{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997461438179016, "class": 2 }, { "id": 1, "prob": 0.9853954911231995, "class": 0 } ], "prob": 0.99974614, "class": 2, "models": [ { "m": "az", "prob": 0.9950742, "class": 0 }, { "m": "az/native", "prob": 0.99948823, "class": 0 }, { "m": "az/pe", "prob": 0.99974614, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T11:42:53Z" }, "path": "111286", "raw": { "v": "4", "fs": [ { "f": "K₂O₉(As₉C₇AlDyEr₄IPSXe)H₆(Cm₅DbF₄OsPo₂Cr)Md₃(Bi₅BkSi₂)", "k": { "pe.timestamp": 1356356554, "hashes.imphash": "3da603644b06c0ab1ac412a11aae3146", "signing.issuer": "Thawte Code Signing CA - G2", "signing.serial": "1c09dbbc732d4b58f7a88ebacf323417", "signing.catalog": "authenticode", "signing.subject": "LLC Mail.Ru", "build.target_arch": "x86", "pe.linker_version": "10.0", "signing.is_signed": true, "signing.not_after": 1391731199, "signing.not_before": 1323388800, "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_GROUP_ICON", "pe.resource_types[3]": "RT_VERSION", "pe.resource_types[4]": "RT_MANIFEST", "signing.signing_time": 1356439652, "pe.rich_header.xor_key": "0x80fa2e2d", "hashes.rich_header_hash": "9eb3220e8549c03c6030c8083ce187f1e6d39d238b7e5634ff4a58038a543968", "signing.thumbprint_sha1": "c183ce85a65d32cbb68f7daace9532b8b31307c2", "pe.version_info.file_version": "1, 0, 0, 0", "pe.version_info.product_name": "Downloader", "pe.dll_characteristics.no_seh": true, "pe.version_info.internal_name": "Downloader", "pe.version_info.legal_copyright": "Copyright c 2005 - 2012", "pe.version_info.product_version": "1, 0, 0, 0", "binary.top_complex_unnamed[0].cc": 53, "binary.top_complex_unnamed[1].cc": 35, "binary.top_complex_unnamed[2].cc": 25, "binary.top_complex_unnamed[3].cc": 20, "binary.top_complex_unnamed[4].cc": 18, "binary.top_complex_unnamed[5].cc": 13, "binary.top_complex_unnamed[6].cc": 11, "binary.top_complex_unnamed[7].cc": 11, "pe.dll_characteristics.nx_compat": true, "pe.manifest.dependencies[0].name": "Microsoft.Windows.Common-Controls", "pe.manifest.dependencies[0].type": "win32", "pe.version_info.file_description": "Downloader", "binary.top_complex_unnamed[0].bbs": 114, "binary.top_complex_unnamed[1].bbs": 71, "binary.top_complex_unnamed[2].bbs": 51, "binary.top_complex_unnamed[3].bbs": 41, "binary.top_complex_unnamed[4].bbs": 42, "binary.top_complex_unnamed[5].bbs": 27, "binary.top_complex_unnamed[6].bbs": 23, "binary.top_complex_unnamed[7].bbs": 25, "pe.version_info.original_filename": "Downloader.exe", "binary.top_complex_unnamed[0].addr": "0x403fa6", "binary.top_complex_unnamed[0].size": 4151, "binary.top_complex_unnamed[1].addr": "0x4036d1", "binary.top_complex_unnamed[1].size": 2261, "binary.top_complex_unnamed[2].addr": "0x405d98", "binary.top_complex_unnamed[2].size": 2001, "binary.top_complex_unnamed[3].addr": "0x402a87", "binary.top_complex_unnamed[3].size": 870, "binary.top_complex_unnamed[4].addr": "0x40880b", "binary.top_complex_unnamed[4].size": 365, "binary.top_complex_unnamed[5].addr": "0x4032b2", "binary.top_complex_unnamed[5].size": 1055, "binary.top_complex_unnamed[6].addr": "0x407d10", "binary.top_complex_unnamed[6].size": 627, "binary.top_complex_unnamed[7].addr": "0x4027c9", "binary.top_complex_unnamed[7].size": 520, "pe.dll_characteristics.dynamic_base": true, "pe.manifest.dependencies[0].version": "6.0.0.0", "pe.rich_header.entries[0].use_count": 15, "pe.rich_header.entries[1].use_count": 90, "pe.rich_header.entries[2].use_count": 17, "pe.rich_header.entries[3].use_count": 1, "pe.rich_header.entries[4].use_count": 1, "pe.manifest.dependencies[0].language": "*", "pe.rich_header.entries[0].product_id": 147, "pe.rich_header.entries[1].product_id": 1, "pe.rich_header.entries[2].product_id": 171, "pe.rich_header.entries[3].product_id": 154, "pe.rich_header.entries[4].product_id": 157, "pe.manifest.requested_execution_level": "requireAdministrator", "pe.rich_header.entries[0].build_number": 30729, "pe.rich_header.entries[0].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[1].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[2].build_number": 40219, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 40219, "pe.rich_header.entries[3].product_name": "C_VS2010", "pe.rich_header.entries[4].build_number": 40219, "pe.rich_header.entries[4].product_name": "Linker_VS2010_LTCG", "pe.dll_characteristics.terminal_server_aware": true, "pe.manifest.dependencies[0].public_key_token": "6595b64144ccf1df", "pe.manifest.dependencies[0].processor_architecture": "x86" }, "x": 166, "id": 0, "is": [ "InternetOpenUrlA", "InternetConnectA", "HttpOpenRequestA", "HttpSendRequestA", "InternetReadFile", "HttpQueryInfoA", "InternetCloseHandle", "InternetOpenA", "InternetSetOptionA", "wvnsprintfA", "PathFindFileNameA", "PathFindExtensionA", "PathFileExistsA", "Sleep", "SetLastError", "GetTempPathA", "lstrcatA", "GetModuleFileNameA", "FindResourceA", "LoadResource", "SizeofResource", "LockResource", "CreateThread", "DeleteFileA", "WaitForSingleObject", "GetStdHandle", "CreateMutexA", "AllocConsole", "FreeConsole", "CloseHandle", "ReleaseMutex", "WriteConsoleA", "lstrlenA", "HeapAlloc", "GetProcessHeap", "HeapFree", "ExitProcess", "GetCommandLineW", "GetModuleHandleA", "SystemTimeToFileTime", "lstrcmpiA", "FindClose", "FindFirstFileA", "SetFileTime", "lstrcpyA", "OutputDebugStringA", "GetLastError", "WideCharToMultiByte", "SetFileAttributesA", "WriteFile", "CreateFileA", "SetFilePointer", "MoveFileA", "GetSystemTimeAsFileTime", "MoveFileExA", "FreeResource", "GetDlgItem", "MessageBoxW", "EnableWindow", "SetWindowLongA", "GetWindowLongA", "SetWindowTextA", "DialogBoxParamA", "SendMessageA", "GetWindowLongW", "SetWindowLongW", "SetTimer", "LoadIconA", "KillTimer", "MoveWindow", "ScreenToClient", "EndDialog", "SendDlgItemMessageA", "MessageBoxA", "SetWindowPos", "GetWindowRect", "ShowWindow", "DefWindowProcA", "SetFocus", "GetWindowTextA", "GetStockObject", "CreateFontW", "GetSaveFileNameA", "CommandLineToArgvW", "ShellExecuteA", "SHGetSpecialFolderPathA", "ShellExecuteExA" ], "ms": { "pe": { "signer": "thawte Primary Root CA, Thawte Code Signing CA - G2, VeriSignMPKI-2-10, LLC Mail.Ru", "machine": 332.0, "checksum": 0.0, "rsrc_size": 22016.0, "subsystem": 2.0, "timestamp": 1356356554.0, "icon_count": 2.0, "image_base": 4194304.0, "leaf_issuer": "Thawte Code Signing CA - G2", "leaf_serial": "1c09dbbc732d4b58f7a88ebacf323417", "rsrc_entropy": 3.53, "signing_time": 1356439652.0, "entry_section": ".text", "has_signature": true, "size_of_image": 77824.0, "timestamp_day": 24.0, "file_alignment": 512.0, "leaf_not_after": 1391731199.0, "primary_signer": "LLC Mail.Ru", "resource_count": 6.0, "resource_types": [ "RT_ICON", "RT_DIALOG", "RT_GROUP_ICON", "RT_VERSION", "RT_MANIFEST" ], "signature_type": "developer", "timestamp_year": 2012.0, "characteristics": 258.0, "entry_point_rva": 7884.0, "leaf_not_before": 1323388800.0, "size_of_headers": 1024.0, "timestamp_month": 12.0, "cert_chain_depth": 3.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 7.0, "manifest_present": true, "signing_time_day": 25.0, "certificate_count": 1.0, "computed_checksum": 90717.0, "section_alignment": 4096.0, "signing_time_year": 2012.0, "cert_validity_days": 790.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "signing_time_month": 12.0, "dll_characteristics": 34112.0, "rich_header_present": true, "leaf_thumbprint_sha1": "c183ce85a65d32cbb68f7daace9532b8b31307c2", "linker_major_version": 10.0, "version_info_present": true, "certificate_table_size": 4032.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 67008.0 }, "binary": { "code_size": 32768.0, "func_count": 147.0, "entry_point": 7884.0, "code_entropy": 5.87, "data_entropy": 2.75, "func_density": 4.59, "import_count": 87.0, "string_count": 219.0, "avg_func_size": 222.88, "has_signature": true, "section_count": 5.0, "avg_complexity": 3.77, "import_density": 2.72, "max_complexity": 53.0, "string_density": 6.84, "overall_entropy": 4.1, "avg_basic_blocks": 7.3, "avg_section_size": 12390.4, "dependency_count": 7.0, "entropy_variance": 2.18, "avg_string_length": 17.1, "complexity_per_kb": 0.12, "max_string_length": 184.0, "wide_string_count": 23.0, "writable_sections": 1.0, "avg_string_entropy": 3.17, "code_to_data_ratio": 1.12, "data_to_file_ratio": 0.01, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.33, "text_to_file_ratio": 0.49, "total_basic_blocks": 1073.0, "embedded_file_count": 1.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "string_length_stddev": 17.12, "embedded_binary_count": 1.0, "high_complexity_funcs": 1.0, "largest_section_ratio": 0.49, "sentence_string_count": 23.0, "sentence_string_ratio": 0.11, "behavioral_import_ratio": 0.05, "unnamed_complex_func_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 184, "Rich-." ], [ 448, ".text" ], [ 527, "@.data" ], [ 568, ".rsrc" ], [ 607, "@.reloc" ], [ 2633, "Atjdj" ], [ 34168, "leave from base cose 10 attempts were used;" ], [ 34224, "Need to restart in base" ], [ 34260, "open" ], [ 34336, "http://internetmailru.cdnmail.ru/Internet.exe" ], [ 34384, "Internet.exe" ], [ 34612, "leave from progress cose 10 attempts were used;" ], [ 34672, "Need to restart in browser" ], [ 34772, "Complete: %s" ], [ 34792, "Filename: %s" ], [ 34852, "http://voffka.com" ], [ 34872, "wide", "MS Sans Serif" ], [ 34900, "%d.%s%d" ], [ 34935, "A%d.%s%d" ], [ 35100, "tiny-dl/nix" ], [ 35120, "Content-Length" ], [ 35144, "code: %d, requested %d bytes, read %d bytes, total: %d of %d" ], [ 35208, "Last-Modified:" ], [ 35224, "Content-Length:" ], [ 35244, "plain" ], [ 35264, "Content-Type:" ], [ 35280, "Range: bytes=%d-" ], [ 35308, "Request returned code %d" ], [ 35336, "HEAD" ], [ 35344, "InternetConnect () failed" ], [ 35372, "Protocol not supported" ], [ 35396, "profitraf1" ], [ 35408, "simple" ], [ 35416, "dltype" ], [ 35424, "referer" ], [ 35432, "force_run" ], [ 35444, "file_size" ], [ 35468, "name" ], [ 35476, "partner_online_url" ], [ 35496, "partner_new_url" ], [ 35540, "partner_new_url_inet" ], [ 35564, "referer_inet" ], [ 35580, "\u003cinternet_silent\u003e" ], [ 35600, "\u003cinternet\u003e" ], [ 35644, "/silent /rfr=%s /partner_new_url=%s" ], [ 35684, "%s%s%d" ], [ 35692, "\\downloader_tmp_" ], [ 35716, "runprog.exe" ], [ 35800, "explorer" ], [ 35852, "http://to-load.ru/get_xml?file_id=" ], [ 35928, "%s.