{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.90139496, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T18:59:26Z" }, "path": "48400", "raw": { "v": "4", "fs": [ { "f": "KO₅(As₁₂AlC₅CoEr₂)H₅(CmDsFPo₂Os)Md₅(SiBi₄Pa)", "x": 50, "id": 0, "is": [ "GetModuleHandleW", "GetProcAddress", "LoadLibraryA", "LoadLibraryExA", "TerminateThread", "VirtualProtect", "GetModuleHandleA", "WaitForSingleObject", "Sleep", "InterlockedExchange", "ReadFile", "WriteConsoleA", "VirtualQuery", "GetSystemInfo", "GetLocaleInfoA", "RtlUnwind", "HeapSize", "CloseHandle", "LCMapStringW", "CreateMutexA", "LCMapStringA", "GetStartupInfoA", "GetCommandLineA", "GetVersionExA", "GetLastError", "WriteFile", "ExitProcess", "TerminateProcess", "GetCurrentProcess", "GetStdHandle", "GetModuleFileNameA", "UnhandledExceptionFilter", "FreeEnvironmentStringsA", "GetEnvironmentStrings", "FreeEnvironmentStringsW", "WideCharToMultiByte", "GetEnvironmentStringsW", "SetHandleCount", "GetFileType", "HeapDestroy", "HeapCreate", "VirtualFree", "HeapFree", "SetFilePointer", "FlushFileBuffers", "GetACP", "GetOEMCP", "GetCPInfo", "HeapAlloc", "VirtualAlloc", "HeapReAlloc", "RaiseException", "SetStdHandle", "QueryPerformanceCounter", "GetTickCount", "GetCurrentThreadId", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "GetStringTypeA", "MultiByteToWideChar", "GetStringTypeW", "CreateFileA", "CoUninitialize", "ORDINAL 19", "acmFormatDetailsA", "AVIFileInit", "ICClose" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "pdb_path": "c:\\Soft\\mogurance.dbg", "rsrc_size": 8192.0, "subsystem": 2.0, "timestamp": 1393313850.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 5.5, "entry_section": ".text", "size_of_image": 851968.0, "timestamp_day": 25.0, "file_alignment": 4096.0, "resource_count": 2.0, "timestamp_year": 2014.0, "characteristics": 271.0, "entry_point_rva": 6754.0, "size_of_headers": 4096.0, "timestamp_month": 2.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 6.0, "computed_checksum": 851858.0, "section_alignment": 4096.0, "unusual_alignment": true, "number_of_sections": 4.0, "resource_timestamp": 0.0, "debug_timestamp_max": 1393313850.0, "debug_timestamp_min": 1393313850.0, "rich_header_present": true, "linker_major_version": 7.0, "api_hashing_indicators": 1.0, "debug_directory_entries": 1.0, "export_timestamp_present": false, "debug_timestamp_consistent": true, "resource_timestamp_present": false, "debug_timestamp_unique_count": 1.0, "debug_timestamp_nonzero_count": 1.0 }, "binary": { "code_size": 28672.0, "file_size": 843776.0, "entry_point": 6754.0, "code_entropy": 6.62, "data_entropy": 5.22, "import_count": 67.0, "string_count": 618.0, "section_count": 4.0, "avg_complexity": 11.23, "function_count": 75.0, "import_density": 2.39, "max_complexity": 82.0, "string_density": 22.07, "overall_entropy": 5.64, "avg_basic_blocks": 18.28, "avg_section_size": 209920.0, "dependency_count": 6.0, "entropy_variance": 1.94, "function_density": 2.68, "avg_function_size": 279.83, "avg_string_length": 11.17, "complexity_per_kb": 0.4, "max_string_length": 175.0, "wide_string_count": 3.0, "writable_sections": 1.0, "avg_string_entropy": 2.58, "code_to_data_ratio": 0.04, "data_to_file_ratio": 0.94, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.01, "text_to_file_ratio": 0.03, "total_basic_blocks": 1371.0, "executable_sections": 1.0, "high_entropy_regions": 1.0, "string_length_stddev": 14.9, "debug_reference_count": 1.0, "largest_section_ratio": 0.94, "sentence_string_count": 40.0, "sentence_string_ratio": 0.06, "behavioral_import_ratio": 