{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.07450331, "class": 0 }, { "m": "az/pe", "prob": 0.044354837, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T01:14:52Z" }, "path": "bfee72dc20b2a5766fd1e744a8fdf7213bfed6de0a5b204d69cbbe1d7ac8f5ec.exe", "raw": { "v": "5", "fs": [ { "f": "O(Er)H(Os)", "x": 3, "ff": { "m": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 0.0, "overlay_padding": 3072.0, "checksum_stripped": 1.0, "computed_checksum": 225417.0, "dos_stub_modified": 1.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 200704.0, "entropy": 4.84, "size_bytes": 200704.0 }, "binary": { "is_pie": 0.0, "code_entropy": 6.24, "data_entropy": 0.36, "string_count": 730.0, "entropy_variance": 4.08, "avg_string_length": 13.5, "max_string_length": 179.0, "code_to_data_ratio": 0.74, "string_length_stddev": 17.69, "largest_section_ratio": 0.63, "sentence_string_count": 119.0, "sentence_string_ratio": 0.16, "high_entropy_string_count": 1.0 }, "sections": { "count": 9.0, "code_size": 131072.0, "entropy_max": 6.39, "entropy_mean": 1.41, "name_entropy": 3.39, "writable_count": 4.0, "executable_count": 2.0, "nonstandard_count": 1.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 76, "u8", "!This file was created by ClamAV for internal use and should not be run." ], [ 150, "u8", "ClamAV - A GPL virus scanner - http://www.clamav.net" ], [ 216, "u8", "CLAM" ], [ 456, "u8", ".text" ], [ 576, "u8", ".bss" ], [ 616, "u8", ".idata" ], [ 656, "u8", ".tls" ], [ 696, "u8", ".rdata" ], [ 735, "u8", "@.reloc" ], [ 775, "u8", "B.rsrc" ], [ 4102, "u8", "string" ], [ 4185, "u8", "TObject" ], [ 4216, "u8", "System" ], [ 4229, "u8", "IInterface" ], [ 4429, "u8", "TInterfacedObject" ], [ 4812, "u8", "FastMM Borland Edition" ], [ 4836, "u8", "2004, 2005 Pierre le Riche / Professional Software Development" ], [ 5756, "u8", "SVWU" ], [ 10896, "u8", "An unexpected memory leak has occurred." ], [ 10940, "u8", "The unexpected small block leaks are:" ], [ 10992, "u8", "Unknown" ], [ 11000, "u8", "String" ], [ 11008, "u8", "The sizes of unexpected leaked medium and large blocks are:" ], [ 11076, "u8", "Unexpected Memory Leak" ], [ 14008, "u8", "SOFTWARE\\Borland\\Delphi\\RTL" ], [ 14036, "u8", "FPUMaskValue" ], [ 14402, "u8", "SVW3" ], [ 14891, "u8", "QSVW" ], [ 15021, "u8", "PPRTj" ], [ 15158, "u8", "YYZX" ], [ 15399, "u8", "YZXtp" ], [ 15417, "u8", "SPRQ" ], [ 15544, "u8", "VWUUh" ], [ 15762, "u8", "ZTUWVSPRTj" ], [ 15973, "u8", "r6t0" ], [ 15993, "u8", "t.Ht" ], [ 18068, "u8", "SVWRP" ], [ 19969, "u8", "PSVW" ], [ 21996, "u8", "kernel32.dll" ], [ 22012, "u8", "GetLongPathNameA" ], [ 22592, "u8", "Software\\Borland\\Locales" ], [ 22620, "u8", "Software\\Borland\\Delphi\\Locales" ], [ 25965, "u8", "TFileName" ], [ 25982, "u8", "TSearchRec`" ], [ 26102, "u8", "Exception" ], [ 26189, "u8", "EHeapException" ], [ 26281, "u8", "EOutOfMemory" ], [ 26373, "u8", "EInOutError" ], [ 26549, "u8", "EExternalException" ], [ 26733, "u8", "EDivByZero" ], [ 26821, "u8", "ERangeError" ], [ 