{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9948396682739258, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.99483967, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.99483967, "class": 0 }, { "m": "az/native", "prob": 0.90297544, "class": 0 }, { "m": "az/pe", "prob": 0.99557674, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T01:59:18Z" }, "path": "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe", "raw": { "v": "5", "fs": [ { "f": "Md(Bi₃)", "x": 124, "ff": { "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 3544622.0, "bss_like_section_count": 1.0, "section_overflow_count": 2.0, "misaligned_section_count": 0.0, "entry_in_writable_section": 1.0 }, "file": { "size": 3538433.0, "entropy": 8.0, "size_bytes": 3538433.0 }, "binary": { "is_pie": 0.0, "code_entropy": 8.0, "data_entropy": 0.0, "string_count": 42333.0, "entropy_variance": 16.0, "avg_string_length": 4.6, "max_string_length": 44.0, "code_to_data_ratio": 0.99, "string_length_stddev": 0.99, "largest_section_ratio": 1.15, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "sections": { "count": 3.0, "code_size": 4081664.0, "entropy_max": 8.0, "entropy_mean": 4.0, "name_entropy": 3.09, "writable_count": 3.0, "executable_count": 2.0, "nonstandard_count": 2.0, "executable_writable_count": 2.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 232, "u8", "Rich" ], [ 512, "u8", "UPX0" ], [ 552, "u8", "UPX1" ], [ 592, "u8", ".rsrc" ], [ 987, "u8", "3.94" ], [ 1508, "u8", "ZRIH" ], [ 2398, "u8", "1CfHX" ], [ 3512, "u8", "tLSly" ], [ 3656, "u8", "kUjtY" ], [ 6094, "u8", "cfRyS" ], [ 6114, "u8", "].T@f_pe" ], [ 7627, "u8", "ArbgEsgT=s5{" ], [ 7915, "u8", "KcXpf" ], [ 8492, "u8", "Gh3sh" ], [ 8652, "u8", "OY0e5" ], [ 9594, "u8", "rBzp" ], [ 12531, "u8", "Ovbg" ], [ 13357, "u8", "3y3j" ], [ 13631, "u8", "dfJq" ], [ 14207, "u8", "UDLdA" ], [ 16089, "u8", "4ecG4" ], [ 16297, "u8", "JXL5" ], [ 19207, "u8", "IT95" ], [ 19685, "u8", "Obbf" ], [ 20308, "u8", "4VUsZ" ], [ 20488, "u8", "VjrMO" ], [ 24442, "u8", "lONFT" ], [ 24628, "u8", "X0F3" ], [ 24783, "u8", "/nHK05" ], [ 26967, "u8", "NoJTgE" ], [ 28407, "u8", "/1Nij" ], [ 28901, "u8", "vODSQ" ], [ 29438, "u8", "jxXv" ], [ 31626, "u8", "T Z7" ], [ 32339, "u8", "TDjog" ], [ 33329, "u8", "RPLF" ], [ 34443, "u8", "ac8k" ], [ 37226, "u8", "L jXxMp" ], [ 38228, "u8", "F.rd" ], [ 40881, "u8", "[k)g" ], [ 42330, "u8", "IfgEz" ], [ 43938, "u8", "heQs" ], [ 45091, "u8", "jeWatM" ], [ 48751, "u8", "s 40" ], [ 48874, "u8", "LE2\u003eX" ], [ 49872, "u8", "c5s9" ], [ 50743, "u8", "DCrys" ], [ 51158, "u8", "do9j" ], [ 51171, "u8", "bcQlm" ], [ 56398, "u8", "ziZo" ], [ 57751, "u8", "lR37W" ], [ 58333, "u8", "a Gn" ], [ 59382, "u8", "7y6Fnk" ], [ 60555, "u8", "46zas" ], [ 60639, "u8", "qK b" ], [ 61521, "u8", "ttT.v" ], [ 62632, "u8", "wnpFT" ], [ 63131, "u8", "Q3NJd" ], [ 63979, "u8", "Kgto" ], [ 64204, "u8", "jRqn" ], [ 64836, "u8", "QMD7K" ], [ 68038, "u8", "R9C8K" ], [ 69116, "u8", "z404Zs" ], [ 70930, "u8", "Wvc9L" ], [ 71640, "u8", "8KEOi" ], [ 73283, "u8", "9 1d" ], [ 73899, "u8", "2EMW" ], [ 75803, "u8", "sKmcu" ], [ 78663, "u8", "6D8L" ], [ 80290, "u8", "BU2fC" ], [ 83408, "u8", "iMfx" ], [ 83947, "u8", "PI2L" ], [ 