0.07, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 488, ".text" ], [ 567, "@.data" ], [ 608, ".rsrc" ], [ 9045, "SVW3" ], [ 12160, "QQSVW3" ], [ 12326, "SUVW" ], [ 13485, "Hutj" ], [ 22794, "SVWU" ], [ 30156, "6PWS" ], [ 30300, "WWWWVSW" ], [ 37742, "GAIsProcessorFeaturePresent" ], [ 37772, "KERNEL32" ], [ 37784, "CorExitProcess" ], [ 37800, "mscoree.dll" ], [ 37812, "runtime error" ], [ 37832, "TLOSS error" ], [ 37848, "SING error" ], [ 37864, "DOMAIN error" ], [ 37880, "R6028\r\n- unable to initialize heap" ], [ 37887, "- unable to initialize heap" ], [ 37920, "R6027\r\n- not enough space for lowio initialization" ], [ 37927, "- not enough space for lowio initialization" ], [ 37976, "R6026\r\n- not enough space for stdio initialization" ], [ 37983, "- not enough space for stdio initialization" ], [ 38032, "R6025\r\n- pure virtual function call" ], [ 38039, "- pure virtual function call" ], [ 38072, "R6024\r\n- not enough space for _onexit/atexit table" ], [ 38079, "- not enough space for _onexit/atexit table" ], [ 38128, "R6019\r\n- unable to open console device" ], [ 38135, "- unable to open console device" ], [ 38172, "R6018\r\n- unexpected heap error" ], [ 38179, "- unexpected heap error" ], [ 38208, "R6017\r\n- unexpected multithread lock error" ], [ 38215, "- unexpected multithread lock error" ], [ 38256, "R6016\r\n- not enough space for thread data" ], [ 38263, "- not enough space for thread data" ], [ 38304, "This application has requested the Runtime to terminate it in an unusual way.\nPlease contact the application's support team for " ], [ 38306, "This application has requested the Runtime to terminate it in an unusual way." ], [ 38384, "Please contact the application's support team for more information." ], [ 38456, "R6009\r\n- not enough space for environment" ], [ 38463, "- not enough space for environment" ], [ 38500, "R6008\r\n- not enough space for arguments" ], [ 38507, "- not enough space for arguments" ], [ 38544, "R6002\r\n- floating point not loaded" ], [ 38551, "- floating point not loaded" ], [ 38584, "Microsoft Visual C++ Runtime Library" ], [ 38628, "Runtime Error!\n\nProgram:" ], [ 38660, "\u003cprogram name unknown\u003e" ], [ 39258, "wide", "h(((( H" ], [ 39772, "GetProcessWindowStation" ], [ 39796, "GetUserObjectInformationA" ], [ 39824, "GetLastActivePopup" ], [ 39844, "GetActiveWindow" ], [ 39860, "MessageBoxA" ], [ 39872, "user32.dll" ], [ 39884, "_nextafter" ], [ 39932, "_hypot" ], [ 39972, "floor" ], [ 39980, "ceil" ], [ 40008, "atan2" ], [ 40016, "atan" ], [ 40024, "acos" ], [ 40032, "asin" ], [ 40064, "log10" ], [ 40096, "A buffer overrun has been detected which has corrupted the program's\ninternal state. The program cannot safely continue executi" ], [ 40165, "internal state. The program cannot safely continue execution and must" ], [ 40236, "now be terminated." ], [ 40256, "Buffer overrun detected!" ], [ 40288, "A security error of unknown cause has been detected which has\ncorrupted the program's internal state. The program cannot safely" ], [ 40350, "corrupted the program's internal state. The program cannot safely" ], [ 40417, "continue execution and must now be terminated." ], [ 40468, "Unknown security failure detected!" ], [ 40628, "RSDS" ], [ 40652, "c:\\Soft\\mogurance.dbg" ], [ 41126, "CreateMutexA" ], [ 41142, "Sleep" ], [ 41150, "GetModuleHandleW" ], [ 41170, "GetProcAddress" ], [ 41188, "LoadLibraryA" ], [ 41204, "LoadLibraryExA" ], [ 41222, "TerminateThread" ], [ 41240, "VirtualProtect" ], [ 41258, "GetModuleHandleA" ], [ 41278, "WaitForSingleObject" ], [ 41300, "CloseHandle" ], [ 