{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 1.0, "class": 2 } ], "prob": 1.0, "class": 2, "models": [ { "m": "az", "prob": 1.0, "class": 2 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:10:57Z" }, "path": "498879", "raw": { "v": "4", "fs": [ { "f": "O₃(CAlAs)H₂(HfU)Md₂(BiSi)", "k": { "hash.imp": "3c628207fd7e99d41d31c363bb85fde6", "pe.checksum": "0x0004c3d2", "pe.timestamp": 1522998228, "hash.authenti": "1861c833eb92b1d5a92dcf655ebaa7fe60ad4357b6e745adaee2f6f459629fd5", "hash.rich_header": "21e45814067187d28ebc5707519b51e796eefd39d7a2aebc145d9aeb9f0e4375", "build.target_arch": "x86", "pe.linker_version": "9.0", "pe.resource_types[0]": "RT_BITMAP", "pe.resource_types[1]": "RT_ICON", "pe.resource_types[2]": "RT_STRING", "pe.resource_types[3]": "RT_GROUP_ICON", "pe.resource_types[4]": "RT_VERSION", "pe.rich_header.xor_key": "0x837c9e0f", "pe.inflated_sections[0]": ".data", "pe.data_directories[0].rva": 59684, "pe.data_directories[1].rva": 5242880, "pe.data_directories[2].rva": 5382144, "pe.data_directories[3].rva": 58400, "pe.data_directories[4].rva": 53248, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 80, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 139184, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 2312, "pe.data_directories[3].name": "load_config", "pe.data_directories[3].size": 64, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 404, "pe.version_info.file_version": "1.0.5.2", "pe.version_info.internal_name": "zogge.exe", "pe.rich_header_compids[0].count": 30, "pe.rich_header_compids[1].count": 17, "pe.rich_header_compids[2].count": 105, "pe.rich_header_compids[3].count": 7, "pe.rich_header_compids[4].count": 116, "pe.rich_header_compids[5].count": 1, "pe.rich_header_compids[6].count": 1, "pe.rich_header_compids[7].count": 1, "pe.version_info.product_version": "1.0.0.1", "binary.top_complex_unnamed[0].cc": 92, "binary.top_complex_unnamed[1].cc": 79, "binary.top_complex_unnamed[2].cc": 65, "binary.top_complex_unnamed[3].cc": 50, "binary.top_complex_unnamed[4].cc": 50, "binary.top_complex_unnamed[5].cc": 48, "binary.top_complex_unnamed[6].cc": 44, "binary.top_complex_unnamed[7].cc": 42, "pe.rich_header_compids[0].compid": 8671774, "pe.rich_header_compids[1].compid": 9785886, "pe.rich_header_compids[2].compid": 8606238, "pe.rich_header_compids[3].compid": 8111655, "pe.rich_header_compids[4].compid": 65536, "pe.rich_header_compids[5].compid": 3995231738, "pe.rich_header_compids[6].compid": 9720350, "pe.rich_header_compids[7].compid": 3660412117, "binary.top_complex_unnamed[0].bbs": 141, "binary.top_complex_unnamed[1].bbs": 137, "binary.top_complex_unnamed[2].bbs": 104, "binary.top_complex_unnamed[3].bbs": 37, "binary.top_complex_unnamed[4].bbs": 37, "binary.top_complex_unnamed[5].bbs": 85, "binary.top_complex_unnamed[6].bbs": 75, "binary.top_complex_unnamed[7].bbs": 74, "pe.rich_header_compids[4].product": "Unknown", "binary.top_complex_unnamed[0].addr": "0x40637c", "binary.top_complex_unnamed[0].size": 1823, "binary.top_complex_unnamed[1].addr": "0x405c6c", "binary.top_complex_unnamed[1].size": 1474, "binary.top_complex_unnamed[2].addr": "0x403859", "binary.top_complex_unnamed[2].size": 1843, "binary.top_complex_unnamed[3].addr": "0x403390", "binary.top_complex_unnamed[3].size": 869, "binary.top_complex_unnamed[4].addr": "0x405700", "binary.top_complex_unnamed[4].size": 869, "binary.top_complex_unnamed[5].addr": "0x409c68", "binary.top_complex_unnamed[5].size": 933, "binary.top_complex_unnamed[6].addr": "0x40aa5f", "binary.top_complex_unnamed[6].size": 559, "binary.top_complex_unnamed[7].addr": "0x402daf", "binary.top_complex_unnamed[7].size": 713, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.section_characteristics[3].name": ".rsrc", "pe.section_characteristics[4].name": ".reloc", "pe.rich_header.entries[0].use_count": 30, "pe.rich_header.entries[1].use_count": 17, "pe.rich_header.entries[2].use_count": 105, "pe.rich_header.entries[3].use_count": 7, "pe.rich_header.entries[4].use_count": 116, "pe.rich_header.entries[5].use_count": 1, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[0].product_id": 132, "pe.rich_header.entries[1].product_id": 149, "pe.rich_header.entries[2].product_id": 131, "pe.rich_header.entries[3].product_id": 123, "pe.rich_header.entries[4].product_id": 1, "pe.rich_header.entries[5].product_id": 60962, "pe.rich_header.entries[6].product_id": 148, "pe.rich_header.entries[7].product_id": 55853, "pe.rich_header.entries[0].build_number": 21022, "pe.rich_header.entries[0].product_name": "Cpp_VS2008_LTCG", "pe.rich_header.entries[1].build_number": 21022, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 21022, "pe.rich_header.entries[2].product_name": "C_VS2008_LTCG", "pe.rich_header.entries[3].build_number": 50727, "pe.rich_header.entries[3].product_name": "unknown", "pe.rich_header.entries[4].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[5].build_number": 26106, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].build_number": 21022, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 29909, "pe.rich_header.entries[7].product_name": "unknown", "pe.section_characteristics[0].raw_size": 48128, "pe.section_characteristics[1].raw_size": 9216, "pe.section_characteristics[2].raw_size": 46080, "pe.section_characteristics[3].raw_size": 139264, "pe.section_characteristics[4].raw_size": 16896, "pe.section_characteristics[0].virtual_size": 47680, "pe.section_characteristics[1].virtual_size": 8782, "pe.section_characteristics[2].virtual_size": 5176808, "pe.section_characteristics[3].virtual_size": 139184, "pe.section_characteristics[4].virtual_size": 16636, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 53248, "pe.section_characteristics[2].virtual_address": 65536, "pe.section_characteristics[3].virtual_address": 5242880, "pe.section_characteristics[4].virtual_address": 5382144, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "c0000040", "pe.section_characteristics[3].characteristics_hex": "40000040", "pe.section_characteristics[4].characteristics_hex": "42000040" }, "x": 189, "id": 0, "is": [ "FindCloseChangeNotification", "GetTickCount", "EnumTimeFormatsW", "GetThreadSelectorEntry", "TerminateProcess", "GetLastError", "GetCurrentDirectoryW", "SetLastError", "GetProcAddress", "LoadLibraryA", "LocalAlloc", "GetExitCodeThread", "AddAtomW", "FindFirstChangeNotificationA", "FatalExit", "FreeEnvironmentStringsW", "SetMailslotInfo", "GetSystemTime", "GetStringTypeW", "GetStringTypeA", "LCMapStringW", "LCMapStringA", "GetLocaleInfoA", "HeapSize", "GetCPInfo", "FindAtomW", "WriteConsoleOutputCharacterW", "HeapFree", "GetCommandLineA", "GetStartupInfoA", "HeapCreate", "VirtualFree", "DeleteCriticalSection", "LeaveCriticalSection", "EnterCriticalSection", "HeapAlloc", "VirtualAlloc", "HeapReAlloc", "SetHandleCount", "GetStdHandle", "GetFileType", "GetCurrentProcess", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "IsDebuggerPresent", "RtlUnwind", "WriteFile", "WideCharToMultiByte", "GetConsoleCP", "GetConsoleMode", "CloseHandle", "GetModuleHandleW", "Sleep", "ExitProcess", "GetModuleFileNameA", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "GetEnvironmentStringsW", "TlsGetValue", "TlsAlloc", "TlsSetValue", "TlsFree", "InterlockedIncrement