{ "ml": { "v": "7", "eng": "2.11.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00007062157, "rte": "az", "prob": 0.00007062157 }, { "cls": 0, "raw": 0.14224215, "rte": "az/native", "prob": 0.14224215 }, { "cls": 0, "raw": 0.022323897, "rte": "az/pe", "prob": 0.022323897 } ], "prob": 0.00007062157, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00007062157237669453, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-17T12:19:36Z" }, "path": "2026-09-17_b1dbc53d7b490becbf86457529d73652_elex_mafia_stealc_tofsee", "raw": { "v": "8", "files": [ { "id": 0, "mol": "Th", "sha": "c04bea9518fdace5094089f961ff11e4c72f0e52011cc9fcb7759758f4825143", "path": "2026-09-17_b1dbc53d7b490becbf86457529d73652_elex_mafia_stealc_tofsee", "risk": 1, "size": 667648, "type": "pe", "facts": { "imp": [ [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "GetComputerNameW" ], [ "kernel32", "GetLocalTime" ], [ "kernel32", "SystemTimeToFileTime" ], [ "kernel32", "FileTimeToSystemTime" ], [ "kernel32", "SizeofResource" ], [ "kernel32", "LockResource" ], [ "kernel32", "LoadResource" ], [ "kernel32", "FindResourceW" ], [ "kernel32", "FindResourceExW" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "LoadLibraryW" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "GetLastError" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "MoveFileW" ], [ "kernel32", "DeleteFileW" ], [ "kernel32", "CreateDirectoryW" ], [ "kernel32", "SetFileAttributesW" ], [ "kernel32", "GetTempPathW" ], [ "kernel32", "GetTempFileNameW" ], [ "kernel32", "MoveFileExW" ], [ "kernel32", "lstrlenW" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "GetFileSize" ], [ "kernel32", "ReadFile" ], [ "kernel32", "WriteFile" ], [ "kernel32", "Sleep" ], [ "kernel32", "GetComputerNameA" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "CreateProcessW" ], [ "kernel32", "GetSystemTime" ], [ "kernel32", "FileTimeToLocalFileTime" ], [ "kernel32", "RaiseException" ], [ "kernel32", "InitializeCriticalSectionAndSpinCount" ], [ "kernel32", "HeapDestroy" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapFree" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "HeapSize" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "LocalAlloc" ], [ "kernel32", "SetEndOfFile" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "InterlockedIncrement" ], [ "kernel32", "InterlockedDecrement" ], [ "kernel32", "InterlockedExchange" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "HeapSetInformation" ], [ "kernel32", "GetStartupInfoW" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "SetHandleCount" ], [ "kernel32", "GetFileType" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsFree" ], [ "kernel32", "SetLastError" ], [ "kernel32", "HeapCreate" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "IsProcessorFeaturePresent" ], [ "kernel32", "GetConsoleCP" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "GetUserDefaultLCID" ], [ "kernel32", "GetLocaleInfoW" ], [ "kernel32", "GetLocaleInfoA" ], [ "kernel32", "EnumSystemLocalesA" ], [ "kernel32", "IsValidLocale" ], [ "kernel32", "GetStringTypeW" ], [ "ole32", "CoCreateInstance" ], [ "ole32", "CoInitialize" ], [ "shlwapi", "PathIsRootW" ], [ "shlwapi", "PathFileExistsW" ], [ "shlwapi", "PathAppendW" ], [ "shlwapi", "PathAddExtensionW" ], [ "shlwapi", "PathRemoveExtensionW" ], [ "advapi32", "AllocateAndInitializeSid" ], [ "advapi32", "CheckTokenMembership" ], [ "advapi32", "FreeSid" ], [ "advapi32", "GetUserNameA" ], [ "advapi32", "GetUserNameW" ], [ "advapi32", "CryptAcquireContextW" ], [ "advapi32", "CryptGenRandom" ], [ "advapi32", "CryptReleaseContext" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "RegOpenKeyExW" ], [ "advapi32", "RegSetValueExW" ], [ "advapi32", "OpenSCManagerW" ], [ "advapi32", "OpenServiceW" ], [ "advapi32", "QueryServiceConfigW" ], [ "advapi32", "ChangeServiceConfigW" ], [ "advapi32", "StartServiceW" ], [ "advapi32", "CloseServiceHandle" ], [ "advapi32", "RegCreateKeyExW" ], [ "advapi32", "RegQueryValueExW" ], [ "shell32", "SHGetSpecialFolderPathW" ], [ "shell32", "ShellExecuteW" ] ], "sec": [ [ ".text", 1024, 140288, 6.67, "r-x" ], [ ".rdata", 141312, 25088, 5.07, "r--" ], [ ".data", 166400, 268288, 7.97, "rw-" ], [ ".rsrc", 434688, 51712, 6.83, "r--" ], [ ".reloc", 486400, 11264, 4.99, "r--" ], [ ".data", 667136, 512, 0.25, "rwx" ] ], "metrics": { "pe": { "checksum": 0, "timestamp": 1068561556, "icon_count": 2, "image_size": 536576, "has_manifest": 1, "has_safe_seh": 1, "headers_size": 1024, "checksum_valid": 0, "file_alignment": 512, "resource_count": 6, "overlay_padding": 169472, "has_version_info": 1, "checksum_stripped": 1, "computed_checksum": 716107, "delay_import_count": 21, "headers_size_ratio": 0, "prose_section_count": 0, "reloc_overhang_bytes": 4208, "reloc_overhang_ratio": 0.37, "bss_like_section_count": 0, "section_overflow_count": 0, "misaligned_section_count": 0, "version.identity_entropy": 4.02, "base_relocation_block_count": 42, "base_relocation_entry_count": 3334, "declared_data_directory_count": 6, "version.identity_symbol_ratio": 0.06, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 667648, "entropy": 7.35 }, "binary": { "is_pie": 1, "code_entropy": 6.64, "data_entropy": 7.97, "string_count": 2970, "entropy_variance": 6.16, "avg_string_length": 19.18, "max_string_length": 751, "peak_region_bytes": 278528, "code_to_data_ratio": 0.34, "peak_region_entropy": 7.86, "string_length_stddev": 26.22, "largest_section_ratio": 0.4, "sentence_string_count": 149, "sentence_string_ratio": 0.05, "high_entropy_string_count": 3 }, "imports": { "count": 127 }, "sections": { "count": 6, "code_size": 140800, "entropy_max": 7.97, "entropy_mean": 5.29, "name_entropy": 3.14, "writable_count": 2, "executable_count": 2, "nonstandard_count": 0, "executable_writable_count": 1 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 3 } } }, "ident": { "name": { "value": "WinWord.exe", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "Microsoft Office Word", "source": "pe.version.description", "verified": false }, "trust": "unsigned", "project": { "value": "2007 Microsoft Office system", "source": "pe.version.product_name", "verified": false }, "version": { "value": "12.0.4518.1014", "source": "pe.version.file_version", "verified": false }, "organization": { "value": "Microsoft Corporation", "source": "pe.version.company", "verified": false } }, "traits": [ { "id": "third_party/SigBase/SUSP/Imphash/Mar23", "conf": 0.9, "crit": 3, "desc": "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)" } ] } ] } }