{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.31724137, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T11:22:24Z" }, "path": "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(Bi₂Si)", "x": 6, "ff": { "i": [ [ "kernel32", "GetModuleHandleA" ], [ "user32", "LoadStringA" ], [ "gdi32", "GetStockObject" ], [ "ole32", "CoUninitialize" ], [ "oleaut32", "ORDINAL 9" ], [ "comctl32", "ORDINAL 17" ], [ "comdlg32", "GetOpenFileNameW" ], [ "shell32", "CommandLineToArgvW" ] ], "m": { "pe": { "checksum": 3444508.0, "checksum_valid": 0.0, "computed_checksum": 3470080.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 3433024.0, "entropy": 7.88, "size_bytes": 3433024.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 7.94, "data_entropy": 7.74, "overlay_size": 10304.0, "string_count": 35404.0, "overlay_ratio": 0.0, "overlay_entropy": 7.49, "entropy_variance": 4.92, "avg_string_length": 4.63, "max_string_length": 76.0, "code_to_data_ratio": 0.99, "string_length_stddev": 1.64, "largest_section_ratio": 0.83, "sentence_string_count": 17.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 8.0 }, "sections": { "count": 10.0, "code_size": 2934784.0, "entropy_max": 7.98, "entropy_mean": 6.24, "name_entropy": 2.09, "writable_count": 3.0, "executable_count": 3.0, "nonstandard_count": 8.0, "executable_writable_count": 1.0 }, "dependencies": { "count": 8.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 232, "u8", "Rich" ], [ 759, "u8", "@.rsrc" ], [ 799, "u8", "@.idata" ], [ 840, "u8", ".themida" ], [ 880, "u8", ".boot" ], [ 3911, "u8", "E9YX" ], [ 4261, "u8", "U25WO" ], [ 6002, "u8", "a.El" ], [ 6453, "u8", "aXREC" ], [ 8047, "u8", "BJM_" ], [ 8375, "u8", "evbe" ], [ 8913, "u8", "7RUM" ], [ 9571, "u8", "BSJR" ], [ 9710, "u8", "S2FS" ], [ 11027, "u8", "7kXnd" ], [ 11987, "u8", "5 VT" ], [ 12851, "u8", "ScqV1S" ], [ 12996, "u8", "7gdDY" ], [ 18607, "u8", "io6q" ], [ 19645, "u8", "ZWxA4" ], [ 21252, "u8", "IHI6" ], [ 22437, "u8", "UJQ6" ], [ 22885, "u8", "/GhS" ], [ 23199, "u8", "aXxes" ], [ 23843, "u8", "5TVLC" ], [ 27667, "u8", "npAr9" ], [ 27877, "u8", "/rXl" ], [ 31792, "u8", "d0I08" ], [ 34049, "u8", "Lpgq" ], [ 35569, "u8", "hkTC6" ], [ 36456, "u8", "fXbiNc" ], [ 37067, "u8", "D4S3" ], [ 38530, "u8", "W6Z0" ], [ 39859, "u8", "Ei62U" ], [ 42404, "u8", "jFxl" ], [ 42959, "u8", "c655Eam" ], [ 42974, "u8", "FtcWQhW" ], [ 45517, "u8", "il dO" ], [ 45927, "u8", "5eifp" ], [ 46853, "u8", "Sd5jk" ], [ 49680, "u8", "hpZu" ], [ 50135, "u8", "VNC1U" ], [ 50470, "u8", "w D.q" ], [ 52693, "u8", "Andf" ], [ 53017, "u8", "/aca" ], [ 53632, "u8", "TNZQt" ], [ 56789, "u8", "}(vu" ], [ 58774, "u8", "/yPV" ], [ 61702, "u8", "9 rf" ], [ 61867, "u8", "OlKr/tx" ], [ 62072, "u8", "KTD_" ], [ 66793, "u8", "vZ0ye" ], [ 67243, "u8", "s3uv" ], [ 67317, "u8", "cvxMt" ], [ 67797, "u8", "rOrPV" ], [ 68701, "u8", "JTFui" ], [ 70661, "u8", "L4QO" ], [ 73420, "u8", "a{)8" ], [ 74032, "u8", "lOhz" ], [ 74590, "u8", "fb03" ], [ 77175, "u8", "o Ew" ], [ 78574, "u8", "iAmt" ], [ 81736, "u8", "vgbsEf" ], [ 83703, "u8", "DYQhvE" ], [ 86226, "u8", "ZeUGh" ], [ 86527, "u8", "Nqu :l" ], [ 91303, "u8", "qfNa" ], [ 92391, "u8", "qPhp" ], [ 93582, "u8", "BLM7" ], [ 96994, "u8", "4JEN" ], [ 97833, "u8", "BReU5B" ], [ 98126, "u8", "K4EFG" ], [ 99025, "u8", "JL2M" ], [ 102514, "u8", "sHvq" ], [ 103207, "u8", "JwfkM" ], [ 103485, "u8", "pSLdB" ], [ 104156, "u8", "lmDa" ], [ 104601, "u8", "l43yA" ], [ 105278, "u8", "zjFq" ], [ 108441, "u8", "Rd u" ], [ 108917, "u8", "K_HR" ], [ 110602, "u8", "MY0D" ], [ 111639, "u8", "nYui" ], [ 112295, "u8", "nlBwk" ], [ 112523, "u8", "FceTj" ], [ 112687, "u8", "6 kn" ], [ 113533, "u8", "HOW G" ], [ 113723, "u8", "0fZUq" ], [ 114723, "u8", "yc5e" ], [ 115848, "u8", "dycQqU" ], [ 118195, "u8", "kJee" ], [ 118397, "u8", "JCkFP" ], [ 119881, "u8", "S28xju" ], [ 