{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.550173, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T05:12:42Z" }, "path": "b495e348fb0e0544e57737f46f9333a711eaca2cd531a5e8065e96bf274d8690.exe", "raw": { "v": "5", "fs": [ { "f": "H(Po₂)Md(Bi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 284748.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 265728.0, "entropy": 7.94, "size_bytes": 265728.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.96, "string_count": 3372.0, "entropy_variance": 10.48, "avg_string_length": 6.19, "max_string_length": 275.0, "code_to_data_ratio": 1.0, "string_length_stddev": 8.3, "largest_section_ratio": 0.99, "sentence_string_count": 32.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 263680.0, "entropy_max": 7.96, "entropy_mean": 3.72, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 6952, "u8", "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ], [ 7109, "u8", "PADPADP" ], [ 8243, "u8", "fHLuF" ], [ 9650, "u8", "tHbn" ], [ 10066, "u8", "pMfk" ], [ 13122, "u8", "wu6u" ], [ 13141, "u8", "3qVWX" ], [ 14099, "u8", "tbcwT" ], [ 16784, "u8", "HQTA" ], [ 16935, "u8", "NJisa" ], [ 16985, "u8", "5UDKD" ], [ 20343, "u8", "xsKr" ], [ 20718, "u8", "2m2xig" ], [ 21600, "u8", "usXg6" ], [ 21854, "u8", "2smWz" ], [ 24173, "u8", "ap9wM" ], [ 24846, "u8", "8fljG" ], [ 25232, "u8", "MBNEu" ], [ 27872, "u8", "y0ez" ], [ 28138, "u8", "qaic" ], [ 29642, "u8", "FsRPh" ], [ 30111, "u8", "rHFE0" ], [ 31152, "u8", "ax4SD" ], [ 34205, "u8", "O3GDc" ], [ 34912, "u8", "oKKBV" ], [ 35314, "u8", "ibV9d" ], [ 36690, "u8", "Rah06kA" ], [ 38153, "u8", "3MLG" ], [ 38201, "u8", "n22j" ], [ 40117, "u8", "vJvh" ], [ 40162, "u8", "trv%zv" ], [ 40579, "u8", "RxeNx" ], [ 40658, "u8", "tZGN7o77f" ], [ 42099, "u8", "bnSq" ], [ 42117, "u8", "Aban" ], [ 42532, "u8", "3ddGS6" ], [ 42633, "u8", "bhFd" ], [ 43792, "u8", "TAHRo" ], [ 45332, "u8", "YK54" ], [ 45864, "u8", "PJHA" ], [ 47424, "u8", "VG8Ff" ], [ 47746, "u8", "H1fPK" ], [ 49121, "u8", "/FiBH" ], [ 50277, "u8", "CA5K" ], [ 50925, "u8", "dEDsza" ], [ 51221, "u8", "89CVN" ], [ 52651, "u8", "isbOyH" ], [ 54155, "u8", "C207" ], [ 54461, "u8", "dUxy" ], [ 54694, "u8", "o6kvU" ], [ 54816, "u8", "kv51" ], [ 54909, "u8", "ZQ1V" ], [ 57079, "u8", "/\tvk" ], [ 58218, "u8", "eb09" ], [ 58887, "u8", "WQZ3" ], [ 60296, "u8", "aStg" ], [ 63195, "u8", "yqpU6" ], [ 63691, "u8", "AJ58" ], [ 63798, "u8", "m221" ], [ 65722, "u8", "b9oXee" ], [ 66318, "u8", "qKrw" ], [ 72094, "u8", "Fpif" ], [ 78767, "u8", "woAO6" ], [ 79713, "u8", "rDwr" ], [ 80916, "u8", "/czu" ], [ 81109, "u8", "PELD" ], [ 82053, "u8", "n/AIx_vCY" ], [ 86736, "u8", "uqu7" ], [ 86948, "u8", "R_LA" ], [ 87485, "u8", "Oyxm" ], [ 87712, "u8", "C5 L" ], [ 91519, "u8", "RWM6" ], [ 92211, "u8", "sIcp" ], [ 92328, "u8", "VGHZ" ], [ 92581, "u8", "DaHS5" ], [ 92786, "u8", "IO3M" ], [ 93583, "u8", "09Lm9KSa" ], [ 94159, "u8", "mZxd" ], [ 94510, "u8", "npEh" ], [ 95117, "u8", "JGzDdL" ], [ 97810, "u8", "Iqne" ], [ 99208, "u8", "bdOYy8" ], [ 100032, "u8", "4PNS" ], [ 100637, "u8", "K066j" ], [ 102025, "u8", "a1r7" ], [ 105859, "u8", "Kfxe" ], [ 107433, "u8", "G xt" ], [ 109020, "u8", "/zQJM" ], [ 109303, "u8", "0zTbw" ], [ 110049, "u8", "W2N4" ], [ 110513, "u8", "ywIn" ], [ 111721, "u8", "Fegui" ], [ 116156, "u8", "C7wbt" ], [ 120620, "u8", "hGpd" ], [ 120925, "u8", "aPld" ], [ 122757, "u8", "TC\u003c\u003c" ], [ 123861, "u8", "bf}[" ], [ 125201, "u8", "xCbvH" ], [ 125491, "u8", "po74" ], [ 125541, "u8", "x95k" ], [ 126291, "u8", "Qolm" ], [ 127421, "u8", "XwDpz" ], [ 127860, "u8", "KJ9M" ], [ 127914, "u8", "ta59PTR" ], [ 128278, "u8", "K3PA" ], [ 129557, "u8", "QK36_" ], [ 130537, "u8", "/VfP" ], [ 134506, "u8", "XcIJM" ], [ 136154, "u8", "Unzi" ], [ 136732, "u8", "icZeyQ" ], [ 138125, "u8", "Cxrh" ], [ 138850, "u8", "LWa6mM" ], [ 138872, "u8", "CQCJj" ], [ 139926, "u8", "so9s" ], [ 140323, "u8", "A698" ], [ 144175, "u8", "Wbfn" ], [ 144699, "u8", "5vhByKI" ], [ 145049, "u8", "/wLt" ], [ 