{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.9545454382896423 } ], "prob": 0.95454544, "models": [ { "m": "az", "raw": 0.96423167, "prob": 0.95454544, "class": 0 }, { "m": "az/native", "raw": 0.96308994, "prob": 0.54242927, "class": 0 }, { "m": "az/pe", "raw": 0.6921885, "prob": 0.9553926, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-07T18:55:24Z" }, "path": "Hardware.dll", "raw": { "v": "6", "fs": [ { "f": "O(As)H(Db)", "x": 41, "ff": { "i": [ [ "mscoree", "CorDllMain" ] ], "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 67873.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 34304.0, "entropy": 7.65, "size_bytes": 34304.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.83, "string_count": 574.0, "overall_entropy": 7.65, "entropy_variance": 10.33, "avg_string_length": 8.13, "max_string_length": 68.0, "code_to_data_ratio": 1.0, "string_length_stddev": 6.87, "largest_section_ratio": 0.94, "sentence_string_count": 2.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 32256.0, "entropy_max": 7.83, "entropy_mean": 3.56, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 1984, "u8", "GT0N" ], [ 2289, "u8", "bRci" ], [ 2390, "u8", "MWO2" ], [ 2850, "u8", "f631" ], [ 4279, "u8", "QCREqE" ], [ 5873, "u8", "7rik" ], [ 6049, "u8", "xn4fe" ], [ 6928, "u8", "LOOfuCsf" ], [ 9837, "u8", "MIy8h" ], [ 10027, "u8", "LIGD" ], [ 10069, "u8", "h23b" ], [ 14320, "u8", "m1h5" ], [ 14983, "u8", "Zddb" ], [ 16259, "u8", "gC2EM" ], [ 17207, "u8", "u3yh" ], [ 20127, "u8", "qBXI5" ], [ 23400, "u8", "5kjT5L" ], [ 25164, "u8", "dQagW" ], [ 25757, "u8", "6r2x" ], [ 26514, "u8", "I1AR3" ], [ 26696, "u8", "C3MB6" ], [ 26719, "u8", "LH3G" ], [ 27230, "u8", "C4LUJ" ], [ 27852, "u8", "ZKKJ" ], [ 28296, "u8", "BSJB" ], [ 29717, "u8", "Dictionary`2" ], [ 29730, "u8", "\u003cModule\u003e" ], [ 29739, "u8", "LoadingAPI" ], [ 29750, "u8", "loadingAPI" ], [ 29761, "u8", "System.IO" ], [ 29771, "u8", "Costura" ], [ 29779, "u8", "PacketLib" ], [ 29789, "u8", "mscorlib" ], [ 29798, "u8", "System.Collections.Generic" ], [ 29825, "u8", "Read" ], [ 29830, "u8", "Load" ], [ 29839, "u8", "isAttached" ], [ 29850, "u8", "Interlocked" ], [ 29862, "u8", "costura.costura.dll.compressed" ], [ 29893, "u8", "costura.packetlib.dll.compressed" ], [ 29926, "u8", "costura.hookhardware.dll.compressed" ], [ 29962, "u8", "HookKeyboard" ], [ 29975, "u8", "UnhookKeyboard" ], [ 29990, "u8", "source" ], [ 29997, "u8", "CompressionMode" ], [ 30013, "u8", "Exchange" ], [ 30022, "u8", "nullCache" ], [ 30032, "u8", "IDisposable" ], [ 30044, "u8", "get_Name" ], [ 30053, "u8", "fullName" ], [ 30062, "u8", "GetName" ], [ 30070, "u8", "requestedAssemblyName" ], [ 30092, "u8", "name" ], [ 30097, "u8", "PacketType" ], [ 30108, "u8", "get_packetType" ], [ 30123, "u8", "HookHardware" ], [ 30136, "u8", "culture" ], [ 30144, "u8", "Dispose" ], [ 30152, "u8", "HookMouse" ], [ 30162, "u8", "UnhookMouse" ], [ 30174, "u8", "Write" ], [ 30180, "u8", "CompilerGeneratedAttribute" ], [ 30207, "u8", "GuidAttribute" ], [ 30221, "u8", "DebuggableAttribute" ], [ 30241, "u8", "ComVisibleAttribute" ], [ 30261, "u8", "AssemblyTitleAttribute" ], [ 30284, "u8", "AssemblyTrademarkAttribute" ], [ 30311, "u8", "TargetFrameworkAttribute" ], [ 30336, "u8", "AssemblyFileVersionAttribute" ], [ 30365, "u8", "AssemblyConfigurationAttribute" ], [ 30396, "u8", "AssemblyDescriptionAttribute" ], [ 30425, "u8", "CompilationRelaxationsAttribute" ], [ 30457, "u8", "AssemblyProductAttribute" ], [ 30482, "u8", "AssemblyCopyrightAttribute" ], [ 30509, "u8", "AssemblyCompanyAttribute" ], [ 30534, "u8", "RuntimeCompatibilityAttribute" ], [ 30564, "u8", "Byte" ], [ 30569, "u8", "TryGetValue" ], [ 30581, "u8", "add_AssemblyResolve" ], [ 30601, "u8", "System.Threading" ], [ 30618, "u8", "System.Runtime.Versioning" ], [ 30644, "u8", "CultureToString" ], [ 30660, "u8", "Attach" ], [ 30667, "u8", "Launch" ], [ 30674, "u8", "get_Length" ], [ 30685, "u8", "EndsWith" ], [ 30694, "u8", "nullCacheLock" ], [ 30708, "u8", "Global" ], [ 30715, "u8", "Hardware.dll" ], [ 30728, "u8", "ReadStream" ], [ 30739, "u8", "LoadStream" ], [ 30750, "u8", "GetManifestResourceStream" ], [ 30776, "u8", "DeflateStream" ], [ 30790, "u8", "MemoryStream" ], [ 30803, "u8", "stream" ], [ 30810, "u8", "set_Item" ], [ 30819, "u8", "System" ], [ 30826, "u8", "Main" ], [ 30831, "u8", "AppDomain" ], [ 