{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.43843845, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T19:37:33Z" }, "path": "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 4421501.0, "checksum_valid": 1.0, "computed_checksum": 4421501.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 4416728.0, "entropy": 5.09, "size_bytes": 4416728.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.09, "overlay_size": 6360.0, "string_count": 10096.0, "overlay_ratio": 0.0, "overlay_entropy": 7.51, "entropy_variance": 6.27, "avg_string_length": 4.83, "max_string_length": 66.0, "code_to_data_ratio": 1.0, "string_length_stddev": 3.75, "largest_section_ratio": 1.0, "sentence_string_count": 8.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 4409344.0, "entropy_max": 5.09, "entropy_mean": 2.59, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 255514, "u8", "% sh" ], [ 4399661, "u8", "\u003cModule\u003e" ], [ 4399670, "u8", "Aeebfaabecbaaa" ], [ 4399685, "u8", "Afefbbfeadbaecedaafbfbaa" ], [ 4399710, "u8", "Acceaeeedaacddcbabcaa" ], [ 4399732, "u8", "Fcfbaafdabeefcfcaa" ], [ 4399751, "u8", "Aabbefffcaa" ], [ 4399763, "u8", "Caacddfddceacecfacfefacbdaa" ], [ 4399791, "u8", "Fcebdedabfcdcdaa" ], [ 4399808, "u8", "Aeebdbccefaeaa" ], [ 4399823, "u8", "Ecdffadeefaa" ], [ 4399836, "u8", "Eddaeeaaba" ], [ 4399847, "u8", "Cedbdbaba" ], [ 4399857, "u8", "Ddbbafbeeeaeccdadaabdddabdaba" ], [ 4399887, "u8", "Facfcabba" ], [ 4399897, "u8", "Aceecdbcdfdbccaffdbcdbbba" ], [ 4399923, "u8", "Acecdeddababbcaddcbba" ], [ 4399945, "u8", "Ababbaecdefdacacdbfcfffedbba" ], [ 4399974, "u8", "Ddabfadfbebabbdeeafccfbbebba" ], [ 4400003, "u8", "Fbabecebeeeacfebecddbbcba" ], [ 4400029, "u8", "Fcbabeaecba" ], [ 4400041, "u8", "Ddafffacecfcbaeedbfebdba" ], [ 4400066, "u8", "Afedfefabcafaafacddba" ], [ 4400088, "u8", "Bceacbeedfdba" ], [ 4400102, "u8", "Abbdcaeabdeefdebeffebccaeba" ], [ 4400130, "u8", "Deadfceeffcfadbabadeaeba" ], [ 4400155, "u8", "Cecfaaeceba" ], [ 4400167, "u8", "Bcacaaebbaaeeebbcefeba" ], [ 4400190, "u8", "Fabcfba" ], [ 4400198, "u8", "Fbadabbbecbcfabaedaacedfba" ], [ 4400225, "u8", "Fefcaafaafdffddacdbffba" ], [ 4400249, "u8", "Bafccbdfdaaca" ], [ 4400263, "u8", "Cbdbfcaccfecafddfcaca" ], [ 4400285, "u8", "Cabbabfadcfbaafaca" ], [ 4400304, "u8", "Dceefbddbccaafaca" ], [ 4400322, "u8", "Dabdeaebdbaabbcbcefbabca" ], [ 4400347, "u8", "Ccbcabaaebeaeeafbfabca" ], [ 4400370, "u8", "Cadcaecddbca" ], [ 4400383, "u8", "Cabcccfedadfcffffabccadfbca" ], [ 4400411, "u8", "Dfabfeedfdbefebdca" ], [ 4400430, "u8", "Efbfecdbfbdca" ], [ 4400444, "u8", "Bdacbfdaaedca" ], [ 4400458, "u8", "Fecaefafdca" ], [ 4400470, "u8", "Cccdeafabfaeecfcfadfebeca" ], [ 4400496, "u8", "Abafceeccefdeca" ], [ 4400512, "u8", "Afabbbeececeefbadaffeca" ], [ 4400536, "u8", "Dfbfffcdfca" ], [ 4400548, "u8", "Cfbfdadbafdecadbfaaadccccada" ], [ 