26909, "u8", "EIntOverflow" ], [ 27001, "u8", "EMathError" ], [ 27089, "u8", "EInvalidOp" ], [ 27177, "u8", "EZeroDivide" ], [ 27353, "u8", "EUnderflow" ], [ 27441, "u8", "EInvalidPointer" ], [ 27533, "u8", "EInvalidCast" ], [ 27625, "u8", "EConvertError" ], [ 27717, "u8", "EAccessViolation" ], [ 27813, "u8", "EPrivilege" ], [ 27901, "u8", "EStackOverflow" ], [ 28081, "u8", "EVariantError" ], [ 28173, "u8", "EAssertionFailed" ], [ 28269, "u8", "EAbstractError" ], [ 28361, "u8", "EIntfCastError" ], [ 28453, "u8", "EOSError" ], [ 28541, "u8", "ESafecallException" ], [ 28721, "u8", "TThreadLocalCounter" ], [ 28940, "u8", "$TMultiReadExclusiveWriteSynchronizer" ], [ 30388, "u8", "True" ], [ 30404, "u8", "False" ], [ 30864, "u8", "SVWQ" ], [ 30880, "u8", "PWVS" ], [ 33814, "u8", "u.INFNAN" ], [ 39280, "u8", "AMPM" ], [ 40004, "u8", "SVWUQ" ], [ 42001, "u8", "QQQQQQSVW3" ], [ 42649, "u8", "QQQQQSVW" ], [ 44221, "u8", "TErrorRec" ], [ 44350, "u8", "TExceptRec" ], [ 44743, "u8", "r3t7" ], [ 47070, "u8", "WUWSj" ], [ 48308, "u8", "mmmm d, yyyy" ], [ 48438, "u8", "TUnitHashArray" ], [ 48486, "u8", "TModuleInfo" ], [ 49132, "u8", "GetDiskFreeSpaceExA" ], [ 53128, "u8", "oleaut32.dll" ], [ 53144, "u8", "VariantChangeTypeEx" ], [ 53164, "u8", "VarNeg" ], [ 53172, "u8", "VarNot" ], [ 53180, "u8", "VarAdd" ], [ 53188, "u8", "VarSub" ], [ 53196, "u8", "VarMul" ], [ 53204, "u8", "VarDiv" ], [ 53212, "u8", "VarIdiv" ], [ 53220, "u8", "VarMod" ], [ 53228, "u8", "VarAnd" ], [ 53236, "u8", "VarOr" ], [ 53244, "u8", "VarXor" ], [ 53252, "u8", "VarCmp" ], [ 53260, "u8", "VarI4FromStr" ], [ 53276, "u8", "VarR4FromStr" ], [ 53292, "u8", "VarR8FromStr" ], [ 53308, "u8", "VarDateFromStr" ], [ 53324, "u8", "VarCyFromStr" ], [ 53340, "u8", "VarBoolFromStr" ], [ 53356, "u8", "VarBstrFromCy" ], [ 53372, "u8", "VarBstrFromDate" ], [ 53388, "u8", "VarBstrFromBool" ], [ 53694, "u8", "TCustomVariantType" ], [ 53723, "u8", "Variants" ], [ 53813, "u8", "EVariantInvalidOpError" ], [ 53913, "u8", "EVariantTypeCastError" ], [ 54013, "u8", "EVariantOverflowError" ], [ 54113, "u8", "EVariantInvalidArgError" ], [ 54213, "u8", "EVariantBadVarTypeError" ], [ 54313, "u8", "EVariantBadIndexError" ], [ 54413, "u8", "EVariantArrayLockedError" ], [ 54517, "u8", "EVariantArrayCreateError" ], [ 54621, "u8", "EVariantNotImplError" ], [ 54721, "u8", "EVariantOutOfMemoryError" ], [ 54825, "u8", "EVariantUnexpectedError" ], [ 54925, "u8", "EVariantDispatchError" ], [ 57893, "u8", "QQQQSV" ], [ 61760, "u8", "Empty" ], [ 61776, "u8", "Null" ], [ 61792, "u8", "Smallint" ], [ 61812, "u8", "Integer" ], [ 61828, "u8", "Single" ], [ 61844, "u8", "Double" ], [ 61860, "u8", "Currency" ], [ 61880, "u8", "Date" ], [ 61896, "u8", "OleStr" ], [ 61912, "u8", "Dispatch" ], [ 61932, "u8", "Error" ], [ 61948, "u8", "Boolean" ], [ 61964, "u8", "Variant" ], [ 61996, "u8", "Decimal" ], [ 62024, "u8", "ShortInt" ], [ 62044, "u8", "Byte" ], [ 62060, "u8", "Word" ], [ 62076, "u8", "LongWord" ], [ 62096, "u8", "Int64" ], [ 62448, "u8", "Array" ], [ 