8", "Select Destination" ], [ 41532, "u8", "Installer Error" ], [ 41548, "u8", "An error prevents this program from continuing:\n\n %s %s" ], [ 41612, "u8", "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders" ], [ 41680, "u8", ".ttf" ], [ 41688, "u8", "Fonts" ], [ 41696, "u8", "WikMailPath" ], [ 41708, "u8", "SOFTWARE\\WikMail" ], [ 41728, "u8", "C:\\Program Files\\WikMail" ], [ 41756, "u8", "%wikmail%" ], [ 41780, "u8", "MS Shell Dlg" ], [ 41796, "u8", "Tahoma" ], [ 41804, "u8", "explore" ], [ 41812, "u8", "Couldn't create output directory." ], [ 41848, "u8", "Are you sure you want to exit?" ], [ 41880, "u8", "Confirm exit" ], [ 41896, "u8", "The target directory doesn't exist. Create it?" ], [ 41944, "u8", "Create Directory?" ], [ 41964, "u8", "Choose an Extraction Folder" ], [ 41992, "u8", "Browse" ], [ 42000, "u8", "open" ], [ 42008, "u8", "Could not extract the current file." ], [ 42044, "u8", "Extracting %s ..." ], [ 42064, "u8", "Could not get file info. This archive is likely corrupted." ], [ 42124, "u8", "Could not read SFX info. It's likely corrupt." ], [ 42228, "u8", "Shortcut%d" ], [ 42240, "u8", "Author" ], [ 42252, "u8", "OpenFolder" ], [ 42264, "u8", "AutoExtract" ], [ 42276, "u8", "FALSE" ], [ 42284, "u8", "Intro" ], [ 42292, "u8", "DefaultPath" ], [ 42304, "u8", "Exec" ], [ 42312, "u8", "Name" ], [ 42320, "u8", "Unnamed Archive" ], [ 42336, "u8", "Debug" ], [ 42344, "u8", "NoGUI" ], [ 42352, "u8", "Delete" ], [ 42360, "u8", "ZipSize" ], [ 42368, "u8", "Can't write temp file" ], [ 42396, "u8", "Could not read the source SFX." ], [ 42428, "u8", "Deleting %s ..." ], [ 42444, "u8", "The extracted files are being removed." ], [ 42484, "u8", "Cleaning up ..." ], [ 42500, "u8", "Removing temp files" ], [ 42520, "u8", "File Cleanup" ], [ 42536, "u8", "Error" ], [ 42544, "u8", "%s could not be executed." ], [ 42632, "u8", "Couldn't create directory" ], [ 42660, "u8", "Could not create the target directory. %s\nBe sure that it does not contain an invalid character: \n/ \\ : * ? \" \u003c \u003e |" ], [ 42702, "u8", "Be sure that it does not contain an invalid character:" ], [ 62214, "wide", "MS Shell Dlg" ], [ 62332, "wide", "\u003c Back" ], [ 62376, "wide", "Next \u003e" ], [ 62420, "wide", "Cancel" ], [ 62496, "wide", "Where WikMail is already installed" ], [ 62596, "wide", "WikMail Stationary Installer" ], [ 62852, "wide", "This will install a Stationery in your WikMail directory.\n\nAs it's a stationery for WikMail, this program must be installed\non y" ], [ 63392, "wide", "Click Next to continue, or Cancel to exit setup." ], [ 63570, "wide", "Setup have found the directory from where the WikMail have been started last.