%d.exe" ], [ 35940, ".exe" ], [ 35976, "All files" ], [ 36040, "http://dlm.mail.ru/about/" ], [ 36068, "http://sputnik.mail.ru" ], [ 36092, "http://internet.mail.ru" ], [ 36280, "leave the progress due to 10 attempts were used;" ], [ 36340, "\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e\u003e Need to restart" ], [ 36388, "tiny-dl" ], [ 36396, "http://binupdate.mail.ru/dwnld/url?u=" ], [ 36456, "http://r.mail.ru/cln5491/exe.agent.mail.ru/sputnik/mailrusputnik.exe" ], [ 36528, "mailrusputnik.exe" ], [ 36560, "/partner_online_url=" ], [ 37122, "InternetSetOptionA" ], [ 37144, "InternetOpenA" ], [ 37160, "InternetCloseHandle" ], [ 37182, "HttpQueryInfoA" ], [ 37200, "InternetReadFile" ], [ 37220, "HttpSendRequestA" ], [ 37240, "HttpOpenRequestA" ], [ 37260, "InternetConnectA" ], [ 37280, "InternetOpenUrlA" ], [ 37298, "WININET.dll" ], [ 37312, "PathFileExistsA" ], [ 37330, "PathFindExtensionA" ], [ 37352, "PathFindFileNameA" ], [ 37372, "wvnsprintfA" ], [ 37384, "SHLWAPI.dll" ], [ 37398, "CreateThread" ], [ 37414, "DeleteFileA" ], [ 37428, "WaitForSingleObject" ], [ 37450, "GetStdHandle" ], [ 37466, "CreateMutexA" ], [ 37482, "AllocConsole" ], [ 37498, "FreeConsole" ], [ 37512, "CloseHandle" ], [ 37526, "ReleaseMutex" ], [ 37542, "WriteConsoleA" ], [ 37558, "lstrlenA" ], [ 37570, "HeapAlloc" ], [ 37582, "GetProcessHeap" ], [ 37600, "HeapFree" ], [ 37612, "ExitProcess" ], [ 37626, "GetCommandLineW" ], [ 37644, "GetModuleHandleA" ], [ 37664, "SystemTimeToFileTime" ], [ 37688, "lstrcmpiA" ], [ 37700, "FindClose" ], [ 37712, "FindFirstFileA" ], [ 37730, "SetFileTime" ], [ 37744, "lstrcpyA" ], [ 37756, "OutputDebugStringA" ], [ 37778, "GetLastError" ], [ 37794, "WideCharToMultiByte" ], [ 37816, "SetFileAttributesA" ], [ 37838, "WriteFile" ], [ 37850, "CreateFileA" ], [ 37864, "SetFilePointer" ], [ 37894, "lstrcatA" ], [ 37920, "GetSystemTimeAsFileTime" ], [ 37946, "GetModuleFileNameA" ], [ 37968, "Sleep" ], [ 37976, "SetLastError" ], [ 37992, "GetTempPathA" ], [ 38008, "FreeResource" ], [ 38024, "LockResource" ], [ 38040, "SizeofResource" ], [ 38058, "LoadResource" ], [ 38074, "FindResourceA" ], [ 38088, "KERNEL32.dll" ], [ 38118, "MessageBoxW" ], [ 38132, "EnableWindow" ], [ 38148, "SetWindowLongA" ], [ 38166, "GetWindowLongA" ], [ 38184, "SetWindowTextA" ], [ 38202, "DialogBoxParamA" ], [ 38220, "SendMessageA" ], [ 38236, "GetWindowLongW" ], [ 38254, "SetWindowLongW" ], [ 38272, "SetTimer" ], [ 38296, "KillTimer" ], [ 38308, "MoveWindow" ], [ 38322, "ScreenToClient" ], [ 38340, "EndDialog" ], [ 38352, "SendDlgItemMessageA" ], [ 38374, "MessageBoxA" ], [ 38388, "SetWindowPos" ], [ 38404, "GetWindowRect" ], [ 38420, "ShowWindow" ], [ 38434, "DefWindowProcA" ], [ 38452, "SetFocus" ], [ 38464, "GetWindowTextA" ], [ 38480, "USER32.dll" ], [ 38494, "CreateFontW" ], [ 38508, "GetStockObject" ], [ 38524, "GDI32.dll" ], [ 38536, "GetSaveFileNameA" ], [ 38554, "COMDLG32.dll" ], [ 38570, "ShellExecuteExA" ], [ 38588, "CommandLineToArgvW" ], [ 38610, "ShellExecuteA" ], [ 38626, "SHGetSpecialFolderPathA" ], [ 38650, "SHELL32.dll" ], [ 40248, "Rich" ], [ 41099, "QQSVW" ], [ 41684, "wide", "restarted" ], [ 41708, "wide", "open" ], [ 41924, "lstrcmpiW" ], [ 41936, "lstrcatW" ], [ 41948, "lstrcpyW" ], [ 41974, "ShellExecuteW" ], [ 42024, "RSDS" ], [ 42048, "C:\\Projects\\sputnik.mail.ru\\trunk\\_out\\RunProg.pdb" ], [ 57928, "wide", "mailrusputnik.exe" ], [ 58156, "wide", "exe.agent.mail.ru" ], [ 58368, "wide", "SysLink" ], [ 58970, "wide", "MS Shell Dlg" ], [ 59020, "wide", "msctls_progress32" ], [ 59324, "wide", "Static" ], [ 60082, "wide", "VS_VERSION_INFO" ], [ 60174, "wide", "StringFileInfo" ], [ 60234, "wide", "FileDescription" ], [ 60268, "wide", "Downloader" ], [ 60298, "wide", "FileVersion" ], [ 60354, "wide", "InternalName" ], [ 60410, "wide", "LegalCopyright" ], [ 60440, "wide", "Copyright c 2005 - 2012" ], [ 60494, "wide", "OriginalFilename" ], [ 60528, "wide", "Downloader.exe" ], [ 60566, "wide", "ProductName" ], [ 60622, "wide", "ProductVersion" ], [ 60682, "wide", "VarFileInfo" ], [ 60714, "wide", "Translation" ], [ 60744, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 60819, "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e" ], [ 60875, "\u003csecurity\u003e" ], [ 60891, "\u003crequestedPrivileges\u003e" ], [ 60920, "\u003crequestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e" ], [ 61027, "\u003c/requestedPrivileges\u003e" ], [ 61057, "\u003c/security\u003e" ], [ 61074, "\u003c/trustInfo\u003e" ], [ 61090, "\u003cdependency\u003e" ], [ 61106, "\u003cdependentAssembly\u003e" ], [ 61131, "\u003cassemblyIdentity type=\"win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0\" processorArchitecture=\"x86\" publicKeyT" ], [ 61323, "\u003c/dependentAssembly\u003e" ], [ 61349, "\u003c/dependency\u003e" ], [ 61366, "\u003c/assembly\u003ePADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD" ], [ 62129, "81989L9" ], [ 63038, "Z0X03" ], [ 63206, "thawte, Inc.1(0\u0026" ], [ 63229, "Certification Services Division1806" ], [ 63270, "/(c) 2006 thawte, Inc. - For authorized use only1" ], [ 63329, "thawte Primary Root CA0" ], [ 63409, "Thawte, Inc.1$0\"" ], [ 63432, "Thawte Code Signing CA - G20" ], [ 63799, "#http://crl.thawte.com/ThawtePCA.crl0" ], [ 63881, "http://ocsp.thawte.com0" ], [ 63960, "VeriSignMPKI-2-100" ], [ 64038, "WHP0" ], [ 65591, "LLC Mail.Ru1" ], [ 65613, "LLC Mail.Ru0" ], [ 65946, "40200" ], [ 65956, "*http://cs-g2-crl.thawte.com/ThawteCSG2.crl0" ], [ 66472, "Thawte Code Signing CA - G2" ], [ 66669, "1705" ], [ 