", "GetCurrentThreadId", "InterlockedDecrement", "QueryPerformanceCounter", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "InitializeCriticalSectionAndSpinCount", "MultiByteToWideChar", "ReadFile", "CreateFileA", "SetFilePointer", "WriteConsoleA", "GetConsoleOutputCP", "WriteConsoleW", "SetStdHandle", "FlushFileBuffers", "GetACP", "GetOEMCP", "IsValidCodePage", "SetEndOfFile", "GetProcessHeap", "SetParent", "GetMonitorInfoA", "GetUpdateRect", "LookupIconIdFromDirectoryEx", "PeekMessageA", "ScrollWindow", "LoadStringW", "SetThreadDesktop", "LoadImageA", "UpdateWindow", "GetDlgCtrlID", "LookupIconIdFromDirectory", "LoadCursorFromFileA", "CreateCompatibleBitmap", "CreateCompatibleDC" ], "ms": { "pe": { "entry": 6078.0, "machine": 332.0, "checksum": 312274.0, "rsrc_size": 139264.0, "subsystem": 2.0, "timestamp": 1522998228.0, "icon_count": 2.0, "image_base": 4194304.0, "has_checksum": true, "rsrc_entropy": 5.21, "entry_section": ".text", "size_of_image": 5402624.0, "checksum_valid": true, "file_alignment": 512.0, "resource_count": 5.0, "resource_types": [ "RT_BITMAP", "RT_ICON", "RT_STRING", "RT_GROUP_ICON", "RT_VERSION" ], "characteristics": 258.0, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 3.0, "computed_checksum": 312274.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "dll_characteristics": 32768.0, "has_export_timestamp": false, "linker_major_version": 9.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "api_hashing_indicator_count": 1.0, "max_section_inflation_ratio": 112.34 }, "file": { "size": 260608.0 }, "binary": { "code_size": 48128.0, "func_count": 176.0, "code_entropy": 6.66, "data_entropy": 4.84, "func_density": 3.74, "import_count": 98.0, "string_count": 255.0, "avg_func_size": 213.35, "section_count": 5.0, "avg_complexity": 8.66, "import_density": 2.09, "max_complexity": 92.0, "string_density": 5.43, "overall_entropy": 4.6, "avg_basic_blocks": 13.69, "avg_section_size": 51916.8, "dependency_count": 3.0, "entropy_variance": 1.74, "avg_string_length": 21.98, "complexity_per_kb": 0.18, "max_string_length": 244.0, "wide_string_count": 21.0, "avg_string_entropy": 3.17, "code_to_data_ratio": 0.23, "data_to_file_ratio": 0.18, "rsrc_to_file_ratio": 0.53, "text_to_file_ratio": 0.18, "total_basic_blocks": 2409.0, "func_analysis_depth": 2.0, "string_length_stddev": 27.47, "largest_section_ratio": 0.53, "sentence_string_count": 57.0, "sentence_string_ratio": 0.22, "writable_section_count": 1.0, "behavioral_import_ratio": 0.03, "executable_section_count": 1.0, "high_entropy_string_count": 3.0, "high_complexity_func_count": 3.0, "unnamed_complex_func_count": 3.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 472, ".text" ], [ 551, "@.data" ], [ 592, ".rsrc" ], [ 631, "@.reloc" ], [ 1864, "SVW3" ], [ 9890, "UVWS" ], [ 24259, "8VVVVV" ], [ 25857, "UQPXY]Y[" ], [ 29098, "QSVW" ], [ 36137, "u99u" ], [ 40411, "WWWWV" ], [ 49636, "UTF-16LE" ], [ 49648, "UNICODE" ], [ 49656, "CorExitProcess" ], [ 49672, "wide", "mscoree.dll" ], [ 49696, "runtime error" ], [ 49716, "TLOSS error" ], [ 49732, "SING error" ], [ 49748, "DOMAIN error" ], [ 49768, "R6034\r\nAn application has made an attempt to load the C runtime library incorrectly.