{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 1.0, "class": 1, "threshold": 1.0 } ], "prob": 1.0, "class": 1, "level": 3, "models": [ { "m": "az", "prob": 0.99750024, "class": 0 }, { "m": "az/native", "prob": 0.99864775, "class": 0 }, { "m": "az/pe", "prob": 1.0, "class": 1 } ], "version": "v17.17", "threshold": 1.0, "analyzed_at": "2026-05-31T08:59:28Z" }, "path": "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe", "raw": { "v": "5", "fs": [ { "f": "O(As₃)Md₃(Bi₄BkHe)", "x": 40, "ff": { "i": [ [ "kernel32", "GetModuleHandleA" ], [ "user32", "CreateMenu" ], [ "advapi32", "RegQueryValueW" ], [ "mscoree", "CorExeMain" ], [ "shell32", "SHChangeNotifyRegister" ], [ "comctl32", "ImageList_SetBkColor" ] ], "m": { "pe": { "checksum": 1640466.0, "icon_count": 2.0, "has_overlay": 1.0, "overlay_end": 1588512.0, "has_manifest": 1.0, "overlay_size": 369577.0, "checksum_valid": 1.0, "overlay_offset": 1218935.0, "resource_count": 10.0, "overlay_padding": 369853.0, "has_version_info": 1.0, "computed_checksum": 1640466.0, "dos_stub_modified": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "entry_in_writable_section": 1.0 }, "file": { "size": 1588512.0, "entropy": 7.97, "size_bytes": 1588512.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 8.0, "data_entropy": 3.85, "overlay_size": 369577.0, "string_count": 17455.0, "overlay_ratio": 0.23, "overlay_entropy": 8.0, "entropy_variance": 3.78, "avg_string_length": 4.83, "max_string_length": 487.0, "code_to_data_ratio": 0.99, "string_length_stddev": 4.3, "largest_section_ratio": 0.7, "sentence_string_count": 10.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 6.0 }, "sections": { "count": 4.0, "code_size": 97655.0, "entropy_max": 8.0, "entropy_mean": 6.6, "name_entropy": 2.97, "writable_count": 2.0, "executable_count": 2.0, "nonstandard_count": 1.0, "executable_writable_count": 1.0 }, "dependencies": { "count": 6.0 } }, "s": [ [ 584, "u8", ".rsrc" ], [ 623, "u8", "@.ctors" ], [ 1260, "u8", "kernel32.dll" ], [ 1280, "u8", "GetModuleHandleA" ], [ 1299, "u8", "user32.dll" ], [ 1317, "u8", "CreateMenu" ], [ 1330, "u8", "advapi32.dll" ], [ 1350, "u8", "RegQueryValueW" ], [ 1367, "u8", "mscoree.dll" ], [ 1398, "u8", "shell32.dll" ], [ 1416, "u8", "SHChangeNotifyRegister" ], [ 1441, "u8", "comctl32.dll" ], [ 1461, "u8", "ImageList_SetBkColor" ], [ 2278, "wide", "SANTA" ], [ 3706, "u8", "dPMAv" ], [ 8494, "u8", "Hbad" ], [ 8989, "u8", "bubh3K" ], [ 9975, "u8", "vG7HE" ], [ 11240, "u8", "5O3B" ], [ 11487, "u8", "8SMC" ], [ 12450, "u8", ".egpw" ], [ 16587, "u8", "XButG" ], [ 17448, "u8", "zerI8" ], [ 19114, "u8", "LzEMo" ], [ 19709, "u8", "ZzHZN" ], [ 22360, "u8", "B N9" ], [ 22649, "u8", "J UwG" ], [ 23141, "u8", "DZswW" ], [ 23890, "u8", "/vwI" ], [ 24200, "u8", "GFA6z" ], [ 24763, "u8", "55UrM" ], [ 25566, "u8", "sIvLP" ], [ 25938, "u8", "CgwZC" ], [ 26918, "u8", "PcJMP" ], [ 27308, "u8", "hsMtoo" ], [ 29817, "u8", "/Gco2" ], [ 32669, "u8", "DCUJ" ], [ 33917, "u8", "hRatT" ], [ 34256, "u8", "3k1h" ], [ 35944, "u8", "E6YN" ], [ 36078, "u8", "8muz" ], [ 36482, "u8", "Nuwhd" ], [ 38247, "u8", "SBktS" ], [ 38573, "u8", "zzUu" ], [ 41313, "u8", "4F5R" ], [ 41328, "u8", "B5SK" ], [ 44362, "u8", "ut1h" ], [ 44651, "u8", "rCxy" ], [ 45016, "u8", "jhHIs" ], [ 46799, "u8", "gp97/1" ], [ 48087, "u8", "byIIf" ], [ 48189, "u8", "`kS7E`" ], [ 52111, "u8", "MXIP" ], [ 54970, "u8", "ahOnB" ], [ 55056, "u8", "iJio" ], [ 56172, "u8", "Isxc" ], [ 