121087, "u8", "rmUm" ], [ 121370, "u8", "EDkYvv" ], [ 121781, "u8", "LGjx0" ], [ 122287, "u8", "BPJ9" ], [ 122323, "u8", "hRcd" ], [ 122953, "u8", "83 S" ], [ 123641, "u8", "ZOfXl" ], [ 124915, "u8", "B_VS" ], [ 124975, "u8", "XMYM" ], [ 126288, "u8", "tJDoc" ], [ 126375, "u8", "Efvz" ], [ 126501, "u8", "oimKc" ], [ 127857, "u8", "WxnG3" ], [ 128493, "u8", "Bxso" ], [ 128835, "u8", "2HEL" ], [ 130815, "u8", "PUPU" ], [ 131169, "u8", "p Mg" ], [ 131281, "u8", "h)Y{" ], [ 132686, "u8", "O8XM" ], [ 134153, "u8", "[y}y" ], [ 134884, "u8", "fIwOEf" ], [ 134996, "u8", "DCYG" ], [ 135441, "u8", "SknfQ" ], [ 135538, "u8", "7GIG" ], [ 136579, "u8", "LgNul" ], [ 136756, "u8", "hZspqJ2" ], [ 137114, "u8", "e2lx" ], [ 138256, "u8", "q[hF}" ], [ 138925, "u8", "x3lPT" ], [ 139643, "u8", "Owxn" ], [ 139831, "u8", "SGVF" ], [ 141046, "u8", "3vySd" ], [ 141452, "u8", "hjUEt" ], [ 141496, "u8", "NnS C" ], [ 145440, "u8", "RxEjwI" ], [ 148555, "u8", "jp45S" ], [ 149877, "u8", "YXPrE" ], [ 152067, "u8", "5PYx2" ], [ 152985, "u8", "aS03L" ], [ 153438, "u8", "Kxbqsz" ], [ 153839, "u8", "Gh.x" ], [ 153950, "u8", "/?7d4RT" ], [ 154088, "u8", "JK22S" ], [ 156041, "u8", "Ro4KE" ], [ 158512, "u8", "vMgm" ], [ 159753, "u8", "V43L" ], [ 166503, "u8", "hGAAF" ], [ 166871, "u8", "fsEyz1" ], [ 169680, "u8", "bIhm" ], [ 170251, "u8", "cXdt" ], [ 170625, "u8", "xzV5U" ], [ 171647, "u8", "LYZCD" ], [ 174789, "u8", "mWlvV" ], [ 174848, "u8", "XDcXgQ" ], [ 179173, "u8", "WyxKM" ], [ 180327, "u8", "Xuual" ], [ 181418, "u8", "lTaxyN" ], [ 181571, "u8", "Gzgm" ], [ 182245, "u8", "zuOd" ], [ 183099, "u8", "3ZQR" ], [ 184173, "u8", "3zk8A" ], [ 184444, "u8", "BXThx" ], [ 185050, "u8", "2\u003eb[" ], [ 185408, "u8", "yICpNj" ], [ 189076, "u8", "gUhn" ], [ 189227, "u8", "xnLh" ], [ 189919, "u8", "kwJbPbC" ], [ 190893, "u8", "2\u003ejn" ], [ 192549, "u8", "D5SIT" ], [ 195104, "u8", "XhohF" ], [ 195516, "u8", "DbpNc" ], [ 197519, "u8", "ifvyS" ], [ 202061, "u8", "lfPbVi2" ], [ 202381, "u8", "ProrNc" ], [ 202821, "u8", "MK01" ], [ 204675, "u8", "EXUB" ], [ 205036, "u8", "sh3SR" ], [ 205919, "u8", "jA4MRKV" ], [ 206848, "u8", "PPC2" ], [ 207339, "u8", "ohc2R" ], [ 211519, "u8", "Qv45S" ], [ 213012, "u8", "RA88" ], [ 213711, "u8", "XvtG5" ], [ 214279, "u8", "aBhnIq" ], [ 215249, "u8", "U8Xvo" ], [ 215393, "u8", "VO uRm" ], [ 215521, "u8", "s5xu" ], [ 217000, "u8", "da3XD" ], [ 217662, "u8", "PUYM" ], [ 218077, "u8", "Siope" ], [ 218347, "u8", "S4riZz" ], [ 218623, "u8", "CxXnr" ], [ 219563, "u8", "DOXS" ], [ 220648, "u8", "niVm.g" ], [ 221313, "u8", "{)hp" ], [ 222135, "u8", "BbwQ8" ], [ 222154, "u8", "8RqAOXi" ], [ 225528, "u8", "mNoo" ], [ 226404, "u8", "/Ysn" ], [ 229283, "u8", "4BI3i" ], [ 229323, "u8", "UDOKI" ], [ 229595, "u8", "KZSL" ], [ 230248, "u8", "RMDP" ], [ 230650, "u8", "Hlwl" ], [ 231273, "u8", "EESdB" ], [ 233353, "u8", "Gax.wy" ], [ 235383, "u8", "ko3u" ], [ 236679, "u8", "VSNM" ], [ 238819, "u8", "CgiXid" ], [ 240338, "u8", "/qAtc\\rn" ], [ 241947, "u8", "FfWZW" ], [ 243310, "u8", "smpEt" ], [ 244214, "u8", "8FbxD" ], [ 247920, "u8", "pjW7Y" ], [ 251395, "u8", "Bsgv" ], [ 253852, "u8", "?2\u003ej" ], [ 256756, "u8", "fa5tPz" ], [ 258130, "u8", "/pMb" ], [ 259139, "u8", "Bsu3ms" ], [ 260565, "u8", "Ip7ob" ], [ 261639, "u8", "HQP_" ], [ 262567, "u8", "/x53" ], [ 263847, "u8", "PMLN" ], [ 264001, "u8", "uNvuD" ], [ 264123, "u8", "iorrL" ], [ 264144, "u8", "PQ8mc" ], [ 265366, "u8", "GAfwa" ], [ 266857, "u8", "J1kMH" ], [ 267127, "u8", "wLgb" ], [ 268897, "u8", "OmjXcWN" ], [ 268930, "u8", "5vso" ], [ 269080, "u8", "`S-{9`" ], [ 269876, "u8", "zmdjT" ], [ 270710, "u8", "2JsCop" ], [ 270994, "u8", "eok8RR" ], [ 271001, "u8", "x NPBc" ], [ 273496, "u8", "rEIp8" ], [ 277036, "u8", "s7BFn" ], [ 280567, "u8", "Xrwu" ], [ 281341, "u8", "8S6tl" ], [ 282000, "u8", "uh7Vf" ], [ 282959, "u8", "VGDU" ], [ 