{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.43843845, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T03:56:38Z" }, "path": "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe", "raw": { "v": "5", "fs": [ { "f": "Md(Bi₃)", "x": 4, "ff": { "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 1918985.0, "bss_like_section_count": 0.0, "section_overflow_count": 3.0, "misaligned_section_count": 0.0 }, "file": { "size": 1854877.0, "entropy": 7.97, "size_bytes": 1854877.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.97, "string_count": 36096.0, "entropy_variance": 14.12, "avg_string_length": 4.97, "max_string_length": 352.0, "code_to_data_ratio": 1.0, "string_length_stddev": 3.64, "largest_section_ratio": 2.74, "sentence_string_count": 4.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "sections": { "count": 3.0, "code_size": 5085184.0, "entropy_max": 7.97, "entropy_mean": 2.66, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 2536, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 2693, "u8", "PADPADP" ], [ 2748, "wide", "oldplayer" ], [ 2802, "wide", "v×tml3b41mmvotmlsb41mmvït" ], [ 2908, "wide", "Imvo" ], [ 3038, "wide", "1mmvodmlsb4" ], [ 3094, "wide", "Vàsb41mmvotmlsb" ], [ 3126, "wide", "Emvotmlsb4" ], [ 3154, "wide", "votmlsb41mmvo" ], [ 3242, "wide", "votmlsbt" ], [ 3282, "wide", "Umvotml3" ], [ 3324, "wide", "1mmvot-" ], [ 3394, "wide", "Uvotmlsb41mí" ], [ 3442, "wide", "Wtmlsb4q" ], [ 3562, "wide", "Z41mmvo4" ], [ 3602, "wide", "Wsb41mm6" ], [ 3620, "wide", "tmlsb41mmvotmlsb41mmvotmlsb41mmvotmlsb41mmvotmlsb41mmvotmlsb41mmvotmlsb41mmvotmlsb41mmvotmlsb41m" ], [ 4012, "u8", "wtVf" ], [ 5732, "u8", "tfboQ" ], [ 5795, "u8", "DK05" ], [ 6170, "u8", "oHEEmH" ], [ 6655, "u8", "f{oh}" ], [ 6716, "u8", "mfyoj_" ], [ 9078, "u8", "mfcovu" ], [ 10854, "u8", "MCbSE" ], [ 12572, "u8", "oD{)" ], [ 13763, "u8", "PUfcl" ], [ 15528, "u8", "78bf" ], [ 15940, "u8", "78mfcov%" ], [ 15970, "u8", "g5P81" ], [ 15976, "u8", "DDIP" ], [ 18987, "u8", "MkutH" ], [ 19704, "u8", "M L NlLdXt$H" ], [ 20700, "u8", "oCm81H" ], [ 21575, "u8", "TH 2" ], [ 21778, "u8", "WeN81I" ], [ 22050, "u8", "98vHF" ], [ 22768, "u8", "oGx81H" ], [ 23670, "u8", "oiG81" ], [ 25264, "u8", "uBgHM" ], [ 25308, "u8", "18oEE" ], [ 25380, "u8", "TM6I" ], [ 25500, "u8", "w8m1" ], [ 25556, "u8", "UM6H" ], [ 25632, "u8", "2PeHT" ], [ 26782, "u8", "sTE8t" ], [ 26792, "u8", "vGH84H" ], [ 28015, "u8", "Ccu5A" ], [ 28128, "u8", "aSU8l" ], [ 29379, "u8", "LK08" ], [ 34181, "u8", "LHxwA" ], [ 34456, "u8", "huiHy" ], [ 36370, "u8", "xcu8vD" ], [ 37846, "u8", "DLRH" ], [ 38087, "u8", "DI82" ], [ 38903, "u8", "TRXF" ], [ 39518, "u8", "mfyWb" ], [ 40935, "u8", "LH079" ], [ 41061, "u8", "TKX8" ], [ 41282, "u8", "DTPX" ], [ 43228, "u8", "S84H" ], [ 43258, "u8", "hUG8o" ], [ 44590, "u8", "N N84" ], [ 44604, "u8", "bKX8m" ], [ 44725, "u8", "E8A0" ], [ 45123, "u8", "HRVyI" ], [ 45364, "u8", "gHRAyL" ], [ 46038, "u8", "QAltzH" ], [ 46186, "u8", "seI8tH" ], [ 48260, "wide", "mlsb41mmvotmlsb41mmvotmlsb41mmvotmlsb41mmvotmlsb\u003e1mmvotmlsb41mmv" ], [ 48550, "wide", "sb41mmvotmlsb41" ], [ 48884, "u8", "LKXK" ], [ 49418, "wide", "mvotmlsb41mmv" ], [ 49746, "wide", "îmvotmlsb" ], [ 49815, "u8", "EQ% WF" ], [ 57652, "wide", "tmlsb41mavotelsb41mmvotmdsb49mmvotmlsb41smvovmlsb41mmvotelsb\u003c1mmvotmlsb4" ], [ 57798, "wide", "mmvntmlsb41mmvo|mlsj41mmvotmlsb,1mmtotmlsb41mmvgtml{b41mmvotmlst41movotmlsb41mm~otmdsb41mmvotmlgb41omvotmlsb41mevotelsb41mmvotm\u003c" ], [ 