4400577, "u8", "Fefdcdccddbdabdaabdada" ], [ 4400600, "u8", "Eccdfeebadbbbedffefebbbdada" ], [ 4400628, "u8", "Ecedaddeada" ], [ 4400640, "u8", "Cabbacbaabebdfada" ], [ 4400658, "u8", "Bbcfcbeebeaaccabbda" ], [ 4400678, "u8", "Edecceddccafccaefbabacdbdcda" ], [ 4400707, "u8", "Cebaddadddecbddda" ], [ 4400725, "u8", "Fcbbfbffcfddddda" ], [ 4400742, "u8", "Cbabbcafeda" ], [ 4400754, "u8", "Bebefeedcbddfda" ], [ 4400770, "u8", "Dffaffda" ], [ 4400779, "u8", "Cbccdbeabeacacfeeeabaea" ], [ 4400803, "u8", "Fedcfebea" ], [ 4400813, "u8", "Aeaadfeebebbbdaeacbcea" ], [ 4400836, "u8", "Cfdcdfeceaabbcfaebfcea" ], [ 4400859, "u8", "Fdcbbedaebfafaefefcea" ], [ 4400881, "u8", "Bebcbdedbcbbffefafbecbeea" ], [ 4400907, "u8", "Cecedaabaecabffafea" ], [ 4400927, "u8", "Aaedceefdbfdbbdfea" ], [ 4400946, "u8", "Aafaafa" ], [ 4400954, "u8", "Abadbebfebbaddbafa" ], [ 4400973, "u8", "Dfafbdcfdaffcdebaeafafa" ], [ 4400997, "u8", "Dadfffeacbfdceddbbaddffcbabfa" ], [ 4401027, "u8", "Becdeebfeecfbfa" ], [ 4401043, "u8", "Acdbcfbffabbfcfa" ], [ 4401060, "u8", "Afddeaecebaacbfdffcbbdbefcfa" ], [ 4401089, "u8", "Defadacbddaebfdaeeaafdcdfa" ], [ 4401116, "u8", "Ffaedbefbdffcdbfdfa" ], [ 4401136, "u8", "Aeddaaccfabcfabefa" ], [ 4401155, "u8", "Cdcdfebbfafedeafefa" ], [ 4401175, "u8", "Bbbdaabdbfacfefa" ], [ 4401192, "u8", "Abaccfbdbcdaeafdbaacabbffa" ], [ 4401219, "u8", "AccessControlEntryData" ], [ 4401242, "u8", "AccessControlListMetadata" ], [ 4401268, "u8", "Caaaacaaab" ], [ 4401279, "u8", "Bebcdffabefaaacfbedefdbbaab" ], [ 4401307, "u8", "Aedffabefedeaab" ], [ 4401323, "u8", "Bcfcddcdfcaeafeaab" ], [ 4401342, "u8", "Ffbcabbab" ], [ 4401352, "u8", "Dbfbfabbab" ], [ 4401363, "u8", "Ecdcbafbbab" ], [ 4401375, "u8", "Feaafbbdeadddcadbdbab" ], [ 4401397, "u8", "Cddebdddffeaabafdebab" ], [ 4401419, "u8", "Abedbfdebeecbdacab" ], [ 4401438, "u8", "Febdbbebdfafedbbfbaccab" ], [ 4401462, "u8", "Dffadcfdab" ], [ 4401473, "u8", "Ddcdebfecfdcdaeccaddbcbeab" ], [ 4401500, "u8", "Dddeccaaaacadfcceab" ], [ 4401520, "u8", "Dbcbddeab" ], [ 4401530, "u8", "Bcdaccfeab" ], [ 4401541, "u8", "Ccdfacfab" ], [ 4401551, "u8", "Defccfab" ], [ 4401560, "u8", "Ebfdbbefeaddfab" ], [ 4401576, "u8", "Aafdfeecbdcaedaffedfdffab" ], [ 4401602, "u8", "Bfbcdfddcdadffbaedabb" ], [ 4401624, "u8", "Eabfbfdedccbecbcafebcdbbb" ], [ 4401650, "u8", "Dcbebbbdaafcbfefecaffbbb" ], [ 4401675, "u8", "Bedafedcbb" ], [ 4401686, "u8", "Bcabcffaaeeaeaefcbb" ], [ 4401706, "u8", "Aabbcdfddbb" ], [ 4401718, "u8", "Caecdcdbebaabdecccddaebb" ], [ 4401743, "u8", "Fdbdaebcfccfebfdfbffcdcbebb" ], [ 4401771, "u8", "Efdaddbebcdffbdebdfeebb" ], [ 4401795, "u8", "Dbdafdadcbccdcbdbcdfabfbb" ], [ 4401821, "u8", "Bebbaceebfdeadbbbcaacacb" ], [ 4401846, "u8", "Bdfdadcfacdaddebeddabfcfbbcb" ], [ 4401875, "u8", "Eedbcfacfcdbbafbcb" ], [ 4401894, "u8", "Bfffcbacfafbcb" ], [ 4401909, "u8", "Bacdcdeaacddefdbedaccb" ], [ 