84033, "u8", "ylPz" ], [ 85088, "u8", "FL2RhV" ], [ 85347, "u8", "KrqR9" ], [ 85602, "u8", "p9Udd" ], [ 86137, "u8", "qDmxx" ], [ 87179, "u8", "zyOLn" ], [ 88692, "u8", "Y66M" ], [ 88867, "u8", "j1h7" ], [ 92675, "u8", "mRUHH5" ], [ 93156, "u8", "OfpFA2F" ], [ 94522, "u8", "dBep" ], [ 94597, "u8", "Kskq" ], [ 96087, "u8", "sPZ8H" ], [ 97957, "u8", "FFi3g" ], [ 99722, "u8", "yK l" ], [ 100117, "u8", "gd4XE" ], [ 101382, "u8", "/J7Vm" ], [ 102000, "u8", "SW7N" ], [ 102321, "u8", "lfPl3" ], [ 102504, "u8", "3hDQA" ], [ 102672, "u8", "ZNX5G" ], [ 102923, "u8", "GCAK" ], [ 105417, "u8", "bZTrw" ], [ 106358, "u8", "HPX7" ], [ 107724, "u8", "RQ65" ], [ 113884, "u8", "tlLa" ], [ 114086, "u8", "Y48X" ], [ 115163, "u8", "VYAI" ], [ 117055, "u8", "vZdi" ], [ 117076, "u8", "AN3m6" ], [ 117606, "u8", "uTapix" ], [ 117703, "u8", ";DNJ a" ], [ 118496, "u8", "ZAWQ" ], [ 120068, "u8", "p9taJ" ], [ 121311, "u8", "yKcl" ], [ 122379, "u8", "W7K0M" ], [ 122952, "u8", "cu4v" ], [ 123015, "u8", "UXls3Jf" ], [ 125282, "u8", "Hnpu" ], [ 133538, "u8", "M 4G" ], [ 134434, "u8", "wjyCY3" ], [ 135893, "u8", "vVbz" ], [ 137041, "u8", "a25f" ], [ 141286, "u8", "pj0OG" ], [ 142240, "u8", "knXs" ], [ 142887, "u8", "hRlf" ], [ 144583, "u8", "9OQQ" ], [ 145764, "u8", "/Ti8" ], [ 146291, "u8", "MXtIa" ], [ 147282, "u8", "9zaPl" ], [ 149515, "u8", "bf95" ], [ 149808, "u8", "OD0L" ], [ 149887, "u8", "60RR" ], [ 152505, "u8", "kd_XB" ], [ 152882, "u8", "M95Qc" ], [ 154529, "u8", ", VJpP" ], [ 156401, "u8", "gqQk" ], [ 158215, "u8", "PPrNC" ], [ 158937, "u8", "5kBsy" ], [ 162380, "u8", "/P0q" ], [ 165384, "u8", "Wucj" ], [ 165921, "u8", "jeFw" ], [ 166053, "u8", "Npsp" ], [ 166275, "u8", "OZZ1j" ], [ 166838, "u8", "NXVZU" ], [ 167595, "u8", "ANEPU" ], [ 167751, "u8", "aTrd" ], [ 173462, "u8", "wxPn" ], [ 173978, "u8", "Txpw" ], [ 176043, "u8", "Fut\u003c\u003c" ], [ 176311, "u8", "05vLJ" ], [ 176614, "u8", "SHFV" ], [ 177176, "u8", "fqpIH" ], [ 179043, "u8", "Ajnb" ], [ 179617, "u8", "DsATm5" ], [ 182683, "u8", "|wAbap q" ], [ 183374, "u8", "sQyg" ], [ 183490, "u8", "sCJa9s" ], [ 186382, "u8", "doku" ], [ 187014, "u8", "LUUY" ], [ 187050, "u8", "`/1`" ], [ 187290, "u8", "bzXb" ], [ 187962, "u8", "Dhpm" ], [ 187968, "u8", "2rdlcDP" ], [ 188558, "u8", "RStyW" ], [ 188671, "u8", "eyOIF" ], [ 189446, "u8", "qWP9Df" ], [ 196240, "u8", "qaSf" ], [ 196538, "u8", "QN4H" ], [ 197831, "u8", "8Q4Q" ], [ 197919, "u8", "ajLx" ], [ 199407, "u8", "QXsZ4" ], [ 200002, "u8", "HDN8" ], [ 201175, "u8", "DrMAn" ], [ 203123, "u8", "bhubGq" ], [ 203681, "u8", "pkEyg" ], [ 204107, "u8", "J316" ], [ 205222, "u8", "45veJ" ], [ 205435, "u8", "6YGqnO" ], [ 205486, "u8", "7CwbU" ], [ 208519, "u8", "ZMTKlQ" ], [ 209574, "u8", "ogGp3" ], [ 212432, "u8", "32QSOs" ], [ 212483, "u8", "ptS76S" ], [ 213895, "u8", "ng1Iv" ], [ 214918, "u8", "LE9P0" ], [ 216918, "u8", "Y3G0" ], [ 217156, "u8", "/gKWF" ], [ 221459, "u8", "cuJp" ], [ 221740, "u8", "CNeDn" ], [ 223095, "u8", "pySm" ], [ 225011, "u8", "jm86" ], [ 225079, "u8", "RXFjf" ], [ 225182, "u8", "bXnnOG1" ], [ 226783, "u8", "5ua5h" ], [ 229033, "u8", "zbmRW" ], [ 233527, "u8", "ao5d" ], [ 234044, "u8", "U622" ], [ 234192, "u8", "6QOL" ], [ 