{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.2392638,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.014666666,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-30T19:13:22Z"
  },
  "path": "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(Ds)",
        "x": 7,
        "ff": {
          "i": [
            [
              "kernel32",
              "WriteFile"
            ],
            [
              "kernel32",
              "WriteConsoleW"
            ],
            [
              "kernel32",
              "WaitForMultipleObjects"
            ],
            [
              "kernel32",
              "WaitForSingleObject"
            ],
            [
              "kernel32",
              "VirtualQuery"
            ],
            [
              "kernel32",
              "VirtualFree"
            ],
            [
              "kernel32",
              "VirtualAlloc"
            ],
            [
              "kernel32",
              "SwitchToThread"
            ],
            [
              "kernel32",
              "SuspendThread"
            ],
            [
              "kernel32",
              "SetWaitableTimer"
            ],
            [
              "kernel32",
              "SetUnhandledExceptionFilter"
            ],
            [
              "kernel32",
              "SetProcessPriorityBoost"
            ],
            [
              "kernel32",
              "SetEvent"
            ],
            [
              "kernel32",
              "SetErrorMode"
            ],
            [
              "kernel32",
              "SetConsoleCtrlHandler"
            ],
            [
              "kernel32",
              "ResumeThread"
            ],
            [
              "kernel32",
              "PostQueuedCompletionStatus"
            ],
            [
              "kernel32",
              "LoadLibraryA"
            ],
            [
              "kernel32",
              "LoadLibraryW"
            ],
            [
              "kernel32",
              "SetThreadContext"
            ],
            [
              "kernel32",
              "GetThreadContext"
            ],
            [
              "kernel32",
              "GetSystemInfo"
            ],
            [
              "kernel32",
              "GetSystemDirectoryA"
            ],
            [
              "kernel32",
              "GetStdHandle"
            ],
            [
              "kernel32",
              "GetQueuedCompletionStatusEx"
            ],
            [
              "kernel32",
              "GetProcessAffinityMask"
            ],
            [
              "kernel32",
              "GetProcAddress"
            ],
            [
              "kernel32",
              "GetEnvironmentStringsW"
            ],
            [
              "kernel32",
              "GetConsoleMode"
            ],
            [
              "kernel32",
              "FreeEnvironmentStringsW"
            ],
            [
              "kernel32",
              "ExitProcess"
            ],
            [
              "kernel32",
              "DuplicateHandle"
            ],
            [
              "kernel32",
              "CreateWaitableTimerExW"
            ],
            [
              "kernel32",
              "CreateThread"
            ],
            [
              "kernel32",
              "CreateIoCompletionPort"
            ],
            [
              "kernel32",
              "CreateFileA"
            ],
            [
              "kernel32",
              "CreateEventA"
            ],
            [
              "kernel32",
              "CloseHandle"
            ],
            [
              "kernel32",
              "AddVectoredExceptionHandler"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 2045942.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 60.0,
              "base_relocation_entry_count": 8469.0
            },
            "file": {
              "size": 2015232.0,
              "entropy": 6.05,
              "size_bytes": 2015232.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 6.15,
              "data_entropy": 4.5,
              "string_count": 6028.0,
              "entropy_variance": 4.09,
              "avg_string_length": 36.7,
              "max_string_length": 74216.0,
              "code_to_data_ratio": 0.9,
              "string_length_stddev": 1035.0,
              "largest_section_ratio": 0.47,
              "sentence_string_count": 420.0,
              "sentence_string_ratio": 0.07,
              "high_entropy_string_count": 2.0
            },
            "imports": {
              "count": 39.0
            },
            "sections": {
              "count": 6.0,
              "code_size": 932352.0,
              "entropy_max": 6.15,
              "entropy_mean": 4.17,
              "name_entropy": 3.43,
              "writable_count": 2.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              392,
              "u8",
              ".text"
            ],
            [
              471,
              "u8",
              "@.data"
            ],
            [
              512,
              "u8",
              ".idata"
            ],
            [
              552,
              "u8",
              ".reloc"
            ],
            [
              591,
              "u8",
              "B.symtab"
            ],
            [
              934620,
              "u8",
              "time"
            ],
            [
              934956,
              "u8",
              "Zone"
            ],
            [
              934962,
              "u8",
              "abid"
            ],
            [
              934992,
              "u8",
              "base"
            ],
            [
              935022,
              "u8",
              "code"
            ],
            [
              935052,
              "u8",
              "data"
            ],
            [
              935058,
              "u8",
              "date"
            ],
            [
              935064,
              "u8",
              "dial"
            ],
            [
              935070,
              "u8",
              "done"
            ],
            [
              935094,
              "u8",
              "elem"
            ],
            [
              935112,
              "u8",
              "file"
            ],
            [
              935118,
              "u8",
              "file"
            ],
            [
              935166,
              "u8",
              "free"
            ],
            [
              935190,
              "u8",
              "goid"
            ],
            [
              935214,
              "u8",
              "head"
            ],
            [
              935220,
              "u8",
              "heap"
            ],
            [
              935232,
              "u8",
              "info"
            ],
            [
              935238,
              "u8",
              "init"
            ],
            [
              935244,
              "u8",
              "ireg"
            ],
            [
              935274,
              "u8",
              "lane"
            ],
            [
              935298,
              "u8",
              "load"
            ],
            [
              935316,
              "u8",
              "mode"
            ],
            [
              935328,
              "u8",
              "mono"
            ],
            [
              935334,
              "u8",
              "name"
            ],
            [
              935358,
              "u8",
              "node"
            ],
            [
              935400,
              "u8",
              "path"
            ],
            [
              935466,
              "u8",
              "read"
            ],
            [
              935502,
              "u8",
              "seek"
            ],
            [
              935514,
              "u8",
              "sema"
            ],
            [
              935526,
              "u8",
              "size"
            ],
            [
              935550,
              "u8",
              "tail"
            ],
            [
              935556,
              "u8",
              "text"
            ],
            [
              935568,
              "u8",
              "user"
            ],
            [
              935586,
              "u8",
              "wait"
            ],
            [
              935592,
              "u8",
              "wake"
            ],
            [
              935616,
              "u8",
              "zero"
            ],
            [
              935622,
              "u8",
              "zone"
            ],
            [
              935628,
              "u8",
              "bufio"
            ],
            [
              935985,
              "u8",
              "align"
            ],
            [
              935992,
              "u8",
              "alloc"
            ],
            [
              935999,
              "u8",
              "atEOF"
            ],
            [
              936013,
              "u8",
              "cache"
            ],
            [
              936048,
              "u8",
              "close"
            ],
            [
              936055,
              "u8",
              "count"
            ],
            [
              936062,
