{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.2316606, "class": 0 }, { "m": "az/pe", "prob": 0.0041841003, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T13:36:32Z" }, "path": "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 2255046.0, "checksum_valid": 1.0, "computed_checksum": 2255046.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 2205088.0, "entropy": 3.21, "size_bytes": 2205088.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 3.19, "overlay_size": 5024.0, "string_count": 206.0, "overlay_ratio": 0.0, "overlay_entropy": 7.21, "entropy_variance": 2.41, "avg_string_length": 10589.66, "max_string_length": 2178250.0, "code_to_data_ratio": 1.0, "string_length_stddev": 151395.97, "largest_section_ratio": 1.0, "sentence_string_count": 5.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 2199040.0, "entropy_max": 3.19, "entropy_mean": 1.63, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 10045, "u8", "/ \nO" ], [ 15992, "u8", "BSJB" ], [ 17732, "u8", "UInt32" ], [ 17739, "u8", "\u003cModule\u003e" ], [ 17748, "u8", "System.IO" ], [ 17758, "u8", "edbacbdbdcbabafbcfbcbdaccbaa" ], [ 17787, "u8", "feeeedacacaa" ], [ 17800, "u8", "eabfacabebbcaa" ], [ 17815, "u8", "fdaccbaeabddeccaa" ], [ 17833, "u8", "cbcfabccffdefdbcdaa" ], [ 17853, "u8", "bacbfbcedfdbaaffccbbefdaa" ], [ 17879, "u8", "adbebdeaaefaecfdedcfaa" ], [ 17902, "u8", "efbacaceeabebbca" ], [ 17919, "u8", "ffcafaffbbffcdea" ], [ 17936, "u8", "GetMetadata" ], [ 17948, "u8", "eccbbfccaedbfafddfaaab" ], [ 17971, "u8", "fbfccaeccb" ], [ 17982, "u8", "bffcbeefdcdcbdeabdbefdb" ], [ 18006, "u8", "cfbcabbbdadabbcbdfb" ], [ 18026, "u8", "mscorlib" ], [ 18035, "u8", "aadafbfebeac" ], [ 18048, "u8", "aaeeafacebdacbfbaabebaeacbc" ], [ 18076, "u8", "eaabecfbfbefbdcedbffbec" ], [ 18100, "u8", "bebbfabbaecbcbacec" ], [ 18119, "u8", "fcdaefaaaacddfcffc" ], [ 18138, "u8", "System.Collections.Generic" ], [ 18165, "u8", "Microsoft.VisualBasic" ], [ 18187, "u8", "fecaadcedfcaabbcdddbdefeedad" ], [ 18216, "u8", "Load" ], [ 18221, "u8", "dcbfaeedbddbedfbabacbbebebbd" ], [ 18254, "u8", "ecbfdbdd" ], [ 18263, "u8", "Versioned" ], [ 18273, "u8", "Microsoft.VisualStudio.ResultsTranslationShared" ], [ 18321, "u8", "abbfdfdcdcabddacbbbbaeefd" ], [ 18347, "u8", "NewGuid" ], [ 18355, "u8", "GetMethod" ], [ 18365, "u8", "Replace" ], [ 18373, "u8", "StackTrace" ], [ 18384, "u8", "ceaedfffacfce" ], [ 18398, "u8", "bbdafdeadfcddfacbabaecde" ], [ 18423, "u8", "ccaedadcefeaadbcaee" ], [ 18443, "u8", "RuntimeTypeHandle" ], [ 18461, "u8", "GetTypeFromHandle" ], [ 18479, "u8", "get_Name" ], [ 18488, "u8", "set_AccessibleName" ], [ 18507, "u8", "CallByName" ], [ 18518, "u8", "StackFrame" ], [ 18529, "u8", "GetFrame" ], [ 18538, "u8", "CallType" ], [ 18547, "u8", "MethodBase" ], [ 18558, "u8", "TryParse" ], [ 18567, "u8", "Write" ], [ 18573, "u8", "ComVisibleAttribute" ], [ 18593, "u8", "AssemblyTitleAttribute" ], [ 18616, "u8", "AssemblyTrademarkAttribute" ], [ 18643, "u8", "TargetFrameworkAttribute" ], [ 18668, "u8", "AssemblyFileVersionAttribute" ], [ 18697, "u8", "AssemblyDescriptionAttribute" ], [ 18726, "u8", "CompilationRelaxationsAttribute" ], [ 18758, "u8", "AssemblyProductAttribute" ], [ 18783, "u8", "AssemblyCopyrightAttribute" ], [ 18810, "u8", "AssemblyCompanyAttribute" ], [ 18835, "u8", "WriteByte" ], [ 18845, "u8", "ToByte" ], [ 18852, "u8", "GetObjectValue" ], [ 18867, "u8", "efbacaceeabebbca.exe" ], [ 18888, "u8", "set_ClientSize" ], [ 18903, "u8", "Serialize" ], [ 18913, "u8", "dabcddaaeecccdfdbeeecbebaaf" ], [ 18941, "u8", "bdbdfaeaaeaf" ], [ 18954, "u8", "adadfacdbcccdef" ], [ 18970, "u8", "cfebcbaefcbffeff" ], [ 18987, "u8", "System.Runtime.Versioning" ], [ 19013, "u8", "ToString" ], [ 19022, "u8", "GetString" ], [ 19032, "u8", "System.Drawing" ], [ 19047, "u8", "get_Length" ], [ 19058, "u8", "Microsoft.Build.Framework" ], [ 19084, "u8", "Decimal" ], [ 19092, "u8", "set_AutoScroll" ], [ 19107, "u8", "Control" ], [ 19115, "u8", "Stream" ], [ 19122, "u8", "ISerializableItem" ], [ 19140, "u8", "ITaskItem" ], [ 19150, "u8", "System" ], [ 19157, "u8", "Form" ], [ 19162, "u8", "Boolean" ], [ 19170, "u8", "Join" ], [ 19175, "u8", "set_Icon" ], [ 19184, "u8", "System.Reflection" ], [ 19202, "u8", "MissingManifestResourceException" ], [ 19235, "u8", "MemberInfo" ], [ 19246, "u8", "set_AllowDrop" ], [ 