{ "ml": { "v": "7", "eng": "2.11.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.001109451, "rte": "az", "prob": 0.001109451 }, { "cls": 0, "raw": 0.37140438, "rte": "az/native", "prob": 0.37140438 }, { "cls": 0, "raw": 0.33271778, "rte": "az/pe", "prob": 0.33271778 } ], "prob": 0.001109451, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0011094510555267334, "type": "pe" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00006044904512236826, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-17T04:48:24Z" }, "path": "Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_269_1.vir", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "e\u0026v\u003c\u0026dAuG6e9.ikeaN+Ve1gKue249Kd[T(jd]HBUd%=m\u0026d/%=Je6HAGex*Jv9lZ?rex*JHt*bQL9lZ?vf6)=6f64h(f8P[Ce@jXEe}wbUe%{*\u0026e%7moe#S@Ef3D-J9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ?r9lZ!", "ln": 43561 }, { "b": ")hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtr)hTtrXPBVb+#Y-nP/!}UXls=2NTI}YJ=RcxI9d}7+$u#aYe5Z!Xj?U!QCh3-F{smMJa!$A=2Y)}J=8xYF]6A@M(IOsFQ:BzH=\u0026f$=2ZAN=3DcyM#R4{TA.o7Nll@ZK34$tO[L8YO\u0026#A\u003eNp%lZ.zwwNM$SlK./ApQTv[aT=1\u003cpbJ=Q)q=1J\u003e.U1\u003ew@Qd\u003cLNXie.XRcPU)U2y[).E4{5XMKH}.E4%9P\u0026*T}Qe3pF.CC\u003c\u003cQ!3EY.Cl78S2RxfTwFl*TwsH.+$:90P/!tAXNg0\u003cW(\u0026RWU1\u003ew@Qd\u003cLNXe-ZX)hQ*fJ=R])H\u003c#{BTvN[MY\u0026xU$=1%3@JbLXe=3#GDPlWQ])m:e@JbLXe=3u3qH\u0026hMxF[.@fTvN[MY\u0026xULQ\u0026JT?PkHRQNllJyYdSC^?z7@XIGMBtJ=Rcx=2YQ\u0026Ka1h+=2Y)}J^XR:-4ZKmFQavRH+OfyF]npCJ+DSJFQavRH+OfsGj}kx=1iU8PfeeEYdSC^?z7@XIGMBtJ=Rcx=2YQ\u0026Ka1h+=2Y)}J^XR:-2O22Z=xd$Y(o}%O{xm8O{u$LJ+E+WM29oPJa/4rGfkzxJbD\u0026NFQavRH+OfOH\u0026xsvNllr*OPRT)NrtnO+#7k=NrlTZGmxTOPlWQ]=0NOhI9cwAFpsEQ.92vUH\u003c^2Y.91[KPkHRQNh?.BH\u003c^2Y.91XDNe", "ln": 44488 }, { "b": "A902t002J2Bwls:BYix\u003cBy+BLB-RbmgCQN[y?%7K000000000000000kMy/1e[[\u003c8BytdHQZ^w800093o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH00000000000000000000000000000000000000000000000000000000000000000000000000000000p^\u003eu:oAts$lSEcm0000000000?#Bk/3JQq/0d\u003eg", "ln": 77248 } ], "mol": "MdTh", "sha": "c1362c5408eee401bec66b5ec0710d18c90c8309a24a59fe88fffe3b559b12dc", "path": "Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_269_1.vir", "risk": 3, "size": 181449, "type": "pe", "facts": { "imp": [ [ "ole32", "CoCreateInstance" ], [ "ole32", "CLSIDFromString" ], [ "ole32", "CoInitialize" ], [ "ole32", "CoUninitialize" ], [ "oleaut32", "SysAllocString" ], [ "wininet", "DeleteUrlCacheEntry" ], [ "wininet", "FindFirstUrlCacheEntryA" ], [ "wininet", "FindNextUrlCacheEntryA" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "ExpandEnvironmentStringsA" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetComputerNameA" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetExitCodeThread" ], [ "kernel32", "GetFileSize" ], [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetSystemDirectoryA" ], [ "kernel32", "GetTempPathA" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "GetVersion" ], [ "kernel32", "GetVersionExA" ], [ "kernel32", "GetWindowsDirectoryA" ], [ "kernel32", "GlobalMemoryStatus" ], [ "kernel32", "CopyFileA" ], [ "kernel32", "InterlockedIncrement" ], [ "kernel32", "IsBadReadPtr" ], [ "kernel32", "IsBadWritePtr" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "LocalAlloc" ], [ "kernel32", "LocalFree" ], [ "kernel32", "OpenMutexA" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "ReadFile" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "CreateMutexA" ], [ "kernel32", "Sleep" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "CreateProcessA" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "WinExec" ], [ "kernel32", "WriteFile" ], [ "kernel32", "lstrlenA" ], [ "kernel32", "lstrlenW" ], [ "kernel32", "CreateThread" ], [ "kernel32", "DeleteFileA" ], [ "user32", "GetWindowTextA" ], [ "user32", "GetWindowRect" ], [ "user32", "FindWindowA" ], [ "user32", "GetWindow" ], [ "user32", "GetClassNameA" ], [ "user32", "SetFocus" ], [ "user32", "GetForegroundWindow" ], [ "user32", "LoadCursorA" ], [ "user32", "LoadIconA" ], [ "user32", "SetTimer" ], [ "user32", "RegisterClassA" ], [ "user32", "MessageBoxA" ], [ "user32", "GetMessageA" ], [ "user32", "GetWindowLongA" ], [ "user32", "SetWindowLongA" ], [ "user32", "CreateDesktopA" ], [ "user32", "SetThreadDesktop" ], [ "user32", "GetThreadDesktop" ], [ "user32", "TranslateMessage" ], [ "user32", "DispatchMessageA" ], [ "user32", "SendMessageA" ], [ "user32", "PostQuitMessage" ], [ "user32", "ShowWindow" ], [ "user32", "CreateWindowExA" ], [ "user32", "DestroyWindow" ], [ "user32", "MoveWindow" ], [ "user32", "DefWindowProcA" ], [ "user32", "CallWindowProcA" ], [ "gdi32", "GetStockObject" ], [ "gdi32", "SetBkColor" ], [ "gdi32", "SetTextColor" ], [ "gdi32", "CreateBrushIndirect" ], [ "gdi32", "CreateFontA" ], [ "advapi32", "GetUserNameA" ], [ "advapi32", "RegCreateKeyExA" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "RegOpenKeyExA" ], [ "advapi32", "RegQueryValueExA" ], [ "advapi32", "RegSetValueExA" ], [ "advapi32", "GetSecurityInfo" ], [ "advapi32", "SetSecurityInfo" ], [ "advapi32", "SetEntriesInAclA" ], [ "crtdll", "GetMainArgs" ], [ "crtdll", "sleep" ], [ "crtdll", "stricmp" ], [ "crtdll", "atoi" ], [ "crtdll", "exit" ], [ "crtdll", "memcpy" ], [ "crtdll", "memset" ], [ "crtdll", "printf" ], [ "crtdll", "raise" ], [ "crtdll", "rand" ], [ "crtdll", "signal" ], [ "crtdll", "sprintf" ], [ "crtdll", "srand" ], [ "crtdll", "sscanf" ], [ "crtdll", "strcat" ], [ "crtdll", "strchr" ], [ "crtdll", "strncmp" ], [ "crtdll", "vsprintf" ], [ "msvcrt", "wgetcwd" ] ], "sec": [ [ ".text", 1024, 33116, 7.15, "rwx" ], [ ".reloc", 0, 0, 0.0, "rw-" ], [ ".data", 34304, 13304, 6.15, "rw-" ], [ ".idata", 47616, 3748, 4.91, "rw-" ], [ ".gfcd", 52224, 512, 2.39, "r-x" ], [ ".reloc", 52736, 4608, 5.29, "rwx" ], [ ".idata", 57344, 1024, 3.59, "r--" ], [ ".text", 58368, 1536, 5.86, "r--" ], [ ".reloc", 59904, 6144, 5.0, "r-x" ], [ ".idata", 66048, 512, 4.04, "r--" ], [ ".rsrc", 66560, 5120, 4.9, "r-x" ], [ ".rdata", 71680, 3584, 5.11, "r--" ], [ ".idata", 75264, 512, 3.41, "r--" ], [ ".idata", 75776, 512, 3.96, "r--" ], [ ".idata", 76288, 512, 3.37, "r--" ], [ ".idata", 76800, 512, 3.6, "r--" ] ], "metrics": { "pe": { "checksum": 0, "timestamp": 2016344387, "image_size": 262144, "has_overlay": 1, "overlay_end": 181449, "headers_size": 1024, "overlay_size": 104137, "checksum_valid": 0, "file_alignment": 512, "overlay_offset": 77312, "dos_stub_zeroed": 1, "overlay_padding": 105169, "checksum_stripped": 1, "computed_checksum": 227151, "dos_stub_modified": 1, "headers_size_ratio": 0.01, "prose_section_count": 2, "bss_like_section_count": 1, "section_overflow_count": 0, "misaligned_section_count": 0, "entry_in_nonstandard_section": 1, "declared_data_directory_count": 2, "executable_prose_section_count": 2, "directory_section_mismatch_count": 1 }, "file": { "size": 181449, "entropy": 6.65 }, "binary": { "is_pie": 0, "has_overlay": 1, "code_entropy": 6.43, "data_entropy": 5.88, "overlay_size": 104137, "string_count": 841, "overlay_ratio": 0.57, "embedded_files": 1, "overlay_entropy": 6.06, "entropy_variance": 1.48, "avg_string_length": 53.14, "embedded_binaries": 1, "max_string_length": 979, "peak_region_bytes": 30720, "code_to_data_ratio": 0.74, "peak_region_entropy": 7.29, "string_length_stddev": 63.77, "largest_section_ratio": 0.18, "sentence_string_count": 425, "sentence_string_ratio": 0.51, "high_entropy_string_count": 0 }, "imports": { "count": 113 }, "sections": { "count": 16, "code_size": 49500, "entropy_max": 7.15, "entropy_mean": 4.58, "name_entropy": 3.32, "writable_count": 5, "executable_count": 5, "nonstandard_count": 1, "executable_writable_count": 2 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.binary_as_unknown": 1 }, "dependencies": { "count": 9 } } }, "traits": [ { "id": "binary/embedded/pe", "atk": "T1027.009", "conf": 0.9, "crit": 3, "desc": "Embedded PE binary at file offset 0x12e00 (~104137 bytes)", "spans": [ [ 77312, 31 ] ] }, { "id": "metadata/encoded-payload/xor", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: xor", "spans": [ [ 43625, 39 ], [ 44552, 46 ], [ 44618, 46 ], [ 44676, 46 ], [ 44746, 41 ], [ 44786, 40 ], [ 44848, 46 ], [ 44911, 46 ] ] }, { "id": "third_party/SigBase/SUSP/Imphash/Mar23", "conf": 0.9, "crit": 3, "desc": "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH00000000000000000000000000000000000000000000000", "ln": 0 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\u003cGNCoNn/MdLYSvl!O%-3unPfqul)3?tYI9g!O}4:H9\u003eauKYmn.ZMd@a-w0!%dN/\u003eE!O$rU[nK[q!+!00{4#WMui38Te05)\u003e)Gy41P\u003eUfdQX*d\u0026uoC-yuo15qSL+9yPR(oCw{wJ)VhZki!O}5H5Q.FHJ\u003cD\u003e5fEaZ!FeT{%!FF^8M2Hjo?i=[8!O@tSIZ]KkH{HFmt:lz4?6p5?FCWfhunW$}s*l+5tX%[OMVcZ{^rq41!QFEY!O}5NKCBYf-RFhDChMQY!=1fTtR/^:RHff!?sC9o*vNjw!O(aGQX0By^qXpTGc.9F-RXtVut{Z2C0Gp*!+^EVuuen06/8rQMVLC-6/8pbF/#BK!O}5R\u003eUbkq!+=sm6/8qhAq=F86/8rO\u003eTnVi!Hwx?dKkWIH+oF{/)c*a@rPv#U6woX%bQVIr\u003cXm(Zf]8cj*OQTd!u+/sBxAg^F\u003e1r/]KkN?tuwXsBxAg\u0026S13ldVX786}sOosr0hrdKf5@e01ih5Q:p(5{oerMVeph!O$kdjUbMj!:()**{33tZI)z0-JXis?eF)7ZJ:\u0026OS=jH05QoOCPM.V2!O}4E]7cyLP\u003c2W2\u00269Y!C!Tj5X!O(Rr?h!Kz6/8qEdgR\u003e/r\u003cXmo!nQ{$H+DQ{t+5Tor.Y*6MVeC$^-v#0!O]-2Bx\u00266b!F:^mh7f.?!O}4E0U^!q!O}37t:t2yY\u003e*}f!FFH0M2K}ZtVEql!O(R3-uSILtORu73@1eErd8h}!#t(Nr\u003cXkk!F:}}@JLc#Y\u0026nk)!FL%7", "ln": 928 }, { "b": "00000000000000000000000000000000000000000000000000000000000000000000000000000000z)7=N?[gH2z\u0026X=@zX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CbT:u)ujNlm8?g*5kX{", "ln": 34240 }, { "b": "zAma}d)Tw^k1+((3RzxHzAipVdo)/:08A/E0APtq08kO598DVH9E8GkzAh!HeMz^#3VMU+3rmAzzAgJ6do)/%7FkSY1apx43TaGS96=a!zAkxuaXr2Hbto4\u003e7i\u003c:dzAhbmjwt]Y08r-b3ov?\u0026izY-G7f?mUzAmd@f\u003c+q@9:wZRzAe*Hf\u0026/xh0a(jU2Vh7u3rmAzzAhen2Wdsr9B9H[zAg-df\u003cj{d2tGa", "ln": 42254 }, { "b": "zX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.CzX3.Cj7!^\u003cpEDZJbqhh%i.p.q7\u0026yui3$6AE3OI]NpGY}2iu.dii:TgLaTo-Y0bz%n4TOjHpHBCC41f6?0dNmn8v[\u0026k18F0q3niq#pHCbmpIx\u002658E=2Je]8za8.TiR4ke@d9d55^94\u003c#-8*-RdkP*Ie8HzGRl17Y)e)6tkpK0mE3$6fxpKr9Wel$tOayvxTiXJ\u0026rcR=^Lei(sBkUJtBj4ZSjkUJIzbtg^CaycakkTMYqcr\u0026crkWu3SdI1T?e\u003c\u0026xWe)G.rpHbF}bqgP!j4{#Gh7}rmel$tOayvxTiUc9*zX1i%3$75F3tZQ#e)xLrksM+gpK-BJ4TXT0pIZ589CM3Tz^JMJ4TXT0pIG(73vLVm0d2R5e)xLrksM+QcsEu:9EOr08.S^YixZaHtP%IK2XB$)3$6AEpHBeu4q(RMpHBCC3#N4\u003cmK7V118nus3l@qH0dt?(40#(a18nus3l@qJ0EChEpJ=+j9wo0.ixZaHtP%IK2XB$)3$6AEpHBeu4q(RMpHBCC3#N4\u003cmH@c:lmK0okvU769bm!T9bkKW40$-%7K(V.4TOBY0wuxp4T\u0026ke18nus3l@qr3s:DE8.SZca7=G{8!GaLpEk7-8!T5c0C?^f9CM3TpFqo(3OJR@0=nrrlOxGX3t{\u003e?lOw)H9EOr08Xkbj3t{\u003e?lOw*G8!{ug7gn7OpFqo(3OJR@0=nrrzZ(+Bn{\u003eI\u003c18nus3l@qJ0EChEpIZ589CM3TpE#H911$^00+#Q!18nus3l@qr3s:DE8.S^B9CXyZiC6plkTC#N8!{vs4T!V}z!Qg\u003ct[o552XC8K3vL6x9Ed([3ss=N3#c!Pz!6kG0CRVyt{fLP0$M8t9CDJg3Vl\u003ey3UfzFt{fLP0$LMq9xWNy8fVAF1A2g^t{fLP0$O3%gB:z9n{\u0026xl93CXQ3j/^4kWtpl7D$F*l1.9nzZ(=sj:NJ4umDf@3Vl\u003ey7\u003cWlepy*8\u003cpARkbn{\u003eI/3$6fp4Q/XX3$6e$n{\u0026x$0aD4j0C:}(25d@{98^qC3N2)z3j/^4gI^e0l4obDz-7e]u3Zx?34aE91p(tBa9[#a24qyM9EnS89$GCN1y#y:18nus3nhG-1zQXn0dt?(40@jW0ENTA0C+C89D\u003egW2Yo(Gk[u4U4S8nLpKr9W4TG3\u003c0dt8t3l-e?j3(XRcp71B0bz@W27ffs3vS{\u003c9CL{08^(AA0aE0H3vrc#8!PJ@8*@k#9bViW24dAEzV@(NpFI\u003c62vFJF6(B{^0awSL4Rt=E3N6zl17\u00260upE1[-3njCvpFp^\u003c8!G7z3j!X7j6J\u003eLz+qG#i$A#Ya$(c0aTeHs3U\u003cL^ltD*j2769v4R2-H4TOBY0ws).3U\u0026Bq0ws\u003c-3$Jal2}(-\u00269CXyZ40-V$mH}BU8HUv:4T!W40Es\u0026L3vM/r4T!W4nHWzt7K(V.4TOBY0ws^Z8!%nu8E\u0026*^a-mx!z=)rq4I6^^9d55^en=Ckz+Ir@eKg\u003eghXe8L3t{\u003e?pIy5l11%)XpKrpJpIZ589CM3TpI6Pl0ds@K8!GaLpKr9W8epc/33G6e0d2R525sPF8!H0Nk[tIK31a-TpKAyN0ChsrpI6OwpK-BJ4TXT43$66x27lN\u003e8!PWQpJ=+jpI}dSpKrpJpHC5w3vLVI2})h]27ffF3#t@r0EE6(0bkhn9C#*4pHBeu0d2R57?