              "u8",
              "csema"
            ],
            [
              936069,
              "u8",
              "cutab"
            ],
            [
              936076,
              "u8",
              "datap"
            ],
            [
              936090,
              "u8",
              "edata"
            ],
            [
              936097,
              "u8",
              "elems"
            ],
            [
              936118,
              "u8",
              "equal"
            ],
            [
              936125,
              "u8",
              "errno"
            ],
            [
              936132,
              "u8",
              "error"
            ],
            [
              936139,
              "u8",
              "etext"
            ],
            [
              936146,
              "u8",
              "evict"
            ],
            [
              936153,
              "u8",
              "extra"
            ],
            [
              936181,
              "u8",
              "fmtBs"
            ],
            [
              936188,
              "u8",
              "fmtBx"
            ],
            [
              936195,
              "u8",
              "fmtQc"
            ],
            [
              936202,
              "u8",
              "fmtSx"
            ],
            [
              936216,
              "u8",
              "gFree"
            ],
            [
              936223,
              "u8",
              "gList"
            ],
            [
              936237,
              "u8",
              "hash0"
            ],
            [
              936244,
              "u8",
              "idxhi"
            ],
            [
              936251,
              "u8",
              "idxlo"
            ],
            [
              936258,
              "u8",
              "incgo"
            ],
            [
              936265,
              "u8",
              "index"
            ],
            [
              936272,
              "u8",
              "inter"
            ],
            [
              936279,
              "u8",
              "iregs"
            ],
            [
              936286,
              "u8",
              "isDST"
            ],
            [
              936293,
              "u8",
              "isdir"
            ],
            [
              936307,
              "u8",
              "isutc"
            ],
            [
              936321,
              "u8",
              "limit"
            ],
            [
              936328,
              "u8",
              "local"
            ],
            [
              936342,
              "u8",
              "magic"
            ],
            [
              936356,
              "u8",
              "minLC"
            ],
            [
              936370,
              "u8",
              "minus"
            ],
            [
              936377,
              "u8",
              "mtime"
            ],
            [
              936405,
              "u8",
              "param"
            ],
            [
              936426,
              "u8",
              "plusV"
            ],
            [
              936433,
              "u8",
              "pread"
            ],
            [
              936440,
              "u8",
              "proto"
            ],
            [
              936447,
              "u8",
              "ptrTo"
            ],
            [
              936461,
              "u8",
              "ready"
            ],
            [
              936482,
              "u8",
              "reset"
            ],
            [
              936489,
              "u8",
              "rsema"
            ],
            [
              936503,
              "u8",
              "runes"
            ],
            [
              936538,
              "u8",
              "sigMu"
            ],
            [
              936552,
              "u8",
              "sleep"
            ],
            [
              936559,
              "u8",
              "space"
            ],
            [
              936594,
              "u8",
              "state"
            ],
            [
              936622,
              "u8",
              "timer"
            ],
            [
              936643,
              "u8",
              "valid"
            ],
            [
              936650,
              "u8",
              "value"
            ],
            [
              936657,
              "u8",
              "wbBuf"
            ],
            [
              936664,
              "u8",
              "wbuf1"
            ],
            [
              936671,
              "u8",
              "wbuf2"
            ],
            [
              936678,
              "u8",
              "write"
            ],
            [
              936685,
              "u8",
              "wsema"
            ],
            [
              937338,
              "u8",
              "errors"
            ],
            [
              937346,
              "u8",
              "unsafe"
            ],
            [
              937786,
              "u8",
              "ZoneId"
            ],
            [
              937794,
              "u8",
              "_defer"
            ],
            [
              937802,
              "u8",
              "_panic"
            ],
            [
              937810,
              "u8",
              "abiMap"
            ],
            [
              937818,
              "u8",
              "accept"
            ],
            [
              937826,
              "u8",
              "action"
            ],
            [
              937834,
              "u8",
              "addArg"
            ],
            [
              937842,
              "u8",
              "addSec"
            ],
            [
              937850,
              "u8",
              "allocN"
            ],
            [
              937858,
              "u8",
              "append"
            ],
            [
              937866,
              "u8",
              "argLen"
            ],
            [
              937874,
              "u8",
              "cancel"
            ],
            [
              937882,
              "u8",
              "closed"
            ],
            [
              937890,
              "u8",
              "cmpVal"
            ],
            [
              937898,
              "u8",
              "common"
            ],
            [
              937906,
              "u8",
              "ctxErr"
            ],
            [
              937914,
              "u8",
              "decref"
            ],
            [
              937922,
              "u8",
              "delete"
            ],
            [
              937930,
              "u8",
              "dialIP"
            ],
            [
              937938,
              "u8",
              "divMul"
            ],
            [
              937946,
              "u8",
              "divmod"
            ],
            [
              937954,
              "u8",
              "doCall"
            ],
            [
              937962,
              "u8",
              "etypes"
            ],
            [
              937970,
              "u8",
              "exited"
            ],
            [
              937978,
              "u8",
              "extend"
            ],
            [
              937986,
              "u8",
              "family"
            ],
            [
              937994,
              "u8",
              "fixLen"
            ],
            [
              938002,
              "u8",
              "fmtSbx"
            ],
            [
              938010,
              "u8",
              "frames"
            ],
            [
              938018,
              "u8",
              "funcID"
            ],
            [
              938026,
              "u8",
              "gcdata"
            ],
            [
              938034,
              "u8",
              "goexit"
            ],
            [
              938042,
              "u8",
              "gofunc"
            ],
            [
              938050,
              "u8",
              "handle"
            ],
            [
              938058,
              "u8",
              "header"
            ],
            [
              938066,
              "u8",
              "inList"
            ],
            [
              938074,
              "u8",
              "incref"
            ],
            [
              938082,
              "u8",
              "insert"
            ],
            [
              938090,
              "u8",
              "intbuf"
            ],
            [
              938098,
              "u8",
              "isFile"
            ],
            [
              938106,
              "u8",
              "isFree"
            ],
            [
              938114,
              "u8",
              "isdone"
            ],
            [
              938122,
              "u8",
              "labels"
            ],
            [
              938130,
              "u8",
              "layout"
            ],
            [
              938138,
              "u8",
              "locabs"
            ],
            [
              938146,
              "u8",
              "lookup"
            ],
