{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999294281005859, "class": 2 } ], "prob": 0.9999294, "class": 2, "models": [ { "m": "az", "prob": 0.99887997, "class": 0 }, { "m": "az/native", "prob": 0.99967754, "class": 0 }, { "m": "az/pe", "prob": 0.9999294, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T08:16:32Z" }, "path": "49685", "raw": { "v": "4", "fs": [ { "f": "KO₆(As₉AlC₄CoDyEr₂)H₆(Cm₂DbFPo₃DsOs)Md₂(Bi₅Si)", "k": { "pe.timestamp": 1358101568, "hashes.imphash": "5b0a252cc68949b496d046e418a62db3", "build.target_arch": "x86", "pe.linker_version": "7.0", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.rich_header.xor_key": "0x4aa4eee8", "hashes.rich_header_hash": "47275e072eab702c175efeffad2f11b1739f05bfe575475a58b75be9cd4b0289", "pe.inflated_sections[0]": ".tdata", "binary.top_complex_unnamed[0].cc": 119, "binary.top_complex_unnamed[1].cc": 47, "binary.top_complex_unnamed[2].cc": 47, "binary.top_complex_unnamed[3].cc": 37, "binary.top_complex_unnamed[4].cc": 34, "binary.top_complex_unnamed[5].cc": 28, "binary.top_complex_unnamed[6].cc": 28, "binary.top_complex_unnamed[7].cc": 19, "binary.top_complex_unnamed[0].bbs": 199, "binary.top_complex_unnamed[1].bbs": 33, "binary.top_complex_unnamed[2].bbs": 33, "binary.top_complex_unnamed[3].bbs": 63, "binary.top_complex_unnamed[4].bbs": 60, "binary.top_complex_unnamed[5].bbs": 50, "binary.top_complex_unnamed[6].bbs": 54, "binary.top_complex_unnamed[7].bbs": 36, "binary.top_complex_unnamed[0].addr": "0x401b22", "binary.top_complex_unnamed[0].size": 1909, "binary.top_complex_unnamed[1].addr": "0x404330", "binary.top_complex_unnamed[1].size": 829, "binary.top_complex_unnamed[2].addr": "0x406920", "binary.top_complex_unnamed[2].size": 829, "binary.top_complex_unnamed[3].addr": "0x4050f6", "binary.top_complex_unnamed[3].size": 764, "binary.top_complex_unnamed[4].addr": "0x402902", "binary.top_complex_unnamed[4].size": 364, "binary.top_complex_unnamed[5].addr": "0x404942", "binary.top_complex_unnamed[5].size": 792, "binary.top_complex_unnamed[6].addr": "0x404e17", "binary.top_complex_unnamed[6].size": 735, "binary.top_complex_unnamed[7].addr": "0x40266e", "binary.top_complex_unnamed[7].size": 356, "pe.rich_header.entries[0].use_count": 20, "pe.rich_header.entries[1].use_count": 86, "pe.rich_header.entries[2].use_count": 9, "pe.rich_header.entries[3].use_count": 82, "pe.rich_header.entries[4].use_count": 3, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 64, "pe.rich_header.entries[1].product_id": 28, "pe.rich_header.entries[2].product_id": 25, "pe.rich_header.entries[3].product_id": 1, "pe.rich_header.entries[4].product_id": 29, "pe.rich_header.entries[5].product_id": 69, "pe.rich_header.entries[6].product_id": 61, "pe.rich_header.entries[0].build_number": 9466, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 9466, "pe.rich_header.entries[1].product_name": "C_VS2005", "pe.rich_header.entries[2].build_number": 9210, "pe.rich_header.entries[2].product_name": "C_VS2005_BTA", "pe.rich_header.entries[3].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[4].build_number": 9466, "pe.rich_header.entries[4].product_name": "Cpp_VS2005", "pe.rich_header.entries[5].build_number": 9466, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].build_number": 9466, "pe.rich_header.entries[6].product_name": "unknown" }, "x": 82, "id": 0, "is": [ "VirtualAlloc", "CloseHandle", "LoadLibraryA", "GetTickCount", "InterlockedExchange", "GetLastError", "VirtualFree", "GetProcAddress", "VirtualQuery", "GetSystemInfo", "VirtualProtect", "SetStdHandle", "GetModuleHandleA", "GetStartupInfoA", "GetCommandLineA", "GetVersionExA", "EnterCriticalSection", "LeaveCriticalSection", "ExitProcess", "TerminateProcess", "GetCurrentProcess", "WriteFile", "GetStdHandle", "GetModuleFileNameA", "UnhandledExceptionFilter", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStringsW", "SetHandleCount", "GetFileType", "DeleteCriticalSection", "TlsFree", "SetLastError", "GetCurrentThreadId", "TlsSetValue", "TlsGetValue", "TlsAlloc", "HeapDestroy", "HeapCreate", "HeapFree", "HeapAlloc", "GetACP", "GetOEMCP", "GetCPInfo", "InitializeCriticalSection", "HeapReAlloc", "FlushFileBuffers", "SetFilePointer", "QueryPerformanceCounter", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "RtlUnwind", "HeapSize", "LCMapStringA", "MultiByteToWideChar", "LCMapStringW", "GetStringTypeA", "GetStringTypeW", "GetLocaleInfoA", "SetActiveWindow", "FindWindowA", "SendMessageA", "PeekMessageA", "ShowWindow", "ORDINAL 19", "midiDisconnect" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 16384.0, "subsystem": 2.0, "timestamp": 1358101568.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 6.19, "entry_section": ".text", "size_of_image": 1040384.0, "timestamp_day": 13.0, "file_alignment": 4096.0, "resource_count": 2.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON" ], "timestamp_year": 2013.0, "characteristics": 271.0, "entry_point_rva": 5807.0, "size_of_headers": 4096.0, "timestamp_month": 1.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 4.0, "computed_checksum": 564209.0, "section_alignment": 4096.0, "unusual_alignment": true, "number_of_sections": 5.0, "resource_timestamp": 0.0, "rich_header_present": true, "linker_major_version": 7.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false, "max_section_inflation_ratio": 7.75 }, "file": { "size": 561152.0 }, "binary": { "code_size": 28672.0, "func_count": 52.0, "entry_point": 5807.0, "code_entropy": 6.21, "data_entropy": 3.51, "func_density": 1.86, "import_count": 68.0, "string_count": 318.0, "avg_func_size": 260.54, "section_count": 5.0, "avg_complexity": 11.81, "import_density": 2.43, "max_complexity": 119.0, "string_density": 11.36, "overall_entropy": 4.58, "avg_basic_blocks": 18.58, "avg_section_size": 111411.2, "dependency_count": 4.0, "entropy_variance": 2.76, "avg_string_length": 13.78, "complexity_per_kb": 0.42, "max_string_length": 175.0, "wide_string_count": 2.0, "writable_sections": 2.0, "avg_string_entropy": 2.75, "code_to_data_ratio": 0.05, "data_to_file_ratio": 0.01, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.03, "text_to_file_ratio": 0.05, "total_basic_blocks": 966.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "high_entropy_strings": 1.0, "string_length_stddev": 19.23, "high_complexity_funcs": 1.0, "largest_section_ratio": 0.78, "sentence_string_count": 39.0, "sentence_string_ratio": 0.12, "behavioral_import_ratio": 0.06, "unnamed_complex_func_count": 1.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 480, ".text" ], [ 559, "@.data" ], [ 600, ".tdata" ], [ 640, ".rsrc" ], [ 7559, "HHtZHHtV" ], [ 8491, "RPWS" ], [ 9841, "QSVW" ], [ 10865, "QQSVW3" ], [ 11031, "SUVW" ], [ 14598, "SVWU" ], [ 16040, "5DAG" ], [ 17032, "EPAG" ], [ 24088, "FVWS" ], [ 28810, "6PWS" ], [ 28954, "WWWWVSW" ], [ 34266, ".suog" ], [ 35455, "JRSA" ], [ 38586, "Ziqf" ], [ 38766, "Ilhk" ], [ 40600, "Zhfj" ], [ 41307, "VL1I" ], [ 47710, "PCQ4" ], [ 50300, "%8m\u003c\u003c;v?" ], [ 52677, "/TRz" ], [ 54241, "TZMZ" ], [ 58902, "OTSP" ], [ 59438, "MC0A" ], [ 60027, "JHDB" ], [ 60479, "Q.bu" ], [ 61132, "GY4W" ], [ 61718, "og12" ], [ 62127, "Jrclr" ], [ 65151, "/mPC" ], [ 