\nPlease contact the application's support te" ], [ 49775, "An application has made an attempt to load the C runtime library incorrectly." ], [ 49853, "Please contact the application's support team for more information." ], [ 49928, "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 49935, "- Attempt to use MSIL code from this assembly during native code initialization" ], [ 50015, "This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native" ], [ 50176, "R6032\r\n- not enough space for locale information" ], [ 50183, "- not enough space for locale information" ], [ 50232, "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 50239, "- Attempt to initialize the CRT more than once." ], [ 50287, "This indicates a bug in your application." ], [ 50332, "R6030\r\n- CRT not initialized" ], [ 50339, "- CRT not initialized" ], [ 50364, "R6028\r\n- unable to initialize heap" ], [ 50371, "- unable to initialize heap" ], [ 50404, "R6027\r\n- not enough space for lowio initialization" ], [ 50411, "- not enough space for lowio initialization" ], [ 50460, "R6026\r\n- not enough space for stdio initialization" ], [ 50467, "- not enough space for stdio initialization" ], [ 50516, "R6025\r\n- pure virtual function call" ], [ 50523, "- pure virtual function call" ], [ 50556, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 50563, "- not enough space for _onexit/atexit table" ], [ 50612, "R6019\r\n- unable to open console device" ], [ 50619, "- unable to open console device" ], [ 50656, "R6018\r\n- unexpected heap error" ], [ 50663, "- unexpected heap error" ], [ 50692, "R6017\r\n- unexpected multithread lock error" ], [ 50699, "- unexpected multithread lock error" ], [ 50740, "R6016\r\n- not enough space for thread data" ], [ 50747, "- not enough space for thread data" ], [ 50784, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 50786, "This application has requested the Runtime to terminate it in an unusual way." ], [ 50936, "R6009\r\n- not enough space for environment" ], [ 50943, "- not enough space for environment" ], [ 50980, "R6008\r\n- not enough space for arguments" ], [ 50987, "- not enough space for arguments" ], [ 51024, "R6002\r\n- floating point support not loaded" ], [ 51031, "- floating point support not loaded" ], [ 51072, "Microsoft Visual C++ Runtime Library" ], [ 51120, "\u003cprogram name unknown\u003e" ], [ 51144, "Runtime Error!\n\nProgram:" ], [ 51300, "EncodePointer" ], [ 51316, "wide", "KERNEL32.DLL" ], [ 51344, "DecodePointer" ], [ 51360, "FlsFree" ], [ 51368, "FlsSetValue" ], [ 51380, "FlsGetValue" ], [ 51392, "FlsAlloc" ], [ 51404, "GetProcessWindowStation" ], [ 51428, "GetUserObjectInformationA" ], [ 51456, "GetLastActivePopup" ], [ 51476, "GetActiveWindow" ], [ 51492, "MessageBoxA" ], [ 51504, "USER32.DLL" ], [ 51551, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 52442, "wide", "h(((( H" ], [ 53120, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 53504, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 53740, "dddd, MMMM dd, yyyy" ], [ 53760, "MM/dd/yy" ], [ 53780, "December" ], [ 53792, "November" ], [ 53804, "October" ], [ 53812, "September" ], [ 53824, "August" ], [ 53832, "July" ], [ 53840, "June" ], [ 53848, "April" ], [ 53856, "March" ], [ 53864, "February" ], [ 53876, "January" ], [ 53932, "Saturday" ], [ 53944, "Friday" ], [ 53952, "Thursday" ], [ 53964, "Wednesday" ], [ 53976, "Tuesday" ], [ 53984, "Monday" ], [ 53992, "Sunday" ], [ 54028, "SunMonTueWedThuFriSat" ], [ 54052, "JanFebMarAprMayJunJulAugSepOctNovDec" ], [ 54092, "bad allocation" ], [ 54112, "rozotahujamijurukukiyi.txt" ], [ 54144, "wide", "gesakukixoyefepuwahujecugetu tunivileraluwafu jojoxaru" ], [ 54256, "VirtualProtect" ], [ 54272, "VirtualAlloc" ], [ 54288, "kernel32.dll" ], [ 56074, "WriteConsoleOutputCharacterW" ], [ 56106, "GetCPInfo" ], [ 56118, "SetMailslotInfo" ], [ 56136, "FindCloseChangeNotification" ], [ 56166, "GetTickCount" ], [ 56182, "EnumTimeFormatsW" ], [ 56202, "GetThreadSelectorEntry" ], [ 56228, "TerminateProcess" ], [ 56248, "GetLastError" ], [ 