{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999483823776245, "class": 2 } ], "prob": 0.9999484, "class": 2, "models": [ { "m": "az", "prob": 0.9992842, "class": 0 }, { "m": "az/native", "prob": 0.9997775, "class": 0 }, { "m": "az/pe", "prob": 0.9999484, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T03:05:11Z" }, "path": "18944", "raw": { "v": "4", "fs": [ { "f": "KO₆(Al₂As₆C₆CoDyEr₂)H₅(Db₂DsPo₂CmOs)Md₄(Bi₄BkSi₂)", "k": { "pe.checksum": "0x0005db43", "pe.timestamp": 1383450385, "hashes.imphash": "aab4a2ea3e2d98b87ce11be03893efa7", "signing.issuer": "Certum Code Signing CA", "signing.serial": "5efeefbcc542e01627b4ce14c355a9a2", "signing.catalog": "authenticode", "signing.subject": "VLADIMIR MATVEEV", "build.target_arch": "x86", "pe.linker_version": "11.0", "signing.is_signed": true, "signing.not_after": 1435921196, "signing.not_before": 1404385196, "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_MANIFEST", "signing.signing_time": 1435924089, "pe.rich_header.xor_key": "0x786c3e82", "hashes.rich_header_hash": "3a0c2d6b401be4a0a5930cc7a8c07ea151910a31129a3147b3cb1c953c0f1585", "signing.thumbprint_sha1": "a2ba5b4c8819f5b5b130171a9f722ecac895d018", "pe.load_config.security_cookie": "0x42f110", "binary.top_complex_unnamed[0].cc": 82, "binary.top_complex_unnamed[1].cc": 65, "binary.top_complex_unnamed[2].cc": 33, "binary.top_complex_unnamed[3].cc": 29, "binary.top_complex_unnamed[4].cc": 26, "binary.top_complex_unnamed[5].cc": 25, "binary.top_complex_unnamed[6].cc": 24, "binary.top_complex_unnamed[7].cc": 22, "pe.manifest.supported_os[0].guid": "{e2011457-1546-43c5-a5fe-008deee3d3f0}", "pe.manifest.supported_os[0].name": "vista", "pe.manifest.supported_os[1].guid": "{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}", "pe.manifest.supported_os[1].name": "win8", "pe.manifest.supported_os[2].guid": "{1f676c76-80e1-4239-95bb-83d0f6d0da78}", "pe.manifest.supported_os[2].name": "win8.1", "pe.manifest.supported_os[3].guid": "{35138b9a-5d96-4fbd-8e2d-a2440225f93a}", "pe.manifest.supported_os[3].name": "win7", "binary.top_complex_unnamed[0].bbs": 199, "binary.top_complex_unnamed[1].bbs": 107, "binary.top_complex_unnamed[2].bbs": 61, "binary.top_complex_unnamed[3].bbs": 35, "binary.top_complex_unnamed[4].bbs": 46, "binary.top_complex_unnamed[5].bbs": 63, "binary.top_complex_unnamed[6].bbs": 35, "binary.top_complex_unnamed[7].bbs": 57, "binary.top_complex_unnamed[0].addr": "0x403d50", "binary.top_complex_unnamed[0].size": 11752, "binary.top_complex_unnamed[1].addr": "0x40bc45", "binary.top_complex_unnamed[1].size": 2090, "binary.top_complex_unnamed[2].addr": "0x4079e5", "binary.top_complex_unnamed[2].size": 380, "binary.top_complex_unnamed[3].addr": "0x40aa80", "binary.top_complex_unnamed[3].size": 3780, "binary.top_complex_unnamed[4].addr": "0x40a700", "binary.top_complex_unnamed[4].size": 489, "binary.top_complex_unnamed[5].addr": "0x401950", "binary.top_complex_unnamed[5].size": 3362, "binary.top_complex_unnamed[6].addr": "0x409aaa", "binary.top_complex_unnamed[6].size": 482, "binary.top_complex_unnamed[7].addr": "0x403140", "binary.top_complex_unnamed[7].size": 2359, "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 19, "pe.rich_header.entries[1].use_count": 10, "pe.rich_header.entries[2].use_count": 87, "pe.rich_header.entries[3].use_count": 80, "pe.rich_header.entries[4].use_count": 3, "pe.rich_header.entries[5].use_count": 6, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[7].use_count": 1, "pe.rich_header.entries[0].product_id": 207, "pe.rich_header.entries[1].product_id": 205, "pe.rich_header.entries[2].product_id": 206, "pe.rich_header.entries[3].product_id": 1, "pe.rich_header.entries[4].product_id": 185, "pe.rich_header.entries[6].product_id": 201, "pe.rich_header.entries[7].product_id": 