66677, "Mail.ru downloader application" ], [ 66711, "http://mail.ru/0" ], [ 66808, "uy2t" ] ], "sz": 67008, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: thawte Primary Root CA", "e": [ "thawte Primary Root CA" ], "i": "metadata/signed/developer::thawte-primary-root-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Thawte Code Signing CA - G2", "e": [ "Thawte Code Signing CA - G2" ], "i": "metadata/signed/developer::thawte-code-signing-ca---g2", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSignMPKI-2-10", "e": [ "VeriSignMPKI-2-10" ], "i": "metadata/signed/developer::verisignmpki-2-10", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: LLC Mail.Ru", "e": [ "LLC Mail.Ru" ], "i": "metadata/signed/developer::llc-mail.ru", "l": 2 }, { "c": 1.0, "d": "Signed by LLC Mail.Ru", "e": [ "LLC Mail.Ru" ], "i": "metadata/signed/leaf::llc-mail.ru", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "Embedded PE binary at file offset 0x9c88 (~16384 bytes)", "e": [ "kind=Pe32 estimated_size=16384" ], "i": "binary/embedded/pe", "l": 3 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.17", "binary.avg_string_entropy = 2.88" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.00", "binary.avg_complexity = 3.77" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 3 }, { "c": 0.8999999761581421, "d": "Convert SYSTEMTIME to FILETIME", "e": [ "SystemTimeToFileTime" ], "i": "micro-behaviors/time/query::systemtime-to-filetime", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 16384.00", "pe.size_of_image = 77824.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "SHGetSpecialFolderPathA", "PathFileExistsA", "GetTempPathA", "PathFindFileNameA", "PathFindExtensionA" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "InternetReadFile stack-string token", "e": [ "InternetReadFile" ], "i": "objectives/anti-static/obfuscation/imports::stack-internetreadfile-token", "l": 3, "m": "B0032" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1073.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 87.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload/resource::load-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "Create modal dialog box (ANSI)", "e": [ "DialogBoxParamA" ], "i": "micro-behaviors/ui/dialog/prompt::dialog-box-param-a", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetConnect API name as string", "e": [ "InternetConnectA" ], "i": "micro-behaviors/communications/http/get::internet-connect-str", "l": 1 }, { "c": 0.949999988079071, "d": "Initialize WinInet session", "e": [ "InternetOpenA" ], "i": "micro-behaviors/communications/http/get::internet-open", "l": 3 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetCloseHandle API name", "e": [ "InternetCloseHandle" ], "i": "micro-behaviors/communications/http/get::internet-close-handle-str", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Modify file creation/access/write times", "e": [ "SetFileTime" ], "i": "micro-behaviors/fs/sync/fsync::set-file-time", "l": 3 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 87.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (eToF)", "e": [ "SystemTimeToFileTime" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-etof", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.85", "binary.overall_entropy = 4.10" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.800000011920929, "d": "ReleaseMutex API call", "e": [ "ReleaseMutex" ], "i": "micro-behaviors/process/sync/mutex::release-mutex", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 219.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1071.001", "c": 0.949999988079071, "d": "Read data from internet handle", "e": [ "InternetReadFile" ], "i": "micro-behaviors/communications/http/get::internet-read-file", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 3 }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage/control::set-timer", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "\\downloader_tmp_", "Downloader", "Downloader.exe", "Mail.ru downloader application" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5", "l": 1 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage/control::set-window-pos", "l": 2 }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[{\"type\":\"win32\",\"name\":\"Microsoft.Windows.Common-Controls\",\"version\":\"6.0.0.0\",\"processor_architecture\":\"x86\",\"public_key_token" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00", "pe.import_dll_count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.699999988079071, "d": "Set window data", "e": [ "SetWindowLongW" ], "i": "micro-behaviors/ui/window/manage/control::set-window-long", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": "requestedExecutionLevel is requireAdministrator", "e": [ "requireAdministrator" ], "i": "metadata/build/manifest::pe-requires-admin", "l": 3 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringA" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "Downloader.exe", "Mail.ru downloader application", "\\downloader_tmp_", "Downloader" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 87.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 147.