57908, "u8", "gpA1Y" ], [ 58966, "u8", "Kaq7K" ], [ 59258, "u8", "SI08" ], [ 59425, "u8", "Tnvt" ], [ 61111, "u8", "rtKo" ], [ 61663, "u8", "9JZrQ" ], [ 61996, "u8", "E9QU" ], [ 65259, "u8", "mBlr" ], [ 65269, "u8", "50DQQ" ], [ 65998, "u8", "4z3g" ], [ 70043, "u8", "MWyYqH" ], [ 70643, "u8", "z Yyb" ], [ 73468, "u8", "52zs" ], [ 74300, "u8", "T4cME" ], [ 74691, "u8", "vhXgC" ], [ 74732, "u8", "OCLNt" ], [ 76954, "u8", "NqoiV" ], [ 78256, "u8", "Qecy" ], [ 79071, "u8", "C8E53" ], [ 79779, "u8", "pKCm2" ], [ 79885, "u8", "F967B" ], [ 82580, "u8", "r.Sc" ], [ 84596, "u8", "rZbl" ], [ 86024, "u8", "TX8sk" ], [ 86532, "u8", "KJLE" ], [ 91720, "u8", "kelLj" ], [ 92268, "u8", "BH7N" ], [ 93263, "u8", "H7lii" ], [ 94401, "u8", "gPgw" ], [ 95842, "u8", "J cAz" ], [ 96213, "u8", "YEMU" ], [ 96795, "u8", "IVMT" ], [ 99861, "u8", "1p78W" ], [ 99985, "u8", "{+B' DjYi" ], [ 102495, "u8", "Zwoi" ], [ 102524, "u8", "de81" ], [ 105329, "u8", "pVDKS" ], [ 105614, "u8", "QPmP7" ], [ 105841, "u8", "jeYi" ], [ 106518, "u8", "pdUu" ], [ 108216, "u8", "svOr" ], [ 113013, "u8", "Tvtu" ], [ 114109, "u8", "ma-hml" ], [ 115996, "u8", "Bsen" ], [ 116541, "u8", "Vxl7F" ], [ 118415, "u8", "K77B7" ], [ 118809, "u8", "/EiS" ], [ 118924, "u8", "]pa{" ], [ 119154, "u8", "Crjw" ], [ 120009, "u8", "N0VP" ], [ 121243, "u8", "/ukg" ], [ 122317, "u8", "uY/wax" ], [ 122730, "u8", "6B3G" ], [ 122769, "u8", "RJYVS" ], [ 122787, "u8", "9v4m" ], [ 122949, "u8", "NOQL" ], [ 123871, "u8", "aCnc" ], [ 125939, "u8", "X6HP" ], [ 127487, "u8", "CKKM" ], [ 128569, "u8", "to8j" ], [ 129369, "u8", "4TZD" ], [ 131736, "u8", "Fjfu" ], [ 133626, "u8", "4PAIo" ], [ 134709, "u8", "ebT @V" ], [ 134958, "u8", "k477" ], [ 137221, "u8", "PVE7" ], [ 138937, "u8", "MojFl" ], [ 139180, "u8", "m0im" ], [ 140642, "u8", "ylMf" ], [ 141124, "u8", "wjT jF" ], [ 142926, "u8", "OT90" ], [ 143745, "u8", "vj6Azn" ], [ 146062, "u8", "CGwF6" ], [ 149589, "u8", "AM1U" ], [ 150679, "u8", "XX5MP" ], [ 151158, "wide", "SMALLSPEAKER\\LFESPK.PNG" ], [ 151288, "u8", "wkWe" ], [ 154487, "u8", "G0GF" ], [ 156410, "wide", "SMALLSPEAKER\\LFESPKPRESS.PNG" ], [ 161778, "u8", "vQOCBgO" ], [ 162018, "wide", "SMALLSPEAKER\\REARSPK.PNG" ], [ 164700, "u8", "mJ3QH" ], [ 164806, "u8", "h3Fbl" ], [ 164946, "wide", "SMALLSPEAKER\\REARSPKPRESS.PNG" ], [ 167313, "u8", "dp52" ], [ 168600, "u8", "IEND" ], [ 168610, "wide", "SMALLSPEAKER\\SIDELEFTSPK.PNG" ], [ 170033, "u8", "3FTL" ], [ 171263, "u8", "sJ.r" ], [ 171304, "wide", "!SMALLSPEAKER\\SIDELEFTSPKPRESS.PNG" ], [ 174413, "u8", "rGL86" ], [ 174690, "wide", "SMALLSPEAKER\\SIDERIGHTSPK.PNG" ], [ 176307, "u8", "KozrD" ], [ 176498, "u8", "ESFS" ], [ 177404, "wide", "\"SMALLSPEAKER\\SIDERIGHTSPKPRESS.PNG" ], [ 178743, "u8", "FmIdy" ], [ 179970, "u8", "/wAw" ], [ 180870, "wide", "SNDEFF\\ARENA.PNG" ], [ 181213, "u8", "LecsO" ], [ 181506, "u8", "W#2\u003e" ], [ 182939, "u8", "siG0I" ], [ 184087, "u8", "*.BwT" ], [ 185303, "u8", "Ktmc" ], [ 186827, "u8", "NXJ_" ], [ 187846, "wide", "SNDEFF\\ARENAHOVER.PNG" ], [ 189494, "u8", "MZG0" ], [ 190412, "u8", "Rvn1A" ], [ 190868, "u8", "j3n4" ], [ 192368, "u8", "QFVH" ], [ 194582, "u8", "rTTPG" ], [ 194886, "wide", "SNDEFF\\ARENAPRESS.PNG" ], [ 195802, "u8", "/ngs" ], [ 197179, "u8", "Emet" ], [ 197414, "u8", "MD7D" ], [ 198216, "u8", "jLuu" ], [ 198615, "u8", "/9ltzy" ], [ 200453, "u8", ".iet" ], [ 200666, "u8", "jqexlS" ], [ 202487, "u8", "CYQ7" ], [ 203022, "wide", "SNDEFF\\AUDOTORIUM.PNG" ], [ 