{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.029040404, "class": 0 }, { "m": "az/pe", "prob": 0.0032894737, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T13:34:53Z" }, "path": "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "m": { "pe": { "checksum": 4427802.0, "checksum_valid": 0.0, "computed_checksum": 4430550.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 4384832.0, "entropy": 1.32, "size_bytes": 4384832.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 1.11, "overlay_size": 10304.0, "string_count": 1050.0, "overlay_ratio": 0.0, "overlay_entropy": 7.49, "entropy_variance": 8.98, "avg_string_length": 10.49, "max_string_length": 1222.0, "code_to_data_ratio": 1.0, "string_length_stddev": 39.56, "largest_section_ratio": 0.98, "sentence_string_count": 24.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "sections": { "count": 2.0, "code_size": 4297216.0, "entropy_max": 7.1, "entropy_mean": 4.1, "name_entropy": 2.72, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 392, "u8", ".text" ], [ 6592, "u8", "__StaticArrayInitTypeSize=22" ], [ 6621, "u8", "ReadInt32" ], [ 6639, "u8", "2E919B1FE7D39979587BA4188B36F86F0347AE5740D8CD626402E31EDE3119B3" ], [ 6704, "u8", "10C8D3383DAE26336EC37AEB92566EFA01DD4C69F199C301B30B6D37582CFFC3" ], [ 6769, "u8", "ToInt64" ], [ 6777, "u8", "ReadInt16" ], [ 6787, "u8", "__StaticArrayInitTypeSize=6" ], [ 6815, "u8", "__StaticArrayInitTypeSize=4286537" ], [ 6849, "u8", "40218EFA6DE7E7B7B936AB611CC31BFDC1F3573EBE8124FDFE42B34D560EF3E8" ], [ 6923, "u8", "\u003cModule\u003e" ], [ 6932, "u8", "\u003cPrivateImplementationDetails\u003e" ], [ 6971, "u8", "GLMA" ], [ 6996, "u8", "T4ME" ], [ 7005, "u8", "get_ASCII" ], [ 7030, "u8", "REP_GDFFP" ], [ 7057, "u8", "B162S" ], [ 7079, "u8", "data" ], [ 7084, "u8", "mscorlib" ], [ 7093, "u8", "System.Collections.Generic" ], [ 7120, "u8", "Microsoft.VisualBasic" ], [ 7142, "u8", "UrethralgiaOrc" ], [ 7157, "u8", "Thread" ], [ 7168, "u8", "HypostomousBuried" ], [ 7186, "u8", "Synchronized" ], [ 7199, "u8", "GetMethod" ], [ 7209, "u8", "method" ], [ 7216, "u8", "defaultInstance" ], [ 7232, "u8", "EndInvoke" ], [ 7242, "u8", "BeginInvoke" ], [ 7254, "u8", "IDisposable" ], [ 7266, "u8", "RuntimeFieldHandle" ], [ 7285, "u8", "RuntimeTypeHandle" ], [ 7303, "u8", "GetTypeFromHandle" ], [ 7321, "u8", "Console" ], [ 7329, "u8", "ProcessModule" ], [ 7343, "u8", "DLLName" ], [ 7351, "u8", "get_FileName" ], [ 7364, "u8", "FunctionName" ], [ 7377, "u8", "name" ], [ 7382, "u8", "WriteLine" ], [ 7392, "u8", "ValueType" ], [ 7402, "u8", "get_Culture" ], [ 7414, "u8", "set_Culture" ], [ 7426, "u8", "resourceCulture" ], [ 7442, "u8", "MethodBase" ], [ 7453, "u8", "ReadOnlyCollectionBase" ], [ 7476, "u8", "ApplicationSettingsBase" ], [ 7500, "u8", "Dispose" ], [ 7508, "u8", "MulticastDelegate" ], [ 7526, "u8", "EditorBrowsableState" ], [ 7547, "u8", "CompilerGeneratedAttribute" ], [ 7574, "u8", "GuidAttribute" ], [ 7588, "u8", "GeneratedCodeAttribute" ], [ 7611, "u8", "UnverifiableCodeAttribute" ], [ 7637, "u8", "DebuggerNonUserCodeAttribute" ], [ 7666, "u8", "DebuggableAttribute" ], [ 7686, "u8", "EditorBrowsableAttribute" ], [ 7711, "u8", "ComVisibleAttribute" ], [ 7731, "u8", "AssemblyTitleAttribute" ], [ 7754, "u8", "AssemblyTrademarkAttribute" ], [ 7781, "u8", "TargetFrameworkAttribute" ], [ 7806, "u8", "AssemblyFileVersionAttribute" ], [ 