            [
              938154,
              "u8",
              "mcache"
            ],
            [
              938162,
              "u8",
              "mcount"
            ],
            [
              938170,
              "u8",
              "method"
            ],
            [
              938178,
              "u8",
              "mustBe"
            ],
            [
              938186,
              "u8",
              "negate"
            ],
            [
              938194,
              "u8",
              "nelems"
            ],
            [
              938202,
              "u8",
              "nfiles"
            ],
            [
              938210,
              "u8",
              "noCopy"
            ],
            [
              938218,
              "u8",
              "noscan"
            ],
            [
              938226,
              "u8",
              "npages"
            ],
            [
              938234,
              "u8",
              "offset"
            ],
            [
              938242,
              "u8",
              "opAddr"
            ],
            [
              938250,
              "u8",
              "opaque"
            ],
            [
              938258,
              "u8",
              "palloc"
            ],
            [
              938266,
              "u8",
              "parent"
            ],
            [
              938274,
              "u8",
              "parked"
            ],
            [
              938282,
              "u8",
              "pcache"
            ],
            [
              938290,
              "u8",
              "pcfile"
            ],
            [
              938298,
              "u8",
              "period"
            ],
            [
              938306,
              "u8",
              "prefix"
            ],
            [
              938314,
              "u8",
              "procid"
            ],
            [
              938322,
              "u8",
              "ptrbit"
            ],
            [
              938330,
              "u8",
              "pwrite"
            ],
            [
              938338,
              "u8",
              "qcount"
            ],
            [
              938346,
              "u8",
              "refill"
            ],
            [
              938354,
              "u8",
              "remove"
            ],
            [
              938362,
              "u8",
              "retPop"
            ],
            [
              938370,
              "u8",
              "rodata"
            ],
            [
              938378,
              "u8",
              "rotate"
            ],
            [
              938386,
              "u8",
              "rusage"
            ],
            [
              938394,
              "u8",
              "rwlock"
            ],
            [
              938402,
              "u8",
              "search"
            ],
            [
              938410,
              "u8",
              "server"
            ],
            [
              938418,
              "u8",
              "setLoc"
            ],
            [
              938426,
              "u8",
              "shared"
            ],
            [
              938434,
              "u8",
              "sharpV"
            ],
            [
              938442,
              "u8",
              "signal"
            ],
            [
              938450,
              "u8",
              "signed"
            ],
            [
              938458,
              "u8",
              "sotype"
            ],
            [
              938466,
              "u8",
              "source"
            ],
            [
              938474,
              "u8",
              "state1"
            ],
            [
              938482,
              "u8",
              "state2"
            ],
            [
              938490,
              "u8",
              "status"
            ],
            [
              938498,
              "u8",
              "stderr"
            ],
            [
              938506,
              "u8",
              "stdout"
            ],
            [
              938514,
              "u8",
              "stkOff"
            ],
            [
              938522,
              "u8",
              "string"
            ],
            [
              938530,
              "u8",
              "subCtx"
            ],
            [
              938538,
              "u8",
              "suffix"
            ],
            [
              938546,
              "u8",
              "thread"
            ],
            [
              938554,
              "u8",
              "ticket"
            ],
            [
              938562,
              "u8",
              "timers"
            ],
            [
              938570,
              "u8",
              "tryGet"
            ],
            [
              938578,
              "u8",
              "unpack"
            ],
            [
              938586,
              "u8",
              "useTCP"
            ],
            [
              938594,
              "u8",
              "vdsoPC"
            ],
            [
              938602,
              "u8",
              "vdsoSP"
            ],
            [
              938610,
              "u8",
              "victim"
            ],
            [
              938618,
              "u8",
              "xcount"
            ],
            [
              938626,
              "u8",
              "context"
            ],
            [
              938635,
              "u8",
              "os/exec"
            ],
            [
              938644,
              "u8",
              "reflect"
            ],
            [
              938653,
              "u8",
              "runtime"
            ],
            [
              938662,
              "u8",
              "strings"
            ],
            [
              938671,
              "u8",
              "syscall"
            ],
            [
              938680,
              "u8",
              "unicode"
            ],
            [
              939238,
              "u8",
              "YearDay"
            ],
            [
              939247,
              "u8",
              "aborted"
            ],
            [
              939256,
              "u8",
              "addRcvr"
            ],
            [
              939265,
              "u8",
              "address"
            ],
            [
              939274,
              "u8",
              "alllink"
            ],
            [
              939283,
              "u8",
              "amended"
            ],
            [
              939292,
              "u8",
              "answers"
            ],
            [
              939301,
              "u8",
              "badVerb"
            ],
            [
              939310,
              "u8",
              "balance"
            ],
            [
              939319,
              "u8",
              "blocked"
            ],
            [
              939328,
              "u8",
              "buckets"
            ],
            [
              939337,
              "u8",
              "callers"
            ],
            [
              939346,
              "u8",
              "cgoCtxt"
            ],
            [
              939355,
              "u8",
              "chanDir"
            ],
            [
              939364,
              "u8",
              "closing"
            ],
            [
              939373,
              "u8",
              "connect"
            ],
            [
              939382,
              "u8",
              "consume"
            ],
            [
              939391,
              "u8",
              "dequeue"
            ],
            [
              939400,
              "u8",
              "destroy"
            ],
            [
              939409,
              "u8",
              "dialTCP"
            ],
            [
              939418,
              "u8",
              "dialUDP"
            ],
            [
              939427,
              "u8",
              "dirinfo"
            ],
            [
              939436,
              "u8",
              "discard"
            ],
            [
              939445,
              "u8",
              "dispose"
            ],
            [
              939454,
              "u8",
              "doPrint"
            ],
            [
              939463,
              "u8",
              "enqueue"
            ],
            [
              939472,
              "u8",
              "environ"
            ],
            [
              939481,
              "u8",
              "filetab"
            ],
            [
              939499,
              "u8",
              "fmtBool"
            ],
            [
              939508,
              "u8",
              "framepc"
            ],
            [
              939517,
              "u8",
              "funcoff"
            ],
            [
              939526,
              "u8",
              "gcSlice"
            ],
            [
              939535,
              "u8",
              "getInfo"
            ],
            [
              939544,
              "u8",
              "getSlow"
            ],
            [
              939553,
              "u8",