19260, "u8", "Char" ], [ 19265, "u8", "System.Resources.ResourceManager" ], [ 19298, "u8", "BitConverter" ], [ 19311, "u8", ".ctor" ], [ 19317, "u8", ".cctor" ], [ 19324, "u8", "UIntPtr" ], [ 19332, "u8", "System.Diagnostics" ], [ 19351, "u8", "System.Runtime.InteropServices" ], [ 19382, "u8", "Microsoft.VisualBasic.CompilerServices" ], [ 19421, "u8", "System.Runtime.CompilerServices" ], [ 19453, "u8", "Microsoft.VisualStudio.ProjectServices" ], [ 19492, "u8", "System.Resources" ], [ 19509, "u8", "GetBytes" ], [ 19518, "u8", "Equals" ], [ 19525, "u8", "System.Windows.Forms" ], [ 19546, "u8", "Conversions" ], [ 19558, "u8", "get_Chars" ], [ 19568, "u8", "RuntimeHelpers" ], [ 19583, "u8", "Format" ], [ 19590, "u8", "Object" ], [ 19597, "u8", "Split" ], [ 19603, "u8", "set_Text" ], [ 19612, "u8", "77x/90x/144x/0x/3x/0x/0x/0x/4x/0x/0x/0x/255x/255x/0x/0x/184x/0x/0x/0x/0x/0x/0x/0x/64x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/" ], [ 2197863, "u8", "ToByteArray" ], [ 2197875, "u8", "ToArray" ], [ 2197883, "u8", "set_AllowTransparency" ], [ 2197905, "u8", "Assembly" ], [ 2197914, "u8", "op_Equality" ], [ 2197926, "u8", "IsNullOrEmpty" ], [ 2198225, "u8", ".NETFramework,Version=v4.0" ], [ 2199022, "u8", "mscoree.dll" ], [ 2200130, "u8", "N0L0" ], [ 2200273, "u8", "Microsoft Windows1" ], [ 2200301, "u8", "Bill Gates1" ], [ 2200322, "u8", "RE 9991" ], [ 2200364, "u8", "201104235420Z" ], [ 2200379, "u8", "211104235420Z0b1" ], [ 2200655, "u8", "C0A0" ], [ 2201473, "u8", "20201104235420Z" ], [ 2201564, "u8", "DigiCert Inc1" ], [ 2201587, "u8", "www.digicert.com110/" ], [ 2201613, "u8", "(DigiCert SHA2 Assured ID Timestamping CA0" ], [ 2201673, "u8", "301017000000Z0L1" ], [ 2201712, "u8", "DigiCert, Inc.1$0\"" ], [ 2201737, "u8", "TIMESTAMP-SHA256-2019-10-150" ], [ 2202170, "u8", "https://www.digicert.com/CPS0" ], [ 2202643, "u8", "j0h02" ], [ 2202653, "u8", ",http://crl3.digicert.com/sha2-assured-ts.crl02" ], [ 2202705, "u8", ",http://crl4.digicert.com/sha2-assured-ts.crl0" ], [ 2202781, "u8", "http://ocsp.digicert.com0O" ], [ 2202818, "u8", "Chttp://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0" ], [ 2203257, "u8", "www.digicert.com1$0\"" ], [ 2203284, "u8", "DigiCert Assured ID Root CA0" ], [ 2203315, "u8", "160107120000Z" ], [ 2203330, "u8", "310107120000Z0r1" ], [ 2203912, "u8", "http://ocsp.digicert.com0C" ], [ 2203949, "u8", "7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" ], [ 2204024, "u8", "4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:" ], [ 2204084, "u8", "4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P" ], [ 2204145, "u8", "I0G08" ], [ 2204584, "u8", "(DigiCert SHA2 Assured ID Timestamping CA" ], [ 2204706, "u8", "201104235420Z0+" ] ], "v": { "file.stem": "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1604534060, "file.basename": "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe", "pe.image_base": 4194304, "pe.image_size": 2220032, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 2206718, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 5024, "pe.image_hash.sha1": "1dfd32017aac77048f3be7ba6a572d0fa7ee0ca1", "pe.image_hash.sha256": "43ef09e311a1b1e2166bd5855d3e14b4715c8668eda1a0849649458a3e87f50b", "pe.image_hash.sha384": "402eb2716adc11b9194e349bb62ff87fc4e1a94e57c15de4be199a1b2774bf6d4e02d11f4cbed9e640158b4f8a82a0d3", "pe.image_hash.sha512": "cc6eaf20102f4070bb2fd45efe0edfc21bb0b73e99c6de8e6017a2de7094f50056ae04813c61d0c12a43a2b48d2278c5e564df4aefca5135e450d2d7eafa923a", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=RE 999,O=Bill Gates,CN=Microsoft Windows", "pe.signatures[0].serial": "00e44af6d459d21983d5874bcd4742abf2", "pe.signatures[0].subject": "C=US,L=New York,OU=RE 999,O=Bill Gates,CN=Microsoft Windows", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 2206636, "pe.data_directories[1].rva": 2200064, "pe.data_directories[2].rva": 2211840, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-11-04T23:54:20Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 79, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 5024, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-11-04T23:54:20Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "8466d5b00f32fbcf04470e0a92a1bef65ea177ad", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "43ef09e311a1b1e2166bd5855d3e14b4715c8668eda1a0849649458a3e87f50b", "pe.signatures[0].thumbprint_sha256": "769a0eda1ff2d88d6f4f63fa3921b9a9716deb842722db92f794fe6c80df0f17", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 