\nIf you want to install the stationery in another d" ], [ 64110, "wide", "\u0026Create this directory if it does not exist" ], [ 64274, "wide", "Please wait while the files in this archive are extracted." ], [ 64414, "wide", "msctls_progress32" ], [ 64450, "wide", "Progress1" ], [ 65893, "u8", "KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKJKJKJKJKJKJKJKJKJKKKKKKKKKKKKKKKKKKKKKKJKJKJKJKJKJKJKJKJKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK" ], [ 66057, "u8", "JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJKJKJKJKJKJKJKJKJKJJJJJJJJJJJJJJJJJJJJJJKJKJKJKJKJKJKJKJKJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ" ], [ 66385, "u8", "KKKJKJKKKKKKKKKKKKKKKKKKKKKKKJKKJKJKJJJJJJJJJJJJJJJJJJ?J?J?J???????????J?J?JJJJJJJJJJJJJJJJJJKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK" ], [ 66549, "u8", "JJJKJKJJJJJJJJJJJJJJJJJJJJJJJKJJKJKJ??I?I?I?I?I?I?I?I?I?I?I??I?I?I?I?I?I?I????I?I?I?I?I?I?I?JJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ" ], [ 66877, "u8", "@;;;;;;;;;;@@@;@KK@;@@K@@;@K@@;;;@@@@JK@@KJK@@KJ?TJJJJJK@@KJK@@@JJJK@@KJJK@;;@@@@KJJ9@@KJ??????K?KKKKJKJKJKKKKKJKJKJKJKJKJKJKJKK" ], [ 67041, "u8", ";A]]]]]]]]AAAAAA;;AAA;;;AA;@@AA]]]AAA;;AAA;;AA;@J?II\u003eIJ;AA@@@;AA@??@;A;KK@A]AAAAA;@K;AA;@?TJJ?@@@@@@@9?KKJJJJJKJKJKJKJKJKJKJKJJJ" ], [ 67205, "u8", "]2lllllllx22]2k2]A2222A]2k2]A2klxkxk2]]2k2A]222A;@@@@;A]k22AA2k2];;A22]A;]klk22k22AAA2k2A;;;;AAA]]]AAAA;;;;;;;;;;;;;;;;;;;;;;;;;" ], [ 67460, "u8", "9@;A22222]AA;;;KKKJJJJJJJJJJJJJJJJJJKKJKJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJ" ], [ 67969, "u8", "A;@KJJJ?JKJKKKJKK;AAAAA@KKJKJKJKJKJKJKJKJKJKJKJKJKJKJ" ], [ 68300, "u8", "\u0026;;;;A;A;;;;;;A2kx" ], [ 68353, "u8", "JKA2l" ], [ 68362, "u8", "OOOOOODxO" ], [ 68451, "base64", "뮺뮺뮺" ], [ 68465, "u8", "\u0026;@;AAA;@KJJK;]kx" ], [ 68486, "u8", "\u0026JJJJJJJJJJJJJJJJJJJJJJJJJJJ" ], [ 68611, "u8", "K@;\u0026-66:6666666666-\u0026;A]22]A@KJK;]2x" ], [ 68651, "u8", "JJTJTJTJTJTJTJTJTJTJTJTJTJT" ], [ 68845, "u8", "TJJA2xDF" ], [ 68939, "u8", "GSSST9\u0026@@;\u0026" ], [ 68952, "u8", "-666666" ], [ 68980, "u8", "JJJJJJTJTJTJTJTJTJTJTJTJTJ" ], [ 69019, "u8", "Dxkk" ], [ 69074, "u8", "OOVR" ], [ 69133, "u8", "A]2xlx$666$\u0026JJJJJJJJJJJJJJJJJJJJJJJJJ" ], [ 69198, "u8", ";??VVV9\u003e\u003e\u003eG?VVVyHKA]" ], [ 69289, "u8", "l2 6666-" ], [ 69356, "u8", "\u003e\u003eXHSGGGS\\\\WhWW\\Wgfgggf\\YK" ], [ 69392, "u8", "ZZZZZZZZZZZZZZZofXT" ], [ 69435, "u8", "]]kkkkkkkxll" ], [ 69467, "u8", "2-6664\u0026;;;;@KKJJJJJTJTJJJTJTJTJ" ], [ 69520, "u8", "JSHGGSSW\\\\W\\W\\\\fgggRRRRf\\fy" ], [ 69556, "u8", "RoQoQZoZQZoZoZoQoffy" ], [ 69591, "u8", "SRf\\\\YKA2klx" ], [ 69633, "u8", "6665" ], [ 69638, "u8", "A]]]A;KJJKJJKJJJTJJJJJJJ" ], [ 69684, "u8", "??IJI\u003e\u003e\u003e\u003e\u003e\u003eGGGGG\\\\\\\\\\\\\\\\\\\\RV" ], [ 69719, "u8", "VRRRRRZRZRZRZRZRRRRRRV" ], [ 69829, "u8", "JJHJ\u003eITTTTTHT\u003e\u003eXXXHWGSS\\WWWWh\\gggRRfRRofoZZZZZZZZ|ZrrrrrrrrrrqrqrqrrrrrrrrrroQ||ZZZoZZZZRfRRfRfXt]xk" ], [ 69973, "u8", "\u0026AAA]AA;KKJJTJTJT" ], [ 69993, "u8", "J\u003eJ\u003eJHIHIHI\u003eH\u003eHHSHSSSS\\WW\\\\\\gggRRRRfRoRoZZQoZQQQqQqqqqqqqqqqqqqqqqqqqqqqqqqqqqQQQQqZQooZoZRoRRfWt" ], [ 70091, "u8", "x2 6666656666\u003c-" ], [ 70118, "base64", "뮺뮺랷" ], [ 70139, "u8", "2222]A;KKJJJJJJ" ], [ 70157, "u8", "@@@KKKKKKK?K9JJ????