204515, "u8", "hjmcX" ], [ 205488, "u8", "BHTR" ], [ 207194, "u8", "1ObtA" ], [ 208422, "u8", "HOxyUx" ], [ 208473, "u8", "BSMTS" ], [ 208585, "u8", "VUhJY" ], [ 208770, "u8", "RA5X" ], [ 208777, "u8", "aor0N" ], [ 209049, "u8", "OU6C" ], [ 209799, "u8", "BQ6E" ], [ 211554, "wide", "SNDEFF\\AUDOTORIUMHOVER.PNG" ], [ 213777, "u8", "CI40xJ" ], [ 219071, "u8", "[20)8" ], [ 219962, "wide", "SNDEFF\\AUDOTORIUMPRESS.PNG" ], [ 222996, "u8", "Ihnx" ], [ 223420, "u8", "JIDWP" ], [ 223716, "u8", "B2Zth" ], [ 224212, "u8", "gEmg3" ], [ 225265, "u8", "oUqk" ], [ 226526, "u8", "QOJZ" ], [ 229238, "wide", "SNDEFF\\BATHROOM.PNG" ], [ 231963, "u8", "oEiKW0" ], [ 232810, "u8", "9P9jGA" ], [ 233549, "u8", "SbSYBC" ], [ 234031, "u8", "zIgl" ], [ 234618, "wide", "SNDEFF\\BATHROOMHOVER.PNG" ], [ 236675, "u8", "gpGd" ], [ 237573, "u8", "/NnO" ], [ 239930, "wide", "SNDEFF\\BATHROOMPRESS.PNG" ], [ 240639, "u8", "c g+kX" ], [ 242569, "u8", "SV7S" ], [ 243321, "u8", "n0ILkEx" ], [ 244558, "u8", "QeoaK" ], [ 246382, "wide", "SNDEFF\\ENV_ICON_OVER_R1_C1.PNG" ], [ 246786, "u8", "dbW8Cc" ], [ 248802, "u8", "Q7I6" ], [ 249043, "u8", "iqAp" ], [ 249493, "u8", "cgRj" ], [ 249595, "u8", "J2 4" ], [ 249861, "u8", "UPTvR" ], [ 252892, "u8", "LD9H" ], [ 253114, "u8", "vHsf" ], [ 253662, "wide", "SNDEFF\\OFF.PNG" ], [ 254174, "wide", "SNDEFF\\OFFHOVER.PNG" ], [ 254698, "wide", "SNDEFF\\OFFPRESS.PNG" ], [ 255644, "wide", "SNDEFF\\ON.PNG" ], [ 256186, "wide", "SNDEFF\\ONHOVER.PNG" ], [ 256734, "wide", "SNDEFF\\ONPRESS.PNG" ], [ 257714, "wide", "SNDEFF\\OPEN.PNG" ], [ 258262, "wide", "SNDEFF\\OPENHOVER.PNG" ], [ 258822, "wide", "SNDEFF\\OPENPRESS.PNG" ], [ 259230, "u8", "CzmiN" ], [ 259714, "wide", "SNDEFF\\RESET.PNG" ], [ 260418, "wide", "SNDEFF\\RESETHOVER.PNG" ], [ 261122, "wide", "SNDEFF\\RESETPRESS.PNG" ], [ 261670, "u8", "TG4Qz" ], [ 262190, "wide", "SNDEFF\\SAVE.PNG" ], [ 262602, "wide", "SNDEFF\\SAVEHOVER.PNG" ], [ 263022, "wide", "SNDEFF\\SAVEPRESS.PNG" ], [ 263814, "wide", "SNDEFF\\SEWERPIPE.PNG" ], [ 264572, "u8", "5aIkh" ], [ 269434, "u8", "7OsgX" ], [ 270038, "wide", "SNDEFF\\SEWERPIPEHOVER.PNG" ], [ 271008, "u8", "ewGq" ], [ 273602, "u8", "og1n" ], [ 275812, "u8", "tsc8o" ], [ 276230, "wide", "SNDEFF\\SEWERPIPEPRESS.PNG" ], [ 283502, "wide", "SNDEFF\\STONE.PNG" ], [ 287602, "u8", "5mkxB" ], [ 288375, "u8", "6h4u" ], [ 288734, "wide", "SNDEFF\\STONEHOVER.PNG" ], [ 289397, "u8", "v2 Bi@" ], [ 289965, "u8", "uni d" ], [ 290167, "u8", "38Sww" ], [ 291366, "u8", "kKePR" ], [ 291600, "u8", "6k0CKt" ], [ 291640, "u8", "m0j8" ], [ 292615, "u8", "m5.1" ], [ 292739, "u8", "otHs" ], [ 293189, "u8", "k511" ] ], "v": { "file.stem": "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3", "pe.imphash": "347dfb5f021ffcf7a9785e4cb437f78d", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 3450386290, "file.basename": "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe", "pe.image_base": 4194304, "pe.image_size": 1462272, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 1363968, "pe.headers_size": 1024, "pe.version.type": "app", "pe.entry_section": ".ctors", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "efdfae866bfc5a29096dec95e589ab0627fc80ed", "pe.version.company": "Glarysoft