204, "pe.manifest.requested_execution_level": "asInvoker", "pe.rich_header.entries[0].build_number": 50929, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 50929, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 50929, "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[4].build_number": 30716, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].build_number": 50727, "pe.rich_header.entries[6].product_name": "unknown", "pe.rich_header.entries[7].build_number": 50727, "pe.rich_header.entries[7].product_name": "unknown", "pe.dll_characteristics.terminal_server_aware": true }, "x": 88, "id": 0, "is": [ "IsBadHugeReadPtr", "HeapCreate", "HeapAlloc", "IsBadReadPtr", "GetProcessHeap", "GetCommandLineA", "GetLastError", "SetLastError", "InterlockedIncrement", "InterlockedDecrement", "GetCurrentThreadId", "EncodePointer", "DecodePointer", "ExitProcess", "GetModuleHandleExW", "GetProcAddress", "MultiByteToWideChar", "GetStdHandle", "WriteFile", "GetModuleFileNameW", "GetFileType", "InitializeCriticalSectionAndSpinCount", "DeleteCriticalSection", "GetStartupInfoW", "GetModuleFileNameA", "QueryPerformanceCounter", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "GetEnvironmentStringsW", "FreeEnvironmentStringsW", "WideCharToMultiByte", "UnhandledExceptionFilter", "SetUnhandledExceptionFilter", "GetCurrentProcess", "TerminateProcess", "TlsAlloc", "TlsGetValue", "TlsSetValue", "TlsFree", "GetModuleHandleW", "EnterCriticalSection", "LeaveCriticalSection", "HeapFree", "Sleep", "IsValidCodePage", "GetACP", "GetOEMCP", "GetCPInfo", "IsDebuggerPresent", "IsProcessorFeaturePresent", "LoadLibraryExW", "OutputDebugStringW", "LoadLibraryW", "RtlUnwind", "HeapReAlloc", "GetStringTypeW", "HeapSize", "LCMapStringW", "FlushFileBuffers", "GetConsoleCP", "GetConsoleMode", "SetStdHandle", "SetFilePointerEx", "WriteConsoleW", "CloseHandle", "CreateFileW" ], "ms": { "pe": { "signer": "Certum Code Signing CA, VLADIMIR MATVEEV", "machine": 332.0, "checksum": 383811.0, "rsrc_size": 110592.0, "subsystem": 2.0, "timestamp": 1383450385.0, "icon_count": 2.0, "image_base": 4194304.0, "leaf_issuer": "Certum Code Signing CA", "leaf_serial": "5efeefbcc542e01627b4ce14c355a9a2", "leaf_subject": "VLADIMIR MATVEEV", "rsrc_entropy": 5.47, "signing_time": 1435924089.0, "entry_section": ".text", "has_signature": true, "size_of_image": 348160.0, "timestamp_day": 3.0, "checksum_valid": true, "file_alignment": 512.0, "leaf_not_after": 1435921196.0, "primary_signer": "Unizeto Technologies S.A.", "resource_count": 3.0, "resource_types": [ "RT_ICON", "RT_GROUP_ICON", "RT_MANIFEST" ], "signature_type": "developer", "timestamp_year": 2013.0, "characteristics": 258.0, "entry_point_rva": 27448.0, "leaf_not_before": 1404385196.0, "security_cookie": 4387088.0, "size_of_headers": 1024.0, "timestamp_month": 11.0, "cert_chain_depth": 1.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 1.0, "manifest_present": true, "signing_time_day": 3.0, "certificate_count": 1.0, "computed_checksum": 383811.0, "section_alignment": 4096.0, "signing_time_year": 2015.0, "cert_validity_days": 365.0, "number_of_sections": 5.0, "resource_timestamp": 0.0, "signing_time_month": 7.0, "dll_characteristics": 32832.0, "rich_header_present": true, "leaf_thumbprint_sha1": "a2ba5b4c8819f5b5b130171a9f722ecac895d018", "linker_major_version": 11.0, "api_hashing_indicators": 1.0, "certificate_table_size": 2256.