4401932, "u8", "Cfefdcfdececccb" ], [ 4401948, "u8", "Afefaadcadfcadcb" ], [ 4401965, "u8", "Ccbebdbbdcdcb" ], [ 4401979, "u8", "Fcfbbfebadebddcb" ], [ 4401996, "u8", "Dceadadafadedcb" ], [ 4402012, "u8", "Bbcfdffaaabeaececedfdbbfdcb" ], [ 4402040, "u8", "Eedbfdcb" ], [ 4402049, "u8", "Cbafaffdfbedbbcfcb" ], [ 4402068, "u8", "Ddbcebdfcb" ], [ 4402079, "u8", "Cabecbeaefcb" ], [ 4402092, "u8", "Edacaedacbbeedcbdabebefcb" ], [ 4402118, "u8", "Bdbeccadb" ], [ 4402128, "u8", "Dbeedfadadb" ], [ 4402140, "u8", "Bcbbbaaeafccbffaaefaeadb" ], [ 4402165, "u8", "Ebbbcbffadb" ], [ 4402177, "u8", "Ddbecbcbffecddfedababdb" ], [ 4402201, "u8", "Abfbbfbbefedbbbefbffbabefebdb" ], [ 4402231, "u8", "Dbdbbdfdfbcdadacdb" ], [ 4402250, "u8", "Abcbbcbcdaebdccfcfadcddb" ], [ 4402275, "u8", "Baaaceecebfcfabeaeadfddb" ], [ 4402300, "u8", "Bdeedddafaaecbedeeffebcbfedb" ], [ 4402329, "u8", "Baecefbdbfdb" ], [ 4402342, "u8", "Ebfbcaecdfbdebdcbecaeefdb" ], [ 4402368, "u8", "Ecbffdb" ], [ 4402376, "u8", "Ccacfdbcfcdcbdebbbdaabeb" ], [ 4402401, "u8", "Bfbebbeb" ], [ 4402410, "u8", "Abbbeadbeb" ], [ 4402421, "u8", "Dacdddcaedecfddaaceb" ], [ 4402442, "u8", "Edcbbbaebbbbfaaceb" ], [ 4402461, "u8", "Fffeaadabbceb" ], [ 4402475, "u8", "Eadfdcadeb" ], [ 4402486, "u8", "Cdbbeaabaededeb" ], [ 4402502, "u8", "Bbecfbfdeffbdfbfbddfefbfdeb" ], [ 4402530, "u8", "Fbdbfaeccabeadcdbaebfefeeb" ], [ 4402557, "u8", "Cbaacfaabbcacdaddfdafb" ], [ 4402580, "u8", "Fdaebeafb" ], [ 4402590, "u8", "Abeaffdacafebfcafcefbfafb" ], [ 4402616, "u8", "Ffeabfb" ], [ 4402624, "u8", "Deabfdbbbbeebbdadbfb" ], [ 4402645, "u8", "Dcdadccabddbbafdbfb" ], [ 4402665, "u8", "Befceadebfefabffebeebfb" ], [ 4402689, "u8", "Dccddafafeaebcbbefcbeaabbcfb" ], [ 4402718, "u8", "Fbbbbcccefddaccfeebceebadccfb" ], [ 4402748, "u8", "Eaebdcfb" ], [ 4402757, "u8", "Edfccbddbadcbcbecbdabdeadfb" ], [ 4402785, "u8", "Abbbefcefecabaedddcfbbefb" ], [ 4402811, "u8", "Cdcffbcfbbeffbcafefb" ], [ 4402832, "u8", "Baefefcaacefdaeecdffb" ], [ 4402854, "u8", "mscorlib" ], [ 4402863, "u8", "Cbacabdeebabdbbaac" ], [ 4402882, "u8", "Dfbdabdfcbbffaac" ], [ 4402899, "u8", "Dcdcbedbac" ], [ 4402910, "u8", "Cfcbafacac" ], [ 4402921, "u8", "Bbceebfcbabcbdcacccac" ], [ 4402943, "u8", "Eddbcbaaeccdcdbeabbddcac" ], [ 4402968, "u8", "Acdbefdddfedddcaefdedcac" ], [ 4402993, "u8", "Abbdfcac" ], [ 4403002, "u8", "Cdafbfbaddafecfedfcac" ], [ 4403024, "u8", "Eaefcac" ], [ 4403032, "u8", "Ddcccaaeddac" ], [ 4403045, "u8", "Ccfcfefcdfaedeac" ], [ 4403062, "u8", "Cedeafdbdcebbdbacebfeac" ], [ 4403086, "u8", "Adcdacdafac" ], [ 4403098, "u8", "Ceeacdfcccaeebefacfac" ], [ 4403120, "u8", "Bbecbeacdbeddcfdfac" ], [ 4403140, "u8", "Eaefefac" ], [ 4403149, "u8", "Ecacedabc" ], [ 4403159, "u8", "Adffeabc" ], [ 4403168, "u8", "Ebabbcbc" ], [ 4403177, "u8", "Cdeeaeaaeefedcbcdccadeaccbc" ], [ 4403205, "u8", "Bdabdbc" ], [ 4403213, "u8", "Ebceedbc" ], [ 