Ltd", "pe.image_hash.sha256": "2119045d7e97631665739d102c47be6ff6bcb83f6c47b8bc41690e00916e4475", "pe.image_hash.sha384": "453f1b84609cfa0b16c294129879f5b851f51d7f9e60585b4fd80dd6795490f241564e463ba829a13289cfc6070a26de", "pe.image_hash.sha512": "0b0102cb72385655e11c83dd95ba6ec237f233ac6e10b2669d19e26fb227b3f8974dab167c2bdcaabf371d81f2ee67a3d046e54623f4df1bb1288556027e989d", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_DIALOG", "pe.resource_types[2]": "RT_STRING", "pe.resource_types[3]": "RT_ACCELERATOR", "pe.resource_types[4]": "RT_RCDATA", "pe.resource_types[5]": "RT_GROUP_ICON", "pe.resource_types[6]": "RT_VERSION", "pe.resource_types[7]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright (c) 2003 - 2021 Glarysoft Ltd", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.manifest.ui_access": "false", "pe.characteristics_raw": 258, "pe.version.description": "Glary Utilities Installer", "pe.inflated_sections[0]": ".bss", "pe.linker_major_version": 6, "pe.version.product_name": "Glary Utilities 5", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.data_directories[0].rva": 237568, "pe.data_directories[1].rva": 241664, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "5.178.0.206", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 500, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1119468, "pe.coff.dos_header_pe_pointer": 256, "pe.manifest.assembly_identity.name": "MyApplication.app", "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.manifest.requested_execution_level": "asInvoker" }, "id": "pe", "sc": [ [ "BSS", 1024, 0, 0.0, "r-x" ], [ ".bss", 1024, 512, 3.85, "rw-" ], [ ".rsrc", 1536, 1119468, 7.95, "r--" ], [ ".ctors", 1121280, 97655, 8.0, "rwx" ] ] }, "id": 0, "sz": 1588512, "ts": [ { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright (c) 2003 - 2021 Glarysoft Ltd" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Glary Utilities Installer" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x11162c" ] }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 17455.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "a": "T1027.003", "c": 0.8600000143051147, "d": "Encoded PE resource section", "e": [ ".rsrc (size: 1119468, entropy: 7.95)" ], "i": "objectives/anti-static/obfuscation/payload/container::moderately-encoded-rsrc", "l": 1, "m": "F0001.006" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x4ec" ] }, { "c": 0.8399999737739563, "d": "PNG image data in PE resources", "e": [ "IHDR" ], "i": "metadata/binary/resource::png-resource-marker", "l": 2, "el": [ "0xff8b3" ] }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2, "el": [ "0x1118d9" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Glary Utilities 5" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 17455.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x1114de" ] }, { "a": "T1105", "c": 0.8999999761581421, "d": "Dominant high entropy overlay", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/command-and-control/dropper/execution/installer::dominant-overlay-high-entropy", "l": 1, "m": "B0022" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 17455.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x111576" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2, "el": [ "value:pe.manifest.requested_execution_level" ] }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":\"false\",\"assembly_identity\":{\"name\":\"MyApplication.app\",\"version\":\"1.0.0.0\"" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "5.178.0.206" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "a": "T1612", "c": 0.8500000238418579, "d": "Large PE resource section", "e": [ ".rsrc (size: 