\u003eI\u003e\u003e\u003eG\u003eGGG\\\\\\\\\\\\\\RRRRfRRRZZZZZQQQQQQQQQQQQQQQQQQQQQQQQQQQQQZQZoRZRRRRRRRR\\\\\\Y;]x2 66: 44$" ], [ 70283, "u8", "5663:6666:\u003c5$" ], [ 70321, "u8", "TTTTTTTTTX\u003eXXGXWSS\\W\\WWgWfggRffffZZZZZo|orrqqqqqqqqqqqq}}}}}}}}}}}}}}}}}}}qqqqqqqqqqqrrr||ZZZZofTA22466\u003c" ], [ 70426, "u8", "\u0026\u0026;;;@tTK;]klk" ], [ 70485, "u8", "HIHIHIH\u003eH\u003eHHHHSSShWWW\\h\\ggRRRfRooZZZQ|Qqqqqqqqqqqq}q}}}}}}}}}}}}}}}}}}}}}}}}}}qq}qqqqqqqQqQZQZZfht" ], [ 70649, "u8", "KKKKKKKKJKKK?IJ\u003eH\u003e\u003e\u003eG\u003eGGW\\\\\\\\\\RRRRfoRZZZQQQQQQQ[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[QQQQQQQQZZZZRRffhTAk" ], [ 70750, "u8", "66663" ], [ 70777, "u8", "6664" ], [ 70782, "u8", "5666" ], [ 70813, "u8", "HTTTTTH\u003e\u003eXXXSGSSG\\W\\WgfgfRffZZZZooQorqqqqqq}}}}}}}}jo" ], [ 70890, "u8", "j}}}}}}}qqqqqqqr|oofgtA" ], [ 70914, "u8", "-666654" ], [ 70941, "u8", "3666" ], [ 70977, "u8", "HIHIHIH\u003eHHHSSXS\\\\W\\\\fggRRRZZoZoqQqqqqqqqq}}}}}" ], [ 71111, "u8", "3665" ], [ 71123, "u8", "36666" ], [ 71141, "u8", "KKKKK?9KJJ??J\u003e\u003e\u003eI\u003e\u003eGGGh\\\\\\\\RRRRRoZQQQQQ[q[[\\" ], [ 71197, "u8", "DDDO" ], [ 71305, "u8", "HTHH\u003eSXXXSSSW\\Wh\\ggggRRfoZZZ||rrqqqq}}}}\\" ], [ 71394, "u8", "}}}qqqqqr" ], [ 71440, "u8", "4663" ], [ 71469, "u8", "HH\u003eHHHHHHGWSWWW\\\\gfgRRfZZZorQqqqqq}}}o" ], [ 71560, "u8", "}}}qqqqqrfgi\u0026" ], [ 71633, "u8", "KKK??KJJ??JI\u003e\u003e\u003e\u003e\u003eGGh\\\\\\\\RRRRZZQQQQ[\\" ], [ 71725, "u8", "\\[QQQQZZZf\\WJ\u0026" ], [ 71797, "u8", "THHSHXXHSWS\\WW\\gggRRRfZZZZrqqqq}}" ], [ 71961, "u8", "H\u003eHHHHHSWWWWW\\ggfRffZZoZZqqqqq}" ], [ 72060, "u8", "qqqrroofpJ\u0026" ], [ 72086, "u8", "56-\u0026HIHIHIT@A" ], [ 72125, "u8", "?KKKJ?I?JIH\u003e\u003e\u003eGGG\\\\\\\\RRRZZZQQQ\\" ], [ 72222, "u8", "XQQZZoRRRR\\\\WH9\u0026" ], [ 72232, "xor", "\u0026\u0026-2C\\quee\\B0EEC:\\ueuC111111:A;'" ], [ 72253, "u8", "9KKKKKK@;A]x" ], [ 72289, "u8", "\u003eXXXXGSWW\\W\\\\fggfRfZZZ|r|qq" ], [ 72325, "hex", "wwwwwwww" ], [ 72388, "u8", "}qqq||ZZofffRggS\u003e\u003eW\\SSGYYYH8?THTTTTTIJtA22" ], [ 72453, "u8", "\u003eHHHSSSWWWW\\ggfRfffooZ|qqqqq" ], [ 72553, "u8", "oqqqrqoZZffRgfg\\WWWWWSHHHH\u003e\u003e\u003e\u003eHIHIHITKA]k" ], [ 72617, "u8", "JKJJ?JJ\u003e\u003eH\u003e\u003eGGW\\\\\\gRRRoZQQQ" ], [ 72718, "u8", "ZQZZRRRR\\\\hWGG\u003e\u003eG\u003e\u003eJJ?JKKK@KKKKKKKKK@;]k2$66-6$\u0026@;;\u0026" ], [ 72781, "u8", "HXHWSWWhW\\ggfg~ffZZ||r" ], [ 72883, "u8", "qqq||ZZfffRggg\\WWhSWSXXXXXXHTHTTTTTTK;]k" ], [ 72945, "u8", "HSGSSWWW\\WfggRffoZo|qqqq}y" ], [ 73048, "u8", "qqq||oZZffRfgg\\WWWSSSHHHHH\u003eT\u003eHIHIHIJ@A]" ], [ 73094, "u8", "IHIHIHIHIHIH" ], [ 73109, "u8", "J??J\u003e\u003e\u003e\u003e\u003eGGGh\\\\\\RRRRoZQQR" ], [ 73212, "u8", "XZZZRRR\\\\h\\GG\u003e\u003eG\u003eH\u003eJ??JKK@?