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 330448.0 }, "binary": { "code_size": 48128.0, "func_count": 143.0, "entry_point": 27448.0, "code_entropy": 6.39, "data_entropy": 4.54, "func_density": 3.04, "import_count": 66.0, "string_count": 298.0, "avg_func_size": 301.03, "has_signature": true, "section_count": 5.0, "avg_complexity": 7.31, "import_density": 1.4, "max_complexity": 82.0, "string_density": 6.34, "overall_entropy": 5.13, "avg_basic_blocks": 12.99, "avg_section_size": 65433.6, "dependency_count": 1.0, "entropy_variance": 2.2, "avg_string_length": 20.48, "complexity_per_kb": 0.16, "max_string_length": 782.0, "wide_string_count": 72.0, "writable_sections": 1.0, "avg_string_entropy": 3.03, "code_to_data_ratio": 0.17, "data_to_file_ratio": 0.07, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.33, "text_to_file_ratio": 0.15, "total_basic_blocks": 1858.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "high_entropy_strings": 3.0, "string_length_stddev": 51.17, "high_complexity_funcs": 2.0, "largest_section_ratio": 0.43, "sentence_string_count": 33.0, "sentence_string_ratio": 0.11, "behavioral_import_ratio": 0.05, "unnamed_complex_func_count": 2.0 }, "consistency": { "cert_issued_after_build": true } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".rsrc" ], [ 647, "@.reloc" ], [ 1986, "fffff." ], [ 27749, "58YC" ], [ 28033, "PSSV" ], [ 29085, "FVWPP" ], [ 29123, "SVWPP" ], [ 29337, "5PEC" ], [ 31090, "50YC" ], [ 37266, "UVWS" ], [ 40284, "SVW3" ], [ 40308, "9E WW" ], [ 43849, "UQPXY]Y[" ], [ 44561, "Genuu_" ], [ 52178, "/JEB" ], [ 53612, "TVEG" ], [ 57912, "EMLWG" ], [ 58985, "AKIU" ], [ 62011, "/bcAa" ], [ 68814, "VFQ9" ], [ 70026, "uba8" ], [ 70566, "eqyp7" ], [ 72327, "Qzny" ], [ 73046, "UUAD" ], [ 74199, "/40xUK" ], [ 74318, "ZZ_N" ], [ 74395, "Toog" ], [ 76196, "/nYT" ], [ 79249, "3j9v" ], [ 81225, "P347T" ], [ 85184, "Hbaed" ], [ 90944, "%/owsj" ], [ 91078, "CTX25" ], [ 94245, "XTF2" ], [ 104667, "13YG" ], [ 113742, "GW02" ], [ 114503, "TVBM" ], [ 116570, "M8XY" ], [ 118679, "t0oo" ], [ 119308, "v7eu2" ], [ 124520, "SKUW" ], [ 128217, "/DV-OvX" ], [ 130894, "m@A.w?D4.lcAHOg" ], [ 134182, "i64a" ], [ 137450, "iN-/ aG" ], [ 141710, "N2OG" ], [ 144628, "Ruqu" ], [ 146991, "x0b3" ], [ 147979, "YWR7" ], [ 149624, "DI10" ], [ 149902, "LV5Q" ], [ 153040, "KDLO" ], [ 162227, "zb23" ], [ 163446, "Wsks" ], [ 164609, "3TIV" ], [ 165265, "92CC" ], [ 169654, "7IQE" ], [ 173137, ".dio" ], [ 173680, "wide", "mscoree.dll" ], [ 173704, "CorExitProcess" ], [ 173720, "wide", "R6008\r\n- not enough space for arguments" ], [ 173808, "wide", "R6009\r\n- not enough space for environment" ], [ 173896, "wide", "R6010\r\n- abort() has been called" ], [ 173968, "wide", "R6016\r\n- not enough space for thread data" ], [ 174056, "wide", "R6017\r\n- unexpected multithread lock error" ], [ 174152, "wide", "R6018\r\n- unexpected heap error" ], [ 174224, "wide", "R6019\r\n- unable to open console device" ], [ 174312, "wide", "R6024\r\n- not enough space for _onexit/atexit table" ], [ 174424, "wide", "R6025\r\n- pure virtual function call" ], [ 174504, "wide", "R6026\r\n- not enough space for stdio initialization" ], [ 174616, "wide", "R6027\r\n- not enough space for lowio initialization" ], [ 174728, "wide", "R6028\r\n- unable to initialize heap" ], [ 174804, "wide", "R6030\r\n- CRT not initialized" ], [ 174872, "wide", "R6031\r\n- Attempt to initialize the CRT more than once.\nThis indicates a bug in your application." ], [ 175072, "wide", "R6032\r\n- not enough space for locale information" ], [ 175176, "wide", "R6033\r\n- Attempt to use MSIL code from this assembly during native code initialization\nThis indicates a bug in your application." ], [ 175672, "wide", "R6034\r\n- inconsistent onexit begin-end variables" ], [ 175776, "wide", "DOMAIN error" ], [ 175808, "wide", "SING error" ], [ 175836, "wide", "TLOSS error" ], [ 175872, "wide", "runtime error" ], [ 176086, "wide", "BR6002\r\n- floating point support not loaded" ], [ 176180, "wide", "Runtime Error!