145327, "u8", "v9t1" ], [ 146175, "u8", "F0J2" ], [ 146767, "u8", "D75C" ], [ 146784, "u8", "D1K U" ], [ 148687, "u8", "9LOB" ], [ 149155, "u8", "kGsf" ], [ 150637, "u8", "QXYN" ], [ 151029, "u8", "cGdt" ], [ 152238, "u8", "4VDR" ], [ 152375, "u8", "ifIy" ], [ 157170, "u8", "jj13" ], [ 157517, "u8", "bcQp" ], [ 158317, "u8", "Kjpz" ], [ 159349, "u8", "N9JSB" ], [ 160768, "u8", "PM8H" ], [ 160831, "u8", "9kk3F" ], [ 161256, "u8", "NEZJ" ], [ 162286, "u8", "571Qx" ], [ 163455, "u8", "/D5j" ], [ 163675, "u8", "EEeL5" ], [ 165262, "u8", "E6QZZQG" ], [ 166302, "u8", "LIF9" ], [ 169269, "u8", "T6_4" ], [ 169613, "u8", "Tpaq" ], [ 169840, "u8", "dIaf" ], [ 172344, "u8", "2lOjmu" ], [ 172593, "u8", "/M3t" ], [ 174259, "u8", "gNsm" ], [ 174264, "u8", "8kgDP" ], [ 174708, "u8", "EfZJx9" ], [ 175362, "u8", "ZEBK" ], [ 175385, "u8", "gR6ddeCQ" ], [ 176343, "u8", "t8 +z9" ], [ 178058, "u8", "y4b1" ], [ 179995, "u8", "tIQAh" ], [ 181111, "u8", "CYHF" ], [ 183383, "u8", "PB5GE" ], [ 186943, "u8", "AE2H" ], [ 186959, "u8", "l.Qj" ], [ 187126, "u8", "HdwDm" ], [ 187872, "u8", "0Juo9.F" ], [ 188364, "u8", "TNjKe" ], [ 188454, "u8", "7TOI" ], [ 189786, "u8", "sgDZA" ], [ 197341, "u8", "uyU2wK" ], [ 198556, "u8", "/JSz5g{" ], [ 198673, "u8", "lOyf" ], [ 198939, "u8", "KNLT9" ], [ 198957, "u8", "/WuJ" ], [ 199277, "u8", "nVCdL" ], [ 199904, "u8", "42CnER" ], [ 200294, "u8", "/44iP" ], [ 200552, "u8", "q9g8" ], [ 202239, "u8", "4PYNg" ], [ 202267, "u8", "u{r)" ], [ 206150, "u8", "II2_" ], [ 206643, "u8", "wsKqs" ], [ 206760, "u8", "/i6A" ], [ 208553, "u8", "ST2V" ], [ 208681, "u8", "jyNe" ], [ 209936, "u8", "Fbco1" ], [ 214952, "u8", "OF2M" ], [ 216581, "u8", "/dxa" ], [ 217499, "u8", "Iwls" ], [ 220946, "u8", "EU_C" ], [ 221650, "u8", "}(wm" ], [ 222955, "u8", "g116" ], [ 224823, "u8", "Hxdl" ], [ 225081, "u8", "Odvk" ], [ 226032, "u8", ".yzf" ], [ 226043, "u8", "p4WYpz" ], [ 226894, "u8", "zv96" ], [ 228379, "u8", "nm]F{" ], [ 228857, "u8", "TD5P" ], [ 229184, "u8", "ZI4H" ], [ 229288, "u8", "ptXk" ], [ 230807, "u8", "gaFn" ], [ 231497, "u8", "Vopy" ], [ 233291, "u8", "bniXN" ], [ 235729, "u8", "Lc6px" ], [ 236808, "u8", "G4SV" ], [ 243105, "u8", "IFIP" ], [ 245355, "u8", "x(l)" ], [ 248091, "u8", "hoFc" ], [ 251687, "u8", "imLyg" ], [ 252608, "u8", "BSJB" ], [ 255841, "u8", "label1" ], [ 255848, "u8", "kernel32" ], [ 255857, "u8", "Int32" ], [ 255863, "u8", "label2" ], [ 255870, "u8", "label3" ], [ 255877, "u8", "\u003cModule\u003e" ], [ 255888, "u8", "SizeF" ], [ 255894, "u8", "System.IO" ], [ 255904, "u8", "colExtra" ], [ 255913, "u8", "mscorlib" ], [ 255922, "u8", "Read" ], [ 255927, "u8", "Thread" ], [ 255943, "u8", "frmMain_Load" ], [ 255960, "u8", "nbrUpDownSpeed" ], [ 255975, "u8", "trkBarSpeed" ], [ 255987, "u8", "add_ValueChanged" ], [ 256004, "u8", "nbrUpDownSpeed_ValueChanged" ], [ 256032, "u8", "add_LinkClicked" ], [ 256048, "u8", "lnkMyWebsite_LinkClicked" ], [ 256073, "u8", "lnkRepo_LinkClicked" ], [ 256093, "u8", "Synchronized" ], [ 256106, "u8", "ReadToEnd" ], [ 256116, "u8", "Stand" ], [ 256122, "u8", "lblPassword" ], [ 256134, "u8", "defaultPassword" ], [ 256150, "u8", "txtPassword" ], [ 256162, "u8", "Replace" ], [ 256170, "u8", "get_StackTrace" ], [ 256185, "u8", "btnVisitDellService" ], [ 256205, "u8", "CreateInstance" ], [ 256220, "u8", "defaultInstance" ], [ 256236, "u8", "set_Mode" ], [ 256245, "u8", "set_AutoScaleMode" ], [ 256263, "u8", "CipherMode" ], [ 256274, "u8", "get_BigEndianUnicode" ], [ 256295, "u8", "get_Message" ], [ 256307, "u8", "AddRange" ], [ 256316, "u8", "CHarlie" ], [ 256324, "u8", "IDisposable" ], [ 256336, "u8", "set_Visible" ], [ 256348, "u8", "RuntimeTypeHandle" ], [ 256366, "u8", "GetTypeFromHandle" ], [ 256384, "u8", "File" ], [ 256389, "u8", "Console" ], [ 256397, "u8", "set_BorderStyle" ], [ 256413, "u8", "set_Name" ], [ 256422, "u8", "set_FileName" ], [ 256435, "u8", "configFileName" ], [ 256450, "u8", "lpFileName" ] ], "v": { "file.stem": "b495e348fb0e0544e57737f46f9333a711eaca2cd531a5e8065e96bf274d8690", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 