41314, "InterlockedExchange" ], [ 41336, "ReadFile" ], [ 41346, "KERNEL32.dll" ], [ 41362, "CoUninitialize" ], [ 41378, "ole32.dll" ], [ 41388, "WS2_32.dll" ], [ 41402, "acmFormatDetailsA" ], [ 41420, "MSACM32.dll" ], [ 41434, "AVIFileInit" ], [ 41448, "ICClose" ], [ 41456, "AVIFIL32.dll" ], [ 41470, "MSVFW32.dll" ], [ 41484, "GetStartupInfoA" ], [ 41502, "GetCommandLineA" ], [ 41520, "GetVersionExA" ], [ 41536, "GetLastError" ], [ 41552, "WriteFile" ], [ 41564, "ExitProcess" ], [ 41578, "TerminateProcess" ], [ 41598, "GetCurrentProcess" ], [ 41618, "GetStdHandle" ], [ 41634, "GetModuleFileNameA" ], [ 41656, "UnhandledExceptionFilter" ], [ 41684, "FreeEnvironmentStringsA" ], [ 41710, "GetEnvironmentStrings" ], [ 41734, "FreeEnvironmentStringsW" ], [ 41760, "WideCharToMultiByte" ], [ 41782, "GetEnvironmentStringsW" ], [ 41808, "SetHandleCount" ], [ 41826, "GetFileType" ], [ 41840, "HeapDestroy" ], [ 41854, "HeapCreate" ], [ 41868, "VirtualFree" ], [ 41882, "HeapFree" ], [ 41894, "SetFilePointer" ], [ 41912, "FlushFileBuffers" ], [ 41942, "GetOEMCP" ], [ 41954, "GetCPInfo" ], [ 41966, "HeapAlloc" ], [ 41978, "VirtualAlloc" ], [ 41994, "HeapReAlloc" ], [ 42008, "RaiseException" ], [ 42026, "SetStdHandle" ], [ 42042, "QueryPerformanceCounter" ], [ 42068, "GetTickCount" ], [ 42084, "GetCurrentThreadId" ], [ 42106, "GetCurrentProcessId" ], [ 42128, "GetSystemTimeAsFileTime" ], [ 42154, "GetStringTypeA" ], [ 42172, "MultiByteToWideChar" ], [ 42194, "GetStringTypeW" ], [ 42212, "LCMapStringA" ], [ 42228, "LCMapStringW" ], [ 42244, "HeapSize" ], [ 42256, "RtlUnwind" ], [ 42268, "GetLocaleInfoA" ], [ 42286, "GetSystemInfo" ], [ 42302, "VirtualQuery" ], [ 42318, "WriteConsoleA" ], [ 42334, "CreateFileA" ], [ 45374, "swwxxxx" ], [ 45536, "rwwxxxx" ], [ 45568, "rwwxxxxc" ], [ 47412, "\u003cswwx\u003e" ], [ 47962, "Ttww" ], [ 48188, "w-Ttwww" ], [ 48358, "swwyxxxc" ], [ 48588, "twwxxxxa" ], [ 49171, "wwwaywww" ], [ 49586, "Xrww" ], [ 49614, "Dsww" ], [ 49830, "wwwxxxx" ], [ 49903, "Xtww" ], [ 50072, "Yxxx" ], [ 50408, "Hsww" ], [ 50671, ".rww" ], [ 50678, "/rww" ], [ 51312, "rwwyxxxa" ], [ 51465, "rwwyxxxc" ], [ 73725, "/VQat" ], [ 73733, "H9C6Z" ], [ 74948, "r8av" ], [ 83474, "Uhnh" ], [ 90064, "J5YG" ], [ 92515, "/G9e" ], [ 93685, "I9X1" ], [ 96517, "/TY0L" ], [ 98400, "HX9GB" ], [ 109938, "O4I2" ], [ 110181, "CUGK" ], [ 113698, "pu5t" ], [ 116600, "7G7I" ], [ 121438, "LXEAO" ], [ 121710, "3G\u003c\u003c" ], [ 126543, "/LMS" ], [ 126943, "4elz" ], [ 131350, "/e\tt" ], [ 139379, "IJL0" ], [ 141549, "L9V7" ], [ 144927, "a0yq" ], [ 146967, "`0`\\`" ], [ 147214, "Mvdd" ], [ 150469, "j16y" ], [ 153426, "P1E1" ], [ 154345, "N1JP4" ], [ 155394, "/6tu" ], [ 160684, "HXDXX" ], [ 163241, "m6om" ], [ 163833, "4MZPP" ], [ 166855, "TTHU" ], [ 167895, "TEEB" ], [ 168935, "MP_O" ], [ 170675, "RDO6" ], [ 170955, "Ptbo" ], [ 171185, "B4SI" ], [ 171215, "WGPA" ], [ 173998, "d979" ], [ 175068, "O9I_" ], [ 182640, "DC5H" ], [ 184772, "/P3S" ], [ 186360, "XJ 1" ], [ 189674, "M64N" ], [ 191216, "9H4T" ], [ 204571, "a0aq" ], [ 207578, "S84F" ], [ 212676, "AHOB" ], [ 212920, "n36s" ], [ 217226, "Eoyy" ], [ 222825, "/BLm" ], [ 223368, "/EdG" ], [ 226771, "RQ4LY" ], [ 227782, "Qjwn" ], [ 229115, "ZPP4" ], [ 230112, "Q4GW" ], [ 235567, "K yw" ], [ 241429, "d6r4" ], [ 241907, "MA8I" ], [ 242427, "EYXV" ], [ 243197, "QAPX" ], [ 245758, "PP2L" ], [ 250900, "Ud m" ], [ 251101, "4M5X" ], [ 261478, "D5P5F" ], [ 266750, "5L1W" ], [ 276716, "TH2F" ], [ 277196, "503k" ], [ 278118, "DPOHF" ], [ 281721, "921n" ], [ 284877, "747e" ], [ 285408, "357I" ], [ 285417, "J0VK" ], [ 286555, "SJNO" ], [ 288941, "x6n7" ], [ 290082, "9d8a" ], [ 293148, "Ftot" ], [ 294426, "Vhot" ], [ 294501, "01EK" ], [ 299328, "gL(L$D DPPTP" ], [ 302970, "8U K" ], [ 308956, "u8cjg" ], [ 309677, "/lpE" ], [ 310243, "msese" ], [ 311553, "E5L2X" ], [ 313317, "FL8L7" ], [ 314592, "TLO9" ], [ 318597, "U0_4" ], [ 319079, "PSAG" ], [ 321966, "Q Z8L" ], [ 322596, "/y\tX" ], [ 326090, "e3t9" ] ], "sz": 843776, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 75.