234798, "u8", "Scdg" ], [ 237365, "u8", "M9QY" ], [ 237818, "u8", "1ZnmV" ], [ 237975, "u8", "P6BC" ], [ 238677, "u8", "LM25J" ], [ 240470, "u8", "B ubx" ], [ 240748, "u8", "7 HA9" ], [ 241884, "u8", "GKwMV" ], [ 242980, "u8", "JX9N" ], [ 243079, "u8", "/713" ], [ 243180, "u8", "Ulmg" ], [ 244822, "u8", "G89mf" ], [ 245062, "u8", "QX7X" ], [ 246090, "u8", "H1PC" ], [ 250011, "u8", "huoi" ], [ 250650, "u8", "rS8wd" ], [ 250658, "u8", "AcNQ4" ], [ 252835, "u8", "dI1uEU" ], [ 254001, "u8", "tAkl" ], [ 255895, "u8", "kQrx" ], [ 256015, "u8", "/COm" ], [ 256297, "u8", "Doim" ], [ 256565, "u8", "p9s8" ], [ 257383, "u8", "/C bA" ], [ 257577, "u8", "V noi8" ], [ 259016, "u8", "dkKa" ], [ 261746, "u8", "wfSjlR" ], [ 262474, "u8", "Ooch" ], [ 263589, "u8", "556lJ" ], [ 263613, "u8", "baok" ], [ 264186, "u8", "$YL/ A2" ], [ 265927, "u8", "vt}P[" ], [ 266129, "u8", "R{h)" ], [ 269860, "u8", "4LQpi" ], [ 270505, "u8", "XAargTy" ], [ 272628, "u8", "o4zd" ], [ 272684, "u8", "93QU" ], [ 274034, "u8", "JwcZQM/" ], [ 275333, "u8", "9h3r" ], [ 281202, "u8", "4m85AJ" ], [ 281649, "u8", "jo.x" ], [ 282816, "u8", "UMHZ" ], [ 284096, "u8", "hfRd" ], [ 285227, "u8", "IMPF" ], [ 285415, "u8", "vEPNMrI" ], [ 285864, "u8", "EhuI9" ], [ 286186, "u8", "1hVZ0" ], [ 290319, "u8", "bWia" ], [ 290436, "u8", "CIOF" ], [ 290729, "u8", "hVD6rf" ], [ 292866, "u8", "wcW8x" ], [ 293408, "u8", "tkO02N" ], [ 294213, "u8", "PM7gH" ], [ 297179, "u8", "9rQGX" ], [ 297656, "u8", "WROIK" ], [ 298626, "u8", "eRkurjH" ], [ 299392, "u8", "l015" ], [ 300594, "u8", "Ybxa" ], [ 304084, "u8", "p20t" ], [ 306729, "u8", "q69pK" ], [ 309304, "u8", "TWE1" ], [ 310088, "u8", "mc573" ], [ 310604, "u8", "jRyl" ], [ 312932, "u8", "Gcye" ] ], "v": { "file.stem": "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a", "pe.machine": "i386", "pe.rich.key": 4015368942, "pe.rich.hash": "b42de8b16c4757c9f7d9a588e2def09a", "pe.subsystem": "windows_gui", "pe.timestamp": 1657473619, "binary.packer": "upx", "file.basename": "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe", "pe.image_base": 4194304, "pe.image_size": 14327808, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 14265024, "pe.headers_size": 4096, "pe.entry_section": "UPX1", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.data_directories[0].rva": 14325164, "pe.data_directories[1].rva": 14270464, "pe.number_of_rva_and_sizes": 16, "pe.overflowing_sections[0]": "UPX1", "pe.overflowing_sections[1]": ".rsrc", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 676, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 54700, "pe.rich.entries[0].build_id": 12, "pe.rich.entries[1].build_id": 14, "pe.rich.entries[2].build_id": 10, "pe.rich.entries[3].build_id": 11, "pe.rich.entries[4].build_id": 19, "pe.rich.entries[5].build_id": 19, "pe.rich.entries[6].build_id": 1, "pe.rich.entries[7].build_id": 11, "pe.rich.entries[8].build_id": 10, "pe.rich.entries[0].use_count": 3, "pe.rich.entries[10].build_id": 6, "pe.rich.entries[1].use_count": 43, "pe.rich.entries[2].use_count": 187, "pe.rich.entries[3].use_count": 87, "pe.rich.entries[4].use_count": 44, "pe.rich.entries[5].use_count": 21, "pe.rich.entries[6].use_count": 588, "pe.rich.entries[7].use_count": 