58182, "wide", "mls`41mmvotmlsb\u003c1mm~otmlsb41mmvŝtmlqb41mmvotmlsj41mevotmlsb41mmjotmnsb41mmvotml{b41emvotmlsb41mWvotolsb41mmvotmdsb49mmvotmlsb41" ], [ 58438, "wide", "mvovmlsb41mmvotelsb\u003c1mmvotmlsb4-mmvmtmlsb41mmvo|mlsj41mmvotmlsbdž1mmtotmlsb41mmvgtml{b41mmvotmls~41movotmlsb41mm~otmdsb41mmvotml" ], [ 59142, "wide", "mvovmlsb41mmvotelsb\u003c1mmvotmlsb4;mmvgtmlsb41mmvo|mlsj41mmvotmlsb|1mmtotmlsb41mmvgtml{b41mmvotmls~41movotmlsb41mm~otmdsb41mmvotml" ], [ 59398, "wide", "b41omvotmlsb41mevotelsb41mmvotmfsb49mmvotmlsb41emvo|mlsb41mmvot" ], [ 59795, "u8", "kFPXb" ], [ 59971, "u8", "lGPKk" ], [ 60169, "u8", "KBzUr" ], [ 60839, "u8", "tCkeT" ], [ 60901, "u8", "63KR" ], [ 63753, "u8", "OuqPx" ], [ 64280, "u8", "pltwX" ], [ 64327, "u8", "fXk ufE" ], [ 64613, "u8", "rNdt" ], [ 64840, "u8", "EOI2" ], [ 64886, "u8", "JFJR" ], [ 66424, "u8", "M3JC" ], [ 66683, "u8", "rIex" ], [ 67495, "u8", "OXmGzownT" ], [ 67606, "u8", "fHTcU" ], [ 68094, "u8", "ZP6W" ], [ 68507, "u8", "yLes" ], [ 71521, "u8", "fGls" ], [ 71609, "u8", "cMrx" ], [ 71831, "u8", "BtC43" ], [ 73306, "u8", "GZiAN0" ], [ 74337, "u8", "YFlB3" ], [ 75106, "u8", "bQOrK" ], [ 76833, "u8", "FG2X" ], [ 77845, "u8", "KJ8P" ], [ 78540, "u8", "Px](" ], [ 79024, "u8", "GhBkWI" ], [ 79585, "u8", "yGlZK" ], [ 79808, "u8", "JB3LL" ], [ 80520, "u8", "hkFz" ], [ 81048, "u8", "acHr" ], [ 81528, "u8", "ZG_6" ], [ 82258, "u8", "GoCppN" ], [ 83160, "u8", "qcHr" ], [ 83489, "u8", "AFlB7" ], [ 83840, "u8", "agGl" ], [ 84766, "u8", "ewRf" ], [ 85569, "u8", "yGlVK" ], [ 86085, "u8", "sNkl" ], [ 87520, "u8", "Yd[]" ], [ 88263, "u8", "OHjFzLI" ], [ 88709, "u8", "RL5E" ], [ 88773, "u8", "%V=@\u003e@.^/N2V" ], [ 89763, "u8", "cGwe" ], [ 90217, "u8", "/ BF" ], [ 90683, "u8", "rLeBthi" ], [ 90961, "u8", "AZOV" ], [ 91416, "u8", "LG76" ], [ 91773, "u8", "JSPni" ], [ 91827, "u8", "/b Yb" ], [ 91872, "u8", "snCl" ], [ 92000, "u8", "TBIlGrK" ], [ 92158, "u8", "ctSf" ], [ 92419, "u8", "gUVvd" ], [ 92533, "u8", "wYbEZ" ], [ 92598, "u8", "xbUc" ], [ 93602, "u8", "RH_78" ], [ 93850, "u8", "dfMj" ], [ 94898, "u8", "CO38" ], [ 95600, "u8", "DdsXW" ], [ 95657, "u8", "/bRA" ], [ 95809, "u8", "iXls" ], [ 96703, "u8", "TU8@1A." ], [ 98106, "u8", "6rcCN" ], [ 99238, "u8", "A0P4" ], [ 101041, "u8", "oZkw" ], [ 101057, "u8", "ail0" ], [ 101073, "u8", "o0kp" ], [ 101312, "u8", "Ea9ll" ], [ 101376, "u8", "Ga.l" ], [ 101488, "u8", "Jo9ko" ], [ 101505, "u8", "a6l2" ], [ 101584, "u8", "Vo kb" ], [ 101952, "u8", "a9lu" ], [ 102048, "u8", "Ta9lo" ], [ 102225, "u8", "o9k8" ], [ 102448, "u8", "/o km" ], [ 102481, "u8", "AMk ye" ], [ 102640, "u8", "0AGk0yi" ], [ 102672, "u8", "PATkEyi" ], [ 102769, "u8", "AHk3yb" ], [ 102835, "u8", "keyu" ], [ 104087, "u8", "/ehT" ], [ 104183, "u8", "/6hm" ], [ 104609, "u8", "fGlrr" ], [ 109119, "u8", "4VfBln" ], [ 109631, "u8", "sj}{l" ], [ 110043, "u8", "rtUC4" ], [ 110615, "u8", "bQcHr5EK" ], [ 110656, "u8", "0CuBMrKk" ], [ 110748, "u8", "boBt" ], [ 110834, "u8", "tkcpsb\u0026c\u003er]e" ], [ 110859, "u8", "zUx$a0h/kNp" ], [ 110915, "u8", "l6rxkjkyz\u003cxta" ], [ 111495, "u8", "kAkFztx" ], [ 111625, "u8", "qx8Px" ], [ 112323, "u8", "lY1UQ?CmBf'kU3" ], [ 112793, "u8", "cLryt" ], [ 112991, "u8", "tuSBlns" ], [ 113123, "u8", "lTLKk" ], [ 113433, "u8", "3Hrx5" ], [ 113475, "u8", "lcqJk" ], [ 113495, "u8", "b41Mrqf" ], [ 113565, "u8", "1Btf3" ], [ 113583, "u8", "aikFk" ], [ 113609, "u8", "hGzi" ], [ 