              "getaddr"
            ],
            [
              939562,
              "u8",
              "growing"
            ],
            [
              939571,
              "u8",
              "gsignal"
            ],
            [
              939580,
              "u8",
              "hasName"
            ]
          ],
          "v": {
            "file.stem": "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960",
            "pe.go.path": "command-line-arguments",
            "pe.imphash": "9cbefe68f395e67356e2a5d8d1b285c0",
            "pe.machine": "x86_64",
            "pe.subsystem": "windows_cui",
            "file.basename": "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960.exe",
            "pe.go.version": "go1.19.9",
            "pe.image_base": 4194304,
            "pe.image_size": 2400256,
            "pe.machine_id": 34404,
            "pe.os_version": "6.1",
            "pe.entry_point": 411232,
            "pe.headers_size": 1536,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 3,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "3aea31c77c6396e4c297dfabb45a7949d16da297",
            "pe.image_hash.sha256": "6d2663b2446c77881a3650df1e109cd41ffdb50ec728e14cde855c7c4ec8df0c",
            "pe.image_hash.sha384": "3fa6db09daca2556501f98d3dd9b0c3435ea1dc3fe761ee2af172f4107169b9a9b9438777f476ea2f570b8a628352ed8",
            "pe.image_hash.sha512": "678162d5f2dd1f60d8a5ff26b2b2de71e94c515f1e93768d707c23ce162345c232484226e7083aea009f42092ed1ee6f673ee1cba2c79c5aa36cb6c511c18fe5",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "6.1",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "large_address_aware",
            "pe.characteristics_raw": 546,
            "pe.inflated_sections[0]": ".data",
            "pe.linker_major_version": 3,
            "pe.dll_characteristics[0]": "high_entropy_va",
            "pe.dll_characteristics[1]": "dynamic_base",
            "pe.dll_characteristics[2]": "nx_compat",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.go.build_settings.GOOS": "windows",
            "pe.data_directories[0].rva": 2371584,
            "pe.data_directories[1].rva": 2375680,
            "pe.data_directories[2].rva": 1892576,
            "pe.dll_characteristics_raw": 33120,
            "pe.number_of_rva_and_sizes": 16,
            "pe.coff.symbol_table_offset": 2014720,
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 1148,
            "pe.data_directories[1].name": "base_relocation",
            "pe.data_directories[1].size": 17418,
            "pe.data_directories[2].name": "iat",
            "pe.data_directories[2].size": 320,
            "pe.go.build_settings.GOARCH": "amd64",
            "pe.go.build_settings.GOAMD64": "v1",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.go.build_settings.-compiler": "gc",
            "pe.go.build_settings.-trimpath": "true",
            "pe.base_relocations.block_count": 60,
            "pe.base_relocations.entry_count": 8469,
            "pe.go.build_settings.CGO_ENABLED": "1"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              1536,
              932352,
              6.15,
              "r-x"
            ],
            [
              ".rdata",
              933888,
              953856,
              5.39,
              "r--"
            ],
            [
              ".data",
              1887744,
              107520,
              4.51,
              "rw-"
            ],
            [
              ".idata",
              1995264,
              1536,
              3.57,
              "rw-"
            ],
            [
              ".reloc",
              1996800,
              17920,
              5.38,
              "r--"
            ],
            [
              ".symtab",
              2014720,
              512,
              0.02,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 2015232,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 6028.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "XGETBV instruction bytes",
            "e": [
              "0F 01 D0"
            ],
            "i": "metadata/binary/instruction::xgetbv-instr",
            "l": 2,
            "el": [
              "0x14e5"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary is 500KB+",
            "e": [
              "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960.exe"
            ],
            "i": "metadata/binary/metrics/threshold::large-binary-500k",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "High plaintext string count",
            "e": [
              "binary.string_count = 6028.00"
            ],
            "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000",
            "l": 1
          },
          {
            "a": "T1129",
            "c": 0.949999988079071,
            "d": "Create thread in current process",
            "e": [
              "CreateThread"
            ],
            "i": "micro-behaviors/process/thread/create::create-thread",
            "l": 2,
            "el": [
              "0x1ce1e8"
            ]
          },
          {
            "c": 0.20000000298023224,
            "d": "encrypted-file trailer vocabulary",
            "e": [
              "magic"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::encrypted-trailer-vocab",
            "l": 1,
            "el": [
              "0xe4996"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Free virtual memory",
            "e": [
              "VirtualFree"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-free",
            "l": 2,
            "el": [
              "0x1ce108"
            ]
          },
          {
            "a": "T1055",
            "c": 0.699999988079071,
            "d": "Load PAGE_READWRITE (0x04) into r8d/r9d",
            "e": [
              "b8",
              "b9"
            ],
            "i": "micro-behaviors/mem/alloc/executable::page-readwrite-arg-x64",
            "l": 1,
            "el": [
              "0xcd2e0",
              "0x36fc7"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Duplicate object handle",
            "e": [
              "DuplicateHandle"
            ],
            "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle",
            "l": 2,
            "el": [
              "0x1ce1d8"
            ]
          },
          {
            "c": 0.20000000298023224,
            "d": "pipe keyword",
            "e": [
              "pipe"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::pipe",
            "l": 1,
            "el": [
              "0x1566ae"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Unicode console output",
            "e": [
              "WriteConsoleW"
            ],
            "i": "micro-behaviors/hardware/display/screen::write-console-w",
            "l": 2,
            "el": [
              "0x1ce0e8"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Get console input/output mode",
            "e": [
              "GetConsoleMode"
            ],
            "i": "micro-behaviors/fs/file/handle::get-console-mode",
            "l": 2,
            "el": [
              "0x1ce1c0"
            ]
          },
          {
            "d": "TCPConn type",
            "e": [
              "TCPConn"
            ],
            "i": "micro-behaviors/communications/socket/tcp::tcp-conn",
            "l": 3,
            "el": [
              "0x1540f0"
            ]
          },
          {
            "a": "T1547.001",
            "c": 0.6000000238418579,
            "d": "Run value name string",
            "e": [
              "Run"
            ],
            "i": "objectives/persistence/login/startup/registry::run-value-name",
            "l": 1,
            "el": [
              "0x154c6b"
            ]
          },
          {
            "a": "T1574.002",
            "c": 0.8999999761581421,
            "d": "Windows GetProcAddress API string",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/dylib/lookup::get-proc-address-text",
            "l": 2,
            "el": [
              "0x1e7438"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Get Windows system directory path",
            "e": [
              "GetSystemDirectoryA"
            ],
            "i": "micro-behaviors/os/sysinfo/directories::get-system-directory",
            "l": 2,
            "el": [
              "0x1ce190"
            ]
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "Go binary uses os/exec",
            "e": [
              "os/exec.interfaceEqual",
              "os/exec.(*Error).Error",
              "os/exec.interfaceEqual.func1",
              "os/exec.(*Cmd).Run",
              "os/exec",
              "os/exec.skipStdinCopyError",
              "os/exec.(*Cmd).stdin.func1",
              "os/exec.(*Cmd).writerDescriptor",
              "os/exec.Command",
              "os/exec.(*Cmd).stdout",
              "os/exec.wrappedError.Unwrap",
              "os/exec.(*Cmd).stdin",
              "os/exec.(*Error).Unwrap",
              "os/exec.(*Cmd).writerDescriptor.func1",
              "os/exec.lookExtensions",
              "os/exec.(*Cmd).stderr"
            ],
            "i": "micro-behaviors/process/create/system::go-os-exec-pclntab",
            "l": 2,
            "m": "E1059",
            "el": [
              "0x154b97",
              "0x154ae4",
              "0x154b7a",
              "0x154c6b",
              "0xe528b",
              "0x154bde",