56264, "GetCurrentDirectoryW" ], [ 56288, "SetLastError" ], [ 56304, "GetProcAddress" ], [ 56322, "LoadLibraryA" ], [ 56338, "LocalAlloc" ], [ 56352, "GetExitCodeThread" ], [ 56384, "FindFirstChangeNotificationA" ], [ 56416, "FatalExit" ], [ 56428, "FreeEnvironmentStringsW" ], [ 56466, "GetSystemTime" ], [ 56480, "KERNEL32.dll" ], [ 56496, "LoadCursorFromFileA" ], [ 56518, "LookupIconIdFromDirectory" ], [ 56546, "GetDlgCtrlID" ], [ 56562, "UpdateWindow" ], [ 56578, "LoadImageA" ], [ 56592, "SetThreadDesktop" ], [ 56612, "LoadStringW" ], [ 56626, "ScrollWindow" ], [ 56642, "PeekMessageA" ], [ 56658, "LookupIconIdFromDirectoryEx" ], [ 56688, "GetUpdateRect" ], [ 56704, "GetMonitorInfoA" ], [ 56722, "SetParent" ], [ 56732, "USER32.dll" ], [ 56746, "CreateCompatibleBitmap" ], [ 56772, "CreateCompatibleDC" ], [ 56792, "GDI32.dll" ], [ 56804, "HeapFree" ], [ 56816, "GetCommandLineA" ], [ 56834, "GetStartupInfoA" ], [ 56852, "HeapCreate" ], [ 56866, "VirtualFree" ], [ 56880, "DeleteCriticalSection" ], [ 56904, "LeaveCriticalSection" ], [ 56928, "EnterCriticalSection" ], [ 56952, "HeapAlloc" ], [ 56980, "HeapReAlloc" ], [ 56994, "SetHandleCount" ], [ 57012, "GetStdHandle" ], [ 57028, "GetFileType" ], [ 57042, "GetCurrentProcess" ], [ 57062, "UnhandledExceptionFilter" ], [ 57090, "SetUnhandledExceptionFilter" ], [ 57120, "IsDebuggerPresent" ], [ 57140, "RtlUnwind" ], [ 57152, "WriteFile" ], [ 57164, "WideCharToMultiByte" ], [ 57186, "GetConsoleCP" ], [ 57202, "GetConsoleMode" ], [ 57220, "CloseHandle" ], [ 57234, "GetModuleHandleW" ], [ 57254, "Sleep" ], [ 57262, "ExitProcess" ], [ 57276, "GetModuleFileNameA" ], [ 57298, "FreeEnvironmentStringsA" ], [ 57324, "GetEnvironmentStrings" ], [ 57348, "GetEnvironmentStringsW" ], [ 57374, "TlsGetValue" ], [ 57388, "TlsAlloc" ], [ 57400, "TlsSetValue" ], [ 57414, "TlsFree" ], [ 57424, "InterlockedIncrement" ], [ 57448, "GetCurrentThreadId" ], [ 57470, "InterlockedDecrement" ], [ 57494, "QueryPerformanceCounter" ], [ 57520, "GetCurrentProcessId" ], [ 57542, "GetSystemTimeAsFileTime" ], [ 57568, "InitializeCriticalSectionAndSpinCount" ], [ 57608, "MultiByteToWideChar" ], [ 57630, "ReadFile" ], [ 57642, "CreateFileA" ], [ 57656, "SetFilePointer" ], [ 57674, "WriteConsoleA" ], [ 57690, "GetConsoleOutputCP" ], [ 57712, "WriteConsoleW" ], [ 57728, "SetStdHandle" ], [ 57744, "FlushFileBuffers" ], [ 57774, "GetOEMCP" ], [ 57786, "IsValidCodePage" ], [ 57804, "SetEndOfFile" ], [ 57820, "GetProcessHeap" ], [ 57838, "HeapSize" ], [ 57850, "GetLocaleInfoA" ], [ 57868, "LCMapStringA" ], [ 57884, "LCMapStringW" ], [ 57900, "GetStringTypeA" ], [ 57918, "GetStringTypeW" ], [ 60670, "abcdefghijklmnopqrstuvwxyz" ], [ 60702, "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ], [ 63488, "kuxabi" ], [ 68608, "wide", "kugikijabesogutuyozu" ], [ 79429, "2797" ], [ 81667, "\u003c5/\u003e" ], [ 83892, "1.10" ], [ 83956, "='-487.-'!9" ], [ 87359, "3555" ], [ 88018, "2\u003e8," ], [ 89159, "6332" ], [ 89805, "2\u003e4/" ], [ 94074, "-()- \u00266.!5126" ], [ 102651, "93.3" ], [ 102671, ".327" ], [ 117603, "u.sl" ], [ 120709, "T qT qT qT qT qT qW" ], [ 121045, "T qT qT qT qT qT qT q" ], [ 121381, "T qT qT qT qT qT q" ], [ 121714, "T qam" ], [ 123721, "T qT qT qT qam" ], [ 125062, "T qT qT qT qT q" ], [ 131434, "T qT qT qT q" ], [ 132103, "T qT qT qT qt" ], [ 132771, "mT qT qT qT q" ], [ 143643, "IHDR" ], [ 143669, "PLTE" ], [ 143909, "%tEXtdate:create" ], [ 143926, "2015-04-14T05:45:04-05:00" ], [ 143958, "%tEXtdate:modify" ], [ 144008, "IEND" ], [ 242482, "wide", "\u0026Lizedoxi rivi xavizo zesafa canemafica" ], [ 242562, "wide", "Verenixadatebi cofutiwe