65678, "F4IM" ], [ 66366, "X62OK" ], [ 66697, "V2AR" ], [ 68193, "Y3RQ" ], [ 70895, "WwO.PKU" ], [ 71022, "W 91" ], [ 72721, "puo1" ], [ 75943, "E2P8" ], [ 82621, "DVH_" ], [ 86406, "w@\"SQL=\\OOP" ], [ 88395, "FHUA" ], [ 91415, "EP5J" ], [ 92180, "HDH0" ], [ 93663, "W4KS" ], [ 95549, "O57A" ], [ 96077, "ZL4R" ], [ 96442, "RINT" ], [ 100901, "kZx/TuK" ], [ 102527, "HI0V" ], [ 103824, "yo5y" ], [ 108690, "AVHU" ], [ 111672, "XFX1" ], [ 115870, "NZG7" ], [ 117316, "ZM80" ], [ 117437, "/z9UQ" ], [ 123095, "h3k5" ], [ 125550, "Ulca" ], [ 126898, "wo5d" ], [ 131609, "/RX7D" ], [ 132417, "/tT8" ], [ 134643, "Jswy" ], [ 135038, "ar./y2" ], [ 139279, "PE1BG" ], [ 146361, "Zitr" ], [ 148638, "2QVRK" ], [ 150284, "q1ey" ], [ 153591, "8NXT" ], [ 153930, "LF0H5" ], [ 155396, "G 4V" ], [ 162666, "/CW2" ], [ 174631, "4YWJ9V" ], [ 175802, "Txnb" ], [ 177784, "/vYM" ], [ 178469, "Vzjn" ], [ 185079, "vz68" ], [ 190497, "P.kt" ], [ 191965, ".alz" ], [ 192614, "B8D_" ], [ 194580, "OAMX" ], [ 197146, "Pueh" ], [ 197318, "/N 9" ], [ 208287, "CLED" ], [ 209772, "QUIX" ], [ 210825, "SSSX" ], [ 214682, "Rxtw" ], [ 218740, "8ate" ], [ 222150, "e09fa6" ], [ 224948, "PBYR" ], [ 226857, "05QY" ], [ 228601, "6FNA" ], [ 231302, "Evxc" ], [ 231864, "8DPL" ], [ 234422, "39JC" ], [ 239400, "8wra" ], [ 242876, "mw76e" ], [ 244511, "U_9U" ], [ 244702, "y5t4" ], [ 245559, "BVWY" ], [ 247560, "d8h3" ], [ 247925, "N67P" ], [ 249008, "8vva" ], [ 249264, "0247" ], [ 258613, "UVB5" ], [ 260897, "8x7e" ], [ 264630, "3VPR" ], [ 265470, "`0(`" ], [ 265959, "DGQE" ], [ 279570, "25lg" ], [ 285432, "Xmxk" ], [ 285777, "Gs2\u003e" ], [ 288692, "3a8of" ], [ 289346, "B12\u003eI{" ], [ 295916, "y6 g8" ], [ 296262, "ZKOM" ], [ 297849, "/5Ar" ], [ 301548, "/IpY" ], [ 302871, "@.[gExk" ], [ 311935, "n12m" ], [ 312930, "IYAM" ], [ 317531, "]}2\u003eNc" ], [ 321882, "ZBAW" ], [ 328276, "G8GO" ], [ 335586, "ZNSO" ], [ 337125, "si80" ], [ 337350, "AK7I" ], [ 339755, "943G" ], [ 340714, "Bubf" ], [ 342769, "2S Z" ], [ 348058, "GCmof d" ], [ 352903, "4aiy" ], [ 354380, "Nh.m" ], [ 356117, "9VWH" ], [ 356287, "/gXH" ], [ 356755, "Mfoq" ], [ 357652, "YJGS" ], [ 357660, "KOVOK_" ], [ 360418, "GK4X" ], [ 363389, "2\u003eDF" ], [ 365290, "e6lzm" ], [ 370583, "R_PM" ], [ 454553, "zrpuljy'jwdDlgz\u003cgA3" ], [ 454577, "}etvSiwmpweG-%;\u003e" ], [ 454626, "at/jmhlv{fp" ], [ 454713, "euu3" ], [ 454742, "}]{Xdnkkmxnyiky}" ], [ 454817, "|sugaTwc}qcorY" ], [ 454842, "edwomysE" ], [ 454888, "R{eqgkhjh{Ij}paozjN" ], [ 454912, "67 =cpwjgitpSoY{" ], [ 454961, "EWjpas|m5Kfwxc{;4" ], [ 455007, "Zy|stqoEw]oqkonh" ], [ 455033, "yljeHi~Nvs\\xH" ], [ 455065, "sieq" ], [ 455082, "sfo_p~Ckme~th" ], [ 455101, "34'E{eqgkhjh{Ij}paozjN" ], [ 455125, "34'E{eqgkhjhj" ], [ 455729, "xlBnish" ], [ 455754, "CPO@XQ-96[vw" ], [ 455774, "uR{citv\\VjjsiZoTW||" ], [ 455962, "WU7FF" ], [ 455976, "Llkkky[ys" ], [ 455990, "W:c[LH5/2ifs" ], [ 456044, "IbxYirmeSyZ|" ], [ 456188, "YfrMn{xJoyX_sb" ], [ 463129, "700WP" ], [ 463145, "`h````" ], [ 463180, "wide", "(null)" ], [ 463196, "(null)" ], [ 463204, "CorExitProcess" ], [ 463220, "mscoree.dll" ], [ 463232, "runtime error" ], [ 463252, "TLOSS error" ], [ 463268, "SING error" ], [ 463284, "DOMAIN error" ], [ 463300, "R6028\r\n- unable to initialize heap" ], [ 463307, "- unable to initialize heap" ], [ 463340, "R6027\r\n- not enough space for lowio initialization" ], [ 463347, "- not enough space for lowio initialization" ], [ 463396, "R6026\r\n- not enough space for stdio initialization" ], [ 463403, "- not enough space for stdio initialization" ], [ 463452, "R6025\r\n- pure virtual function