4403222, "u8", "Eaaacaeacebfebc" ], [ 4403238, "u8", "Ddfbcbfbfbc" ], [ 4403250, "u8", "Bbddfbdccbcdbdaaecbacc" ], [ 4403273, "u8", "Ffbfafedeffbaeaaffabeabcc" ], [ 4403299, "u8", "Bdbaffcadfafbbacfffbbcc" ], [ 4403323, "u8", "Cfacddcdfaceccddfcbcc" ], [ 4403345, "u8", "Cafcdfbffccacebfefabbbaccc" ], [ 4403372, "u8", "Fefabbdbcadcc" ], [ 4403386, "u8", "Fbdaadbfcc" ], [ 4403397, "u8", "Dcdeeebffecbfbfcc" ], [ 4403415, "u8", "Fcbcabdcfcc" ], [ 4403427, "u8", "Decfbacbbadc" ], [ 4403440, "u8", "Fefdeadc" ], [ 4403449, "u8", "Cddecaedadbdeecbfadc" ], [ 4403470, "u8", "Dfaddfcdddeafbeaffbeaefadc" ], [ 4403497, "u8", "Dcbbeccbcaccaabdc" ], [ 4403515, "u8", "Ffbcdecfbcbecabdc" ], [ 4403533, "u8", "Bbeddacdc" ], [ 4403543, "u8", "Dbeaafcdfeeadcdfffecdc" ], [ 4403566, "u8", "Bcceccecdeefcadebbbadddc" ], [ 4403591, "u8", "Bbbdbbcccbeedacffcafcbddddc" ], [ 4403619, "u8", "Cdafffcbbdcadafdc" ], [ 4403637, "u8", "Ddbfdbcdabcfbbeeacfdc" ], [ 4403659, "u8", "Ffddefdc" ], [ 4403668, "u8", "Defeefdc" ], [ 4403677, "u8", "Ebefcceaabdfedbfffdc" ], [ 4403698, "u8", "Ffbafaceefefffffcbfffeaec" ], [ 4403724, "u8", "Fcbdcec" ], [ 4403732, "u8", "Deffcdfefbddcfbebcdefabacdec" ], [ 4403761, "u8", "Fcbdcbdbbfcecfbeebdccdec" ], [ 4403786, "u8", "Aedfabfbeecdedaededec" ], [ 4403808, "u8", "Dcecbcdabfabeeffbbafdcadbeeec" ], [ 4403838, "u8", "Cdccacebcecacdcfbafcfbadeeec" ], [ 4403867, "u8", "Fedeeedafeec" ], [ 4403880, "u8", "Dbceaeecacecaadaeabcebdcabfec" ], [ 4403910, "u8", "Cbcdaacbddbfec" ], [ 4403925, "u8", "Fcdfebbebbabeabffbfec" ], [ 4403947, "u8", "Cbdfdabfbeacfdebfcfccdefec" ], [ 4403974, "u8", "Ecfacaddffffeeffafabadbafc" ], [ 4404001, "u8", "Eefbeaaeeebababafeafc" ], [ 4404023, "u8", "Bcfabfeafbbdaadcdadeabcebfc" ], [ 4404051, "u8", "Eddccffcebfbfc" ], [ 4404066, "u8", "Facefdfecebcbbccacdacfc" ], [ 4404090, "u8", "Aaeecfcacbfbdbecaadcfc" ], [ 4404113, "u8", "Acdfcaabdacafeeaebdfc" ], [ 4404135, "u8", "Beeadbbeabfcebddcdfc" ], [ 4404156, "u8", "Cdffddffbbabbbddbccffacedfc" ], [ 4404184, "u8", "Cfabdbafbccbfadbefc" ], [ 4404204, "u8", "Edccccecdbefc" ], [ 4404218, "u8", "Ecadcabfecacdbcdfcbcdbacdcefc" ], [ 4404248, "u8", "Efdddeafdefc" ], [ 4404261, "u8", "Eeeaaebbccdadcedeeffc" ], [ 4404283, "u8", "Feeecfcfffc" ], [ 4404295, "u8", "Microsoft.VisualBasic" ], [ 4404317, "u8", "WorkItemId" ], [ 4404328, "u8", "Edbcbdfbbceadaccbecfaad" ], [ 4404352, "u8", "Aadaacfbcfbcababad" ], [ 4404371, "u8", "Acedebeebdddbccbdfbadbcad" ], [ 4404397, "u8", "Dbbeadfffabdeeaefbdfecdad" ], [ 4404423, "u8", "Cdeafdebebfdfbdbeadfbcfecddad" ], [ 4404453, "u8", "Bbbebfbfbeadadeddad" ], [ 4404473, "u8", "Bfecbadbaaeccdedafafddad" ], [ 4404498, "u8", "Caafbcdffcbdddfdeedad" ], [ 4404520, "u8", "Aaafbbcfcead" ], [ 4404533, "u8", "Adcaaaabd" ] ], "v": { "file.stem": "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1605490824, "file.basename": "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe", "pe.image_base": 