3427299189, "file.basename": "b495e348fb0e0544e57737f46f9333a711eaca2cd531a5e8065e96bf274d8690.exe", "pe.image_base": 4194304, "pe.image_size": 294912, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 271566, "pe.headers_size": 512, "pe.version.type": "app", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "e9c9bdb9a993c5141e65c23ad033d9979999e12e", "pe.version.company": "Vivaldi Technologies AS", "pe.version.comments": "Vivaldi", "pe.image_hash.sha256": "a73cd6c99d4fcacff84d99c4c46266c93fbb8c28d223d8d8cdbc537ce9561bd5", "pe.image_hash.sha384": "6c9aba4b46d965d46e46839e3573b588ec341b5ff6b727d2bc45a38e9752deed08513282a6414e5d5a08cdb221a5ea13", "pe.image_hash.sha512": "07a81118bb625b159e8a32cc84737da85722d84e7afc8c60051b9a38b693ff61575c9cd5a72ef6379adb117ff189f6d754a82dfb2012137d9f4350b3c4c3d032", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.version.copyright": "Copyright 2022 Vivaldi Technologies AS. All rights reserved.", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.version.description": "vivaldi", "pe.linker_major_version": 48, "pe.version.file_version": "5.5.0.0", "pe.version.product_name": "Vivaldi", "pe.version.internal_name": "vivaldi.exe", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 271476, "pe.data_directories[1].rva": 278528, "pe.data_directories[2].rva": 286720, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "5.5.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 968, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.version.original_filename": "vivaldi.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1 }, "id": "pe", "sc": [ [ ".text", 512, 263680, 7.96, "r-x" ], [ ".rsrc", 264192, 1024, 3.09, "r--" ], [ ".reloc", 265216, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 265728, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x3dac0" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x3dac0" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "b495e348fb0e0544e57737f46f9333a711eaca2cd531a5e8065e96bf274d8690.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8199999928474426, "d": ".NET child stderr redirection", "e": [ "set_RedirectStandardError" ], "i": "micro-behaviors/process/create/spawn::redirect-standard-error-dotnet", "l": 3, "el": [ "0x3f2e3" ] }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright 2022 Vivaldi Technologies AS. All rights reserved." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x3f345" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x3f05c" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": ".NET StringBuilder Append use", "e": [ "StringBuilder" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "l": 1, "m": "C0025", "el": [ "0x3f1bf" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "vivaldi" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "a": "T1105", "c": 0.8999999761581421, "d": "ProcessStartInfo execution token", "e": [ "ProcessStartInfo" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::processstartinfo-exec-token", "l": 1, "el": [ "0x3f0fd" ] }, { "c": 1.0, "d": "Near-maximum entropy in .text section", "e": [ ".text (entropy: 7.96, perms: r-x)" ], "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x40329" ] }, { "c": 0.800000011920929, "d": ".NET child stdin redirection", "e": [ "set_RedirectStandardInput" ], "i": "micro-behaviors/process/create/spawn::redirect-standard-input-dotnet", "l": 3, "el": [ "0x3f626" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "5.5.