7835, "u8", "SecurityPermissionAttribute" ], [ 7863, "u8", "AssemblyConfigurationAttribute" ], [ 7894, "u8", "AssemblyDescriptionAttribute" ], [ 7923, "u8", "UnmanagedFunctionPointerAttribute" ], [ 7957, "u8", "CompilationRelaxationsAttribute" ], [ 7989, "u8", "AssemblyProductAttribute" ], [ 8014, "u8", "AssemblyCopyrightAttribute" ], [ 8041, "u8", "AssemblyCompanyAttribute" ], [ 8066, "u8", "RuntimeCompatibilityAttribute" ], [ 8096, "u8", "ToByte" ], [ 8103, "u8", "value" ], [ 8109, "u8", "Dox2_C2.exe" ], [ 8121, "u8", "Resize" ], [ 8128, "u8", "System.Threading" ], [ 8145, "u8", "Encoding" ], [ 8154, "u8", "System.Runtime.Versioning" ], [ 8180, "u8", "ToString" ], [ 8189, "u8", "GetString" ], [ 8199, "u8", "Substring" ], [ 8209, "u8", "get_Length" ], [ 8220, "u8", "EndsWith" ], [ 8229, "u8", "PtrToStringAnsi" ], [ 8245, "u8", "AsyncCallback" ], [ 8259, "u8", "callback" ], [ 8268, "u8", "Marshal" ], [ 8276, "u8", "System.ComponentModel" ], [ 8298, "u8", "MyProgram" ], [ 8308, "u8", "System" ], [ 8315, "u8", "resourceMan" ], [ 8327, "u8", "Main" ], [ 8332, "u8", "AppDomain" ], [ 8342, "u8", "get_CurrentDomain" ], [ 8360, "u8", "System.Configuration" ], [ 8381, "u8", "System.Globalization" ], [ 8402, "u8", "SecurityAction" ], [ 8417, "u8", "Interaction" ], [ 8429, "u8", "System.Reflection" ], [ 8447, "u8", "ProcessModuleCollection" ], [ 8471, "u8", "CallingConvention" ], [ 8489, "u8", "MissingMethodException" ], [ 8512, "u8", "InvalidOperationException" ], [ 8538, "u8", "StringComparison" ], [ 8555, "u8", "MethodInfo" ], [ 8566, "u8", "CultureInfo" ], [ 8578, "u8", "Zero" ], [ 8583, "u8", "CustomMap" ], [ 8593, "u8", "Sleep" ], [ 8599, "u8", "MyApp" ], [ 8605, "u8", "Char" ], [ 8610, "u8", "get_ResourceManager" ], [ 8630, "u8", "System.CodeDom.Compiler" ], [ 8654, "u8", "LiodermiaGranulater" ], [ 8674, "u8", "GetDelegateForFunctionPointer" ], [ 8704, "u8", "ToLower" ], [ 8712, "u8", "IEnumerator" ], [ 8724, "u8", "GetEnumerator" ], [ 8738, "u8", ".ctor" ], [ 8744, "u8", ".cctor" ], [ 8751, "u8", "UIntPtr" ], [ 8763, "u8", "System.Diagnostics" ], [ 8782, "u8", "System.Runtime.InteropServices" ], [ 8813, "u8", "System.Runtime.CompilerServices" ], [ 8845, "u8", "System.Resources" ], [ 8862, "u8", "MyProgram.Properties.Resources.resources" ], [ 8903, "u8", "DebuggingModes" ], [ 8918, "u8", "MyProgram.Properties" ], [ 8939, "u8", "get_Modules" ], [ 8951, "u8", "GetBytes" ], [ 8960, "u8", "Settings" ], [ 8969, "u8", "Equals" ], [ 8976, "u8", "System.Security.Permissions" ], [ 9004, "u8", "System.Collections" ], [ 9023, "u8", "get_Chars" ], [ 9033, "u8", "RuntimeHelpers" ], [ 9048, "u8", "GetCurrentProcess" ], [ 9066, "u8", "get_BaseAddress" ], [ 9082, "u8", "Concat" ], [ 9089, "u8", "Object" ], [ 9096, "u8", "object" ], [ 9103, "u8", "op_Explicit" ], [ 9115, "u8", "Split" ], [ 9121, "u8", "get_Default" ], [ 9133, "u8", "IAsyncResult" ], [ 9146, "u8", "result" ], [ 9153, "u8", "get_Current" ], [ 9165, "u8", "Convert" ], [ 9173, "u8", "MoveNext" ], [ 9182, "u8", "System.Text" ], [ 9194, "u8", "InitializeArray" ], [ 9210, "u8", "ToArray" ], [ 9218, "u8", "get_Assembly" ], [ 9231, "u8", "Copy" ], [ 9236, "u8", "op_Equality" ], [ 9248, "u8", "System.Security" ], [ 9268, "wide", "REP_GDFFP" ], [ 9296, "wide", "Null" ], [ 9316, "wide", "Null1" ], [ 9336, "wide", "MyProgram.Properties.Resources" ], [ 