              "0x154bc3",
              "0x154c25",
              "0x154b6a",
              "0x154bf9",
              "0x154b4e",
              "0x154bae",
              "0x154b1b",
              "0x154c45",
              "0x154c7e",
              "0x154c0f"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Wait for process/object",
            "e": [
              "WaitForSingleObject"
            ],
            "i": "micro-behaviors/process/create/spawn::wait-for-single-object",
            "l": 2,
            "el": [
              "0x14f0e9"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 30+ imports",
            "e": [
              "imports.count = 39.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-imports-30",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "TCP endpoint state error",
            "e": [
              "transport endpoint is already connected",
              "transport endpoint is not connected"
            ],
            "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint",
            "l": 2,
            "el": [
              "0x5190f3",
              "0x51862f"
            ]
          },
          {
            "c": 1.0,
            "d": "High-entropy ASLR (64-bit)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-high-entropy-va",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1055",
            "c": 0.699999988079071,
            "d": "Load PAGE_EXECUTE_READ (0x20) into r8d/r9d",
            "e": [
              "b8",
              "b9"
            ],
            "i": "micro-behaviors/mem/alloc/executable::page-execute-read-arg-x64",
            "l": 1,
            "el": [
              "0x72584",
              "0x2d2ac"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "CreateThread API name reference",
            "e": [
              "CreateThread"
            ],
            "i": "micro-behaviors/process/threading/create::create-thread-text",
            "l": 2,
            "el": [
              "0x1e74ca"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reference to tempfile module",
            "e": [
              "…s/types.goos/dir.goos/tempfile.gofmt/format.gofmt/pr…",
              "os/tempfile.go"
            ],
            "i": "micro-behaviors/fs/temp/reference::tempfile-ref",
            "l": 2,
            "el": [
              "0x556ce0",
              "0x156e70"
            ]
          },
          {
            "a": "T1055",
            "c": 0.699999988079071,
            "d": "Load PAGE_EXECUTE_READWRITE (0x40) into r8d/r9d (x64 ABI)",
            "e": [
              "b9",
              "b8"
            ],
            "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64",
            "l": 1,
            "el": [
              "0x2c2b8",
              "0x1267d"
            ]
          },
          {
            "a": "T1082",
            "c": 0.6499999761581421,
            "d": "Hostname in binary",
            "e": [
              "Hostname"
            ],
            "i": "micro-behaviors/os/sysinfo/hostname::hostname-string-raw",
            "l": 1,
            "m": "E1082",
            "el": [
              "0x150e13"
            ]
          },
          {
            "c": 0.20000000298023224,
            "d": "output keyword",
            "e": [
              "input/output error"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::output",
            "l": 1,
            "el": [
              "0x5137e6"
            ]
          },
          {
            "c": 1.0,
            "d": "LoadLibrary symbol",
            "e": [
              "LoadLibraryW",
              "LoadLibraryA"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym",
            "l": 1,
            "el": [
              "0x1ce170",
              "0x1ce168"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Suppress error dialogs",
            "e": [
              "SetErrorMode"
            ],
            "i": "micro-behaviors/os/exception/error-handling::set-error-mode",
            "l": 2,
            "el": [
              "0x1e732c"
            ]
          },
          {
            "a": "T1071.001",
            "c": 0.4000000059604645,
            "d": "Generic cmd/command/result field word fragment",
            "e": [
              "result",
              "Cmd",
              "Command",
              "Result"
            ],
            "i": "objectives/command-and-control/beacon/network/json::result-command-word",
            "l": 1,
            "m": "B0030",
            "el": [
              "0xe6ec8",
              "0x154bae",
              "0x154b6a",
              "0xea7b3"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Create named event object",
            "e": [
              "CreateEventA"
            ],
            "i": "micro-behaviors/process/sync/event::create-event",
            "l": 2,
            "m": "C0039",
            "el": [
              "0x1ce200"
            ]
          },
          {
            "d": "overflow keyword",
            "e": [
              "overflownil resource bodyno data",
              "…verflowruntime.(*bmap).overflowruntime.(*bmap).setover…",
              "oldoverflow",
              "…flowruntime.(*bmap).setoverflowruntime.(*hmap).incrnov…",
              "integer overflow",
              "runtime.(*bmap).setoverflow",
              "overflow",
              "runtime.(*hmap).newoverflow",
              "setoverflow",
              "…llocruntime.(*hmap).newoverflowruntime.(*bmap).overflo…",
              "runtime.panicoverflow",
              "LockOSThread nesting overflow",
              "runtime.(*bmap).overflow",
              "newoverflow",
              "noverflow",
              "incrnoverflow"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::overflow",
            "l": 1,
            "el": [
              "0x112388",
              "0x543f00",
              "0xe730c",
              "0x543f00",
              "0x512f9e",
              "0x1442f7",
              "0xe5d2a",
              "0x1442c2",
              "0xe7410",
              "0x543f00",
              "0x14a028",
              "0x516c74",
              "0x1442de",
              "0xe72f2",
              "0xe6386",
              "0xe7fc1"
            ]
          },
          {
            "c": 0.7200000286102295,
            "d": "Winsock connect API string",
            "e": [
              "connect"
            ],
            "i": "micro-behaviors/communications/socket/init::ws2-connect-api-string",
            "l": 1,
            "el": [
              "0xe556d"
            ]
          },
          {
            "a": "T1053.005",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "internal/poll.(*FD).ConnectEx.func1",
              "syscall.Connect",
              "net.canUseConnectEx",
              "isConnected",
              "syscall.LoadConnectEx",
              "net.selfConnect",
              "go.buildidinternal/cpu.Initializeinternal/cpu.processOptionsinternal/cpu.indexByteinternal/cpu.doinitinternal/cpu.isSetint",
              "syscall.LoadConnectEx.func1",
              "internal/poll.(*FD).ConnectEx",
              "syscall.ConnectEx",
              "syscall.LoadConnectEx.func1.1"
            ],
            "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1",
            "l": 1,
            "m": "F0012",
            "el": [
              "0x15078a",
              "0x14ebe9",
              "0x153397",
              "0xe72a4",
              "0x14ec6a",
              "0x1541d0",
              "0x543f00",
              "0x14ec30",
              "0x1507ae",
              "0x14eca2",
              "0x14ec4c"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Windows file creation/open API",
            "e": [
              "CreateFileA"
            ],
            "i": "micro-behaviors/fs/file/open::file-create-win",
            "l": 2,
            "el": [
              "0x1ce1f8"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "Register unhandled exception filter",
            "e": [
              "SetUnhandledExceptionFilter"
            ],
            "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import",
            "l": 2,
            "el": [
              "0x1ce130"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Close handle",
            "e": [
              "CloseHandle"
            ],
            "i": "micro-behaviors/process/create/spawn::close-handle-dup",
            "l": 2,
            "el": [
              "0x14ed9d"
            ]
          },
          {
            "a": "T1027.007",
            "c": 0.8999999761581421,
            "d": "Go syscall SyscallN dispatch",
            "e": [
              "syscall.SyscallN"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::syscall-syscalln",
            "l": 1,
            "el": [
              "0x14b836"
            ]
          },
          {
            "c": 0.20000000298023224,
            "d": "command keyword",
            "e": [
              "path\tcommand-line-arguments",
              "…Argos.appendBSBytesos.commandLineToArgvos.Executable…",
              "os.commandLineToArgv"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-dup",
            "l": 1,
            "el": [
              "0x1cce3b",
              "0x543f00",
              "0x150ba3"
            ]
          },
          {
            "d": "Regex component marker",
            "e": [
              "runtime.goexit",
              "runtime.main",
              "runtime.main."