30841, "u8", "get_CurrentDomain" ], [ 30859, "u8", "Plugin" ], [ 30866, "u8", "FodyVersion" ], [ 30878, "u8", "System.IO.Compression" ], [ 30900, "u8", "destination" ], [ 30912, "u8", "System.Globalization" ], [ 30933, "u8", "System.Reflection" ], [ 30951, "u8", "set_Position" ], [ 30964, "u8", "StringComparison" ], [ 30981, "u8", "CopyTo" ], [ 30988, "u8", "get_CultureInfo" ], [ 31004, "u8", "AssemblyLoader" ], [ 31019, "u8", "sender" ], [ 31026, "u8", "ResolveEventHandler" ], [ 31046, "u8", "Enter" ], [ 31052, "u8", ".ctor" ], [ 31058, "u8", ".cctor" ], [ 31065, "u8", "Monitor" ], [ 31073, "u8", "System.Diagnostics" ], [ 31092, "u8", "System.Runtime.InteropServices" ], [ 31123, "u8", "System.Runtime.CompilerServices" ], [ 31155, "u8", "ReadFromEmbeddedResources" ], [ 31181, "u8", "DebuggingModes" ], [ 31196, "u8", "GetAssemblies" ], [ 31210, "u8", "resourceNames" ], [ 31224, "u8", "symbolNames" ], [ 31236, "u8", "assemblyNames" ], [ 31250, "u8", "get_Flags" ], [ 31260, "u8", "AssemblyNameFlags" ], [ 31278, "u8", "ResolveEventArgs" ], [ 31295, "u8", "Equals" ], [ 31302, "u8", "PacketLib.Utils" ], [ 31318, "u8", "Miscellaneous" ], [ 31332, "u8", "Concat" ], [ 31339, "u8", "Object" ], [ 31346, "u8", "PacketLib.Packet" ], [ 31363, "u8", "IPacket" ], [ 31371, "u8", "get_currentPacket" ], [ 31389, "u8", "Exit" ], [ 31394, "u8", "ToLowerInvariant" ], [ 31411, "u8", "ProcessedByFody" ], [ 31427, "u8", "ContainsKey" ], [ 31439, "u8", "ResolveAssembly" ], [ 31455, "u8", "ReadExistingAssembly" ], [ 31476, "u8", "GetExecutingAssembly" ], [ 31497, "u8", "CleanMemory" ], [ 31509, "u8", "op_Equality" ], [ 31521, "u8", "op_Inequality" ], [ 31535, "u8", "IsNullOrEmpty" ], [ 31556, "u8", ".compressed" ], [ 31584, "u8", "costura" ], [ 31600, "u8", "costura.costura.dll.compressed" ], [ 31662, "u8", "hookhardware" ], [ 31688, "u8", "costura.hookhardware.dll.compressed" ], [ 31760, "u8", "packetlib" ], [ 31780, "u8", "costura.packetlib.dll.compressed" ], [ 32320, "u8", "WrapNonExceptionThrows" ], [ 32362, "u8", "Hardware" ], [ 32382, "u8", "Copyright" ], [ 32394, "u8", "2022" ], [ 32466, "u8", ".NETFramework,Version=v4.5" ], [ 32497, "u8", "FrameworkDisplayName" ], [ 32518, "u8", ".NET Framework 4.5" ], [ 32638, "u8", "mscoree.dll" ], [ 32862, "wide", "VS_VERSION_INFO" ], [ 32954, "wide", "VarFileInfo" ], [ 32986, "wide", "Translation" ], [ 33022, "wide", "StringFileInfo" ], [ 33082, "wide", "Comments" ], [ 33110, "wide", "CompanyName" ], [ 33146, "wide", "FileDescription" ], [ 33180, "wide", "Hardware" ], [ 33206, "wide", "FileVersion" ], [ 33254, "wide", "InternalName" ], [ 33280, "wide", "Hardware.dll" ], [ 33314, "wide", "LegalCopyright" ], [ 33344, "wide", "Copyright © 2022" ], [ 33386, "wide", "LegalTrademarks" ], [ 33430, "wide", "OriginalFilename" ], [ 33498, "wide", "ProductName" ], [ 33550, "wide", "ProductVersion" ], [ 33602, "wide", "Assembly Version" ] ], "v": { "file.stem": "Hardware", "pe.imphash": "dae02f32a21e03ce65412f6e56942daa", "pe.machine": "i386", "pe.subsystem": "windows_cui", "pe.timestamp": 2277264093, "file.basename": "Hardware.dll", "pe.image_base": 4194304, "pe.image_size": 57344, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 40334, "pe.headers_size": 512, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "536876cd3ea4b14c354227c12f11d6f2d0fddd3c", "pe.image_hash.sha256": "79ced7239353e51189b5b69481ee486fb0bed3ac7b05b9853a3f68b0d8baba81", "pe.image_hash.sha384": "0b431cfa11c8dcbeb0c437257c1f563b6e4ffd13504dbcb69a0e1bb5cd6b2aeb5e8a84d23d8873220cc7e215b78eb2aa", "pe.image_hash.sha512": "02c639bd6cf545f2290c38cb6559a2a00c992eb3b02f5b5a9d869da591657e41026ca9d1b97a2d2095619dd61be96916d55dc6b421fe7e9ac85b2078cbc5c41c", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "6.0", "pe.version.copyright": "Copyright © 2022", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8450, "pe.clr.runtime_version": "2.5", "pe.version.description": "Hardware", "pe.linker_major_version": 48, "pe.version.file_version": "1.0.0.0", "pe.version.product_name": "Hardware", "pe.debug.entries[0].type": "repro", "pe.version.internal_name": "Hardware.dll", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "no_seh", "pe.dll_characteristics[4]": "terminal_server_aware", "pe.data_directories[0].rva": 40244, "pe.data_directories[1].rva": 40960, "pe.data_directories[2].rva": 49152, "pe.data_directories[3].rva": 