283634, "u8", "sNjEP" ], [ 283723, "u8", "ARJV8" ], [ 283928, "u8", "oDEeQz" ], [ 284128, "u8", "AaPkx" ], [ 285718, "u8", "YXxiw" ], [ 286063, "u8", "yKzy" ], [ 287484, "u8", "cpVe" ], [ 287803, "u8", "vSifH" ], [ 288159, "u8", "E6hev" ], [ 288192, "u8", "dR4gs" ], [ 291892, "u8", "rk.p" ], [ 293490, "u8", "HCQN" ], [ 294055, "u8", "Leis" ], [ 295923, "u8", "i4el" ], [ 296518, "u8", "9ehx" ], [ 297358, "u8", "AIIM" ], [ 297729, "u8", "18TjK" ], [ 298021, "u8", "wiVF4" ], [ 302853, "u8", "EEC8" ], [ 304266, "u8", "9UTso" ] ], "v": { "file.stem": "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c", "pe.imphash": "16df4a699f5d1bd131c6c43f669b46dd", "pe.machine": "x86_64", "pe.rich.key": 296532227, "pe.rich.hash": "7994ad5a70cafb89ce283ac4daa6cc46", "pe.subsystem": "windows_gui", "pe.timestamp": 1683979102, "file.basename": "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe", "pe.image_base": 5368709120, "pe.image_size": 7999488, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 5161048, "pe.headers_size": 1024, "pe.entry_section": ".boot", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 10304, "pe.image_hash.sha1": "07815d99aad57a40add07bf27981497eb997a498", "pe.image_hash.sha256": "329e66875d9115557489cdfbcd2bd7c255b44f03f48ec53cbca7b06aa8745a37", "pe.image_hash.sha384": "10731488210ee2bd5c1b7a51e34c37239c6aa979726fc7db02df019e0cb32def234095b3c71b7b7a95fba64abd87db8a", "pe.image_hash.sha512": "6ac2cdae2f0ab0ae6c0c54a4f701edc5f2ee9b6a5596e0c90b243247ea8322ebdd5ebd7cd164a5d72e494e5a36164bdc7a64b31553691b2b924506f247afbe1e", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.inflated_sections[0]": " ", "pe.inflated_sections[1]": ".idata", "pe.linker_major_version": 14, "pe.linker_minor_version": 29, "pe.signatures[0].issuer": "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.signatures[0].serial": "330000047f2f422a735308deea00000000047f", "build.toolchain.compiler": "msvc", "pe.signatures[0].subject": "CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 856266, "pe.data_directories[1].rva": 679936, "pe.data_directories[2].rva": 4820328, "pe.data_directories[3].rva": 3422720, "pe.dll_characteristics_raw": 32800, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2026-05-15T18:49:10Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 316, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 173028, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 4380, "pe.data_directories[3].name": "certificate", "pe.data_directories[3].size": 10304, "pe.rich.entries[0].build_id": 260, "pe.rich.entries[1].build_id": 259, "pe.rich.entries[2].build_id": 261, "pe.rich.entries[3].build_id": 261, "pe.rich.entries[4].build_id": 260, "pe.rich.entries[5].build_id": 259, "pe.rich.entries[6].build_id": 257, "pe.rich.entries[7].build_id": 1, "pe.rich.entries[9].build_id": 260, "pe.signatures[0].not_before": "2025-05-15T18:49:10Z", "pe.rich.entries[0].use_count": 13, "pe.rich.entries[10].build_id": 258, "pe.rich.entries[1].use_count": 6, "pe.rich.entries[2].use_count": 139, "pe.rich.entries[3].use_count": 37, "pe.rich.entries[4].use_count": 16, "pe.rich.entries[5].use_count": 9, "pe.rich.entries[6].use_count": 17, "pe.rich.entries[7].use_count": 158, "pe.rich.entries[8].use_count": 4, "pe.rich.entries[9].use_count": 5, "pe.coff.dos_header_pe_pointer": 256, "pe.rich.entries[0].product_id": 26715, "pe.rich.entries[10].use_count": 1, "pe.rich.entries[1].product_id": 26715, "pe.rich.entries[2].product_id": 26715, "pe.rich.entries[3].product_id": 30034, "pe.rich.entries[4].product_id": 30034, "pe.rich.entries[5].product_id": 30034, "pe.rich.entries[6].product_id": 26715, "pe.rich.entries[9].product_id": 30153, "pe.rich.entries[10].product_id": 30153, "pe.signatures[0].thumbprint_sha1": "ea2f8cbc69a1a01142a1edd8b1256fecbc1d9f2d", "pe.signatures[0].cert_chain_depth": 2, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "eaa55544018e0151b3cf455da68c5873dbc8004ec422912fe6a5cbf923463e8f", "pe.signatures[0].thumbprint_sha256": "58b5021c22dd86d7838350b38ec5a702b48634125acb6ded71022de07836f768", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ " ", 1024, 98304, 7.98, "r-x" ], [ " ", 99328, 283136, 7.96, "r--" ], [ " ", 382464, 25088, 7.82, "rw-" ], [ " ", 407552, 2560, 7.56, "r--" ], [ " ", 410112, 512, 2.49, "r--" ], [ " ", 410624, 2048, 7.49, "r--" ], [ ".rsrc", 412672, 173056, 3.42, "r--" ], [ ".idata", 585728, 512, 3.48, "rw-" ], [ ".themida", 586240, 0, 0.0, "rwx" ], [ ".boot", 586240, 2836480, 7.94, "r-x" ] ] }, "id": 0, "sz": 3433024, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/unknown::microsoft-corporation", "l": 2 }, { "c": 1.0, "d": "Signed by Microsoft Corporation", "e": [ "Microsoft Corporation" ], "i": "metadata/signed/leaf::microsoft-corporation", "l": 3 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 35404.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x344116" ] }, { "c": 0.8199999928474426, "d": "Encoded Microsoft OCSP URL", "e": [ "Phttp://www.microsoft.com/pkiops/certs/Microsoft Time-Stamp PCA 2010(1).crt0", "Nhttp://www.microsoft.com/pkiops/crl/Microsoft Time-Stamp PCA 2010(1).crl0l" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-ms-ocsp-url", "l": 1, "el": [ "0x3450c3", "0x345057" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x8edce" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 35404.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x8f000" ] }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "0x8f020" ] }, { "c": 0.9599999785423279, "d": "Themida memory-only RWX section", "e": [ ".themida (size: 0, perms: rwx)" ], "i": "objectives/anti-static/pack/detect::themida-memory-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x8edfe" ] }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 9 (htons)", "e": [ "ORDINAL 9" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-9", "l": 1, "el": [ "0xd11c0" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0xd1180" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 35404.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.949999988079071, "d": "Microsoft timestamp certificate chain", "e": [ "Microsoft Time-Stamp Service", "Microsoft Time-Stamp PCA 2010" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "l": 2, "el": [ "0x344c12", "0x344cc4" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 8.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "Themida or ASProtect section", "e": [ ".themida" ], "i": "objectives/anti-static/pack/detect::themida-or-asprotect", "l": 1 }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0x64e87" ] }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.9800000190734863, "d": "GetStockObject import symbol", "e": [ "GetStockObject" ], "i": "metadata/binary/symbols/imports::getstockobject-import", "l": 1, "el": [ "0xd11a0" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Reference to SHELL32.dll", "e": [ "SHELL32.dll" ], "i": "micro-behaviors/os/module/load::shell32-dll-reference", "l": 2, "el": [ "0x8f0a9" ] }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x8ef1e" ] }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/shell/com::oleaut32-import-reference", "l": 1, "m": "B0025", "el": [ "0x8f06f" ] }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 35404.