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x406be" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.4000000059604645, "d": "version word (lowercase)", "e": [ "version" ], "i": "metadata/package/versioning::version-word-lower", "l": 2, "el": [ "0x3efdc" ] }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1, "el": [ "0x3efc8" ] }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "get_ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x3f1d4" ] }, { "a": "T1552.001", "c": 0.30000001192092896, "d": "\"password\" keyword", "e": [ "password" ], "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword", "l": 1, "el": [ "0x3f810" ] }, { "c": 0.800000011920929, "d": "Dynamic object instantiation via Activator", "e": [ "Activator" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::activator", "l": 1, "el": [ "0x3f30b" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Vivaldi" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.96)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "b495e348fb0e0544e57737f46f9333a711eaca2cd531a5e8065e96bf274d8690.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 3372.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "Semantic version pattern", "e": [ "v1.0.0" ], "i": "metadata/package/versioning::semver-pattern", "l": 2, "el": [ "0x400b7" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R", "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x1b28", "0x3e7a9" ] }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "a": "T1140", "c": 0.8399999737739563, "d": "CreateInstance activation token", "e": [ "CreateInstance" ], "i": "objectives/command-and-control/dropper/staging/embedded::createinstance-token", "l": 1, "m": "B0030", "el": [ "0x3e8cd" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x4085e" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "Polynomial hash multiply-by-31 instruction (modified djb2)", "e": [ "c9" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "l": 1, "m": "B0032.014", "el": [ "0x999d" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 3372.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x40962" ] }, { "c": 0.8199999928474426, "d": "AppDomain GetDomain token", "e": [ "GetDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-getdomain-token", "l": 1, "el": [ "0x3efd2" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.96" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027.009", "c": 0.7200000286102295, "d": ".NET resource GetObject token", "e": [ "GetObject" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getobject-token", "l": 1, "el": [ "0x3f545" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1041", "c": 0.8600000143051147, "d": "Notification config wording", "e": [ "sender" ], "i": "objectives/exfiltration/messaging/webhook::notification-config-word", "l": 1, "m": "B0030", "el": [ "0x3f1cd" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0x40378" ] }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://changwei.me" ], "i": "objectives/command-and-control/infrastructure/domain/heuristic::http-url-binary", "l": 1, "m": "C0002", "el": [ "0x3fe27" ] }, { "c": 0.75, "d": ".NET StartupPath property token", "e": [ "get_StartupPath" ], "i": "micro-behaviors/process/create/spawn::startup-path-dotnet", "l": 2, "el": [ "0x3ee36" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "5.5.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "cmd" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x3f7aa" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x40a1a" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "5.5.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.7799999713897705, "d": "Process shell execute configuration", "e": [ "set_UseShellExecute" ], "i": "objectives/evasion/process/hidden/execution::use-shell-execute", "l": 1, "el": [ "0x3ec7d" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x406be" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x40af2" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x3f46c" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x3f46c" ] }, { "c": 0.699999988079071, "d": ".NET Process type token", "e": [ "ProcessStartInfo" ], "i": "micro-behaviors/process/create/spawn::process-token-dotnet", "l": 1, "el": [ "0x3f0fd" ] }, { "c": 0.550000011920929, "d": ".NET Start method token", "e": [ "Start" ], "i": "micro-behaviors/process/create/spawn::start-method-token-dotnet", "l": 1, "el": [ "0x3f5e5" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x3ecbc" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.96" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 0.8199999928474426, "d": "Reflection exported types token", "e": [ "GetExportedTypes" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-exported-types-token", "l": 1, "el": [ "0x3f401" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "0x3f332" ] }, { "c": 0.7799999713897705, "d": "Assembly accessor token (get_Assembly)", "e": [ "get_Assembly" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-assembly-token", "l": 1, "el": [ "0x3f75d" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 3372.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x3db8f" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 3372.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO", "System.Security" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x3e796", "0x3f740" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "value", "Value", "get_Value", "add_ValueChanged", "set_Value", "nbrUpDownSpeed_ValueChanged", "colValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x3ecb6", "0x3fe9d", "0x3ec99", "0x3e7f3", "0x3eca3", "0x3e804", "0x3ecad" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027.009", "c": 0.8600000143051147, "d": ".NET ResourceReader payload access", "e": [ "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.…" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader", "l": 1, "el": [ "0x1b28" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.6000000238418579, "d": ".NET Process class token", "e": [ "Process" ], "i": "micro-behaviors/process/create/spawn::process-class-token-dotnet", "l": 1, "el": [ "0x3f4c6" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x40b32" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "CreateDecryptor" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr", "l": 1, "el": [ "0x3f322" ] }, { "a": "T1027", "c": 0.8799999952316284, "d": ".NET MD5CryptoServiceProvider use", "e": [ "MD5CryptoServiceProvider" ], "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-md5-crypto-service", "l": 1, "el": [ "0x3f1a6" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo", "WritePrivateProfileString", "GetPrivateProfileString", "lpReturnedString", "lpString", "StringBuilder", "ToString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x408fe", "0x3ed6f", "0x3ed89", "0x3ed5e", "0x3edaa", "0x3f1bf", "0x3eda1" ] }, { "c": 0.800000011920929, "d": "ICryptoTransform interface token", "e": [ "ICryptoTransform" ], "i": "micro-behaviors/crypto/symmetric/3des::icryptotransform", "l": 1, "el": [ "0x3ef5d" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.800000011920929, "d": "cmd.exe command interpreter reference", "e": [ "cmd.exe" ], "i": "micro-behaviors/process/create/exec::cmd-exe-reference", "l": 3, "el": [ "0x3f7aa" ] }, { "c": 0.8199999928474426, "d": ".NET child stdout redirection", "e": [ "set_RedirectStandardOutput" ], "i": "micro-behaviors/process/create/spawn::redirect-standard-output-dotnet", "l": 3, "el": [ "0x3f653" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8999999761581421, "d": "WCF generated code attribute", "e": [ "GeneratedCodeAttribute" ], "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute", "l": 1, "el": [ "0x3ead9" ] }, { "c": 0.800000011920929, "d": "CodeDom compiler access", "e": [ "System.CodeDom.Compiler" ], "i": "metadata/lang/compiler/managed::codedom-compiler", "l": 2, "el": [ "0x3f209" ] }, { "c": 0.800000011920929, "d": "CreateDecryptor method token", "e": [ "CreateDecryptor" ], "i": "micro-behaviors/crypto/symmetric/3des::create-decryptor", "l": 1, "el": [ "0x3f322" ] }, { "c": 0.8500000238418579, "d": "IPv4-like .NET assembly version", "e": [ "Version=4.0.0.0" ], "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "l": 2, "el": [ "0x1b28" ] }, { "a": "T1217", "c": 0.7799999713897705, "d": "Alternate Chromium browser process names", "e": [ "vivaldi.exe" ], "i": "objectives/collection/activity/browser::browser-process-name-alt", "l": 1, "el": [ "0x40a34" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x409b2" ] }, { "d": "password keyword", "e": [ "TxtPassword_LostFocus", "Password", "set_PasswordChar", "txtPassword", "lblPassword", "defaultPassword", "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1, "el": [ "0x3f4f5", "0x3fa71", "0x3f157", "0x3e896", "0x3e87a", "0x3e886", "0x3f810" ] }, { "c": 0.8999999761581421, "d": ".NET CreateDecryptor method", "e": [ "CreateDecryptor" ], "i": "micro-behaviors/crypto/symmetric/aes/library::dotnet-create-decryptor", "l": 1, "el": [ "0x3f322" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 3372.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "filePath", "configFilePath", "ipmitoolPath", "get_StartupPath", "currentPath" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012", "el": [ "0x3ee20", "0x3ee11", "0x3ee29", "0x3ee36", "0x3ee46" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.9200000166893005, "d": "Large high-entropy random executable section", "e": [ ".text (size: 263680, entropy: 7.96, perms: r-x)" ], "i": "metadata/binary/section/metrics::random-exec-payload-section", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 263680, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "b495e348fb0e0544e57737f46f9333a711eaca2cd531a5e8065e96bf274d8690.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1564.003", "c": 0.8600000143051147, "d": ".NET process window suppression", "e": [ "set_CreateNoWindow" ], "i": "micro-behaviors/process/create/hidden::dotnet-create-no-window", "l": 2, "el": [ "0x3f6b6" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x3ecbc" ] }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1, "el": [ "0x3f7aa" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyConfigurationAttribute", "EditorBrowsableAttribute", "ApplicationSettingsBase", "CompilerGeneratedAttribute", "GeneratedCodeAttribute", "CompilationRelaxationsAttribute", "AssemblyFileVersionAttribute", "DebuggerNonUserCodeAttribute", "TargetFrameworkAttribute", "ComVisibleAttribute", "AssemblyCopyrightAttribute", "DebuggableAttribute", "AssemblyTrademarkAttribute", "AssemblyTitleAttribute", "AssemblyDescriptionAttribute", "AssemblyProductAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x3ebb6", "0x3eb21", "0x3ea40", "0x3eab0", "0x3ead9", "0x3ebf2", "0x3eb99", "0x3eaf0", "0x3eb80", "0x3eb3a", "0x3ec2b", "0x3eb0d", "0x3eb65", "0x3eb4e", "0x3ebd5", "0x3ec12" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "5.5.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.002", "c": 0.8500000238418579, "d": ".NET assembly with single import (packed)", "e": [ "imports.count = 1.00", "binary.code_entropy = 7.96", "BSJB" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-single-import", "l": 1 }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "5.5.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8799999952316284, "d": ".NET child process stdio redirection", "e": [ "set_RedirectStandardError", "ProcessStartInfo", "set_RedirectStandardInput", "set_RedirectStandardOutput" ], "i": "micro-behaviors/process/create/spawn::dotnet-redirected-stdio", "l": 3, "el": [ "0x3f2e3", "0x3f0fd", "0x3f626", "0x3f653" ] }, { "a": "T1027.002", "c": 0.8999999761581421, "d": ".NET assembly with bootstrap-only imports", "e": [ "binary.code_entropy = 7.96", "imports.count = 1.00", "BSJB" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-bootstrap-imports", "l": 1 }, { "c": 0.9200000166893005, "d": ".NET hidden process launch setup", "e": [ "set_CreateNoWindow", "set_UseShellExecute", "ProcessStartInfo" ], "i": "objectives/evasion/process/hidden/execution::dotnet-hidden-process-launch", "l": 1, "el": [ "0x3f6b6", "0x3ec7d", "0x3f0fd" ] } ], "sha": "b495e348fb0e0544e57737f46f9333a711eaca2cd531a5e8065e96bf274d8690", "path": "b495e348fb0e0544e57737f46f9333a711eaca2cd531a5e8065e96bf274d8690.exe", "type": "pe" } ], "tv": "52045" } }