113762, "u8", "Glvv" ], [ 114137, "u8", "fIru" ], [ 114374, "u8", "kvkBz" ], [ 115543, "u8", "bTQIB" ], [ 115697, "u8", "oCkDB" ], [ 116225, "u8", "gFlCB" ], [ 117105, "u8", "MFkCp" ], [ 117171, "u8", "kFpYblE" ], [ 117303, "u8", "bYDIr" ], [ 117325, "u8", "xXahO" ], [ 117347, "u8", "lGrKkIL" ], [ 117367, "u8", "bYDLrIe" ], [ 117391, "u8", "a9OCk" ], [ 117455, "u8", "ayLFkCp" ], [ 117567, "u8", "t9CCl" ], [ 117633, "u8", "CFlBr" ], [ 117721, "u8", "ELrIe" ], [ 117809, "u8", "NFkCp" ], [ 117853, "u8", "eGtlA" ], [ 117875, "u8", "kFpYbVD" ], [ 118636, "u8", "vxGey" ], [ 118655, "u8", "tAba" ], [ 118843, "u8", "rLECt" ], [ 118865, "u8", "HFkCP" ], [ 118909, "u8", "EFtRF" ], [ 118931, "u8", "kRPXb" ], [ 118953, "u8", "KBzAX" ], [ 118975, "u8", "tCFCl" ], [ 119041, "u8", "FFlVR" ], [ 119063, "u8", "bECIr" ], [ 119085, "u8", "XYaVH" ], [ 119481, "u8", "cMr)(" ], [ 120966, "wide", "otmlsb41mmvotml" ], [ 121019, "u8", "rZeGtRf" ], [ 121241, "u8", "corBg" ], [ 121530, "u8", "Hrid" ], [ 122096, "u8", "DL1kGpY" ], [ 123616, "u8", "eBgl" ], [ 123652, "u8", "[rSkekrzox;a'hBkHpwbdc_r|eqtwf!l" ], [ 123717, "u8", "rkkrkGz@xga)h" ], [ 123731, "u8", "kvpkbtc\u0026rSe/tPf2lNr~k]k" ], [ 124363, "u8", "zPnXaCh" ], [ 124409, "u8", "7JrPQ" ], [ 125111, "u8", "bgBMrmq" ], [ 125135, "u8", "acIBk" ], [ 126729, "u8", "kNzCx^aIhEkBp" ], [ 126745, "u8", "c[r[eZtEfIlXrYk" ], [ 126821, "u8", "rDktkvzox6a%hXkvprbocDr{eyt" ], [ 126857, "u8", "k*z\u0026x2a6h.k*pyb7cMr" ], [ 126881, "u8", "fFlsrcklk~zyxza4hBkKpmbvc6raeqtkfilwr'k8k~z)xXaOhCk?phb" ], [ 126955, "u8", "z\tx\\a~h*k3pdbfcvrYeftcfzl" ], [ 126985, "u8", "k6zlxoaIhukdpVbpcyr4e(t fyl" ], [ 127031, "u8", "bmcgrment~fnlkr`kak-zUx" ], [ 127055, "u8", "aIhlkspNbac{rle!tWfBl.r" ], [ 127081, "u8", "k^zyxmazhVkup.b'c}rzekt" ], [ 127107, "u8", "l/r8k-k;z`xsa+h" ], [ 127129, "u8", "c]rzettdf5l,rvkmkOzjxua{h" ], [ 127163, "u8", "r|eptrf,l)rdkykwz" ], [ 127189, "u8", "pRbocjrtestSf~l7r2kskszuxkash" ], [ 127219, "u8", "k]ptbwc4r;ewtifmlhr.k)kXz\u003ex.auhrk/p2b\u003ec$r\u003ce.t7f l^r\u003ek8ktzExsa~hTkfpwb8ctr\u003ee%t f\u003elDryktk:zzxvavh/k7pvb(c}rrettkfmlvr}k\u003ckhz\tx" ], [ 127363, "u8", "lrrJkjkozlxnaah|k#pYb_c}r`eNt~fplxr9k k0z,xra" ], [ 127415, "u8", "b\tcErye~t3f7l}rckTkyz}xda" ], [ 127443, "u8", "kGp5b:cFr|ektkf7l" ], [ 127471, "u8", "alhqk`prbrc`rBeetsf4l+rxkok" ], [ 127499, "u8", "z:x6a,h1k1p$bdcHrQe" ], [ 127521, "u8", "fJlfrekFkmzjx=a" ] ], "v": { "file.stem": "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1681665753, "file.basename": "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe", "pe.image_base": 4194304, "pe.image_size": 5111808, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 5093022, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.linker_major_version": 11, "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 5092936, "pe.data_directories[1].rva": 5095424, "pe.data_directories[2].rva": 5103616, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.overflowing_sections[0]": ".text", "pe.overflowing_sections[1]": ".rsrc", "pe.overflowing_sections[2]": ".reloc", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1232, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.coff.dos_header_pe_pointer": 128 }, "id": "pe", "sc": [ [ ".text", 512, 5085184, 7.97, "r-x" ], [ ".rsrc", 5085696, 1536, 0.0, "r--" ], [ ".reloc", 5087232, 512, 0.0, "r--" ] ] }, "id": 0, "sz": 1854877, "ts": [ { "c": 0.8999999761581421, "d": "PE section headers declare sizes beyond end of file", "i": "metadata/binary/anomaly::inflated-section-headers", "l": 3 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 7.97, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 36096.