9883, "u8", "System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934" ], [ 10020, "u8", "SkipVerification" ], [ 10263, "u8", "WrapNonExceptionThrows" ], [ 10305, "u8", "Copyright" ], [ 10317, "u8", "2023" ], [ 10384, "u8", ".NETFramework,Version=v4.8" ], [ 10415, "u8", "FrameworkDisplayName" ], [ 10436, "u8", ".NET Framework 4.8A" ], [ 10457, "u8", "3System.Resources.Tools.StronglyTypedResourceBuilder" ], [ 10528, "u8", "KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t16.10.0.0" ], [ 10644, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 10801, "u8", "PADPADP" ], [ 10840, "u8", "B84ZH49G77G5H8P20HA8C8" ], [ 4298629, "u8", "vugvWgtwgp" ], [ 4298654, "u8", "xwwwwwwww" ], [ 4299221, "u8", "vGBVw" ], [ 4299251, "u8", "DFFWdwx" ], [ 4300232, "u8", "vugvWgt" ], [ 4300956, "u8", "gVwh" ], [ 4301016, "u8", "wwwvwww" ], [ 4301049, "u8", "wsswW" ], [ 4302329, "u8", "rBBBBBBBBBBBBBBBBBAh" ], [ 4302479, "u8", "xzdDL" ], [ 4306443, "u8", "gXuyua" ], [ 4306545, "u8", "b42GMKONLJX" ], [ 4306578, "u8", "+CYP=\u003c\u003c?A@)\u0026g" ], [ 4308198, "u8", "18CPLC00H1" ], [ 4308280, "u8", "FZXF" ], [ 4308286, "u8", "L@\u0026\u0026\u0026\u0026\u0026\u0026WFGEECEGGE" ], [ 4308320, "u8", "HLMMTMC@HSMMJH" ], [ 4308507, "u8", "IHDR" ], [ 4308533, "u8", "IDATx" ], [ 4314124, "u8", ".VWocwk" ], [ 4314179, "u8", "fg035" ], [ 4314392, "u8", "Gihn" ], [ 4314576, "u8", "N..beu" ], [ 4314907, "u8", "YLOM" ], [ 4315577, "u8", "677q" ], [ 4315918, "u8", "qlRm" ], [ 4316231, "u8", "AN2K6" ], [ 4317207, "u8", "ff091Q" ], [ 4317793, "u8", "CLONbfz" ], [ 4318323, "u8", "o}{iwo" ], [ 4318649, "u8", "6676" ], [ 4318914, "u8", "lMarr" ], [ 4319341, "u8", "iujo8B" ], [ 4320495, "u8", "Zafz" ], [ 4321465, "u8", "sPhh" ], [ 4322408, "u8", "2LOL I" ], [ 4323674, "u8", "qjPeZ" ], [ 4324450, "u8", "Vamh" ], [ 4324643, "u8", "AA 3" ], [ 4324941, "u8", "IDAT" ], [ 4325356, "u8", "UtUWueu-YKWnU" ], [ 4325906, "u8", "6VWV" ], [ 4326894, "u8", "UQppq" ], [ 4328172, "u8", "4ap1K" ], [ 4329066, "u8", "lv9e" ], [ 4329087, "u8", "JA7L" ], [ 4330564, "u8", "Iaem" ], [ 4330585, "u8", "M+C/ yqr!L" ], [ 4332619, "u8", "Ajuz" ], [ 4333710, "u8", "KK7W" ], [ 4334547, "u8", "0199" ], [ 4335890, "u8", "bfD9w" ], [ 4336827, "u8", "7055" ], [ 4336951, "u8", "TLOOcb" ], [ 4338271, "u8", "M0MU" ], [ 4339243, "u8", "bUae" ], [ 4339948, "u8", "lW9sPU" ], [ 4341067, "u8", "k03y" ], [ 4341631, "u8", "WW111" ], [ 4341953, "u8", "7FaT81r" ], [ 4342508, "u8", "biGHL" ], [ 4342895, "u8", "ULML" ], [ 4347323, "u8", "/XiE4" ], [ 4347535, "u8", "TG71" ], [ 4347957, "u8", "L191L" ], [ 4348473, "u8", "VZMZ" ], [ 4350086, "u8", "8QRe7" ], [ 4350117, "u8", "FP5I" ], [ 4350686, "u8", "4EJI" ], [ 4351255, "u8", "IbDBS" ], [ 4351956, "u8", "xB0::B" ], [ 4352172, "u8", "044DX2-" ], [ 4353289, "u8", "Ry jj" ], [ 4353947, "u8", "LOOQ" ], [ 4354384, "u8", "IEFc1d" ], [ 4354609, "u8", "mRfw" ], [ 4355437, "u8", "S7HM" ], [ 4356971, "u8", "IEND" ], [ 4357500, "u8", "gYMZhZN" ], [ 4368251, "u8", "CMIF" ], [ 4372166, "wide", "VS_VERSION_INFO" ] ], "v": { "file.stem": "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9", "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "pe.timestamp": 3439293862, "file.basename": "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe", "pe.image_base": 5368709120, "pe.image_size": 4390912, "pe.machine_id": 