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "a": "T1071.001", "c": 0.949999988079071, "d": "HttpSendRequest WinInet API", "e": [ "HttpSendRequestA" ], "i": "micro-behaviors/communications/http/post::http-send-request", "l": 3, "m": "C0002" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.800000011920929, "d": "Uses internet communication API imports", "e": [ "HttpOpenRequestA", "InternetOpenA" ], "i": "micro-behaviors/communications/http/client/winhttp::has-internet-communication-apis", "l": 3 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "InternetConnect () failed", "InternetConnectA" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012" }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage/control::get-window-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file attributes (ANSI)", "e": [ "SetFileAttributesA" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-a", "l": 2 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file with options", "e": [ "MoveFileExA" ], "i": "micro-behaviors/fs/file/move::move-file-ex", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::find-resource-a", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "\u003cassemblyIdentity type=\"win32\" name=\"Microsoft.Windows.Common-Controls\" version=\"6.0.0.0\" processorArchitecture=\"x86\" publicKeyT" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage/control::send-message-a", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload/resource::lock-resource", "l": 2 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "OutputDebugStringA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.85", "binary.overall_entropy = 4.10" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextA" ], "i": "micro-behaviors/ui/window/manage/control::get-window-text", "l": 2 }, { "c": 0.949999988079071, "d": "Send HTTP request via WinInet", "e": [ "HttpSendRequestA" ], "i": "micro-behaviors/communications/http/get::http-send-request", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "111286", "111286!!embedded:pe@0x9c88" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.8199999928474426, "d": "Resolve special folder path ANSI", "e": [ "SHGetSpecialFolderPathA" ], "i": "micro-behaviors/fs/shell-ops::shell-get-special-folder-path-a", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload/resource::sizeof-resource", "l": 2 }, { "c": 0.6499999761581421, "d": "Close dialog and return result", "e": [ "EndDialog" ], "i": "micro-behaviors/ui/dialog/prompt::end-dialog", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage/control::show-window", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "PE has an Authenticode signature", "e": [ "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-is-authenticode-signed", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "explorer" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "c": 0.949999988079071, "d": "Open HTTP request via WinInet", "e": [ "HttpOpenRequestA" ], "i": "micro-behaviors/communications/http/get::http-open-request", "l": 3 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 147.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1027.007", "c": 0.9200000166893005, "d": "InternetSetOptio truncated stack fragment", "e": [ "InternetSetOptionA" ], "i": "objectives/anti-static/obfuscation/imports::stack-internetsetoption-truncated", "l": 3, "m": "B0032" }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage/control::kill-timer", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpQueryInfo API name as string", "e": [ "HttpQueryInfoA" ], "i": "micro-behaviors/communications/http/get::http-query-info-str", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "a": "T1027.007", "c": 0.9200000166893005, "d": "InternetCloseHan truncated stack fragment", "e": [ "InternetCloseHandle" ], "i": "objectives/anti-static/obfuscation/imports::stack-internetclosehandle-truncated", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetReadFile API name as string", "e": [ "InternetReadFile" ], "i": "micro-behaviors/communications/http/get::internet-read-file-str", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage/control::enable-window", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"requireAdministrator\",\"ui_access\":false,\"dependencies\":[{\"type\":\"win32\",\"name\":\"Microsoft.Windows." ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1356356554.00", "pe.timestamp = 1347006132.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "\u003c/assembly\u003ePADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "c": 0.8999999761581421, "d": "Check file existence via SHLWAPI", "e": [ "PathFileExistsA" ], "i": "micro-behaviors/fs/path/check::path-file-exists", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 147.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseHandle", "InternetCloseHandle", "FindClose" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 87.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpOpenRequest API name as string", "e": [ "HttpOpenRequestA" ], "i": "micro-behaviors/communications/http/get::http-open-request-str", "l": 1 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.949999988079071, "d": "Connect to HTTP/FTP server via WinInet", "e": [ "InternetConnectA" ], "i": "micro-behaviors/communications/http/get::internet-connect", "l": 3 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpSendRequest API name as string", "e": [ "HttpSendRequestA" ], "i": "micro-behaviors/communications/http/get::http-send-request-str", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetOpen API name as string", "e": [ "InternetOpenA" ], "i": "micro-behaviors/communications/http/get::internet-open-str", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "RunProg.