\n\nProgram:" ], [ 176232, "wide", "\u003cprogram name unknown\u003e" ], [ 176296, "wide", "Microsoft Visual C++ Runtime Library" ], [ 176372, "wide", "kernel32.dll" ], [ 176400, "FlsAlloc" ], [ 176412, "FlsFree" ], [ 176420, "FlsGetValue" ], [ 176432, "FlsSetValue" ], [ 176444, "InitializeCriticalSectionEx" ], [ 176472, "CreateSemaphoreExW" ], [ 176492, "SetThreadStackGuarantee" ], [ 176516, "CreateThreadpoolTimer" ], [ 176540, "SetThreadpoolTimer" ], [ 176560, "WaitForThreadpoolTimerCallbacks" ], [ 176592, "CloseThreadpoolTimer" ], [ 176616, "CreateThreadpoolWait" ], [ 176640, "SetThreadpoolWait" ], [ 176660, "CloseThreadpoolWait" ], [ 176680, "FlushProcessWriteBuffers" ], [ 176708, "FreeLibraryWhenCallbackReturns" ], [ 176740, "GetCurrentProcessorNumber" ], [ 176768, "GetLogicalProcessorInformation" ], [ 176800, "CreateSymbolicLinkW" ], [ 176820, "SetDefaultDllDirectories" ], [ 176848, "EnumSystemLocalesEx" ], [ 176868, "CompareStringEx" ], [ 176884, "GetDateFormatEx" ], [ 176900, "GetLocaleInfoEx" ], [ 176916, "GetTimeFormatEx" ], [ 176932, "GetUserDefaultLocaleName" ], [ 176960, "IsValidLocaleName" ], [ 176980, "LCMapStringEx" ], [ 176996, "GetCurrentPackageId" ], [ 177048, "Sunday" ], [ 177056, "Monday" ], [ 177064, "Tuesday" ], [ 177072, "Wednesday" ], [ 177084, "Thursday" ], [ 177096, "Friday" ], [ 177104, "Saturday" ], [ 177164, "January" ], [ 177172, "February" ], [ 177184, "March" ], [ 177192, "April" ], [ 177200, "June" ], [ 177208, "July" ], [ 177216, "August" ], [ 177224, "September" ], [ 177236, "October" ], [ 177244, "November" ], [ 177256, "December" ], [ 177276, "MM/dd/yy" ], [ 177288, "dddd, MMMM dd, yyyy" ], [ 177376, "wide", "Sunday" ], [ 177392, "wide", "Monday" ], [ 177408, "wide", "Tuesday" ], [ 177424, "wide", "Wednesday" ], [ 177444, "wide", "Thursday" ], [ 177464, "wide", "Friday" ], [ 177480, "wide", "Saturday" ], [ 177596, "wide", "January" ], [ 177612, "wide", "February" ], [ 177632, "wide", "March" ], [ 177644, "wide", "April" ], [ 177656, "wide", "June" ], [ 177668, "wide", "July" ], [ 177680, "wide", "August" ], [ 177696, "wide", "September" ], [ 177716, "wide", "October" ], [ 177732, "wide", "November" ], [ 177752, "wide", "December" ], [ 177788, "wide", "MM/dd/yy" ], [ 177808, "wide", "dddd, MMMM dd, yyyy" ], [ 177944, "wide", "USER32.DLL" ], [ 177968, "MessageBoxW" ], [ 177980, "GetActiveWindow" ], [ 177996, "GetLastActivePopup" ], [ 178016, "GetUserObjectInformationW" ], [ 178044, "GetProcessWindowStation" ], [ 178842, "wide", "h(((( H" ], [ 179520, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 179904, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~" ], [ 186548, "wide", "az-az-cyrl" ], [ 186572, "wide", "az-az-latn" ], [ 186632, "wide", "bs-ba-latn" ], [ 186764, "wide", "div-mv" ], [ 187500, "wide", "kok-in" ], [ 187768, "wide", "quz-bo" ], [ 187784, "wide", "quz-ec" ], [ 187800, "wide", "quz-pe" ], [ 187912, "wide", "sma-no" ], [ 187928, "wide", "sma-se" ], [ 187944, "wide", "smj-no" ], [ 187960, "wide", "smj-se" ], [ 187976, "wide", "smn-fi" ], [ 187992, "wide", "sms-fi" ], [ 188020, "wide", "sr-ba-cyrl" ], [ 188044, "wide", "sr-ba-latn" ], [ 188068, "wide", "sr-sp-cyrl" ], [ 188092, "wide", "sr-sp-latn" ], [ 188152, "wide", "syr-sy" ], [ 188264, "wide", "uz-uz-cyrl" ], [ 188288, "wide", "uz-uz-latn" ], [ 188336, "wide", "zh-chs" ], [ 188352, "wide", "zh-cht" ], [ 188479, "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 188672, "Polymorphic" ], [ 189722, "IsBadHugeReadPtr" ], [ 189742, "HeapCreate" ], [ 189756, "HeapAlloc" ], [ 189768, "IsBadReadPtr" ], [ 189784, "GetProcessHeap" ], [ 189800, "KERNEL32.dll" ], [ 189816, "GetCommandLineA" ], [ 189834, "GetLastError" ], [ 189850, "SetLastError" ], [ 189866, "InterlockedIncrement" ], [ 189890, "InterlockedDecrement" ], [ 189914, "GetCurrentThreadId" ], [ 189936, "EncodePointer" ], [ 189952, "DecodePointer" ], [ 189968, "ExitProcess" ], [ 