%EK273Z)pK0l+4T!Z58ES$T9Ewq{24m/Q4LF(d9CbsTpKJQD25k1[0bkhe8HUvW3sTAG9wm}b3$72Q8*\u003c[he{)", "ln": 44424 }, { "b": "b@)D09-Sh*3RLzh0A{Q.1y8vZzvo/3kNOFvoby(WzuRy(bxV\u003ctpzubaog*gs8F]W/3SXf)mJic\u003em\u0026K/B8Xt%Vog*gs0:!ly4[^mr8w-G-4oKMY0ASeJog?]nzEjq\u003c4nv4m02VO2m(:g?qw..Ap8\u003ef9lLJxdl(eo5hwud4jx@quuKgNtd$nNS16/:]9uk$JlM47W4ncXG0BD^0cS.m499iF]pj9\u003ec0-*sR962/A3QC\u003eA0zr+y3QCaMzFoPc201!N2U=dN99+o^2u\u0026cQ9AAF[gh[Y@jZn}L9+vDG8Czj-7Hd{\u003cek2$/9B6+58ega04o%)2zwK/}d0N^ui+pAsc#y}sjBw}K2u\u0026cQ9AAF[ghWq83rw0\u003egi%\u003c!99-I\u003ei9WFK2uy\u003e7d)Um!0zr=Fgj73H8a\u003el43R\u0026{m0A]?T9xtJT0B34zj4Y\u003cdaZUK=2uIlyjYR(o8cv[]gir.p99a4!2U^9S2uIpv8a(XU8+Rh^08kE*97*Ay0a^G=8Eap\u003e3R:A43R.NL0a3SQuK{HczFyp=i=lMQd}G]p4ncXG0BD^AizY-(0zTRkeLEgk3S!oI3RIEK0AR6D08i/G09*D@jZn}M2uIgUggHq)3RAi88-Z?t3%0:VpZ48J165heqwHl*98E-7p=Rc}9B6K/2uh4r8+\u0026*O6Ci!^ll3)\u003crxgW5og/O14nl?r08k:e9tYYw3@^BTmI5Jf6/=OD09QsN0AS6tmI6F]9A\u003cE}9./GxqwGND98]=CqCWyz8+\u003caP7Fa@?oIcju15G{*peqvf8^Dn?nE6e-9yT(}09ZB)rxiW0qCWyz8+\u003caP7Fa@?oK4%q8xhE$4]\u003cJ.qYXLUnF}K", "ln": 46058 }, { "b": "kr}wGo!MGG0+$TMn{\u003cqqz!R\u0026XtZyn\u003e4pxJdq4DLu2wK=Pq4B)F41ed\u003e0bit=emoC?zZ(+h8!H0*3nCgCn{TwJ8!H0*3nDA42wK=Pq4Dq(q.yAKpBXQq8zsC(q4DM48!5\u003cNzY]rV0Um{@n]dd7z/2LL0C:z-9blDNibe\u003ctdTqz68.Syo2XTPsz^irI8*z(^3r5fC41edG0biu.ia-d@0c/I}ep5pe3sK\u0026\u003e3vJ{\u003e0avS$2wKrujzC\u003ci25BV\u003c4p]]J8+QMs4T63%4R]%ba8S5)0+}Zfz^9As3t{hE0CAYU3U/-6z+Iu\u0026cqc9l98!j^kyAMojzC\u003ci3vMg/zZ(=sn{\u0026)f17Mjnst?NPe\u003e^Wylp\u0026OKdK4[0t1RebrZf[8tS#l$rZebzeJv2p5!wIkwM}6frwc]-94ktNzZ]63h.P5*dPYN!z=u^y0CAxGqyR]ZpGeud0+b7F22X$(n{\u003conzZ(+Bn([U?zZ(+Bdl{1qfE!$v8*\u003c}K0b8Qst{6hH2XB5M1:?vK7?%D}3Vns993C+/8!GHX0C1D00aG?X250#O24qx=7h:sS03I!L0UleN4pP\u0026A10E!v0BOe@0aG?B79J/O0BOe@0aFk^kO3aU8EST.3$6e$l23{68!PjG0C1CQjz1[3pEUsA9a/HU24o=44q(%#z:KLipEUsAl4ozga8Rb@3$6e$84Nlr0$Mth3j?2mvG*T\u003e25CnW9af4Dpx", "ln": 46828 }, { "b": "mr\u0026=WzE=gNC4\u003e#nzF-%5Bw)p4x(mN8k(/4cm}D^fz/6u1zE=BPzE(9l007pAm}D^fz/6DoBy/F/vqPNw007\u003cQm}D^fB-IIlzGFY}z!0v1B4G)x007{Sm}D^fB-IIlzGF\u0026\u003eA+eV\u0026nN}/3008M\u0026m}D^hCXIm!z!9AUxMvV)wb#x8m}D^ix(4uVx)Ks\u003c000ubm}D^pz!a0b", "ln": 49094 }, { "b": "m}D^wwO(x.vrufG00311m}D^wx\u003e7{Cz/]@t003m8m}D^ywPz\u003caz/bKP003p9m}D^ywPz\u003caz/e0*k(+D%m}D^zx(mE1Cxle^A+e:5z/Qa?004fym@i9MvqFUHzeTDuq/(C\u0026B-NJ.001qBlVl{?mRMWIk(^bInP5SYA+]V7yH}3FzEWY#zdNQb005w!nPNjbwkV#Ewb", "ln": 49350 }, { "b": "006b4oMaAHy^z(Nz^@+E006n8oMaAHy^@CRwDpcVpJf(.o)7L?CThrf001.NlVM:DBy^{Qy?k)j008\u0026@qE%oEmRMWI000GgqGM.PzG//jwb[T(q!p5ux(4uSz!T9hwPv+J002aYlVM:DBy!f?By/X.003Khq/32Rz#:XQraQ8!x(mv3wL^z=v}x.5004@Vr+VO@BZY8-B.bPs002p+lVM:DBy!o?z!0v1B3P^a005h:s7b/+mSirCx(mN1wLV=IwN//Z005t!s7#hRlUG[GrbUGNy\u0026\u003cwTD30P$005w/s7#LvCX7v+005.{s8@1%wKZxIwDo*Ny\u0026:Ysy?mGI007dyy\u0026:Ysy?mG=002H?lVM:DBy!A+A+eV\u0026002%#l$HgCBy^{Qy?k)j003Qhm}D^zx(mE1Ct@c#Bu])b003^mm}D^zx(mE1Ct-0ZBo3mWmRM:Js7#L.z*aFE0049vm}D^zx(mE1Ck@9Mm}D^fy*?yapgn0Jk(!?6q!p5uz!0{h", "ln": 49542 }, { "b": "003d5m}D^zx(mE1Ct8{)xf=H$003j7q!p5Lx(mE1Ct8{)xf=H$003salVM:DBy^\u003cKB8b(oA6TE7003Nhq!p5IxMvV)wjg0IyJKGl003Qim}D^wxMvV)wjg0IyJKGl001nArb#z+B8kobwLD-SB75Y)001qBl${ZYvru0)o\u003ewx!vp%dq001XMq!o\u0026So\u003ewx!vp%dq002dZp\u0026yz%qfuO{o\u003ewx!vp%cK002T(q!Q8[s7#L.z*8fY002^{lVM:DBy!J/zE^Wf", "ln": 50062 }, { "b": "A=lk8x(mE1Ck$Uzo(Ch^s7#L.z*8fY003j6l$G$ix(mE1CtJr#v)H7{003p8lT:!Es7#L.z*b2#z^#6k004\u0026Qm}D^vBz\u003eV8pHX6Iv@}XJ007dwq!p5qyEr2Rz/L*T007*Pq!p5IwQ5q:z!%uj008\u0026}lVM:DBy^^VB-Rj/zE^E4wN//Z000#slVM:DBy^{WzGFeA004=Om}D^xB7Gw!vqPNw0040tqE%GdA+eW3wLlPWmr?8#0049wqE%Gdy\u0026sxaoj-wG004oBqE%GpAaJ]WwQcZ?k(=MsqE%GrB.bPsr://!wKQ\u0026f0058YqE%GtwPQ%Yy\u0026%qTCThrf007dxm}D^vwN/\u003e6x([R(zF0!!007mAq!p5HwN/\u003e6x([R(zF0!!007HHq!p5tzGG]kwPHBXl1sZ%000\u0026ouTDrmBwlgTzB5qQA@Z:(uVQ3{wPdRH005\u003e%uVQsfx\u003e81000900vruB4000ucwQ4{h002$1zdNM]AcRA-00343zdNN9wPN[L003j8Ab]VgBy\u003eHM003ydA:-W6wDlcuA:-\u0026@003:nB7]o8vqC]z003\u003cqB8VelzGC", "ln": 50282 }, { "b": "z#Y\u003erMJztKAb]VgBy\u003eHMz!