            ],
            "i": "metadata/lang/compiled::go-runtime-marker--rx-1",
            "l": 1,
            "el": [
              "0x14bd1a",
              "0x148d54",
              "0x148d41"
            ]
          },
          {
            "c": 1.0,
            "d": "File larger than 1MB",
            "e": [
              "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960.exe"
            ],
            "i": "metadata/binary/metrics/size::large-file-1mb",
            "l": 2
          },
          {
            "c": 0.8399999737739563,
            "d": "Read wide environment block",
            "e": [
              "GetEnvironmentStringsW"
            ],
            "i": "micro-behaviors/os/env/access::get-environment-strings-wide",
            "l": 2,
            "el": [
              "0x1ce1b8"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Exit current process",
            "e": [
              "ExitProcess"
            ],
            "i": "micro-behaviors/process/terminate/kill::exit-process",
            "l": 2,
            "el": [
              "0x1ce1d0"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 25+ imports",
            "e": [
              "imports.count = 39.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-imports-25",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.699999988079071,
            "d": "Query virtual memory info (VirtualQuery)",
            "e": [
              "VirtualQuery"
            ],
            "i": "micro-behaviors/mem/query/info::virtualquery",
            "l": 2,
            "el": [
              "0x1ce100"
            ]
          },
          {
            "c": 0.8799999952316284,
            "d": "Native runtime binary is large",
            "e": [
              "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960.exe"
            ],
            "i": "metadata/lang/compiler/aot::native-runtime-large-file",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 6.15"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "Go binary built with trimpath flag",
            "e": [
              "build\t-trimpath=true"
            ],
            "i": "metadata/lang/go-build::go-trimpath",
            "l": 2,
            "el": [
              "0x1cce6a"
            ]
          },
          {
            "a": "T1027.007",
            "c": 0.8999999761581421,
            "d": "Go syscall LazyProc resolver",
            "e": [
              "syscall.(*LazyProc).Find"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::syscall-lazyproc-find",
            "l": 1,
            "el": [
              "0x14e7d2"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Go bytes.Buffer methods",
            "e": [
              ".WriteString",
              ".WriteByte"
            ],
            "i": "micro-behaviors/data/buffer::go-bytes-buffer-methods",
            "l": 2,
            "el": [
              "0x14d004",
              "0x14d2bd"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Get standard I/O handle",
            "e": [
              "GetStdHandle"
            ],
            "i": "micro-behaviors/fs/file/handle::get-std-handle",
            "l": 2,
            "el": [
              "0x1ce198"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Release wide environment block",
            "e": [
              "FreeEnvironmentStringsW"
            ],
            "i": "micro-behaviors/os/env/access::free-environment-strings-wide",
            "l": 2,
            "el": [
              "0x1ce1c8"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Set event object state",
            "e": [
              "SetEvent"
            ],
            "i": "micro-behaviors/process/sync/event::set-event",
            "l": 2,
            "m": "C0039",
            "el": [
              "0x1ce140"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "SOCKS5 BIND request opcode",
            "e": [
              "05 02 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte",
            "l": 1,
            "el": [
              "0x15c45"
            ]
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 0.800000011920929,
            "d": "CreateProcess API string reference",
            "e": [
              "syscall.CreateProcessAsUser",
              "syscall.CreateProcess",
              "…call.CreatePipesyscall.CreateProcesssyscall.deleteProcThrea…",
              "…adAttributeListsyscall.CreateProcessAsUsersyscall.RegCloseK…"
            ],
            "i": "objectives/evasion/process/injection/hollowing::create-process-string",
            "l": 1,
            "m": "E1055.012",
            "el": [
              "0x14ed18",
              "0x14edd7",
              "0x543f00",
              "0x543f00"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Wait on multiple object handles",
            "e": [
              "WaitForMultipleObjects"
            ],
            "i": "micro-behaviors/process/sync/semaphore::wait-for-multiple-objects",
            "l": 2,
            "m": "C0042",
            "el": [
              "0x1ce0f0"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "token keyword",
            "e": [
              "Token"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::token",
            "l": 1,
            "el": [
              "0x14e967"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 20+ imports",
            "e": [
              "imports.count = 39.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-imports-20",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Hardcoded alphabet array for filename randomization",
            "e": [
              "30 30 30 31 30 32 30 33 30 34"
            ],
            "i": "objectives/command-and-control/dropper/standalone::mutated-exe-randomizer-string",
            "l": 1,
            "m": "E1027",
            "el": [
              "0x11a88d"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x1e7228"
            ]
          },
          {
            "a": "T1622",
            "c": 0.9200000166893005,
            "d": "ProcessDebugObjectHandle info class (mov edx, 0x1E)",
            "e": [
              "BA 1E 00 00 00"
            ],
            "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-object-info-class",
            "l": 1,
            "m": "B0001",
            "el": [
              "0x31971"
            ]
          },
          {
            "d": "Regex component marker",
            "e": [
              "runtime.main",
              "runtime.goexit"
            ],
            "i": "metadata/lang/compiled::go-runtime-marker--rx-2",
            "l": 1,
            "el": [
              "0x148d54",
              "0x14bd1a"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Read files (Go)",
            "e": [
              "os.(*File).Read"
            ],
            "i": "micro-behaviors/fs/file/read::read-go",
            "l": 2,
            "el": [
              "0x150be9"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "GetSystemDirectory API string",
            "e": [
              "GetSystemDirectoryA"
            ],
            "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string",
            "l": 2,
            "el": [
              "0x1e73da"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Go bytes.Buffer I/O",
            "e": [
              ".ReadFrom",
              ".WriteTo"
            ],
            "i": "micro-behaviors/data/buffer::go-bytes-buffer-io",
            "l": 2,
            "el": [
              "0x14d020",
              "0x14d05f"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Write data to file handle",
            "e": [
              "WriteFile"
            ],
            "i": "micro-behaviors/fs/file/write/direct::write-file",
            "l": 2,
            "el": [
              "0x1ce0e0"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc",
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "a": "T1082",
            "c": 0.8999999761581421,
            "d": "Query system hardware info (CPU cores)",
            "e": [
              "GetSystemInfo"
            ],
            "i": "micro-behaviors/os/sysinfo/hardware::get-system-info",
            "l": 2,
            "el": [
              "0x1ce188"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Get environment strings",
            "e": [
              "GetEnvironmentStringsW",
              "FreeEnvironmentStringsW"
            ],
            "i": "micro-behaviors/os/env/access::get-environment-strings",
            "l": 2,
            "el": [
              "0x1ce1b8",
              "0x1ce1c8"
            ]
          },
          {
            "d": "Regex component marker",
            "e": [
              "runtime.mstart"
            ],
            "i": "metadata/lang/compiled::go-runtime-marker--rx-3",
            "l": 1,
            "el": [
              "0x14b96c"
            ]
          },
          {
            "c": 1.0,
            "d": "go/rs language suffix",
            "e": [
              "runtime.rt0_go"
            ],
            "i": "micro-behaviors/data/text/malware/terms::malware-lang-suffix",
            "l": 1,
            "el": [
              "0x14b94d"
            ]
          },
          {
            "c": 0.8799999952316284,
            "d": "Go PE retains .symtab section",
            "e": [
              ".symtab"
            ],
            "i": "metadata/lang/compiler/systems::go-pe-symtab",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Go time.Sleep delay call",
            "e": [
              "time.Sleep"
            ],
            "i": "micro-behaviors/time/sleep/interval::go-time-sleep",