189982, "GetModuleHandleExW" ], [ 190004, "GetProcAddress" ], [ 190022, "MultiByteToWideChar" ], [ 190044, "GetStdHandle" ], [ 190060, "WriteFile" ], [ 190072, "GetModuleFileNameW" ], [ 190094, "GetFileType" ], [ 190108, "InitializeCriticalSectionAndSpinCount" ], [ 190148, "DeleteCriticalSection" ], [ 190172, "GetStartupInfoW" ], [ 190190, "GetModuleFileNameA" ], [ 190212, "QueryPerformanceCounter" ], [ 190238, "GetCurrentProcessId" ], [ 190260, "GetSystemTimeAsFileTime" ], [ 190286, "GetEnvironmentStringsW" ], [ 190312, "FreeEnvironmentStringsW" ], [ 190338, "WideCharToMultiByte" ], [ 190360, "UnhandledExceptionFilter" ], [ 190388, "SetUnhandledExceptionFilter" ], [ 190418, "GetCurrentProcess" ], [ 190438, "TerminateProcess" ], [ 190458, "TlsAlloc" ], [ 190470, "TlsGetValue" ], [ 190484, "TlsSetValue" ], [ 190498, "TlsFree" ], [ 190508, "GetModuleHandleW" ], [ 190528, "EnterCriticalSection" ], [ 190552, "LeaveCriticalSection" ], [ 190576, "HeapFree" ], [ 190588, "Sleep" ], [ 190596, "IsValidCodePage" ], [ 190624, "GetOEMCP" ], [ 190636, "GetCPInfo" ], [ 190648, "IsDebuggerPresent" ], [ 190668, "IsProcessorFeaturePresent" ], [ 190696, "LoadLibraryExW" ], [ 190714, "OutputDebugStringW" ], [ 190736, "LoadLibraryW" ], [ 190752, "RtlUnwind" ], [ 190764, "HeapReAlloc" ], [ 190778, "GetStringTypeW" ], [ 190796, "HeapSize" ], [ 190808, "LCMapStringW" ], [ 190824, "FlushFileBuffers" ], [ 190844, "GetConsoleCP" ], [ 190860, "GetConsoleMode" ], [ 190878, "SetStdHandle" ], [ 190894, "SetFilePointerEx" ], [ 190914, "WriteConsoleW" ] ], "sz": 330448, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Certum Code Signing CA", "e": [ "Certum Code Signing CA" ], "i": "metadata/signed/developer::certum-code-signing-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VLADIMIR MATVEEV", "e": [ "VLADIMIR MATVEEV" ], "i": "metadata/signed/developer::vladimir-matveev", "l": 2 }, { "c": 1.0, "d": "Signed by Unizeto Technologies S.A.", "e": [ "Unizeto Technologies S.A." ], "i": "metadata/signed/leaf::unizeto-technologies-s.a.", "l": 3 }, { "c": 0.8999999761581421, "d": "Thread-local storage allocation", "e": [ "TlsAlloc" ], "i": "micro-behaviors/process/tls/fiber::tls-alloc", "l": 2 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "MZ header validation in code", "e": [ "B8 4D 5A 00 00" ], "i": "objectives/anti-static/obfuscation/imports::mz-magic-check", "l": 1, "m": "B0032.014" }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false,\"supported_os\":[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\",\"nam" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.03" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.39)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38", "e2011457-1546-43c5-a5fe-008deee3d3f0", "35138b9a-5d96-4fbd-8e2d-a2440225f93a" ], "i": "objectives/command-and-control/channel/http::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 3, "m": "B0033" }, { "c": 0.75, "d": "Printable ASCII substitution table", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], "i": "micro-behaviors/data/encode/charset::printable-ascii-substitution-table", "l": 1 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.75, "d": "High entropy encrypted data", "e": [ ".rdata (entropy: 7.83)" ], "i": "micro-behaviors/data/encode/payload::payload-blob-metrics", "l": 3 }, { "c": 0.8999999761581421, "d": "Check processor features (potential VM detection)", "e": [ "IsProcessorFeaturePresent" ], "i": "objectives/anti-analysis/vm-detect/processor-features::is-processor-feature-present", "l": 1, "m": "B0009" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.13" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "Threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "a": "T1082", "c": 0.8399999737739563, "d": "Enumerate