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "40" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "a": "T1059.003", "c": 0.8999999761581421, "d": "ShellExecuteExA ANSI extended API", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/system::shell-execute-ex-a", "l": 3, "m": "E1059.003" }, { "c": 0.699999988079071, "d": "Get window data", "e": [ "GetWindowLongW" ], "i": "micro-behaviors/ui/window/manage/control::get-window-long", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 87.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Move or rename file", "e": [ "MoveFileA" ], "i": "micro-behaviors/fs/file/move::move-file", "l": 2 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "download", "Download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "c": 0.8999999761581421, "d": "Open URL via WinInet", "e": [ "InternetOpenUrlA" ], "i": "micro-behaviors/communications/http/get::internet-open-url", "l": 3 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027.007", "c": 0.9200000166893005, "d": "InternetOpenUrlA stack-string token", "e": [ "InternetOpenUrlA" ], "i": "objectives/anti-static/obfuscation/imports::stack-internetopenurla-token", "l": 3, "m": "B0032" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 87.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 87.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage/control::screen-to-client", "l": 2 }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://to-load.ru/", "http://mail.ru/", "http://voffka.com" ], "i": "objectives/command-and-control/infrastructure/domain/heuristic::http-url-binary", "l": 3, "m": "C0002" }, { "c": 1.0, "d": "Compatibility alias", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex-a", "l": 1 }, { "a": "T1071", "c": 1.0, "d": "GetWindowText import (ANSI or wide)", "e": [ "GetWindowTextA" ], "i": "objectives/command-and-control/backdoor/shell/com::get-window-text-import", "l": 1, "m": "B0025" }, { "a": "T1071", "c": 1.0, "d": "GetWindow / GetWindowRect import", "e": [ "GetWindowRect" ], "i": "objectives/command-and-control/backdoor/shell/com::get-window-rect-import", "l": 1, "m": "B0025" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemTimeAsFileTime", "GetModuleFileNameA", "SystemTimeToFileTime", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 4 }, { "a": "T1071.001", "c": 0.949999988079071, "d": "InternetOpenUrl downloader API string", "e": [ "InternetOpenUrlA" ], "i": "micro-behaviors/communications/http/get::dynamic-wininet-api-set", "l": 4 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.7200000286102295, "d": "WinInet DLL import name", "e": [ "WININET.dll" ], "i": "micro-behaviors/communications/http/get::wininet-dll-import-name", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (wvnsprintfA, PathFindFileNameA, PathFindExtensionA, PathFileExistsA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (Sleep, SetLastError, GetTempPathA, lstrcatA, GetModuleFileNameA, ... +38 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links COMDLG32.dll (GetSaveFileNameA)", "e": [ "COMDLG32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WININET.dll (InternetOpenUrlA, InternetConnectA, HttpOpenRequestA, HttpSendRequestA, InternetReadFile, ... +4 more)", "e": [ "WININET.dll" ], "i": "metadata/dylib::wininet/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (GetStockObject, CreateFontW)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (CommandLineToArgvW, ShellExecuteA, SHGetSpecialFolderPathA, ShellExecuteExA)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetDlgItem, MessageBoxW, EnableWindow, SetWindowLongA, GetWindowLongA, ... +19 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "Standard MSVC CRT linkage (rich header + many imports)", "e": [ "binary.import_count = 87.00", "pe.rich_header_present = 1.00" ], "i": "objectives/evasion/process/injection/module-stomping::msvc-crt-full-linkage", "l": 1 }, { "c": 0.8500000238418579, "d": "Drop and execute file from Temp directory", "e": [ "GetTempPathA", "ShellExecuteA", "WriteFile" ], "i": "objectives/command-and-control/dropper/staging/temp::temp-file-execution", "l": 2 }, { "c": 0.800000011920929, "d": "Temp directory staging primitives", "e": [ "GetTempPathA", "MoveFileExA" ], "i": "micro-behaviors/fs/temp/directory::temp-file-staging-primitives", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "WinInet APIs resolved dynamically", "e": [ "HttpSendRequestA", "InternetReadFile", "HttpQueryInfoA", "HttpOpenRequestA", "InternetCloseHandle", "InternetConnectA", "InternetReadFile", "InternetOpenA" ], "i": "micro-behaviors/communications/http/get::wininet-dynamic-load", "l": 2 }, { "c": 0.8999999761581421, "d": "WinInet request and response workflow", "e": [ "HttpOpenRequestA", "InternetOpenUrlA", "HttpSendRequestA", "InternetOpenA", "InternetReadFile", "InternetConnectA" ], "i": "micro-behaviors/communications/http/get::wininet-http-flow", "l": 3 