34404, "pe.os_version": "4.0", "pe.headers_size": 512, "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 10304, "pe.image_hash.sha1": "650a95c11f6d9482f2535d0216188de3be569b3e", "pe.image_hash.sha256": "532d4dc0f9fb7aeb7478aaf129edd57365d17ec66bbeab11ae57e2db4912188a", "pe.image_hash.sha384": "366c93c12c746bf9b719983518ce2116dbd31314481d60d0f61e56e68a85afad1bc13a2e30ffd1ad5a1fe7e23ec29234", "pe.image_hash.sha512": "2dd162ada1a89d9c50352cf9fc2cf0fae8408c7ea5e41f1225c508f8b3b13d3db976e462b06ce5c5d23a8a3e68525a365b328784faac9d33669a0cc1805f78ef", "pe.section_alignment": 8192, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 48, "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].serial": "33000003a54111e8f07fbe0b750000000003a5", "pe.debug.entries[0].type": "repro", "pe.signatures[0].subject": "CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "no_seh", "pe.dll_characteristics[4]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 4308992, "pe.data_directories[1].rva": 4374528, "pe.data_directories[2].rva": 18492, "pe.data_directories[3].rva": 8192, "pe.dll_characteristics_raw": 34144, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2024-10-16T19:51:56Z", "pe.data_directories[0].name": "resource", "pe.data_directories[0].size": 76394, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 10304, "pe.data_directories[2].name": "debug", "pe.data_directories[2].size": 28, "pe.data_directories[3].name": "clr_runtime_header", "pe.data_directories[3].size": 72, "pe.debug.entries[0].type_id": 16, "pe.signatures[0].not_before": "2023-10-19T19:51:56Z", "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].thumbprint_sha1": "05a822642cf64464460cb4684ff11c7f476873ca", "pe.signatures[0].cert_chain_depth": 2, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "2cf997552f8be5c1b3984b4d5242adf9ad9e7d9379f561539bad6f07b9ebb006", "pe.signatures[0].thumbprint_sha256": "36305d4ddfd4756d17fcdfb742fd2031a3d5133bce34bd8e3080bc803ae44d0b", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 4297216, 1.11, "r-x" ], [ ".rsrc", 4297728, 76800, 7.1, "r--" ] ] }, "id": 0, "sz": 4384832, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x1024" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x1024" ] }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/unknown::microsoft-corporation", "l": 2 }, { "c": 1.0, "d": "Signed by Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/leaf::microsoft-corporation", "l": 3 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x224e" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x20ed" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.6000000238418579, "d": "AppDomain.CurrentDomain accessor", "e": [ "get_CurrentDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "l": 1, "el": [ "0x2096" ] }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x2841" ] }, { "c": 0.800000011920929, "d": "Very low code entropy, minimal code", "e": [ "binary.code_entropy = 1.11" ], "i": "metadata/binary/resource::low-code-entropy", "l": 2 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 76800, entropy: 7.10)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0x41be1b" ] }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "0x42bd04" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1, "el": [ "0x208c" ] }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "get_ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x21a2" ] }, { "c": 1.0, "d": "Malware infrastructure naming suffix", "e": [ "Dox2_C2" ], "i": "micro-behaviors/data/text/malware/terms::malware-infrastructure-suffix", "l": 2, "el": [ "0x1fad" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "Delegate BeginInvoke token", "e": [ "BeginInvoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::begininvoke-token", "l": 1, "el": [ "0x1c4a" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1050.