2199040, 3.19, "r-x" ], [ ".reloc", 2199552, 512, 0.08, "r--" ] ] }, "id": 0, "sz": 2205088, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x3e78" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x3e78" ] }, { "c": 1.0, "d": "Authenticode chain CN: Microsoft Windows", "e": [ "Microsoft Windows" ], "i": "metadata/signed/unknown::microsoft-windows", "l": 2 }, { "c": 1.0, "d": "Signed by Bill Gates", "e": [ "Bill Gates" ], "i": "metadata/signed/leaf::bill-gates", "l": 3 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x4af0" ] }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "0x484b" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.949999988079071, "d": "PE has exactly two sections", "e": [ "sections.count = 2.00" ], "i": "well-known/malware/virus/virlock::two-section-layout", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic", "Microsoft.VisualBasic.CompilerServices" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x46f5", "0x4bb6" ] }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x218dee" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0x21980d" ] }, { "c": 0.6000000238418579, "d": "MethodBase class reference", "e": [ "MethodBase" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-methodbase-token", "l": 1, "el": [ "0x4873" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x49b3" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x4554" ] }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x4c45" ] }, { "c": 0.6200000047683716, "d": "Assembly Load method token", "e": [ "Load" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-assembly-load-token", "l": 1, "el": [ "0x4728" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6000000238418579, "d": "GetMethod call reference", "e": [ "GetMethod" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::get-method-call", "l": 1, "el": [ "0x47b3" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x4b97" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x4c45" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x218dee" ] }, { "c": 0.949999988079071, "d": "DigiCert timestamp certificate chain", "e": [ "DigiCert SHA2 Assured ID Timestamping CA" ], "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain", "l": 2, "el": [ "0x21980d" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "System.Resources.ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x4b41" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x218c4c" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "GetObjectValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x49a4" ] }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0x218ad1" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x466a" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 206.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ToString", "GetString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x4a45", "0x4a4e" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.02" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.6499999761581421, "d": ".NET Diagnostics namespace token", "e": [ "System.Diagnostics" ], "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "l": 1, "el": [ "0x4b84" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Giant embedded string blob metric", "e": [ "binary.max_string_length = 2178250.00" ], "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyTitleAttribute", "CompilationRelaxationsAttribute", "AssemblyProductAttribute", "MissingManifestResourceException", "TargetFrameworkAttribute", "AssemblyCopyrightAttribute", "AssemblyTrademarkAttribute", "AssemblyFileVersionAttribute", "ComVisibleAttribute", "AssemblyDescriptionAttribute", "AssemblyCompanyAttribute" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x48a1", "0x4926", "0x4946", "0x4b02", "0x48d3", "0x495f", "0x48b8", "0x48ec", "0x488d", "0x4909", "0x497a" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 2199040, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "0x4b41" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x49b3" ] }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-11/b850eaea20bea75de7773fc3a80ce83d65a41dd319b71243a3f2c2beb965e0c7.exe", "type": "pe" } ], "tv": "ca5ef" } }