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Get Unicode character type", "e": [ "GetStringTypeW" ], "i": "micro-behaviors/os/env/access::get-string-type-w", "l": 2 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "AkIMakeStreamFromClipboard" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "a": "T1071", "c": 0.7799999713897705, "d": "Winsock library string marker", "e": [ "WS2_32.dll" ], "i": "objectives/command-and-control/backdoor/binary::winsock-library-reference", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 8192.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics::four-section-pe", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz" ], "i": "micro-behaviors/dylib/library::xz-ref", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1393313850.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload::gzip-magic", "l": 2 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 11.23" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.58" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.949999988079071, "d": "ANSI console output", "e": [ "WriteConsoleA" ], "i": "micro-behaviors/hardware/display/screen::write-console-a", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense short mixed-case data tokens", "e": [ "Ttwww", "Rnmumof", "Ttcde", "Lxypm", "Dxkaa", "mzxQgq", "HtcqHCX", "jsSynsj", "vbEniE", "askYmRle", "WiazYt", "nssvVsweI", "LqomupL", "woIgFl", "uciSRM", "VsxDcy" ], "i": "objectives/anti-static/obfuscation/string::dense-short-mixedcase-data-tokens", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.8500000238418579, "d": "Unicode string locale mapping", "e": [ "LCMapStringW" ], "i": "micro-behaviors/os/env/access::lcmap-string-w", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 843776.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 2.59)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 618.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "Debug timestamps internally consistent", "e": [ "pe.debug_timestamp_consistent = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 843776.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.949999988079071, "d": "Process termination via TerminateProcess", "e": [ "TerminateProcess" ], "i": "micro-behaviors/process/terminate/kill::terminate-process", "l": 2, "m": "B0033" }, { "c": 0.8999999761581421, "d": "Set standard I/O handle", "e": [ "SetStdHandle" ], "i": "micro-behaviors/fs/file/operations::set-std-handle", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.800000011920929, "d": "Query process window station", "e": [ "GetProcessWindowStation" ], "i": "micro-behaviors/ui/window/station::get-process-window-station", "l": 2 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.62)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "LWLWMXIT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 75.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "ws2_32 ordinal 19 (send)", "e": [ "ORDINAL 19" ], "i": "micro-behaviors/communications/socket/init::ws2-32-ordinal-19", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "CorExitProcess CLR termination reference", "e": [ "CorExitProcess" ], "i": "micro-behaviors/process/inject/runtime::corexitprocess-string", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 75.