4194304, "pe.image_size": 4431872, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4417278, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 6360, "pe.image_hash.sha1": "6036514b510b5560c42d854a052407eca964970f", "pe.image_hash.sha256": "206c4eef9f6c42a179426ff230b2383302cbe0d198069b37f3bb3f5fad381001", "pe.image_hash.sha384": "acf415bc71e67f53c40533ba00ddc70ac7cb547507dac707e9789b5f97aaa32116e8c9fff0ebefc5e246f5df2d42c0b8", "pe.image_hash.sha512": "31f3bfdd851144954f66e2013aa7ea2a1e5532f81c6861daab4763af0a47cca47986a8ce23b0cc8f23df95acea7b32421b3f84b2f8dc4ba7e17910d78adbb19d", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=Fedffcebedcbddcbabcccebbd,O=Babeaaefeaccbeddacedfa,CN=Cdaadbffbaedaabbdedfdbfebf", "pe.signatures[0].serial": "00b5f34b7c326c73c392b515eb4c2ec80e", "pe.signatures[0].subject": "C=US,L=New York,OU=Fedffcebedcbddcbabcccebbd,O=Babeaaefeaccbeddacedfa,CN=Cdaadbffbaedaabbdedfdbfebf", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 4417196, "pe.data_directories[1].rva": 4410368, "pe.data_directories[2].rva": 4423680, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-11-16T01:40:24Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 79, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 6360, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-11-16T01:40:24Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "9d35805d6311fd2fe6c49427f55f0b4e2836bbc5", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "206c4eef9f6c42a179426ff230b2383302cbe0d198069b37f3bb3f5fad381001", "pe.signatures[0].thumbprint_sha256": "bb98b081393f3b124734650088da97260c98106b96fd265d51d33ca797c36a9f", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 4409344, 5.09, "r-x" ], [ ".reloc", 4409856, 512, 0.08, "r--" ] ] }, "id": 0, "sz": 4416728, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x43138c" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x43138c" ] }, { "c": 1.0, "d": "Authenticode chain CN: Cdaadbffbaedaabbdedfdbfebf", "e": [ "Cdaadbffbaedaabbdedfdbfebf" ], "i": "metadata/signed/unknown::cdaadbffbaedaabbdedfdbfebf", "l": 2 }, { "c": 1.0, "d": "Signed by Babeaaefeaccbeddacedfa", "e": [ "Babeaaefeaccbeddacedfa" ], "i": "metadata/signed/leaf::babeaaefeaccbeddacedfa", "l": 3 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x4344bf" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Giant text section dominates PE", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large PE with exactly two sections", "e": [ "sections.count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xb63" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "0x433d69" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "GetObjectValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x433dc0" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 10096.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic.CompilerServices", "Microsoft.VisualBasic" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x434467", "0x433447" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x1be7" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x4348ee" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "String" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x4343a1" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "System.Resources.ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x43442a" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x13ad" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Single section occupies nearly all bytes", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 10096.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x4348ee" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x4343cb" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 10096.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1.0," ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "0x435a27" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.00" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x4344bf" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x433dcf" ] }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.Net" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x43450e" ] }, { "c": 0.8999999761581421, "d": "PE contains many extracted strings", "e": [ "binary.string_count = 10096.00" ], "i": "metadata/package/quality::high-string-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 10096.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x432ea6" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "0x43442a" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 10096.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1036.005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.string_count = 10096.00" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.75, "d": "DJB2 hash algorithm constant (5381)", "e": [ "05 15 00 00" ], "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "l": 1, "m": "B0032.014", "el": [ "0xba2b" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "QuerySortOrderEntry", "MetadataTableHaveEntry", "AccessControlEntryData", "SectigoRSATimeStampingCA", "AccessControlListMetadata" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x434543", "0x43452c", "0x432843", "0x4356f5", "0x43285a" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 4409344, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 10096.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x433dcf" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9700000286102295, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59", "path": "b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59.exe", "type": "pe" } ], "tv": "176d6" } }