@#vga\u003e%*oAk4)002v^002v^002v^002v^pFshyrA7+fe\u003c@xb000006AyG2s4MdUpdnbml}*nOc\u0026=Qmc\u0026=Qmc\u0026=Qmogq-NmnbG)e\u003c@xb00000jod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.", "ln": 50792 }, { "b": "jod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Gjod.Grz#s:gCQNJoItA^pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.pYJ\u0026.m)]{8ga\u003e%*oAk4)wb[%%wb[%%wb[%%wb[%%wb[%%k$1:tp!rC#e\u003c@xb00000CMp8hCMp8hCMp8hCMp8hCMp8hCMp8hCMp8hCMp8hCMp8hlSc(KoIv6boItA^I#ViBI#ViBI#", "ln": 51024 }, { "b": "00000000000000000000000000000000000000000000000000000000000000000000000000000000:rgM+0000000000O*%)yUP:eH*-MX00000000000S4d@I-3bo-\u003craK80000000000WjqsV+PWb?]Djko0000000000.7bP/*-=?2S38ly0000000000=mn$%KrT\u0026c93LE+0000000000/^^d81sa6Hg:i240000000000\u003c0$ii93+Q^tP%mI0000000000[gaOv", "ln": 52672 }, { "b": "%nKhw00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 57280 }, { "b": "00000000000000000000000000000000000000000000000000000000000000000000000000000000xMOuniXJd8A:-D]wIdFhz7/yqzGG]cv@#=yayPd#az\u003eLjayX[8B-p(1By!#9vTf7(A:-D]wGUP9z/3Rsx(dA7Bz\u0026pzx(dA7Cwhejz/{dAzF%Shv}u^8zY\u003cszBUj2kB-7Yhx(v($y?X0paA7\u003cmBzbkdAb](fA:-*ae*aqnBS+vaC4z^LfD:[mD2\u003e9uA=k!qBzbkdwmYN\u003eC4CYtay[]5wGV8kaz2.8y\u0026%fdwGV8dwPIA9Ab](fA:-*ae*9.$aBd)Fay]4[x\u003eg=$Bz\u0026pAB7DF5zG#N/z/65dC4CYnx(v)gaA7\u003cmBzbkdB8LVjCvtJ6efF+yyH[R-z/^alz/M%#wPIo@wGUA0wfsfFvpS}^x\u003e5o7AV!w1x)a6dB7]-wavP*PBzkVhaAIEkBA.elwH[%jA+bORBZ/A4A+O#]AYLsSB0b18w[=c]wftr4asHUEayMypz/PSczF5", "ln": 75428 }, { "b": "B2$G)vKSBdaAhmtBywS{wGUU{zE^*1BrCHxaAg+4x(mMawmY{#v}u^8xKL#\u0026mSiq\u0026BzbkdAclhuz/YGhaA7\u003cmpJx#SAV!7+zEEf?zdNQbefEk?C42n#wN(]WA+P2$zF782zE:\u003e^B-H#9vrld2xdLf4A=kM3B8#5lzEEu7rDz.(B0a[iwGUz$y\u0026sJewft#jaz\u003eL8BZY95C{3WoBy/F1ra]#!ayO]6wO2Z\u0026zGE0HBz\u003e/6BzblaaA}KwxDRzdA=2\u003euvpJ!=ze-{3D1?eeayPekaAIEkBA.elwGV5pAbYS8zdNQbB1wCRAaAy0wPGyBvqYP#B7Gxnx\u003e7Z}3q1b:uR:u]l0)UEgb7BpgHAKYw)XN[gbpTtgY", "ln": 75895 }, { "b": "By=O6zE:(bvr\u0026#7y\u0026:IqvR3V\u003cB-.Lsvrui[vqG+93qTL=lRG]\u003eoI4Pupe:O7k#6/\u003cq:\u003cO+nKC{BaveH}mmx{tpe?NtA+fA9zGE1jx([31AV/sfA==NHw].*bay]hcv@c78x(mMaBzbkdBy/GfB0bywaAhvnv}/*[aA.NjwPw]nxLzJgvp%Q(wO\u003e#", "ln": 76296 }, { "b": "ayPvmBzbkdzfoVpx(E)1CXI5dazbUjzGE1jzE+vxl3mo/zddJ$wftt\u0026ByO##zF78gw/$R)Byuq7A=k!qv@Dj6B-.hnaARJAv@Dj6B-.hnazC)tAaK6bx([Ddwg/0cz/(y}xl4M{zdNQbayO(7wPw]sz/{7yB8LVjCvtJ6azC)tA=(nqx(mMavTf8ez!T94aARJABzbkdB8LVjCvtJ6av{6WA3fjiA+e*1ayPd#ay/k4v@2^@xcqbgaARpd3t9\u003cTBAIRnB1OOmxK@q%wPJ0kAbP=saz#atx\u003e7Z}ayPq4aAIWmygQ)%aARJAv}Yp*xjTdEpJx(Ny?j-kx(4PdAb](ux\u003eg=$B-p(1By!#9wmY?8AbY-oBrCEtBzkk@B0bysawDA?vn3", "ln": 76769 }, { "b": "wPF#hB-RTEvR3V#x\u003e7Z(B7F(8B7Gr0A::63y\u003cvSuvqYQez/M$vB-88hzF7NAs7#+\u0026aAz4mAaJK3aARJABzbkdlV)D(z/66aavGTWviw9-vJYSgz!B90z7D/zzxJF3By/Gfx(mT5xcqqfwGU(kzdm6%aA7\u003cmy?Wx\u003czGxxgaAz4kB.L(cwgO\u003cwzFTO9", "ln": 79627 }, { "b": "AV!gIp9sd!AV/EqwGV5jw]@l9A+cwnxKM09D2E*FA+e-(x)a5#aA}KwxDROsB-FQzB-H#9vrl0hayPd#aBd)FATClWAaJ{dwGT(ZAbP=siV@cTay]4}x(mG)ayPslBzbkd", "ln": 81204 }, { "b": "qB9VHawU(Tr8ly\u003eefE.^awU%cmn^hUq:\u0026kWq+fhFoDVU\u003cawtv3nMnbDaxhbVr7GC2mNY:A3rfL+p9q?BpfwYho\u0026aIPmmnn1k#HPDawL)cmn\u003e-Wm].?$qB8B2r7fkOefE.^avw}1l}HuHpFK?hoHhPRawU:asS*ajqB%RNaxg)23ufW7B7]b)y-)i", "ln": 85429 }, { "b": "z!s8lvSD3*v}YB{ayPekaAg+fBrCHlaARphB0a[7A+e*0wO#POaw23BsX\u00263uni{oBavdbBsS*3%q+o[gmO=[?wmY*(A+O#]wftP7aARpdaA8phwPzH5xcp-6v%8T1zGEGrzfoVpx(E)1aAIamC4CYnefF$Axjk*\u003ey?mWeaA7\u003cmCw7MfxK#ibBzbkdx(mD}C4\u003eGfvqE62B0a(", "ln": 86617 }, { "b": "B7o38B9hImaA7\u003cmBzbj)gCf!IB7DFdzxJvgr+VO@BZY92DsZRfmq^o.A=k\u0026jwO#Pxaw3e/D2E*FB-RapC4\u003e#sBZY92Dsp]fz/cXsz!s9nvrb{gazC.6y\u0026%o5zF784y?WD#BrCmxAaK5wB$s+TzY\u0026LgwNPW(3tBu@z/P@dzGE1fzE:(iz!AT6xK#ibv@=c?By=OpxLzJgv@DmbA:-E1aARp9BrC1hAbol1B0bNyaBd)Fe*aqnBS+g5zxJ$hC4\u003eJiaz++fyH}30By/GfB0a}qaAg+gBzkS93qUXJv@bZ0l2Z^Vx-", "ln": 88024 }, { "b": "v@DHcBy!