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "GetLastError", "CreateMutexA", "ExitProcess" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "LoadResource", "SizeofResource", "LockResource", "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-full-extraction", "l": 3 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file/script::module-path-delete", "l": 2, "m": "F0007" }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "LockResource", "LoadResource", "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload/resource::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1027.007", "c": 0.9700000286102295, "d": "WININET API names built as stack strings", "e": [ "InternetOpenUrlA", "InternetSetOptionA", "InternetCloseHandle", "InternetReadFile" ], "i": "objectives/anti-static/obfuscation/imports::wininet-stack-string-fragment-cluster", "l": 4, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Resource extraction to temp directory", "e": [ "LockResource", "GetTempPathA", "LoadResource", "SizeofResource", "FindResourceA" ], "i": "objectives/command-and-control/dropper/staging/embedded::pe-resource-temp-stager-persistence-chain", "l": 1 }, { "a": "T1105", "c": 0.949999988079071, "d": "Temp staged file copy with shell handoff", "e": [ "MoveFileA", "GetTempPathA", "ShellExecuteA", "GetModuleFileNameA", "MoveFileExA" ], "i": "objectives/command-and-control/dropper/execution/loader::temp-copy-shell-handoff", "l": 4, "m": "B0024" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 20.00" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8799999952316284, "d": "Small string table footprint", "e": [ "binary.string_count = 21.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table", "l": 1 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.84" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 10.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.8999999761581421, "d": "VB6 binary with very few strings", "e": [ "binary.string_count = 21.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6", "l": 1, "m": "B0032" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.8799999952316284, "d": ".reloc section nearly as large as .text", "e": [ ".reloc", ".reloc = 100.0% of .text (512 / 512 bytes)" ], "i": "metadata/binary/section/metrics::reloc-near-text-size", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.overlay_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 2.57" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteW)", "e": [ "ShellExecuteW" ], "i": "micro-behaviors/process/create/exec::shell-execute", "l": 3 }, { "c": 0.8799999952316284, "d": "Sparse function count stub", "e": [ "binary.func_count = 1.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::sparse-function-stub", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny PE single-function stub", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/layout::tiny-single-function-pe", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.84" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 10.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 10.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.9900000095367432, "d": "Single-function packed stub layout", "e": [ "binary.func_count = 1.00" ], "i": "well-known/malware/worm/mydoom::metric-function-count-1", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 34112.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "c": 0.4000000059604645, "d": "Very few basic blocks (analysis-limited or sparse)", "e": [ "binary.total_basic_blocks = 8.00" ], "i": "metadata/binary/metrics/structural::few-basic-blocks", "l": 3 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Execution capability with minimal imports", "e": [ "ShellExecuteW", "HeapAlloc" ], "i": "objectives/anti-static/obfuscation/payload/import::shell-exec-minimal-imports", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "b1f4c1a007318acf062b8a13c813eb66d667e58a63cdbeccb87bb566d7a0ec36", "path": "111286", "type": "pe" }, { "f": "KO₄(As₆C₃Er₂S)H(Po)Md₄(Bi₅SiHePa)", "x": 40, "dp": 1, "id": 1, "is": [ "ExitProcess", "GetCommandLineW", "HeapAlloc", "GetProcessHeap", "Sleep", "lstrcmpiW", "lstrcatW", "lstrcpyW", "CommandLineToArgvW", "ShellExecuteW" ], "ms": { "pe": { "machine": 332.0, "checksum": 22685.0, "pdb_path": "C:\\Projects\\sputnik.mail.ru\\trunk\\_out\\RunProg.pdb", "subsystem": 2.0, "timestamp": 1347006132.0, "image_base": 4194304.0, "codeview_age": 17.0, "codeview_guid": "D737CEE4-6F23-4B21-BB47-040FF7ADF966", "entry_section": ".text", "size_of_image": 16384.0, "timestamp_day": 7.0, "file_alignment": 512.0, "timestamp_year": 2012.0, "characteristics": 258.0, "entry_point_rva": 4096.0, "size_of_headers": 1024.0, "timestamp_month": 9.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 2.0, "checksum_mismatch": true, "computed_checksum": 34508.0, "section_alignment": 4096.0, "number_of_sections": 3.