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1371.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 67.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large PE with dense string corpus", "e": [ "binary.string_density = 22.07" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-string-density-large-pe", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.64" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Flush file buffer to disk", "e": [ "FlushFileBuffers" ], "i": "micro-behaviors/fs/file/operations::flush-file-buffers", "l": 2 }, { "c": 0.4000000059604645, "d": "HKCU registry hive reference", "e": [ "HKCU" ], "i": "micro-behaviors/os/registry/access::hkcu-hive", "l": 2 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStrings", "FreeEnvironmentStringsW", "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".data (entropy: 7.85, perms: rw-)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "c": 0.6000000238418579, "d": "High entropy in data section", "e": [ ".data (entropy: 7.85)" ], "i": "metadata/binary/metrics::high-entropy-data", "l": 1 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/binary-metrics::dominant-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Create private heap (HeapCreate)", "e": [ "HeapCreate" ], "i": "micro-behaviors/mem/alloc/heap::heap-create", "l": 2 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "binary.import_count = 67.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::max-80-imports", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload::unusual-alignment-pe", "l": 3 }, { "a": "T1027", "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 67.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-under-80", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Large .data section (\u003e70% of", "e": [ "binary.data_to_file_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::large-data-section", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "QueryPerformanceCounter timing API", "e": [ "QueryPerformanceCounter" ], "i": "micro-behaviors/time/timing/delay::query-performance-counter", "l": 2 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted data section (very high)", "e": [ ".data (entropy: 7.85)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-data-section", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Inline MZ and PE validation", "e": [ "39" ], "i": "micro-behaviors/fs/file/pe-inspect::inline-pe-signature-check", "l": 3 }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Packed loader code-to-data ratio below 0.4", "e": [ "binary.code_to_data_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-low-code-to-data-ratio", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 67.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.8500000238418579, "d": "Repeated GetTickCount with small-constant comparisons", "e": [ "68 80 40 00", "b4 80 40 00", "c4 80 40 00", "c4 80 40 00", "68 80 40 00", "68 80 40 00" ], "i": "objectives/anti-static/obfuscation/instruction/junk::gettickcount-junk-branches", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 2.