40216, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34144, "pe.number_of_rva_and_sizes": 16, "pe.version.product_version": "1.0.0.0", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 888, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 28, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.debug.entries[0].type_id": 16, "pe.version.original_filename": "Hardware.dll", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1 }, "id": "pe", "sc": [ [ ".text", 512, 32256, 7.83, "r-x" ], [ ".rsrc", 32768, 1024, 2.78, "r--" ], [ ".reloc", 33792, 512, 0.08, "r--" ] ] }, "id": 0, "sz": 34304, "ts": [ { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "8156" ] }, { "c": 0.6499999761581421, "d": "AppDomain class token", "e": [ "AppDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token", "l": 1, "el": [ "786f" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "805e" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "7e74" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "82da" ] }, { "c": 0.949999988079071, "d": "AssemblyResolve event registration", "e": [ "add_AssemblyResolve" ], "i": "micro-behaviors/data/embedded/payload/resource::assemblyresolve-hook", "l": 3, "el": [ "7775" ] }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.83)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "Hardware.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.5" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "7ed2" ] }, { "c": 0.800000011920929, "d": "Costura embedded assembly bundle marker", "e": [ "costura.costura.dll.compressed" ], "i": "micro-behaviors/data/embedded/payload/resource::costura-bundle-marker", "l": 1, "el": [ "74a6" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "74a6" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8600000143051147, "d": "notify/sender vocabulary word", "e": [ "sender" ], "i": "micro-behaviors/data/text/keywords/lexicon::notification-config-word", "l": 1, "el": [ "792b" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 7.83" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "7486" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "7e7e" ] }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Hardware" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "a": "T1140", "c": 0.8799999952316284, "d": "ResolveEventHandler delegate token", "e": [ "ResolveEventHandler" ], "i": "objectives/command-and-control/dropper/staging/embedded::resolveeventhandler-token", "l": 1, "m": "B0030", "el": [ "7932" ] }, { "c": 0.9200000166893005, "d": "PE FileVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-file-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1027", "c": 0.949999988079071, "d": "Code section entropy above 7.4", "e": [ "binary.code_entropy = 7.83" ], "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "l": 1 }, { "c": 1.0, "d": "Modification of HTTP context items", "e": [ "set_Item" ], "i": "micro-behaviors/communications/http/server/managed::http-item-setter", "l": 1, "el": [ "785a" ] }, { "c": 0.6000000238418579, "d": "AppDomain.CurrentDomain accessor", "e": [ "get_CurrentDomain" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain", "l": 1, "el": [ "7879" ] }, { "c": 0.8999999761581421, "d": "Binary has high overall entropy (packed/encrypted)", "e": [ "binary.overall_entropy = 7.65" ], "i": "metadata/binary/metrics/threshold::high-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "817a" ] }, { "c": 1.0, "d": "Windows DLL extension", "e": [ "Hardware.dll" ], "i": "metadata/file/extension::dll", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "8296" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "745d" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "TryGetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "7769" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "DLL filename extension present", "e": [ "Hardware.dll" ], "i": "metadata/file/extension::dll-basename", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright © 2022" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2, "el": [ "830e" ] }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2, "el": [ "805e" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringComparison", "CultureToString", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "78f4", "77b4", "80fe" ] }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "7961" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2, "el": [ "value:pe.resource_types[0]" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.9900000095367432, "d": "High overall binary entropy", "e": [ "binary.overall_entropy = 7.65" ], "i": "objectives/command-and-control/dropper/elex-loader::high-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "81e6" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "78d5" ] }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2, "el": [ "81b6" ] }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Hardware" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "a": "T1027.009", "c": 0.8500000238418579, "d": ".NET manifest resource stream access", "e": [ "GetManifestResourceStream" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getmanifestresourcestream", "l": 2, "el": [ "781e" ] }, { "c": 0.949999988079071, "d": "Filename ends with .dll", "e": [ "Hardware.dll" ], "i": "metadata/package/files::dll-extension-basename", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "7441" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 574.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "7f7e" ] }, { "c": 0.9200000166893005, "d": "PE ProductVersion resembles IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::pe-product-version-ipv4-shape", "l": 1, "el": [ "value:pe.version.product_version" ] }, { "c": 0.75, "d": "System.IO.Compression namespace reference", "e": [ "System.IO.Compression" ], "i": "micro-behaviors/data/compress/library::system-io-compression", "l": 1, "el": [ "789e" ] }, { "c": 1.0, "d": "Costura bundled .NET dependency marker", "e": [ "costura.hookhardware.dll.compressed", "costura.costura.dll.compressed", "costura.packetlib.dll.compressed" ], "i": "objectives/anti-static/pack/entropy::dotnet-costura-bundle-marker", "l": 1, "el": [ "74e6", "74a6", "74c5" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "7974" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "High overall file entropy", "e": [ "binary.overall_entropy = 7.65" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-overall-entropy", "l": 3, "m": "B0032" }, { "a": "T1045", "c": 0.949999988079071, "d": "Very high overall file entropy", "e": [ "binary.overall_entropy = 7.65" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::very-high-entropy", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyDescriptionAttribute", "AssemblyTrademarkAttribute", "CompilerGeneratedAttribute", "DebuggableAttribute", "AssemblyProductAttribute", "RuntimeCompatibilityAttribute", "GetManifestResourceStream", "ReadFromEmbeddedResources", "CompilationRelaxationsAttribute", "AssemblyTitleAttribute", "AssemblyFileVersionAttribute", "AssemblyConfigurationAttribute", "ComVisibleAttribute", "AssemblyCompanyAttribute", "TargetFrameworkAttribute", "AssemblyCopyrightAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "76bc", "764c", "75e4", "760d", "76f9", "7746", "781e", "79b3", "76d9", "7635", "7680", "769d", "7621", "772d", "7667", "7712" ] }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1, "el": [ "805e" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "nullCache", "nullCacheLock" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023", "el": [ "7546", "77e6" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "PE version numbers look like IPv4", "e": [ "1.0.0.0" ], "i": "metadata/package/versioning::version-number-ipv4-metadata", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027.002", "c": 0.8999999761581421, "d": ".NET assembly with bootstrap-only imports", "e": [ "BSJB", "imports.count = 1.00", "binary.code_entropy = 7.83" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-bootstrap-imports", "l": 1 }, { "a": "T1036.005", "c": 0.9399999976158142, "d": "Two dotted-quad version strings", "e": [ "1.0.0.0" ], "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "VS_VERSION_INFO", "FileVersion" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2, "el": [ "830e", "805e", "81b6" ] }, { "a": "T1027.002", "c": 0.8500000238418579, "d": ".NET assembly with single import (packed)", "e": [ "BSJB", "imports.count = 1.00", "binary.code_entropy = 7.83" ], "i": "objectives/command-and-control/dropper/execution/loader::dotnet-single-import", "l": 1 } ], "sha": "b68dee91daf843e84bda216b75fb7ce684cdbd5dc38d7e61ce2e4f16629cb4ce", "path": "Hardware.dll", "type": "pe" } ], "tv": "318d5" } }