            "l": 2,
            "el": [
              "0x14b847"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x27811"
            ]
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "printValue",
              "runtime.pcvalueCacheKey",
              "a non-pointer ValuegcSweep being",
              "runtime.pcvalue",
              "*reflect.Value",
              "*context.valueCtx",
              "valueStart",
              "value",
              "lookupValues",
              "*reflect.methodValue",
              "*reflect.ValueError",
              "*net.onlyValuesCtx",
              "stepsForValue",
              "valuesprofilealloc called withou",
              "*[]reflect.Value",
              "of closed filevalue out of range"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0xe6be1",
              "0x14a66f",
              "0x1184a4",
              "0x14a65f",
              "0xe8452",
              "0xe924c",
              "0xe6d55",
              "0xe4aca",
              "0xe7979",
              "0xe9e8f",
              "0xe9b1d",
              "0xe9737",
              "0xe80b1",
              "0x11a024",
              "0xe8cd1",
              "0x11292e"
            ]
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "Allocate virtual memory",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc",
            "l": 2,
            "el": [
              "0x1ce110"
            ]
          },
          {
            "a": "T1622",
            "c": 0.9200000166893005,
            "d": "ProcessDebugFlags info class (mov edx, 0x1F)",
            "e": [
              "BA 1F 00 00 00"
            ],
            "i": "objectives/anti-analysis/debugger-detect/check::nt-process-debug-flags-info-class",
            "l": 1,
            "m": "B0001",
            "el": [
              "0x9a784"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "SOCKS5 UDP ASSOCIATE request opcode",
            "e": [
              "05 03 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte",
            "l": 1,
            "el": [
              "0x7e2b"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 6028.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "d": "COMPUTERNAME environment variable",
            "e": [
              "…rnal/syscall/windows.GetComputerNameExinternal/syscall/wind…",
              "internal/syscall/windows.GetComputerNameEx"
            ],
            "i": "micro-behaviors/os/env/vars/system-info::computername-var",
            "l": 2,
            "el": [
              "0x543f00",
              "0x14fe49"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 2000+ strings",
            "e": [
              "binary.string_count = 6028.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-strings-2000",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "padString",
              "*strings.span",
              "string",
              "stringNonString",
              "*func() string",
              "*fmt.GoStringer",
              "truncateString",
              "*[][]string",
              "strings",
              "*func(string)",
              "writeString",
              "fmtString",
              "*map[string]int",
              "*map[string]bool",
              "*map[int]string",
              "*[8][]string"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0xe63b2",
              "0xe7d69",
              "0xe521a",
              "0xe8c10",
              "0xe8382",
              "0xe888b",
              "0xe87d2",
              "0xe6e1f",
              "0xe52a6",
              "0xe7c2e",
              "0xe74b9",
              "0xe6289",
              "0xe88e0",
              "0xe8d4f",
              "0xe88cf",
              "0xe7519"
            ]
          },
          {
            "a": "T1622",
            "c": 0.8500000238418579,
            "d": "PEB.BeingDebugged byte cmp (multiple sites)",
            "e": [
              "80 78 02 00"
            ],
            "i": "objectives/anti-analysis/debugger-detect/check::peb-being-debugged-cmp-multi",
            "l": 1,
            "m": "B0001",
            "el": [
              "0x34e7c"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Low ratio of sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.07"
            ],
            "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Giant embedded string blob metric",
            "e": [
              "binary.max_string_length = 74216.00"
            ],
            "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Query Windows system directory",
            "e": [
              "GetSystemDirectoryA"
            ],
            "i": "micro-behaviors/fs/path/system::get-system-directory-import",
            "l": 2,
            "el": [
              "0x1ce190"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 6028.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "TCP connection reset error",
            "e": [
              "connection reset by peer"
            ],
            "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-reset",
            "l": 2,
            "el": [
              "0x5157de"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Register vectored exception handler",
            "e": [
              "AddVectoredExceptionHandler"
            ],
            "i": "micro-behaviors/os/exception/error-handling::add-vectored-exception-handler",
            "l": 1,
            "m": "B0001",
            "el": [
              "0x1ce210"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "TCP connection timeout error",
            "e": [
              "connection timed out"
            ],
            "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-timeout",
            "l": 2,
            "el": [
              "0x51422f"
            ]
          },
          {
            "c": 0.8399999737739563,
            "d": "Large binary with few DLL dependencies",
            "e": [
              "dependencies.count = 1.00"
            ],
            "i": "metadata/package/metrics::import-count-under-80",
            "l": 2
          },
          {
            "a": "T1195.002",
            "c": 0.550000011920929,
            "d": "Plaintext sleep command token",
            "e": [
              "sleep"
            ],
            "i": "objectives/supply-chain/trojanized/backdoor::plaintext-sleep-command-token",
            "l": 1,
            "m": "B0025",
            "el": [
              "0xe4a68"
            ]
          },
          {
            "a": "T1622",
            "c": 0.8600000143051147,
            "d": "GetEnvironmentVariable profiler check",
            "e": [
              "GetEnvironmentVariable"
            ],
            "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api",
            "l": 1,
            "m": "B0001",
            "el": [
              "0x14ef0b"
            ]
          },
          {
            "a": "T1055",
            "c": 0.8999999761581421,
            "d": "ResumeThread API reference",
            "e": [
              "ResumeThread"
            ],
            "i": "micro-behaviors/process/inject/runtime/call::resume-thread-dup",
            "l": 2,
            "el": [
              "0x1e7354"
            ]
          },
          {
            "a": "T1027.007",
            "c": 0.8999999761581421,
            "d": "Kernel32 DLL resolution string",
            "e": [
              "kernel32.dll"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver",
            "l": 1,
            "el": [
              "0x1e7228"
            ]
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "SetThreadContext API reference",
            "e": [
              "SetThreadContext"
            ],
            "i": "micro-behaviors/process/inject/runtime/call::set-thread-context-dup",
            "l": 2,
            "el": [
              "0x1e73a2"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "TCP connection refused error",
            "e": [
              "connection refused"
            ],
            "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-refused",
            "l": 2,
            "el": [
              "0x513756"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "CreateFile API string reference",
            "e": [
              "CreateFile"
            ],
            "i": "micro-behaviors/fs/file/open::createfile-api",
            "l": 2,
            "el": [
              "0x14edb1"
            ]
          },
          {
            "c": 0.8799999952316284,
            "d": "Configure waitable timer",
            "e": [
              "SetWaitableTimer"
            ],
            "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer",
            "l": 2,
            "el": [
              "0x1e72d4"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "DNP3 link-layer sync header bytes",
            "e": [
              "0c 01 03 01",
              "3d 04 0a 04"
            ],
            "i": "micro-behaviors/communications/dnp3::sync-header",
            "l": 1,
            "el": [
              "0x189aab",
              "0x183731"
            ]
          },
          {
            "a": "T1005",
            "c": 0.8999999761581421,
            "d": "GetThreadContext API reference",
            "e": [
              "GetThreadContext"
            ],
            "i": "micro-behaviors/process/inject/runtime/call::get-thread-context-dup",
            "l": 2,
            "el": [
              "0x1e73b6"
            ]
          },
          {
            "a": "T1053.005",
            "c": 0.8799999952316284,
            "d": "Regex component marker",
            "e": [