installed system locales", "e": [ "EnumSystemLocalesEx" ], "i": "micro-behaviors/os/sysinfo/platform/locale::enum-system-locales", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.949999988079071, "d": "Certum CRL distribution URL", "e": [ "http://crl.certum.pl/csca.crl0h" ], "i": "micro-behaviors/data/embedded/certificate::certum-crl-url", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "PE has an Authenticode signature", "e": [ "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-is-authenticode-signed", "l": 2, "m": "B0032" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "LCMapStringW", "OutputDebugStringW", "CompareStringEx", "LCMapStringEx", "FreeEnvironmentStringsW", "GetStringTypeW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage deallocation", "e": [ "TlsFree" ], "i": "micro-behaviors/process/tls/fiber::tls-free", "l": 2 }, { "c": 0.8600000143051147, "d": "asInvoker manifest tag in resources", "e": [ "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\" /\u003e" ], "i": "metadata/binary/resource::asinvoker-resource-manifest-flex", "l": 2 }, { "c": 1.0, "d": "requestedExecutionLevel is asInvoker", "e": [ "asInvoker" ], "i": "metadata/build/manifest::pe-as-invoker", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cprogram name unknown\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 143.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Set last error code", "e": [ "SetLastError" ], "i": "micro-behaviors/os/exception/error-handling::set-last-error", "l": 2 }, { "c": 0.8500000238418579, "d": "Oversized resource section for a DLL", "e": [ "pe.rsrc_size = 110592.00" ], "i": "well-known/malware/trojan/shellobject/exceldna::xll-large-rsrc-section", "l": 1 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8199999928474426, "d": "Get extended module handle", "e": [ "GetModuleHandleExW" ], "i": "micro-behaviors/os/module/load::get-module-handle-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "48", "46" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8600000143051147, "d": "High entropy rdata section", "e": [ ".rdata (entropy: 7.83)" ], "i": "metadata/binary/section/metrics::high-entropy-rdata-section", "l": 1 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://center-ring.link", "http://parentmodel.biz", "http://first-usapro.info" ], "i": "objectives/command-and-control/infrastructure/domain/heuristic::http-url-binary", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8199999928474426, "d": "rdata over 2.5 times text size", "e": [ ".rdata", ".rdata = 294.7% of .text (141824 / 48128 bytes)" ], "i": "metadata/binary/section/metrics::rdata-ratio-over-2pt5x", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "a": "T1622", "c": 0.8199999928474426, "d": "IsBadReadPtr anti-debug style probe", "e": [ "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::bad-read-ptr", "l": 1, "m": "B0001" }, { "c": 1.0, "d": "Self-signed cert (issuer == subject)", "e": [ "pe.cert_chain_depth = 1.00" ], "i": "metadata/signed/certificate::pe-cert-issuer-self-signed", "l": 3 }, { "a": "T1620", "c": 0.8500000238418579, "d": "mscoree.dll text reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-dll-text-ref", "l": 3, "m": "B0032" }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "18944" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": "certificate string reference", "e": [ "certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1858.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 143.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 143.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 110592.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1383450385.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 348160.