@KKKKKKK@@A]2" ], [ 73273, "u8", "SSWShWh\\gggfRffoZZ|rqq" ], [ 73377, "u8", "qqr||ZZfffgfggWWWWSWXXXXXXXXTTTTTTTTK" ], [ 73437, "u8", "WSSWWWWggfgffZZo||qqq" ], [ 73541, "u8", "tqq||oZfffgggpWhWWSSWHHHHHTTHTHTHTHTJKt@\u0026$65" ], [ 73586, "u8", "HHIHIHIHIHIH" ], [ 73601, "u8", "JJ\u003e\u003eH\u003e\u003eGGGh\\\\\\RRRZZoQQq" ], [ 73706, "u8", "ZZZRRg\\\\h\\GGG\u003e\u003e\u003eI\u003eJ?JJKJKKJKKKKKKKK@@@;@\u0026" ], [ 73749, "u8", "\u0026KKKKKKKKKKKK" ], [ 73765, "u8", "S\\WWW\\gggRfffoZ|orrq" ], [ 73790, "u8", "D777" ], [ 73870, "u8", "|qr|ZZZffRgggphW\\SiSGSXHXXHHIHIHIHIHIIIII99HIHIHIHIHIHIH" ], [ 73929, "u8", "SWWWgpfggfffoZ||qq" ], [ 74034, "u8", "\\q|||oZfffggfhWWWSSSSSHXHHHXYXYXYXYXYXYXYXYXYXYXYXYXYXYX" ], [ 74199, "u8", "ZZZRRg\\\\\\\\GHX\u003eHH\u003eJTJJJJKJ@KKKKKKKKKKKKKKKKKKKKKKKKKKKKK" ], [ 74257, "u8", "WWWWgfgfffZZZ||r" ], [ 74364, "u8", "r|||offfgfggWhWhSSSSHXXXXXTXTXTXTXTXTXTXTXTXTXTXTXTXYH" ], [ 74421, "u8", "Whggggffffoo||qq" ], [ 74526, "u8", "tqqq|oZZfffgggpWWWWWSWXHHHHHHXHHHXHHHXHHHXHHHXHHHXHHHXHH" ], [ 74585, "u8", "\u003e\u003e\u003eGG\\h\\\\gRRRoZZQQq[[}[" ], [ 74749, "u8", "ppgggfffZZZ|||q" ], [ 74857, "u8", "|||of~fffgpgWWhWWSWHXHXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ], [ 74913, "u8", "pggfgfffZo||qq" ], [ 75020, "u8", "qq||ZZfffgfpgiWWXSSSSXHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH" ], [ 75077, "u8", "HGGW\\\\\\fgRRoZZQQq[[}[}j|" ], [ 75181, "u8", "trQZZZRRg\\\\\\WGGH\u003eGH\u003e\u003eJTKIJJJKKKKKKKKKKKKKKKKKKKKKKKKKKKKJ" ], [ 75241, "u8", "gfgff~fo|||q" ], [ 75349, "u8", "q||ZZff~RgfgpWWhWWSSSHGHXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ], [ 75514, "u8", "|||ZffffggpghWWWSWSWXHXHHHHHHHHHHHHHHHHHHHHHHHHHHHHH" ], [ 75569, "u8", "WS\\\\ggRRRZooQrq[[[}jj" ], [ 75672, "u8", "[[qQZZZRRgg\\\\WWSXH\u003eHHJJJJKKJKJJKJKKKKKKKKKKKKKKKKKKKKKKKKJ" ], [ 75842, "u8", "|||oofffggggihWhSiSWSXXYHXHXXXXXXXXXXXXXXXXXXXXXXXXH" ], [ 76005, "u8", "q|||oZfffgggpiWWWSSSSSHHSXHHXHHHHHHHHHHHHHHHHHHHHHHHH" ], [ 76061, "u8", "W\\gggRfoZoQrq[[}}jjjjjjjjjj}" ], [ 76168, "u8", "QoZoRRgg\\WWWSXHG\u003eHHHJTJTJJKJJKKJKJKJKJKJKJKJKJKJKJKJKJ" ], [ 76334, "u8", "q|||fo~ffgggpiWhWiSSSSWSHSXHXYXHXYXHXYXHXYXHXYXHXYXH" ], [ 76499, "u8", "|||ZffffgfggihWWWXWSWSSXSXHXHXHXHXHXHXHXHXHXHXHXHXH" ], [ 76553, "u8", "gggRRoZZQqqq[}}}t" ], [ 76659, "u8", "QQoooRRRggW\\\\SGHS\u003eTHH\u003eJJJJJTJKJKJKJKJKJKJKJKJKJKJKJKJKJ" ], [ 76827, "u8", "q||off~ffgfgpgWWWhSWSWSSSSSXHXHXHXHXHXHXHXHXHXHXHXH" ], [ 76992, "u8", "|||ZZffffgfpgpWWWWWSSWSWSXSXXSXSXSXSXSXSXSXSXSXSXS" ], [ 