fogu" ], [ 242620, "wide", "Cubohe" ], [ 242634, "wide", "Xuvi4Yicaya nemoyice hijetudexica womutegafefo piwozemogi" ], [ 242750, "wide", "Gaxujazajiya_Nivoxazo wiwayepaxo liwuropiyenazi zofo conalese yimucayedupoxi yo ni cemibehahasepa wudehukusi?Dadagara teri sovuh" ], [ 243096, "wide", "Suyiyofakitawe vi lereti xaha" ], [ 243266, "wide", "VS_VERSION_INFO" ], [ 243358, "wide", "StringFileInfo" ], [ 243394, "wide", "457aa56b" ], [ 243418, "wide", "FileVersion" ], [ 243466, "wide", "InternalName" ], [ 243492, "wide", "zogge.exe" ], [ 243518, "wide", "ProductVersion" ], [ 243548, "wide", "1.0.0.1" ], [ 243570, "wide", "VarFileInfo" ], [ 243602, "wide", "Translation" ], [ 244021, "\u003c[\u003cm\u003c?=I=V=q=x=" ], [ 244469, "0,030G0N0f0r0x0" ], [ 244892, "I0U0" ] ], "sz": 260608, "ts": [ { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.66)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-locale-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.60" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.800000011920929, "d": "Reparent window via SetParent", "e": [ "SetParent" ], "i": "micro-behaviors/ui/window/manage/control::set-parent-api", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 139264.00" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-large-rsrc-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8500000238418579, "d": "AddAtomW junk API import", "e": [ "AddAtomW" ], "i": "objectives/anti-static/obfuscation/imports::add-atom-w-import", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "498879" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 3.17" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 176.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 2409.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 3.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console output code page", "e": [ "GetConsoleOutputCP" ], "i": "micro-behaviors/fs/file/handle::get-console-output-cp", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_STRING, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 98.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "a": "T1612", "c": 0.8999999761581421, "d": "PE resource table contains RT_BITMAP", "e": [ "[RT_BITMAP, RT_ICON, RT_STRING, RT_GROUP_ICON, RT_VERSION]" ], "i": "objectives/anti-static/obfuscation/payload/resource::rsrc-bitmap-present", "l": 1, "m": "B0023" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LCMapStringW", "LoadStringW", "GetEnvironmentStrings", "GetStringTypeW", "StringFileInfo", "GetStringTypeA", "FreeEnvironmentStringsA", "FreeEnvironmentStringsW", "LCMapStringA", "GetEnvironmentStringsW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.66" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 112.34" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "a": "T1622", "c": 0.8999999761581421, "d": "mscoree.dll resolved at runtime", "e": [ "mscoree.dll" ], "i": "objectives/anti-analysis/debugger-detect/stub::mscoree-runtime-resolve-string", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.17" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.22" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "46", "41", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryW" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "c": 0.8999999761581421, "d": "Attach thread to desktop", "e": [ "SetThreadDesktop" ], "i": "micro-behaviors/ui/window/station::set-thread-desktop-import", "l": 3 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 139264.