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PE code-to-data ratio below 0.08", "e": [ "binary.code_to_data_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/binary-metrics::code-data-ratio-below-008", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Legitimate DLL name associated with module stomping", "e": [ "mscoree.dll" ], "i": "objectives/evasion/process/injection::module-stomping-target", "l": 1 }, { "c": 0.8999999761581421, "d": "Very low code-to-data ratio (large PE payload)", "e": [ "binary.code_to_data_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/payload::low-code-to-data-ratio-pe", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1027", "c": 0.949999988079071, "d": "Massive encrypted .data payload", "e": [ ".data (size: 790528, entropy: 7.85, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::massive-encrypted-dot-data", "l": 1, "m": "B0032" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetProcessWindowStation", "GetUserObjectInformationA", "GetModuleFileNameA", "UnhandledExceptionFilter", "WideCharToMultiByte", "GetCurrentProcessId", "GetSystemTimeAsFileTime", "MultiByteToWideChar" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Oversized data section vs code", "e": [ ".rdata", ".data", ".rdata+.data = 2800.0% of text (802816 / 28672 bytes)" ], "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetModuleHandleW, GetProcAddress, LoadLibraryA, LoadLibraryExA, TerminateThread, ... +57 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoUninitialize)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (ORDINAL 19)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSACM32.dll (acmFormatDetailsA)", "e": [ "MSACM32.dll" ], "i": "metadata/dylib::msacm32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links AVIFIL32.dll (AVIFileInit)", "e": [ "AVIFIL32.dll" ], "i": "metadata/dylib::avifil32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links MSVFW32.dll (ICClose)", "e": [ "MSVFW32.dll" ], "i": "metadata/dylib::msvfw32/dll", "l": 2 }, { "c": 0.8600000143051147, "d": "Winsock send import", "e": [ "ORDINAL 19", "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::send-api-ordinal", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1497.003", "c": 0.8500000238418579, "d": "Multiple timing calls (delta measurement)", "e": [ "GetTickCount", "QueryPerformanceCounter" ], "i": "objectives/anti-analysis/timing/evasion::timing-delta-check", "l": 1, "m": "B0003.003" }, { "c": 0.949999988079071, "d": "PE extreme data-to-code ratio with unusual alignment", "e": [ "pe.unusual_alignment = 1.00", "binary.code_to_data_ratio = 0.04" ], "i": "objectives/anti-static/obfuscation/payload::pe-packed-dropper-anomaly", "l": 4 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "CreateMutexA", "GetLastError", "ExitProcess" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "c": 0.8999999761581421, "d": "Unsigned binary contains DLL name associated with module stomping", "e": [ "mscoree.dll", "binary.has_signature = 0.00" ], "i": "objectives/evasion/process/injection::unsigned-module-stomping-target", "l": 1 }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "LWLWMXIT", "CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "a": "T1027", "c": 0.949999988079071, "d": "Packed loader with dominant encrypted .data", "e": [ "binary.code_to_data_ratio = 0.04", "binary.largest_section_ratio = 0.94", ".data (size: 790528, entropy: 7.85, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Unpacking API pattern (Alloc + Protect)", "e": [ "VirtualAlloc", "VirtualProtect", "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/pack/runtime::unpacking-api-pattern", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "wkJ*sS^^FGI[IWI#HWY8UGX;fGDDC[\\DBC\"5\";\"J \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "c02ff5cefdde2a5ba90dee24ac1c57b3e97a60d0800d7d7abf177532b0b0c9a4", "path": "48400", "type": "pe" } ], "tv": "feb13" } }