77045, "u8", "gRRoooQqqqqqt" ], [ 77320, "u8", "|||Zfff~fgfggpihWhWiSWSWSWSWSHSXSSSXSHSXSHSXSHSXSH" ], [ 77483, "u8", "qq|||ZZfffggfggpWWWWWWXWSSSSSSWSWSSWSWSWSWSWSWSWSWS" ], [ 77537, "u8", "RoooQqqq" ], [ 77635, "u8", "jjjj}}[qqqrqoZoRRggg\\W\\XHGHHG\u003eGTH\u003eJ\u003eTJTJTJJJJTJJJJJJJJJJJJJJJJJ" ], [ 77814, "u8", "||||Zff~ffgggpWiWhWhXWSXSSSWSWSSWSWSWSWSWSWSWSWS" ], [ 77978, "u8", "|||oZffffgfggpgihWWWWWWSWSWSSSSWSSSSSSSSSSSSSSSS" ], [ 78029, "u8", "ZZoqrq" ], [ 78131, "u8", "j}}}[qqqooooRfRgg\\\\\\WSGSX\u003e\u003e\u003eHTH\u003eJJJJJJTJTJJTJTJTJTJTJTJTJTJ" ], [ 78307, "u8", "||||fff~ffgggpgiWhWhWhSiSSSSSWSSSSSSSSSSSSSSSSS" ], [ 78472, "u8", "||||ZffffgfgghpgiWWWWWXXiSWSSSWSWSWSWSWSWSWSWS" ], [ 78521, "u8", "Zoqrqq" ], [ 78618, "u8", "ojjjjjj}}}}qqqr" ], [ 78634, "u8", "ooofRRgggWW\\SGSXY\u003e\u003e\u003eHHH\u003e\u003e\u003eJJJJJTJJJJJJJJJJJJJJJJ" ], [ 78801, "u8", "|||fff~ffgfgggpgWWhWhWiXhSWSSWSWSWSWSWSWSWSWS" ], [ 78965, "u8", "||||ZZffffggggpgiiWWWWWXXXSWSSSSSSSSSSSSSSSSS" ], [ 79037, "u8", "00000000\u003cC:\u003c\u003c\u003c\u003c:Cd" ], [ 79116, "u8", "qjjj}}}qqqroZZZfRgggg\\WW\\SGGHX\u003e\u003eHTHTHHHJJJTJTJTJTJTJTJTJTJ" ], [ 79201, "u8", "40000000:0M\u003cC:\u003c:\u003c\u003cM:M:MC" ], [ 79294, "u8", "|||o|fo~ffgfgggpgipWihWhXhWWXSXSXSXSXSXSXSXS" ], [ 79365, "u8", "4000000\u003c0\u003c0CCCM\u003c\u003cM\u003cMMMMMMMnnCd" ], [ 79457, "u8", "|||||offffffgfgfphgihWWWWXWXSWSWSWSWSWSWSWSWS" ], [ 79529, "u8", "40000000\u003c:\u003c\u003cCMCC:\u003c:MMMMMnMnMnnnnnn" ] ], "v": { "file.stem": "a29c151d98135393c7279dad4d7a8a95f2e6f6270b83b2a511ca4980f5c8035f", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1296124995, "file.basename": "a29c151d98135393c7279dad4d7a8a95f2e6f6270b83b2a511ca4980f5c8035f.exe", "pe.image_base": 4194304, "pe.image_size": 126976, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 15475, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "195f48e968ca796be112be1b2c3d9669c1c36a81", "pe.image_hash.sha256": "7996bdce5b5ff0d5d7e00cc2eefb5356bc8ff5a79e939aba2755a5e3139b3a91", "pe.image_hash.sha384": "873c8b47349ebaf35858272807ac27705ff00c1e1768aa673cd0b06bd6d3f4014c2a4456c55cad85a3badcc19ba68c4c", "pe.image_hash.sha512": "bb2759f91e259c5190cafc379b5de358f71fb77012dc4df0199990a22634545466448671eee09c27c425243468af758ffa99a60700e49bc169b355530685c373", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 287, "pe.linker_major_version": 6, "pe.data_directories[0].rva": 30688, "pe.data_directories[1].rva": 61440, "pe.data_directories[2].rva": 28672, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 140, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 63024, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 376, "pe.coff.dos_header_pe_pointer": 208 }, "id": "pe", "sc": [ [ ".text", 4096, 24576, 6.06, "r-x" ], [ ".rdata", 28672, 8192, 1.68, "r--" ], [ ".data", 36864, 24576, 1.11, "rw-" ], [ ".rsrc", 61440, 65536, 6.78, "r--" ] ] }, "id": 0, "sz": 126976, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "a29c151d98135393c7279dad4d7a8a95f2e6f6270b83b2a511ca4980f5c8035f.