62464, "u8", "ByRef" ], [ 63857, "u8", "EStreamError" ], [ 63949, "u8", "EFileStreamError" ], [ 64045, "u8", "EFCreateError" ], [ 64137, "u8", "EFOpenError" ], [ 64225, "u8", "EFilerError" ], [ 64313, "u8", "EReadError" ], [ 64401, "u8", "EWriteError" ], [ 64489, "u8", "EListError" ], [ 64577, "u8", "EStringListError" ], [ 64689, "u8", "TList" ], [ 64773, "u8", "TThreadList" ], [ 64906, "u8", "TPersistent" ], [ 64928, "u8", "Classes" ], [ 64946, "u8", "IStringsAdapter" ], [ 65242, "u8", "TStrings" ], [ 65278, "u8", "TStringItem" ], [ 65537, "u8", "TStringList" ], [ 65693, "u8", "TStream" ], [ 65805, "u8", "THandleStream" ], [ 65943, "u8", "TFileStream" ], [ 66061, "u8", "TCustomMemoryStream" ], [ 66189, "u8", "TMemoryStream" ], [ 66280, "u8", "TRegGroup" ], [ 66369, "u8", "TRegGroups" ], [ 69120, "u8", "Strings" ], [ 78817, "u8", "EZlibError" ], [ 78905, "u8", "ECompressionError" ], [ 79001, "u8", "EDecompressionErrorU" ], [ 115277, "u8", "ERegistryException" ], [ 115390, "u8", "TRegistryS" ], [ 116829, "u8", "TComRegistration" ], [ 118364, "u8", "\\YS3o5f7t9wBaFrHeJ\\LMNiQcSrUoWsYo2f4t6\\8WAiDnGdIoKwNsP\\RCTuVrYr.e3n5t7VAeCrEsGiIoKnN\\PERxTpVlYo.r4e6r9\\BSDhFeHlKlM OFQoSlVdXe.r2" ], [ 118504, "u8", "DPeRsUkWtYo2p" ], [ 118528, "u8", "SNtPaRrUtW .M2e4n6u" ], [ 118556, "u8", "PQrSoVgXr.a3m5s" ], [ 118580, "u8", "SOtQaUrWtYu.p" ], [ 118604, "u8", "PKeNrQsSoUnWaYl" ], [ 118628, "u8", "AHpKpNDPaRtTa" ], [ 118652, "u8", "FCoEnGtJs" ], [ 118692, "u8", "FUaWvYo3r5i7t9eBs" ], [ 118720, "u8", "CTaVcYh.e" ], [ 118740, "u8", "CKoMoPkRiTeWs" ], [ 118764, "u8", "HEiHsJtLoNrPy" ], [ 118788, "u8", "N8eAtCHGoIoKd" ], [ 118812, "u8", "P4r6i9nCtEHGoIoKd" ], [ 118840, "u8", "T4e8mApClEaGtJeMs" ], [ 118868, "u8", "L9oBcDaGlI KAMpOpRDTaVtYa" ], [ 118904, "u8", "\\4S6O8FBTDWFAHRJEM\\PMRiTcVrYo.s3o5f7tA\\CWEiGnIdLoNwQsS\\UCXu.r2r4e6n9tBVEeGrJsLiNoPn" ], [ 118996, "u8", "PHrJoMgNrRaTmVFXi.l3e5s7D9iBr" ], [ 119036, "u8", "C2o5m7mAoCnEFGiIlLeNsPDRiTr" ], [ 119072, "u8", "CJoLnNfQiRgVPXa.t2h" ], [ 119100, "u8", "DMePvRiUcWeYP.a4t6h" ], [ 119128, "u8", "MPeSdUiWa.P2a4t6h" ], [ 119156, "u8", "WRaTlWlYP.a3p6e9rBDDiFr" ], [ 119404, "u8", "DFlHlJRLePgRiTsVtYe.r3S5e7r9vCeEr" ], [ 119448, "u8", "DDlFlHUKnMrOeQgSiVsXt.e3r6S8eArCvEeHr" ], [ 120236, "u8", "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/" ], [ 122032, "u8", "TOMRP" ], [ 122048, "u8", "T9EBMDP" ], [ 122101, "u8", "QQQQQSV" ], [ 122636, "u8", "SUYWS.T3E5M7\\9CBuErHrJeLnOtQCSoUnWtYr2o4l6S9eAtE\\GCIoKnOtQrSoUlW\\.C2o4m6p8uBtEeGrINKaNmPeR\\TCVoYm.p3u5t7eArCNEaGmIe" ], [ 122760, "u8", "CUoWmYp.u5t7e9rBNDaGmIe" ], [ 122984, "u8", "aWbYc.d3e5f8gAhCiEjGkKlLmOnPoSpVqXr.s2t4u7v9xBwDyFzI0K1M2O3Q4U5V6Y7.839" ], [ 123061, "u8", "QQQQQS" ], [ 123560, "u8", "S9OBFETHWJALRNEP\\SMUiXc.r3o5s7o9fBtE\\GWIiKnMdQoRwUsW\\YC2u4r6r8eAnDtFVHeJrLsPiRoTnV\\XP.o3l5i7c9iCeEsG\\ISMyOsQtSeUm" ], [ 123684, "u8", "E7n9aBbDlGeILKUMA" ], [ 123712, "u8", "E5n7a9bClEeGLIUKA" ], [ 125356, "u8", "G9ECTE H%JsL NHPTSTUPW/.1..51" ], [ 125408, "u8", "HGoIsKtM:O R%Ts" ], [ 