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_BITMAP, RT_ICON, RT_STRING, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time", "e": [ "GetSystemTime" ], "i": "micro-behaviors/time/query::get-system-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.5.2" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 3, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8600000143051147, "d": "VirtualProtect then VirtualAlloc strings", "e": [ "VirtualProtectVirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtualprotect-virtualalloc-pair", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1522998228.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.66" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 255.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 98.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 3, "m": "C0014" }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 98.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 176.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 176.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.60" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.800000011920929, "d": "Repeated consonant-vowel token", "e": [ "rozotahujamijurukukiyi", "gesakukixoyefepuwahujecugetu", "liwuropiyenazi", "kugikijabesogutuyozu" ], "i": "objectives/anti-static/obfuscation/string/junking::consonant-vowel-gibberish", "l": 3 }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "28 d1 40 00", "20 d0 40 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetUserObjectInformationA", "GetProcessWindowStation", "GetThreadSelectorEntry", "SunMonTueWedThuFriSat", "LoadCursorFromFileA", "LookupIconIdFromDirectory", "WideCharToMultiByte", "GetModuleFileNameA", "LookupIconIdFromDirectoryEx", "JanFebMarAprMayJunJulAugSepOctNovDec", "UnhandledExceptionFilter", "GetCurrentDirectoryW", "FindCloseChangeNotification", "SetUnhandledExceptionFilter", "WriteConsoleOutputCharacterW", "FindFirstChangeNotificationA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 32768.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.949999988079071, "d": "links GDI32.dll (CreateCompatibleBitmap, CreateCompatibleDC)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (FindCloseChangeNotification, GetTickCount, EnumTimeFormatsW, GetThreadSelectorEntry, TerminateProcess, ... +78 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (SetParent, GetMonitorInfoA, GetUpdateRect, LookupIconIdFromDirectoryEx, PeekMessageA, ... +8 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "pe.has_rich_header = 1.00", "binary.import_count = 98.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "a": "T1036", "c": 0.8500000238418579, "d": "PE version info present but string fields stripped", "e": [ "1.0.5.2", "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-string-table-stripped", "l": 4 }, { "a": "T1027.002", "c": 0.9200000166893005, "d": "Control-flow-flattened packer loading .NET payload", "e": [ "CorExitProcess", "pe.max_section_inflation_ratio = 112.34" ], "i": "objectives/command-and-control/dropper/execution/loader::flattened-packer-clr-loader", "l": 5, "m": "B0032" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "SetUnhandledExceptionFilter", "IsDebuggerPresent", "Sleep" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "a": "T1622", "c": 0.8999999761581421, "d": "Empty PE stub with COM/CLR runtime resolver", "e": [ "pe.import_dll_count = 3.00", "mscoree.dll", "LoadLibraryA" ], "i": "objectives/anti-analysis/debugger-detect/stub::empty-stub-runtime-resolver", "l": 4 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 } ], "sha": "b0dc010628c8e5309602e3f46c8ff86be2d04cdfb255cfa792938e9dc1e5b537", "path": "498879", "type": "pe" } ], "tv": "46790" } }