1119468)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-rsrc-section", "l": 1, "m": "B0023" }, { "c": 1.0, "d": "PE has RT_DIALOG in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-dialog-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "c": 1.0, "d": "PE has RT_ACCELERATOR resources", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-accelerator-list", "l": 1, "el": [ "value:pe.resource_types" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.70" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x557" ] }, { "c": 0.949999988079071, "d": "Register shell change notifications", "e": [ "SHChangeNotifyRegister" ], "i": "micro-behaviors/fs/shell-ops::shell-change-notify-register", "l": 1, "el": [ "0x3a0cc" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 8.00" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 17455.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 17455.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "RegQueryValueW" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x546" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2, "el": [ "0x3a08c" ] }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x111682" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x11153a" ] }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 1119468)" ], "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section", "l": 1 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 369577.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 3 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "Large PE resource section with high entropy", "e": [ ".rsrc (size: 1119468, entropy: 7.95)" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-high-entropy-rsrc", "l": 2 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 6.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Manifest is MyApplication template name", "e": [ "MyApplication.app" ], "i": "metadata/build/manifest::pe-manifest-myapplication-template", "l": 3, "el": [ "value:pe.manifest.assembly_identity.name" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x1115b2" ] }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 17455.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "sections.executable_writable_count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 17455.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8199999928474426, "d": "Oversized PE resource section", "e": [ ".rsrc (size: 1119468)" ], "i": "metadata/binary/resource::oversized-rsrc", "l": 3 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 369577.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::large-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "Binary has 25 or fewer imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-25-imports", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.70" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 8.00" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 3 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 6.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".ctors (size: 97655, perms: rwx)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x4ec" ] }, { "c": 0.699999988079071, "d": "Binary has 50 or fewer imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-50-imports", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 6.