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1347006132.0, "debug_timestamp_min": 1347006132.0, "dll_characteristics": 34112.0, "rich_header_present": true, "linker_major_version": 10.0, "debug_directory_types": [ 2.0 ], "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "file": { "size": 16384.0 }, "binary": { "code_size": 512.0, "func_count": 1.0, "entry_point": 4096.0, "has_overlay": true, "code_entropy": 3.31, "data_entropy": 4.36, "func_density": 2.0, "import_count": 10.0, "overlay_size": 13824.0, "string_count": 21.0, "avg_func_size": 214.0, "overlay_ratio": 0.84, "section_count": 3.0, "avg_complexity": 5.0, "import_density": 20.0, "max_complexity": 5.0, "string_density": 42.0, "overall_entropy": 2.85, "overlay_entropy": 2.57, "avg_basic_blocks": 8.0, "avg_section_size": 512.0, "dependency_count": 2.0, "entropy_variance": 1.46, "avg_string_length": 12.43, "complexity_per_kb": 10.0, "max_string_length": 50.0, "wide_string_count": 1.0, "avg_string_entropy": 2.88, "code_to_data_ratio": 0.5, "entry_point_is_rva": true, "text_to_file_ratio": 0.03, "total_basic_blocks": 8.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "string_length_stddev": 11.34, "debug_reference_count": 1.0, "largest_section_ratio": 0.03, "sentence_string_count": 1.0, "sentence_string_ratio": 0.05, "behavioral_import_ratio": 0.1 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 176, "Rich" ], [ 448, ".text" ], [ 527, "@.reloc" ], [ 1027, "QQSVW" ], [ 1612, "restarted" ], [ 1636, "wide", "open" ], [ 1782, "ExitProcess" ], [ 1796, "GetCommandLineW" ], [ 1814, "HeapAlloc" ], [ 1826, "GetProcessHeap" ], [ 1844, "Sleep" ], [ 1852, "lstrcmpiW" ], [ 1864, "lstrcatW" ], [ 1876, "lstrcpyW" ], [ 1886, "KERNEL32.dll" ], [ 1902, "ShellExecuteW" ], [ 1918, "CommandLineToArgvW" ], [ 1938, "SHELL32.dll" ], [ 1952, "RSDS" ], [ 1976, "C:\\Projects\\sputnik.mail.ru\\trunk\\_out\\RunProg.pdb" ] ], "sz": 16384, "ts": [ { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.88" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 16384.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.800000011920929, "d": "Dense PE import table references", "e": [ "binary.import_density = 20.00" ], "i": "metadata/binary/metrics/structural::high-import-density", "l": 3 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 2.85" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8799999952316284, "d": "Small string table footprint", "e": [ "binary.string_count = 21.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table", "l": 1 }, { "c": 0.9399999976158142, "d": "PE overlay exceeds thirty-five percent", "e": [ "binary.overlay_ratio = 0.84" ], "i": "metadata/binary/layout::overlay-over-35pct", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 10.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.8999999761581421, "d": "VB6 binary with very few strings", "e": [ "binary.string_count = 21.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.85" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "111286!!embedded:pe@0x9c88" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.8799999952316284, "d": ".reloc section nearly as large as .text", "e": [ ".reloc = 100.0% of .text (512 / 512 bytes)", ".reloc" ], "i": "metadata/binary/section/metrics::reloc-near-text-size", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1347006132.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.overlay_ratio = 0.84" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "RunProg.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 2.57" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteW)", "e": [ "ShellExecuteW" ], "i": "micro-behaviors/process/create/exec::shell-execute", "l": 3 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8799999952316284, "d": "Sparse function count stub", "e": [ "binary.func_count = 1.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::sparse-function-stub", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny PE single-function stub", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/layout::tiny-single-function-pe", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.9200000166893005, "d": "Overlay exceeds one-third", "e": [ "binary.overlay_ratio = 0.84" ], "i": "metadata/binary/layout::overlay-dominates-third", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 10.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 10.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.9900000095367432, "d": "Single-function packed stub layout", "e": [ "binary.func_count = 1.00" ], "i": "well-known/malware/worm/mydoom::metric-function-count-1", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 1.0, "d": "ASLR bit not set in DLL Characteristics", "e": [ "pe.dll_characteristics = 34112.00" ], "i": "metadata/hardening/mitigation::no-aslr-bit", "l": 1 }, { "c": 0.4000000059604645, "d": "Very few basic blocks (analysis-limited or sparse)", "e": [ "binary.total_basic_blocks = 8.00" ], "i": "metadata/binary/metrics/structural::few-basic-blocks", "l": 3 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (ExitProcess, GetCommandLineW, HeapAlloc, GetProcessHeap, Sleep, ... +3 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHELL32.dll (CommandLineToArgvW, ShellExecuteW)", "e": [ "SHELL32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Execution capability with minimal imports", "e": [ "ShellExecuteW", "HeapAlloc" ], "i": "objectives/anti-static/obfuscation/payload/import::shell-exec-minimal-imports", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 } ], "sha": "5f68b34aa22e00524fa42636ea4c69f99ddd4e38ccb78708fa9eda7d3edd474d", "path": "111286!!embedded:pe@0x9c88", "type": "pe" } ], "tv": "db300" } }