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934", "mscorlib", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x269b", "0x1bac", "0x2994" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x42b6c6" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1050.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x42b75e" ] }, { "c": 0.8500000238418579, "d": ".NET unmanaged function pointer delegate", "e": [ "GetDelegateForFunctionPointer" ], "i": "objectives/evasion/process/injection/toolkit::dotnet-function-pointer-delegate", "l": 1, "el": [ "0x21e2" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.8" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0x2890" ] }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x42c716" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x23ba" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x42b7da" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.6000000238418579, "d": "GetMethod call reference", "e": [ "GetMethod" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-method-call", "l": 1, "el": [ "0x1c1f" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x42b86e" ] }, { "c": 0.6000000238418579, "d": "MethodBase class reference", "e": [ "MethodBase" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-methodbase-token", "l": 1, "el": [ "0x1d12" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x1fad" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x278d" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "0x223b" ] }, { "c": 0.8199999928474426, "d": "Encoded Microsoft OCSP URL", "e": [ "Nhttp://www.microsoft.com/pkiops/crl/Microsoft Time-Stamp PCA 2010(1).crl0l", "Phttp://www.microsoft.com/pkiops/certs/Microsoft Time-Stamp PCA 2010(1).crt0" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-ms-ocsp-url", "l": 1, "el": [ "0x42d657", "0x42d6c3" ] }, { "c": 0.699999988079071, "d": "Delegate EndInvoke token", "e": [ "EndInvoke" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::endinvoke-token", "l": 1, "el": [ "0x1c40" ] }, { "c": 0.7799999713897705, "d": "Assembly accessor token (get_Assembly)", "e": [ "get_Assembly" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token", "l": 1, "el": [ "0x2402" ] }, { "c": 0.949999988079071, "d": "Microsoft timestamp certificate chain", "e": [ "Microsoft Time-Stamp Service", "Microsoft Time-Stamp PCA 2010" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "l": 2, "el": [ "0x42d212", "0x42d2c4" ] }, { "c": 1.0, "d": "Issued by a Microsoft Code Signing PCA", "e": [ "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US" ], "i": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca", "l": 2, "el": [ "value:pe.signatures[0].issuer" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Microsoft code-signing certificate chain", "e": [ "Microsoft Code Signing PCA 2011" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "l": 