74, "pe.rich.entries[8].use_count": 25, "pe.rich.entries[9].use_count": 31, "pe.coff.dos_header_pe_pointer": 264, "pe.rich.entries[0].product_id": 7291, "pe.rich.entries[10].use_count": 1, "pe.rich.entries[1].product_id": 7299, "pe.rich.entries[2].product_id": 9782, "pe.rich.entries[3].product_id": 9782, "pe.rich.entries[4].product_id": 8022, "pe.rich.entries[5].product_id": 8034, "pe.rich.entries[7].product_id": 8168, "pe.rich.entries[8].product_id": 8168, "pe.rich.entries[10].product_id": 1735 }, "id": "pe", "sc": [ [ "UPX0", 1024, 0, 0.0, "rwx" ], [ "UPX1", 1024, 4081664, 8.0, "rwx" ], [ ".rsrc", 4082688, 55808, 0.0, "rw-" ] ] }, "id": 0, "sz": 3538433, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 1.0, "d": "Binary contains a UPX packing marker", "i": "anti-static/packer/upx", "l": 4 }, { "c": 1.0, "d": "UPX decompression failed (possibly tampered): upx: /tmp/hopper-litmus-1031862631/.tmpK0jzc1: CantUnpackException: header corrupted\n", "i": "anti-static/packer/upx/decompression-failed", "l": 5 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 42333.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 42333.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.15" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KG token", "e": [ "KG " ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-kg", "l": 1, "m": "B0007.003", "el": [ "0x22cd11" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 42333.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.15" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 8.00" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 1.15" ], "i": "metadata/binary/metrics/structural::section-exceeds-file-size", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 42333.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.15" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 42333.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 4081664, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ "UPX1 (size: 4081664, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 42333.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1, "el": [ "0x200", "0x228" ] }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 42333.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "c": 0.9200000166893005, "d": "Large null-filled PE resources", "e": [ ".rsrc (size: 55808, entropy: 0.00)" ], "i": "metadata/binary/resource::large-null-rsrc", "l": 3 }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "c": 1.0, "d": "Downgrade standalone UPX packer finding", "i": "metadata/binary/framework::upx-packer-downgrade", "l": 2 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.15" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 42333.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 8.00" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.60" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX1", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.15" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 } ], "sha": "abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-06/abda8fb882294cb6e54c4730367dd56dfd62ad58b32ac467b1a79dc79add151a.exe", "type": "pe" } ], "tv": "ca5ef" } }