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M" ], "i": "objectives/anti-static/obfuscation/payload/registry::hkcu-software-text", "l": 1, "m": "B0032", "el": [ "0xa28c" ] }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 65536, entropy: 6.78)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.9900000095367432, "d": "CLAM COFF timestamp marker", "e": [ "43 4c 41 4d" ], "i": "metadata/binary/anomaly/rewrite::clamav-coff-timestamp", "l": 1, "el": [ "0xd8" ] }, { "a": "T1485", "c": 0.699999988079071, "d": "Windows Shell Folders registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders" ], "i": "objectives/impact/destroy/file-deletion::shell-folders-personal-targeting", "l": 3, "m": "C0047", "el": [ "0xa28c" ] }, { "c": 0.9900000095367432, "d": "ClamAV holder DOS stub banner", "e": [ "21 54 68 69 73 20 66 69 6c 65 20 77 61 73 20 63 72 65 61 74 65 64 20 62 79 20 43 6c 61 6d 41 56" ], "i": "metadata/binary/anomaly/rewrite::clamav-holder-banner", "l": 1, "el": [ "0x4c" ] }, { "c": 1.0, "d": "scanner word", "e": [ "scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1, "el": [ "0x96" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "a29c151d98135393c7279dad4d7a8a95f2e6f6270b83b2a511ca4980f5c8035f.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "e4 70 40 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1, "el": [ "0x31f7" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1059.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Lowercase underscore internal name", "e": [ "mmmm_mumma", "mmmm_mmmammaaamw" ], "i": "objectives/evasion/masquerade/identity/fabricated::lowercase-underscore-internal-name", "l": 1, "el": [ "0x184ac", "0x18172" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1059.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.06" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1204", "c": 0.699999988079071, "d": "Virus reference", "e": [ "virus" ], "i": "micro-behaviors/data/text/malware/terms::virus-marker", "l": 2, "el": [ "0x96" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "virus word", "e": [ "virus" ], "i": "objectives/impact/infect/lexicon::virus-word", "l": 1, "el": [ "0x96" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Couldn't create output directory." ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1, "el": [ "0xa354" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "4e" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x1240" ] }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2, "el": [ "0x96" ] }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 1.68)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x4191" ] }, { "c": 1.0, "d": "Copy create file status", "e": [ "Create Directory" ], "i": "objectives/impact/wipe/disk/mass-delete::copy-create-file-message", "l": 1, "el": [ "0xa3d8" ] }, { "c": 0.9900000095367432, "d": "ClamAV scanner banner string", "e": [ "43 6c 61 6d 41 56 20 2d 20 41 20 47 50 4c 20 76 69 72 75 73 20 73 63 61 6e 6e 65 72" ], "i": "metadata/binary/anomaly/rewrite::clamav-gpl-banner", "l": 1, "el": [ "0x96" ] }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Four section compact loader layout", "e": [ "sections.count = 4.00" ], "i": "well-known/malware/trojan/elex/compact-signals::four-section-compact-loader", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1059.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8999999761581421, "d": "Inline MZ and PE validation", "e": [ "3e" ], "i": "micro-behaviors/fs/file/pe-inspect::inline-pe-signature-check", "l": 3, "el": [ "0x4526" ] }, { "c": 0.800000011920929, "d": "Data before JAR/ZIP header", "e": [ "50 4B 03 04" ], "i": "objectives/anti-static/polyglot/format::jar-polyglot-prefix", "l": 1, "el": [ "0x3708" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.949999988079071, "d": "XORed Cobalt Strike config marker", "e": [ "EF BE [2] BE B7" ], "i": "well-known/malware/rat/cobalt-strike::xored-config-beef-rdata", "l": 1, "el": [ "0x73ed" ] }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x63f6" ] }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "d4 70 40 00", "58 71 40 00", "40 70 40 00", "dc 70 40 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1, "el": [ "0x58d1", "0x47ff", "0x4006", "0x30a0" ] }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x63f6" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "a29c151d98135393c7279dad4d7a8a95f2e6f6270b83b2a511ca4980f5c8035f.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload/archive::zip-magic", "l": 2, "el": [ "0x3708" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "ZffffgfgghpgiWWWWWXXiSWSSSWSWSWSWSWSWSWSWS", "ZffffggpghWWWSWSWXHXHHHHHHHHHHHHHHHHHHHHHHHHHHHHH", "ZffffffffgfgfgpppiiWWWWWWhXWXWXWXWXWXWXWXW", "RgfgpWWhWWSSSHGHXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "WgfgfRffZZZZooQorqqqqqq", "ZffffgfggihWWWXWSWSSXSXHXHXHXHXHXHXHXHXHXHXHXHXH" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x13288", "0x126fa", "0x13850", "0x12655", "0x1149d", "0x12ad3" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "\u0026\u0026-2C\\quee\\B0EEC:\\ueuC111111:A;' \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3, "el": [ "offset:72232" ] } ], "sha": "a29c151d98135393c7279dad4d7a8a95f2e6f6270b83b2a511ca4980f5c8035f", "path": "a29c151d98135393c7279dad4d7a8a95f2e6f6270b83b2a511ca4980f5c8035f.exe", "type": "pe" } ], "tv": "52045" } }