              "runtime.name.pkgPath",
              "type..eq.io/fs.PathError",
              "runtime.initLongPathSupport",
              "syscall.FullPath",
              "os.IsPathSeparator",
              "os.(*fileStat).saveInfoFromPath",
              "lookPathErr",
              "saveInfoFromPath",
              "*fs.PathError",
              "io/fs.(*PathError).Timeout",
              "syscall.GetFullPathName",
              "io/fs.(*PathError).Error",
              "appendNameToPath",
              "pkgPath",
              "io/fs.(*PathError).Unwrap",
              "os.fixLongPath"
            ],
            "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5",
            "l": 1,
            "m": "F0012",
            "el": [
              "0x14b142",
              "0x14fd4b",
              "0x148345",
              "0x14e882",
              "0x150d63",
              "0x150f55",
              "0xe72be",
              "0xe9067",
              "0xe7bf2",
              "0x14fd25",
              "0x14ef98",
              "0x14fcf2",
              "0xe8f8f",
              "0xe56de",
              "0x14fd0b",
              "0x150d84"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Resolve exports with GetProcAddress",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/os/module/load::get-proc-address-import",
            "l": 2,
            "el": [
              "0x1ce1b0"
            ]
          },
          {
            "a": "T1140",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              "*runtime.pageCache",
              "cacheZone",
              "cacheStart",
              "cache",
              "sudogcache",
              "goidcache",
              "allocCountBeforeCache",
              "mspancache",
              "cacheEnd",
              "allocCache",
              "stackcache",
              "*runtime.mcache",
              "mcache",
              "goidcacheend",
              "refillAllocCache",
              "pcache"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2",
            "l": 1,
            "m": "B0023",
            "el": [
              "0xe9827",
              "0xe621b",
              "0xe6989",
              "0xe484d",
              "0xe6c89",
              "0xe62b5",
              "0xea259",
              "0xe6b69",
              "0xe5b2c",
              "0xe6941",
              "0xe6c7d",
              "0xe89f0",
              "0xe50aa",
              "0xe78fb",
              "0xe9055",
              "0xe512a"
            ]
          },
          {
            "a": "T1129",
            "c": 0.8799999952316284,
            "d": "Dynamic library loading via LoadLibraryW",
            "e": [
              "LoadLibraryW"
            ],
            "i": "micro-behaviors/dylib/load/runtime::load-library-w",
            "l": 3,
            "el": [
              "0x1ce170"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "Register console control handler",
            "e": [
              "SetConsoleCtrlHandler"
            ],
            "i": "micro-behaviors/os/console/control::set-console-ctrl-handler",
            "l": 2,
            "el": [
              "0x1ce150"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Dense embedded domain list",
            "e": [
              "os.timeout",
              "net.sockaddr",
              "runtime.name",
              "net.ret",
              "sync.eface",
              "runtime.itab",
              "net.timeout",
              "fmt.buffer",
              "net.result",
              "sync.entry",
              "runtime.hmap",
              "time.abbr",
              "runtime.bmap",
              "cpu.option"
            ],
            "i": "metadata/package/quality::dense-domain-list",
            "l": 1,
            "el": [
              "0xe6eef",
              "0xe7ca6",
              "0xe7d3c",
              "0xe7bc5",
              "0xe6f09",
              "0xe7d2d",
              "0xe75f9",
              "0xe6e6d",
              "0xe6ec8",
              "0xe6f16",
              "0xe7d1e",
              "0xe7b3e",
              "0xe7d0f",
              "0xe6e53"
            ]
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 39.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.8999999761581421,
            "d": "Create extended waitable timer",
            "e": [
              "CreateWaitableTimerExW"
            ],
            "i": "micro-behaviors/time/schedule/waitable::create-waitable-timer-ex",
            "l": 2,
            "el": [
              "0x1e74b0"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Query process CPU affinity",
            "e": [
              "GetProcessAffinityMask"
            ],
            "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask",
            "l": 1,
            "el": [
              "0x1ce1a8"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "links kernel32 (WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, ... +34 more)",
            "e": [
              "kernel32"
            ],
            "i": "metadata/dylib::kernel32",
            "l": 2,
            "el": [
              "39 symbols"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Get and set context",
            "e": [
              "SetThreadContext",
              "GetThreadContext"
            ],
            "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-set",
            "l": 1,
            "el": [
              "0x1e73a2",
              "0x1e73b6"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Create and arm waitable timer",
            "e": [
              "CreateWaitableTimerExW",
              "SetWaitableTimer"
            ],
            "i": "micro-behaviors/time/schedule/waitable::create-and-set-waitable-timer",
            "l": 1,
            "el": [
              "0x1e74b0",
              "0x1e72d4"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Set context plus resume",
            "e": [
              "ResumeThread",
              "SetThreadContext"
            ],
            "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-set-resume",
            "l": 1,
            "el": [
              "0x1e7354",
              "0x1e73a2"
            ]
          },
          {
            "c": 0.8799999952316284,
            "d": "Get set resume thread context",
            "e": [
              "ResumeThread",
              "GetThreadContext",
              "SetThreadContext"
            ],
            "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-triple-no-suspend",
            "l": 1,
            "el": [
              "0x1e7354",
              "0x1e73b6",
              "0x1e73a2"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Get context plus resume",
            "e": [
              "ResumeThread",
              "GetThreadContext"
            ],
            "i": "micro-behaviors/process/inject/runtime/thread-context::thread-context-pair-get-resume",
            "l": 1,
            "el": [
              "0x1e7354",
              "0x1e73b6"
            ]
          },
          {
            "c": 0.8799999952316284,
            "d": "Enumerate process environment block",
            "e": [
              "FreeEnvironmentStringsW",
              "GetEnvironmentStringsW"
            ],
            "i": "micro-behaviors/os/env/access::environment-block-enumeration",
            "l": 1,
            "el": [
              "0x1ce1c8",
              "0x1ce1b8"
            ]
          },
          {
            "a": "T1059.004",
            "c": 0.9399999976158142,
            "d": "Garbled Go remote tasking capability",
            "e": [
              ".WriteTo",
              "os/exec.(*Error).Error",
              "os/exec.(*Cmd).writerDescriptor.func1",
              ".WriteByte",
              "os/exec.(*Cmd).stdin",
              ".WriteString",
              "os/exec.(*Error).Unwrap",
              "os/exec.(*Cmd).stdin.func1",
              "os/exec",
              ".ReadFrom",
              "os/exec.lookExtensions",
              "os/exec.(*Cmd).writerDescriptor",
              "os/exec.interfaceEqual",
              "os/exec.interfaceEqual.func1",
              "os/exec.skipStdinCopyError",
              "os/exec.(*Cmd).stdout"
            ],
            "i": "objectives/command-and-control/remote-command/control::go-garbled-remote-tasking-capability",
            "l": 1,
            "el": [
              "0x14d05f",
              "0x154ae4",
              "0x154c45",
              "0x14d2bd",
              "0x154bae",
              "0x14d004",
              "0x154b1b",
              "0x154bc3",
              "0xe528b",
              "0x14d020",
              "0x154c7e",
              "0x154c25",
              "0x154b97",
              "0x154b7a",
              "0x154bde",
              "0x154bf9"
            ]
          },
          {
            "a": "T1082",
            "c": 0.6499999761581421,
            "d": "Hostname in Go binary",
            "e": [
              "runtime.main.",
              "Hostname",
              "runtime.main",
              "runtime.goexit",
              "runtime.mstart"
            ],
            "i": "micro-behaviors/os/sysinfo/hostname::hostname-string",
            "l": 2,
            "m": "E1082",
            "el": [
              "0x148d41",
              "0x150e13",
              "0x148d54",
              "0x14bd1a",
              "0x14b96c"
            ]
          }
        ],
        "sha": "b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-10/b1ead52870bd3f557716840b7e786af809db6dbf2c6637bb09c7795056a70960.exe",
        "type": "pe"
      }
    ],
    "tv": "ca5ef"
  }
}