125432, "u8", "C8oBnEnGeIcKtMiPoRnT:V Xc.l3o5s7e" ], [ 125504, "u8", "HVTXT.P3/618.A1C E2H0J0L OORK" ], [ 125544, "u8", "HJTLTPPR/T1V..12 426080B EOGK" ], [ 125763, "u8", "QSVW3" ], [ 127376, "u8", "cAfDgFfIiKlNe" ], [ 127412, "u8", "lHoJgLfNiRlTe" ], [ 127436, "u8", "mOoQdTfViYl.e" ], [ 127460, "u8", "oXr.i3g5e9mBfDiFlIe" ], [ 127488, "u8", "cHoJnMfOiSrUmWaYf2i4l6e" ], [ 127520, "u8", "o4l7e9oCfEiGlJe" ], [ 127544, "u8", "sEfHfKiNlPe" ], [ 127564, "u8", "fPiRlUeWs" ], [ 127584, "u8", "hYt.t6p8:A/C/E2H0J0L.N9P8S.U1W3Y6..47628/AtCmFpH/KwLuOcRpTsV.Yj.s" ], [ 127652, "u8", "FJMORTVY02" ], [ 127664, "u8", "OXZ1357BDF" ], [ 127684, "u8", "R5E7E" ], [ 127700, "u8", "%CsEIGnJtLeNrQnSeVtX .E2x4p7l9oBrDeFrI\\LiNePxSpUlWoYr.e4.7e9xBe" ], [ 137052, "u8", "Runtime error at 00000000" ], [ 137084, "u8", "0123456789ABCDEF" ], [ 137860, "u8", "deflate 1.0.4 Copyright 1995-1996 Jean-loup Gailly" ], [ 138050, "u8", "unknown compression method" ], [ 138077, "u8", "invalid window size" ], [ 138097, "u8", "incorrect header check" ], [ 138120, "u8", "need dictionary" ], [ 138136, "u8", "incorrect data check" ], [ 138160, "u8", "inflate 1.0.4 Copyright 1995-1996 Mark Adler" ], [ 138700, "u8", "oversubscribed dynamic bit lengths tree" ], [ 138740, "u8", "incomplete dynamic bit lengths tree" ], [ 138776, "u8", "oversubscribed literal/length tree" ], [ 138811, "u8", "incomplete literal/length tree" ], [ 139316, "u8", "invalid block type" ], [ 139335, "u8", "invalid stored block lengths" ], [ 139364, "u8", "too many length or distance symbols" ], [ 139400, "u8", "invalid bit length repeat" ], [ 139428, "u8", "invalid literal/length code" ], [ 139456, "u8", "invalid distance code" ], [ 193152, "wide", "FJMORTVY02\nOXZ1357BDF" ], [ 193198, "wide", "DVCLAL" ], [ 193212, "wide", "PACKAGEINFO" ], [ 193552, "wide", "List capacity out of bounds (%d)" ], [ 193620, "wide", "List count out of bounds (%d)" ] ], "v": { "file.stem": "bfee72dc20b2a5766fd1e744a8fdf7213bfed6de0a5b204d69cbbe1d7ac8f5ec", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1296124995, "file.basename": "bfee72dc20b2a5766fd1e744a8fdf7213bfed6de0a5b204d69cbbe1d7ac8f5ec.exe", "pe.image_base": 65536, "pe.image_size": 200704, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 131740, "pe.headers_size": 1024, "pe.entry_section": ".itext", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "e8e0ad19d233d3d1bca1e6983f0f34c7bde60e38", "pe.image_hash.sha256": "8e5a57eef1aae84998b1fe52b2134fc4de30ebed834cd206a6ec5da2ec52424c", "pe.image_hash.sha384": "470611088adabcbb37ca7e28177d61e8001ba1f6d242fdd171ffb12d20880b0d55f28c5e5053516cbbecccd30319df9a", "pe.image_hash.sha512": "5c69ea3690ea8538ee11a1787a16e62859cb46bd7a4248d43b2b2d560bbb8790e6616862034305a2b1938161ce0494d8b889032dc555444872eae3bbe410071b", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 33166, "pe.linker_major_version": 2, "pe.linker_minor_version": 25, "pe.data_directories[0].rva": 172032, "pe.data_directories[1].rva": 192512, "pe.data_directories[2].rva": 184320, "pe.data_directories[3].rva": 