#9vriM1y?$kgx(mG8x(){6B0bysayPdgvq{gaz*2Y5aAz4kB.L]hBzkVh3qB8VqCQj!mPpH0svk+Zl}72%k$\u003c@{nLJ2PnKV2\u0026s3Y.Zk{e{4nKVMeaw2r}oJsFL", "ln": 88319 }, { "b": "z/M$sBzblaazb+jy+o*Gy\u0026%Paay]hcyANedx)a5gwO#0#D2N\u003etz/cXtwN/y\u003ez!%u8C{3%jC{3Ncaz+RgB0bKnv%8*6azCZovix-cA==Cjy?Xibwc#:.wfu5fA==Cjy?Xi7Bzg", "ln": 90884 }, { "b": "wPzj3x(mMavpKy[C4(5jwPGEhp/p7RmmxQopdDBdnLz/2lpA1:pFBeEpdmL[s4MvZavdbBpGf\u003eNqxP4jr7G!+r3kdhmiCA8nL-kbs5IQ?r7fK?l2Z^Vx\u003e7N[x(v(iqE%oEeL*n2C{3adwPx*Ox(+zcwObT]wN(](B0a[eazC.7x)ai3BZY8evrDW9", "ln": 92144 }, { "b": "A=(mxz/fxpaAqKnA+P9aaA8oyA+fidA==vBvp%1.zGx[xBzbj)q!o#)x\u003e7Y%x(+z9C4293vpB4:aA8cuxMOuniXJdgCxUVTA:-D]wIdFhz7/EhBZ[\u003c4x(v(xz!%qzawM\u0026%CwhejB97\u0026dwnb{]ayPekBzbxaxcqqmaARpday/tcBAg/gC{3*saARpdayO]6wO2Z\u0026zGEApbUYy}zxIUZzEEf?wfsfVB7GDmiV@cTay]4}x(mG)ayPslz/fbeze0*5x(v(irw4i5ay]zby*?v9asHf1C4CLl", "ln": 92309 }, { "b": "w/#hewGV5jw]@l9A+c\u003cCs-nB9zddYjB-Rapx(\u003cXZpdXhWmn^2-p/G\u003eKawU(Tr7GqOawU)3lRG]\u003es4M7Vavw}5qBJ@LaveW{aw+%im]zSEavPgapF$azaxhbVr7GC2moAITpe?O?G0#\u003e2wPRTbwN(]JvqYH:x\u003c\u003e)4mSirSwPF#hwO\u003e)/AV/pvavG^W", "ln": 92758 }, { "b": "aw2r}nKM0xr6.T2efEqQpe:OUryGUZnKl33awU(xvpJ!UB8@ExzFT38wGUP0y?mVgx(k4(yK5r*x)a5gvqYP#wO#m3C{4ixwGT=Xw[+:^ax0b^ze0)2ax8\u0026(C4\u003eC$aA}KwxM53nayX[@zF782B8bt$aARJAA+e*1By/FnD2E?C3tar%z95\u003eGzE:8)A+5:4ayPd#aAIj8y?$k7z/fVhzGPIkw]zYjvixJ2A+PD5aA7\u003cmf^7:Mvr9$yl3ak\u003e", "ln": 94878 }, { "b": "r9ptkpF@r3pfwYck$%Tnmn\u003er{qB%!UpdDB5rA78pmJ+G8aw$T4k#ZovaxhbVr7GOVaveH}mmx{tpe\u0026uiqvl\u0026OayPekazkziwO@Sjx(dAlawW2*wPw[/vqYH^wO(0@BrBO8wPz\u0026mvrb{4vqG:#Cv+qcBz\u0026psvqZi@y\u00261wtwO#Q3AV/pvwmY!5ay]hb", "ln": 95813 } ], "depth": 1, "facts": { "imp": [ [ "ole32", "CoCreateInstance" ], [ "ole32", "CLSIDFromString" ], [ "ole32", "CoInitialize" ], [ "ole32", "CoUninitialize" ], [ "oleaut32", "SysAllocString" ], [ "wininet", "DeleteUrlCacheEntry" ], [ "wininet", "FindFirstUrlCacheEntryA" ], [ "wininet", "FindNextUrlCacheEntryA" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "ExpandEnvironmentStringsA" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetComputerNameA" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetExitCodeThread" ], [ "kernel32", "GetFileSize" ], [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetSystemDirectoryA" ], [ "kernel32", "GetTempPathA" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "GetVersion" ], [ "kernel32", "GetVersionExA" ], [ "kernel32", "GetWindowsDirectoryA" ], [ "kernel32", "GlobalMemoryStatus" ], [ "kernel32", "CopyFileA" ], [ "kernel32", "InterlockedIncrement" ], [ "kernel32", "IsBadReadPtr" ], [ "kernel32", "IsBadWritePtr" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "LocalAlloc" ], [ "kernel32", "LocalFree" ], [ "kernel32", "OpenMutexA" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "ReadFile" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "CreateMutexA" ], [ "kernel32", "Sleep" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "CreateProcessA" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "WinExec" ], [ "kernel32", "WriteFile" ], [ "kernel32", "lstrlenA" ], [ "kernel32", "lstrlenW" ], [ "kernel32", "CreateThread" ], [ "kernel32", "DeleteFileA" ], [ "user32", "GetWindowTextA" ], [ "user32", "GetWindowRect" ], [ "user32", "FindWindowA" ], [ "user32", "GetWindow" ], [ "user32", "GetClassNameA" ], [ "user32", "SetFocus" ], [ "user32", "GetForegroundWindow" ], [ "user32", "LoadCursorA" ], [ "user32", "LoadIconA" ], [ "user32", "SetTimer" ], [ "user32", "RegisterClassA" ], [ "user32", "MessageBoxA" ], [ "user32", "GetMessageA" ], [ "user32", "GetWindowLongA" ], [ "user32", "SetWindowLongA" ], [ "user32", "CreateDesktopA" ], [ "user32", "SetThreadDesktop" ], [ "user32", "GetThreadDesktop" ], [ "user32", "TranslateMessage" ], [ "user32", "DispatchMessageA" ], [ "user32", "SendMessageA" ], [ "user32", "PostQuitMessage" ], [ "user32", "ShowWindow" ], [ "user32", "CreateWindowExA" ], [ "user32", "DestroyWindow" ], [ "user32", "MoveWindow" ], [ "user32", "DefWindowProcA" ], [ "user32", "CallWindowProcA" ], [ "gdi32", "GetStockObject" ], [ "gdi32", "SetBkColor" ], [ "gdi32", "SetTextColor" ], [ "gdi32", "CreateBrushIndirect" ], [ "gdi32", "CreateFontA" ], [ "advapi32", "GetUserNameA" ], [ "advapi32", "RegCreateKeyExA" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "RegOpenKeyExA" ], [ "advapi32", "RegQueryValueExA" ], [ "advapi32", "RegSetValueExA" ], [ "advapi32", "GetSecurityInfo" ], [ "advapi32", "SetSecurityInfo" ], [ "advapi32", "SetEntriesInAclA" ], [ "crtdll", "GetMainArgs" ], [ "crtdll", "sleep" ], [ "crtdll", "stricmp" ], [ "crtdll", "atoi" ], [ "crtdll", "exit" ], [ "crtdll", "memcpy" ], [ "crtdll", "memset" ], [ "crtdll", "printf" ], [ "crtdll", "raise" ], [ "crtdll", "rand" ], [ "crtdll", "signal" ], [ "crtdll", "sprintf" ], [ "crtdll", "srand" ], [ "crtdll", "sscanf" ], [ "crtdll", "strcat" ], [ "crtdll", "strchr" ], [ "crtdll", "strncmp" ], [ "crtdll", "vsprintf" ], [ "msvcrt", "wgetcwd" ] ], "sec": [ [ ".text", 1024, 33116, 7.14, "rwx" ], [ ".bss", 0, 0, 0.0, "rw-" ], [ ".data", 34304, 13304, 5.97, "rw-" ], [ ".idata", 47616, 3748, 4.91, "rw-" ], [ ".gfcd", 52224, 512, 2.33, "r-x" ], [ ".l1", 52736, 4608, 5.29, "rwx" ] ], "metrics": { "pe": { "checksum": 0, "timestamp": 2102744387, "image_size": 212992, "has_overlay": 1, "overlay_end": 104137, "headers_size": 1024, "overlay_size": 46793, "checksum_valid": 0, "file_alignment": 512, "overlay_offset": 57344, "dos_stub_zeroed": 1, "overlay_padding": 47825, "checksum_stripped": 1, "computed_checksum": 156572, "dos_stub_modified": 1, "headers_size_ratio": 0.01, "prose_section_count": 0, "bss_like_section_count": 0, "section_overflow_count": 0, "misaligned_section_count": 0, "entry_in_nonstandard_section": 1, "declared_data_directory_count": 2, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 104137, "entropy": 6.06 }, "binary": { "is_pie": 0, "has_overlay": 1, "code_entropy": 6.85, "data_entropy": 5.73, "overlay_size": 46793, "string_count": 517, "overlay_ratio": 0.45, "overlay_entropy": 3.67, "entropy_variance": 2.53, "avg_string_length": 57.42, "max_string_length": 979, "peak_region_bytes": 15360, "code_to_data_ratio": 0.69, "peak_region_entropy": 7.26, "string_length_stddev": 73.1, "largest_section_ratio": 0.32, "sentence_string_count": 275, "sentence_string_ratio": 0.53, "high_entropy_string_count": 0 }, "imports": { "count": 113 }, "strings": { "truncated": 0, "retained_count": 517, "extracted_count": 517 }, "sections": { "count": 6, "code_size": 38236, "entropy_max": 7.14, "entropy_mean": 5.13, "name_entropy": 3.44, "writable_count": 5, "executable_count": 3, "nonstandard_count": 2, "executable_writable_count": 2 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.binary_as_unknown": 1 }, "dependencies": { "count": 9 } } }, "id": 1, "mol": "K(Mc)O₇(C₄Ca₂P₃As₂Er₄Al₂Dy)H₇(Cm₃DbF₃Os₈Po₅TiU)Md₄(Bi₇He₂PtSi)Th", "path": "Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_269_1.vir!!embedded:pe@0x12e00", "pid": 0, "risk": 675, "sha": "9dbf942417ecd0f5d9e44d21a1cc2afa73a82c4ab710b7c8122d018826b561be", "size": 104137, "traits": [ { "id": "metadata/binary/header/malformed::pe-dos-stub-modified", "conf": 0.9, "crit": 3, "desc": "PE DOS stub region modified" }, { "id": "metadata/binary/header/malformed::pe-dos-stub-zeroed", "conf": 0.9, "crit": 3, "desc": "PE DOS stub region zeroed" }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/layout/overlay::overlay-over-30pct", "conf": 0.9, "crit": 3, "desc": "PE overlay exceeds thirty