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 0.9399999976158142, "d": "High-entropy .boot packer section", "e": [ ".boot (size: 2836480, entropy: 7.94, perms: r-x)" ], "i": "objectives/anti-static/pack/detect::boot-packed-section", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.94" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x8eede" ] }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2, "el": [ "0x8f039" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in certificate data", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-cert", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x8ed02" ] }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2, "el": [ "0xd11b0" ] }, { "c": 1.0, "d": "Issued by a Microsoft Code Signing PCA", "e": [ "CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US" ], "i": "metadata/signed/certificate::pe-cert-issuer-microsoft-pca", "l": 2, "el": [ "value:pe.signatures[0].issuer" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "LoadStringA" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x8ed5e", "0x8f02d" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x8ef00" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.949999988079071, "d": "Microsoft code-signing certificate chain", "e": [ "Microsoft Code Signing PCA 2011" ], "i": "micro-behaviors/data/embedded/certificate::microsoft-code-signing-pca", "l": 2, "el": [ "0x343b27" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 35404.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x8ed9a" ] }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 173056)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.94" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "imports.count = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 35404.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 8.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8799999952316284, "d": "Large low-entropy PE resources", "e": [ ".rsrc (size: 173056, entropy: 3.42)" ], "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 10.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ " (size: 98304, perms: r-x)", ".boot (size: 2836480, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 35404.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.63" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 8.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.94" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 8.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x8f000" ] }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x8ef00" ] }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 35404.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 8.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.83" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links comctl32 (ORDINAL 17)", "e": [ "comctl32" ], "i": "metadata/dylib::comctl32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links ole32 (CoUninitialize)", "e": [ "ole32" ], "i": "metadata/dylib::ole32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links comdlg32 (GetOpenFileNameW)", "e": [ "comdlg32" ], "i": "metadata/dylib::comdlg32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links shell32 (CommandLineToArgvW)", "e": [ "shell32" ], "i": "metadata/dylib::shell32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links gdi32 (GetStockObject)", "e": [ "gdi32" ], "i": "metadata/dylib::gdi32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (GetModuleHandleA)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (LoadStringA)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links oleaut32 (ORDINAL 9)", "e": [ "oleaut32" ], "i": "metadata/dylib::oleaut32", "l": 2, "el": [ "1 symbols" ] }, { "c": 1.0, "d": "Microsoft certificate chain markers", "e": [ "Microsoft Time-Stamp PCA 2010", "Microsoft Code Signing PCA 2011", "Microsoft Time-Stamp Service", "Microsoft Corporation" ], "i": "metadata/signed/platform::microsoft-certificate-chain", "l": 1, "el": [ "0x344cc4", "0x343b27", "0x344c12", "" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 8.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-10/b2a03203a52830894579157f0210feeea726ddcf65cb20fcded60915885fa90c.exe", "type": "pe" } ], "tv": "52045" } }