call" ], [ 463459, "- pure virtual function call" ], [ 463492, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 463499, "- not enough space for _onexit/atexit table" ], [ 463548, "R6019\r\n- unable to open console device" ], [ 463555, "- unable to open console device" ], [ 463592, "R6018\r\n- unexpected heap error" ], [ 463599, "- unexpected heap error" ], [ 463628, "R6017\r\n- unexpected multithread lock error" ], [ 463635, "- unexpected multithread lock error" ], [ 463676, "R6016\r\n- not enough space for thread data" ], [ 463683, "- not enough space for thread data" ], [ 463720, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 463722, "This application has requested the Runtime to terminate it in an unusual way." ], [ 463800, "Please contact the application's support team for more information." ], [ 463872, "R6009\r\n- not enough space for environment" ], [ 463879, "- not enough space for environment" ], [ 463916, "R6008\r\n- not enough space for arguments" ], [ 463923, "- not enough space for arguments" ], [ 463960, "R6002\r\n- floating point not loaded" ], [ 463967, "- floating point not loaded" ], [ 464000, "Microsoft Visual C++ Runtime Library" ], [ 464044, "Runtime Error!\n\nProgram:" ], [ 464076, "\u003cprogram name unknown\u003e" ], [ 464746, "wide", "h(((( H" ], [ 465292, "GetProcessWindowStation" ], [ 465316, "GetUserObjectInformationA" ], [ 465344, "GetLastActivePopup" ], [ 465364, "GetActiveWindow" ], [ 465380, "MessageBoxA" ], [ 465392, "user32.dll" ], [ 465420, "InitializeCriticalSectionAndSpinCount" ], [ 465460, "kernel32.dll" ], [ 465783, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 465968, "A buffer overrun has been detected which has corrupted the program's\ninternal state. The program cannot safely continue executi" ], [ 466037, "internal state. The program cannot safely continue execution and must" ], [ 466108, "now be terminated." ], [ 466128, "Buffer overrun detected!" ], [ 466160, "A security error of unknown cause has been detected which has\ncorrupted the program's internal state. The program cannot safely" ], [ 466222, "corrupted the program's internal state. The program cannot safely" ], [ 466289, "continue execution and must now be terminated." ], [ 466340, "Unknown security failure detected!" ], [ 466488, "dddd, MMMM dd, yyyy" ], [ 466508, "MM/dd/yy" ], [ 466528, "December" ], [ 466540, "November" ], [ 466552, "October" ], [ 466560, "September" ], [ 466572, "August" ], [ 466580, "July" ], [ 466588, "June" ], [ 466596, "April" ], [ 466604, "March" ], [ 466612, "February" ], [ 466624, "January" ], [ 466680, "Saturday" ], [ 466692, "Friday" ], [ 466700, "Thursday" ], [ 466712, "Wednesday" ], [ 466724, "Tuesday" ], [ 466732, "Monday" ], [ 466740, "Sunday" ], [ 466804, "SunMonTueWedThuFriSat" ], [ 466828, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 467274, "VirtualAlloc" ], [ 467290, "CloseHandle" ], [ 467304, "LoadLibraryA" ], [ 467320, "GetTickCount" ], [ 467336, "InterlockedExchange" ], [ 467358, "GetLastError" ], [ 467374, "VirtualFree" ], [ 467388, "GetProcAddress" ] ], "sz": 561152, "ts": [ { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.58" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8600000143051147, "d": "High entropy rdata section", "e": [ ".rdata (entropy: 7.91)" ], "i": "metadata/binary/section/metrics::high-entropy-rdata-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1358101568.