2, "el": [ "0x42c127" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x1103" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.Security" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x2310" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "value", "ValueType" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x1fa7", "0x1ce0" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "get_BaseAddress" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-1", "l": 1, "el": [ "0x236a" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x2994" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x42b89a" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "Substring", "GetString", "PtrToStringAnsi", "StringComparison", "ToString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x42b722", "0x2007", "0x1ffd", "0x2025", "0x215a", "0x1ff4" ] }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x1bd0" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.02" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1, "el": [ "0x42b9d9" ] }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "c": 0.8999999761581421, "d": "WCF generated code attribute", "e": [ "GeneratedCodeAttribute" ], "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute", "l": 1, "el": [ "0x1da4" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.800000011920929, "d": "CodeDom compiler access", "e": [ "System.CodeDom.Compiler" ], "i": "metadata/lang/compiler/managed::codedom-compiler", "l": 2, "el": [ "0x21b6" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x269b" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x42b782" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1050.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 4297216, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x1fad" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyConfigurationAttribute", "UnmanagedFunctionPointerAttribute", "ApplicationSettingsBase", "AssemblyFileVersionAttribute", "CompilerGeneratedAttribute", "DebuggableAttribute", "SecurityPermissionAttribute", "AssemblyTitleAttribute", "EditorBrowsableAttribute", "ComVisibleAttribute", "AssemblyDescriptionAttribute", "UnverifiableCodeAttribute", "DebuggerNonUserCodeAttribute", "AssemblyTrademarkAttribute", "TargetFrameworkAttribute", "GeneratedCodeAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x1eb7", "0x1ef3", "0x1d34", "0x1e7e", "0x1d7b", "0x1df2", "0x1e9b", "0x1e33", "0x1e06", "0x1e1f", "0x1ed6", "0x1dbb", "0x1dd5", "0x1e4a", "0x1e65", "0x1da4" ] }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1, "el": [ "0x42b9d9" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "PNG and manifest in resources", "e": [ "IHDR", "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::png-and-manifest-rsrc", "l": 2, "el": [ "0x41be1b", "0x42bd04" ] }, { "c": 1.0, "d": "Microsoft certificate chain markers", "e": [ "Microsoft Code Signing PCA 2011", "Microsoft Corporation", "Microsoft Corporation", "Microsoft Time-Stamp PCA 2010", "Microsoft Time-Stamp Service" ], "i": "metadata/signed/platform::microsoft-certificate-chain", "l": 1, "el": [ "0x42c127", "", "0x42b9d9", "0x42d2c4", "0x42d212" ] } ], "sha": "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9", "path": "af93dec8d543cfcb877a0d511e995e6988519f21174c63f2bfd623495f34cbc9.exe", "type": "pe" } ], "tv": "52045" } }