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.97)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 36096.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x9e8" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "cd", "c9", "c8" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014", "el": [ "0x10bf8b", "0xd954d", "0x164b36" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 36096.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.97" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1552.001", "c": 0.800000011920929, "d": "Keystore file suffix", "e": [ ".p8" ], "i": "micro-behaviors/fs/path/sensitive/credentials::keystore-suffix", "l": 1, "el": [ "0x12defb" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "x64 indirect payload call", "e": [ "41 FF D5" ], "i": "objectives/command-and-control/dropper/execution/loader::x64-indirect-payload-call-r13", "l": 1, "el": [ "0xaea7" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 2.74" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 2.74" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "c3", "ce", "c0" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0x137f09", "0xed652", "0x1eb13" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.97" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 2.74" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "4b", "44" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x76c16", "0x128e87" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 36096.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x721" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 36096.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x9e8" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.949999988079071, "d": "PE section declared larger than file (truncated/corrupt)", "e": [ "binary.largest_section_ratio = 2.74" ], "i": "metadata/binary/metrics/structural::section-exceeds-file-size", "l": 1 }, { "c": 1.0, "d": "Large near-high entropy .text section", "e": [ ".text (size: 5085184, entropy: 7.97, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-large-near-high-entropy-text-raw", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x9e8" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 36096.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 36096.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 2.74" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.97" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 7.97, perms: r-x)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 5085184, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "75 47 d0 61 7c" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1, "el": [ "0xaed1b" ] }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 2.74" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.97" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 36096.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 2.74" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 2.74" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" } ], "sha": "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9", "path": "b30309946ea7e99d0f96eface8122a3ec12b5bab2148f51622d86fa8f7095be9.exe", "type": "pe" } ], "tv": "52045" } }