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "GetEnvironmentStrings", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage/control::send-message-a", "l": 2 }, { "c": 0.75, "d": "Find window by class/title (ANSI)", "e": [ "FindWindowA" ], "i": "micro-behaviors/ui/window/manage/control::find-window-a-import", "l": 2 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.800000011920929, "d": "High entropy .rdata section (likely encrypted)", "e": [ ".rdata (entropy: 7.91)" ], "i": "metadata/binary/section/names::high-entropy-rdata", "l": 3 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.800000011920929, "d": "rdata over five times text size", "e": [ ".rdata", ".rdata = 1528.6% of .text (438272 / 28672 bytes)" ], "i": "metadata/binary/section/metrics::rdata-ratio-over-5x", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LCMapStringW", "FreeEnvironmentStringsW", "GetStringTypeW", "GetEnvironmentStringsW", "FreeEnvironmentStringsA", "GetStringTypeA", "GetEnvironmentStrings", "LCMapStringA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.75" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 3 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 52.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "49685" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8199999928474426, "d": "rdata over 2.5 times text size", "e": [ ".rdata", ".rdata = 1528.6% of .text (438272 / 28672 bytes)" ], "i": "metadata/binary/section/metrics::rdata-ratio-over-2pt5x", "l": 1 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "49685" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 52.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 318.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 19 (send)", "e": [ "ORDINAL 19" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-19", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 966.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.8399999737739563, "d": "Large binary with few imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 4096)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 4.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 1.0, "d": "PE has exactly two resource entries", "e": [ "pe.resource_count = 2.00" ], "i": "metadata/binary/resource::pe-resource-count-two", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1620", "c": 0.8500000238418579, "d": "mscoree.dll text reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-dll-text-ref", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 68.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 52.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.58" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 11.81" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.75, "d": "High entropy encrypted data", "e": [ ".rdata (entropy: 7.91)" ], "i": "micro-behaviors/data/encode/payload::payload-blob-metrics", "l": 3 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 68.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".rdata+.data+.tdata = 1785.7% of text (512000 / 28672 bytes)", ".tdata", ".data", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted rdata section (PE crypter)", "e": [ ".rdata (entropy: 7.91)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-rdata-section", "l": 4, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "binary.import_count = 68.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 3 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 68.