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.699999988079071, "d": "Binary has 30 or fewer imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-30-imports", "l": 3 }, { "a": "T1027", "c": 0.75, "d": "Near-noise average string length in large binary", "e": [ "binary.avg_string_length = 4.83" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::noisy-avg-string-length", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".ctors (size: 97655, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 17455.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "a": "T1027", "c": 0.6000000238418579, "d": "High entropy in .rsrc section", "e": [ ".rsrc (size: 1119468, entropy: 7.95)" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-rsrc", "l": 3, "m": "C0027" }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 6.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.8399999737739563, "d": "Resource-heavy PE with large .rsrc", "e": [ ".rsrc (size: 1119468)" ], "i": "metadata/binary/resource::resource-heavy-rsrc", "l": 3 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 6.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 369577.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::medium-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.70" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links advapi32 (RegQueryValueW)", "e": [ "advapi32" ], "i": "metadata/dylib::advapi32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (GetModuleHandleA)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links comctl32 (ImageList_SetBkColor)", "e": [ "comctl32" ], "i": "metadata/dylib::comctl32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links user32 (CreateMenu)", "e": [ "user32" ], "i": "metadata/dylib::user32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.949999988079071, "d": "links shell32 (SHChangeNotifyRegister)", "e": [ "shell32" ], "i": "metadata/dylib::shell32", "l": 2, "el": [ "1 symbols" ] }, { "c": 0.8199999928474426, "d": "Large PE with four standard sections", "e": [ "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe", "sections.count = 4.00" ], "i": "metadata/binary/metrics/structural::large-four-section-pe", "l": 3 }, { "c": 0.8600000143051147, "d": "PNG and manifest in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/\u003e", "IHDR" ], "i": "metadata/binary/resource::png-and-manifest-rsrc", "l": 2, "el": [ "0x1118d9", "0xff8b3" ] }, { "a": "T1612", "c": 0.8500000238418579, "d": "Disproportionately large icon resources (payload carrier)", "e": [ ".rsrc (size: 1119468)", "pe.icon_count = 2.00", "[RT_ICON, RT_DIALOG, RT_STRING, RT_ACCELERATOR, RT_RCDATA, RT_GROUP_ICON, RT_VERSION, RT_MANIFEST]" ], "i": "objectives/anti-static/obfuscation/payload/resource::large-icon-resource", "l": 3, "m": "B0023", "el": [ "", "", "value:pe.resource_types" ] }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Large high-entropy overlay", "e": [ "binary.overlay_entropy = 8.00", "binary.overlay_size = 369577.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-entropy-overlay", "l": 4, "m": "B0032" }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Binary with encrypted overlay payload", "e": [ "binary.has_overlay = 1.00", "binary.overlay_size = 369577.00", "binary.overlay_entropy = 8.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::binary-encrypted-overlay", "l": 4, "m": "B0032" } ], "sha": "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3", "path": "b473aa2e24b0c9a7c0e02a56553b1cb836985caeb4f9e52403019786fe4085e3.exe", "type": "pe" } ], "tv": "52045" } }