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.31" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime/clr::corexitprocess-string", "l": 3 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/handle::get-file-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameW", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Get process startup information", "e": [ "GetStartupInfoW" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 298.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Pointer value encoding", "e": [ "EncodePointer" ], "i": "micro-behaviors/os/syscall/invoke::encode-pointer", "l": 2 }, { "c": 0.8799999952316284, "d": "User-object API string", "e": [ "GetUserObjectInformationW" ], "i": "well-known/malware/worm/mabezat::xor-getuserobjectinformationw", "l": 1 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/handle::set-std-handle", "l": 2 }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_MANIFEST]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position extended", "e": [ "SetFilePointerEx" ], "i": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSectionAndSpinCount" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "a": "T1622", "c": 0.8199999928474426, "d": "OutputDebugString anti-debug API", "e": [ "OutputDebugStringW" ], "i": "objectives/anti-analysis/debugger-detect/check::output-debug-string", "l": 1, "m": "B0001" }, { "a": "T1071.001", "d": "Old Mozilla 4.0 User-Agent", "e": [ "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" ], "i": "micro-behaviors/communications/http/headers::ua-mozilla-old", "l": 2, "m": "C0002" }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 66.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/handle::flush-file-buffers", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "c": 0.8500000238418579, "d": "Query window station object info", "e": [ "GetUserObjectInformationW" ], "i": "micro-behaviors/ui/window/station::get-user-object-information", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "CloseThreadpoolWait", "CloseThreadpoolTimer", "CloseHandle" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-75", "l": 1 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Packed loader code-to-data ratio below 0.4", "e": [ "binary.code_to_data_ratio = 0.17" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-low-code-to-data-ratio", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection/toolkit::module-stomping-target", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".rdata", ".data", ".rdata+.data = 339.4% of text (163328 / 48128 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 66.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-w", "l": 3 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Encoded Mozilla user agent string", "e": [ "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-mozilla-ua", "l": 4 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SetThreadStackGuarantee", "GetUserObjectInformationW", "GetModuleHandleExW", "InitializeCriticalSectionEx", "InterlockedIncrement", "SetDefaultDllDirectories", "GetCurrentPackageId", "FreeLibraryWhenCallbackReturns", "GetCurrentProcessorNumber", "WaitForThreadpoolTimerCallbacks", "FlushProcessWriteBuffers", "EnumSystemLocalesEx", "GetProcessWindowStation", "InterlockedDecrement", "GetUserDefaultLocaleName", "GetLogicalProcessorInformation" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Browser process termination API", "e": [ "TerminateProcess" ], "i": "objectives/collection/stealer/browser::windows-browser-terminate-api", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Manifest declares only Vista support", "e": [ "[{\"guid\":\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\",\"name\":\"vista\"}, {\"guid\":\"{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}\",\"name\":\"win8" ], "i": "metadata/build/manifest::pe-vista-only-manifest", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted rdata section (PE crypter)", "e": [ ".rdata (entropy: 7.83)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-rdata-section", "l": 4, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "c": 0.6000000238418579, "d": "High entropy in data section", "e": [ ".rdata (entropy: 7.83)" ], "i": "metadata/binary/metrics/structural::high-entropy-data", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Oversized rdata section vs code", "e": [ ".rdata", ".rdata = 294.7% of .text (141824 / 48128 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-rdata-section", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted data section (very high)", "e": [ ".rdata (entropy: 7.83)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-data-section", "l": 4, "m": "B0032" }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (Unicode)", "e": [ "LoadLibraryExW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-ex-w", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.code_to_data_ratio = 0.17" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-0--inline-29187", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".rdata", ".data", ".rdata+.data = 339.4% of text (163328 / 48128 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "binary.code_to_data_ratio = 0.17" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-0--inline-29196", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".rdata (entropy: 7.83)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-payload-section-cond-0--inline-29177", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".rdata", ".data", ".rdata+.data = 339.4% of text (163328 / 48128 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (IsBadHugeReadPtr, HeapCreate, HeapAlloc, IsBadReadPtr, GetProcessHeap, ... +61 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8600000143051147, "d": "Query active window station state", "e": [ "GetUserObjectInformationW", "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::window-station-query-chain", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleExW", "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.8999999761581421, "d": "Register and invoke exception filters", "e": [ "UnhandledExceptionFilter", "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::exception-filter-pair-imports", "l": 2 }, { "a": "T1622", "c": 0.8999999761581421, "d": "SEH with bad pointer debug probes", "e": [ "SetUnhandledExceptionFilter", "OutputDebugStringW", "IsBadReadPtr" ], "i": "objectives/anti-analysis/debugger-detect/check::seh-pointer-probe-anti-debug", "l": 4, "m": "B0001" }, { "a": "T1622", "c": 0.9300000071525574, "d": "Debugger check with teardown guards", "e": [ "Sleep", "SetUnhandledExceptionFilter", "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::debugger-check-with-guards", "l": 2, "m": "B0001" }, { "a": "T1620", "c": 0.9300000071525574, "d": "Native PE loads .NET payload via CLR", "e": [ "mscoree.dll", "CorExitProcess", "binary.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/loader::native-pe-loads-dotnet-payload", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.9100000262260437, "d": "Sparse KERNEL32 loader profile", "e": [ "GetModuleHandleExW", "IsDebuggerPresent", "binary.export_count = 0.00", "LoadLibraryExW", "pe.import_dll_count = 1.00", "GetProcAddress" ], "i": "objectives/anti-static/obfuscation/imports::sparse-kernel32-loader-profile", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "Mozilla/4.0 (compatible; MSIE 6.0; Windo \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "bb18ffc24e65436a9d21acd6b615a84cb6660b49d0bc53e4f7ca7238ba957639", "path": "18944", "type": "pe" } ], "tv": "db300" } }