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "c": 0.8999999761581421, "d": "Inline MZ and PE validation", "e": [ "39" ], "i": "micro-behaviors/fs/file/pe-inspect::inline-pe-signature-check", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "98 80 40 00", "b4 80 40 00", "14 80 40 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted data section (very high)", "e": [ ".rdata (entropy: 7.91)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-data-section", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::module-stomping-target", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "PE code-to-data ratio below 0.08", "e": [ "binary.code_to_data_ratio = 0.05" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::code-data-ratio-below-008", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "binary.import_count = 68.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low behavioral-import ratio", "e": [ "binary.behavioral_import_ratio = 0.06" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-behavioral-import-ratio", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": ".rdata significantly larger than .text", "e": [ ".rdata", ".rdata = 1528.6% of .text (438272 / 28672 bytes)" ], "i": "metadata/binary/section/metrics::oversized-rdata-ratio", "l": 4 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::unusual-alignment-pe", "l": 4 }, { "c": 0.6000000238418579, "d": "High entropy in data section", "e": [ ".rdata (entropy: 7.91)" ], "i": "metadata/binary/metrics/structural::high-entropy-data", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Oversized rdata section vs code", "e": [ ".rdata = 1528.6% of .text (438272 / 28672 bytes)", ".rdata" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-rdata-section", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitializeCriticalSectionAndSpinCount", "GetProcessWindowStation", "GetUserObjectInformationA", "UnhandledExceptionFilter", "JanFebMarAprMayJunJulAugSepOctNovDec", "GetModuleFileNameA", "MultiByteToWideChar", "InitializeCriticalSection", "WideCharToMultiByte", "GetSystemTimeAsFileTime", "GetCurrentProcessId", "SunMonTueWedThuFriSat" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".data", ".tdata", ".rdata", ".rdata+.data+.tdata = 1785.7% of text (512000 / 28672 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".tdata", ".rdata+.data+.tdata = 1785.7% of text (512000 / 28672 bytes)", ".rdata", ".data" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".rdata (entropy: 7.91)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-payload-section-cond-0--inline-29177", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (VirtualAlloc, CloseHandle, LoadLibraryA, GetTickCount, InterlockedExchange, ... +56 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (SetActiveWindow, FindWindowA, SendMessageA, PeekMessageA, ShowWindow)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (ORDINAL 19)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINMM.dll (midiDisconnect)", "e": [ "WINMM.dll" ], "i": "metadata/dylib::winmm/dll", "l": 2 }, { "c": 0.8600000143051147, "d": "Winsock send import", "e": [ "ORDINAL 19", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::send-api-ordinal", "l": 3 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "GetTickCount", "QueryPerformanceCounter" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1620", "c": 0.9300000071525574, "d": "Native PE loads .NET payload via CLR", "e": [ "LoadLibraryA", "CorExitProcess", "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::native-pe-loads-dotnet-payload", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "binary.has_signature = 0.00", "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::unsigned-module-stomping-target", "l": 1 } ], "sha": "b03ab382cbda20b3419f4d83b6b142fc8fe59a795d2755c8b5203457e37fe231", "path": "49685", "type": "pe" } ], "tv": "84923" } }