180224, "pe.data_directories[4].rva": 172824, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 3628, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 6656, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 7020, "pe.data_directories[3].name": "tls", "pe.data_directories[3].size": 24, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 552, "pe.coff.dos_header_pe_pointer": 208 }, "id": "pe", "sc": [ [ ".text", 4096, 126976, 6.39, "r-x" ], [ ".itext", 131072, 4096, 1.51, "r-x" ], [ ".data", 135168, 8192, 2.0, "rw-" ], [ ".bss", 143360, 28672, 0.0, "rw-" ], [ ".idata", 172032, 4096, 0.0, "rw-" ], [ ".tls", 176128, 4096, 0.0, "rw-" ], [ ".rdata", 180224, 4096, 0.03, "r--" ], [ ".reloc", 184320, 8192, 0.0, "r--" ], [ ".rsrc", 192512, 8192, 2.73, "r--" ] ] }, "id": 0, "sz": 200704, "ts": [ { "d": "overflow keyword", "e": [ "Stack overflow\rControl-C hit", "Variant overflow", "Integer overflow Invalid floating point operation", "Floating point overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1, "el": [ "0x2ff08", "0x2fc76", "0x302f8", "0x3039c" ] }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2, "el": [ "0x96" ] }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".rdata (size: 4096, entropy: 0.03, perms: r--)", ".reloc (size: 8192, entropy: 0.00, perms: r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x55ec" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2, "el": [ "0xbfec" ] }, { "c": 0.8999999761581421, "d": "Borland locales registry key", "e": [ "Software\\Borland\\Locales" ], "i": "metadata/lang/compiler/managed::borland-locales-regkey", "l": 1, "el": [ "0x5840" ] }, { "c": 0.9900000095367432, "d": "CLAM COFF timestamp marker", "e": [ "43 4c 41 4d" ], "i": "metadata/binary/anomaly/rewrite::clamav-coff-timestamp", "l": 1, "el": [ "0xd8" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 730.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.9900000095367432, "d": "ClamAV holder DOS stub banner", "e": [ "21 54 68 69 73 20 66 69 6c 65 20 77 61 73 20 63 72 65 61 74 65 64 20 62 79 20 43 6c 61 6d 41 56" ], "i": "metadata/binary/anomaly/rewrite::clamav-holder-banner", "l": 1, "el": [ "0x4c" ] }, { "a": "T1204", "c": 0.699999988079071, "d": "Virus reference", "e": [ "virus" ], "i": "micro-behaviors/data/text/malware/terms::virus-marker", "l": 2, "el": [ "0x96" ] }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\B" ], "i": "objectives/anti-static/obfuscation/payload/registry::hkcu-software-text", "l": 1, "m": "B0032", "el": [ "0x5840" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3, "el": [ "0xbfec" ] }, { "c": 0.9200000166893005, "d": "UHARC linker major version", "e": [ "2" ], "i": "metadata/binary/framework::uharc-linker-major", "l": 2, "el": [ "value:pe.linker_major_version" ] }, { "c": 0.9900000095367432, "d": "ClamAV scanner banner string", "e": [ "43 6c 61 6d 41 56 20 2d 20 41 20 47 50 4c 20 76 69 72 75 73 20 73 63 61 6e 6e 65 72" ], "i": "metadata/binary/anomaly/rewrite::clamav-gpl-banner", "l": 1, "el": [ "0x96" ] }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 0.03)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x21a84" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.24" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 8192)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 1.0, "d": "virus word", "e": [ "virus" ], "i": "objectives/impact/infect/lexicon::virus-word", "l": 1, "el": [ "0x96" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.949999988079071, "d": "Borland Delphi RTL registry key", "e": [ "SOFTWARE\\Borland\\Delphi\\RTL" ], "i": "metadata/lang/compiler/managed::borland-rtl-regkey", "l": 2, "el": [ "0x36b8" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "EStringListError", "TStringList", "String", "TStrings", "Cannot assign a %s to a %s%String list does not allow duplicates", "IStringsAdapter", "TStringItem", "string", "Strings" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0xfc41", "0x10001", "0x2af8", "0xfeda", "0x2f6f8", "0xfdb2", "0xfefe", "0x1006", "0x10e00" ] }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "43" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0x79a7" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "Invalid property value", "FPUMaskValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x2f7e6", "0x36d4" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.39)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x53bd" ] }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 1.0, "d": "scanner word", "e": [ "scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1, "el": [ "0x96" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "bfee72dc20b2a5766fd1e744a8fdf7213bfed6de0a5b204d69cbbe1d7ac8f5ec.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "bfee72dc20b2a5766fd1e744a8fdf7213bfed6de0a5b204d69cbbe1d7ac8f5ec.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x92da" ] }, { "c": 1.0, "d": "Borland Delphi RTL registry key string", "e": [ "SOFTWARE\\Borland\\Delphi\\RTL" ], "i": "objectives/command-and-control/dropper/execution/loader::borland-rtl-regkey-objective", "l": 1, "el": [ "0x36b8" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "bfee72dc20b2a5766fd1e744a8fdf7213bfed6de0a5b204d69cbbe1d7ac8f5ec.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 9.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 126976, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0x1f3e4" ] }, { "c": 0.8500000238418579, "d": "Legacy Borland Delphi registry path", "e": [ "Software\\Borland\\Delphi", "SOFTWARE\\Borland\\Delphi" ], "i": "objectives/evasion/masquerade/brand/legacy::registry-path-borland", "l": 3, "el": [ "0x585c", "0x36b8" ] }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x55ec" ] }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0x1f3e4" ] } ], "sha": "bfee72dc20b2a5766fd1e744a8fdf7213bfed6de0a5b204d69cbbe1d7ac8f5ec", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-06/bfee72dc20b2a5766fd1e744a8fdf7213bfed6de0a5b204d69cbbe1d7ac8f5ec.exe", "type": "pe" } ], "tv": "52045" } }