percent" }, { "id": "metadata/binary/section/permission::pe-multiple-executable-writable-sections", "conf": 0.95, "crit": 3, "desc": "Two or more executable writable sections" }, { "id": "metadata/binary/symbols/imports::getstockobject-import", "conf": 0.98, "crit": 3, "desc": "GetStockObject import symbol", "spans": [ [ 205828, 14 ] ] }, { "id": "metadata/hardening/mitigation::post-2020-pe", "conf": 1.0, "crit": 2, "desc": "PE built after 2020-01-01" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 85477, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 76344, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 92806, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 86665, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 86681, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 76088, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 44552, 0 ] ] }, { "id": "micro-behaviors/communications/http/client/wininet::delete-url-cache-entry", "conf": 0.9, "crit": 3, "desc": "Deletes a WinInet URL cache entry", "spans": [ [ 205516, 19 ] ] }, { "id": "micro-behaviors/communications/http/client/wininet::find-first-url-cache-entry", "conf": 0.9, "crit": 3, "desc": "Begin WinInet URL cache enumeration", "spans": [ [ 205520, 23 ] ] }, { "id": "micro-behaviors/communications/http/client/wininet::find-next-url-cache-entry", "conf": 0.9, "crit": 3, "desc": "Continue WinInet URL cache enumeration", "spans": [ [ 205524, 22 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::xor-decoded-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 4, "desc": "XOR-decoded HTTP URL", "spans": [ [ 44618, 57 ] ] }, { "id": "micro-behaviors/data/embedded/payload/section::large-data-section", "conf": 0.75, "crit": 3, "desc": "Large .data section in PE binary", "spans": [ [ 34304, 34 ] ] }, { "id": "micro-behaviors/fs/delete/file/library::deletefile-a", "conf": 0.66, "crit": 3, "desc": "Delete files (Windows API ANSI)", "spans": [ [ 205704, 11 ] ] }, { "id": "micro-behaviors/fs/file/copy::copyfile-a", "conf": 0.66, "crit": 3, "desc": "Copy files (Windows API ANSI)", "spans": [ [ 205608, 9 ] ] }, { "id": "micro-behaviors/fs/file/handle::set-file-pointer", "conf": 0.9, "crit": 2, "desc": "Set file position", "spans": [ [ 205652, 0 ] ] }, { "id": "micro-behaviors/fs/file/open::file-create-win", "conf": 0.9, "crit": 2, "desc": "Windows file creation/open API", "spans": [ [ 205640, 0 ] ] }, { "id": "micro-behaviors/fs/file/stat::get-file-size", "conf": 0.65, "crit": 2, "desc": "Get file size", "spans": [ [ 205560, 0 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::read-file", "conf": 0.9, "crit": 2, "desc": "Read data from file handle", "spans": [ [ 205644, 0 ] ] }, { "id": "micro-behaviors/fs/temp/directory::get-temp-path-import", "conf": 0.88, "crit": 3, "desc": "Imports GetTempPath temp-directory API", "spans": [ [ 205584, 12 ] ] }, { "id": "micro-behaviors/fs/write/file/handle::write-file", "conf": 0.9, "crit": 2, "desc": "Write data to file handle", "spans": [ [ 205688, 0 ] ] }, { "id": "micro-behaviors/os/com/registration::threadingmodel-word", "conf": 0.9, "crit": 3, "desc": "References the COM ThreadingModel registry value", "spans": [ [ 47053, 14 ] ] }, { "id": "micro-behaviors/os/module/load::get-module-filename-ansi", "conf": 0.7, "crit": 2, "desc": "Get module file path (ANSI)", "spans": [ [ 205564, 0 ] ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-ansi", "conf": 0.7, "crit": 3, "desc": "Get module handle ANSI", "spans": [ [ 205568, 16 ] ] }, { "id": "micro-behaviors/os/msdos/internal::check-command-com", "conf": 0.8, "crit": 3, "desc": "Check for COMMAND.COM execution (COMM)", "spans": [ [ 45324, 11 ] ] }, { "id": "micro-behaviors/os/random/crypto::rand-symbol", "conf": 0.3, "crit": 2, "desc": "Random number generation (rand)", "spans": [ [ 205928, 0 ] ] }, { "id": "micro-behaviors/os/random/crypto::srand-symbol", "conf": 0.4, "crit": 2, "desc": "Random seed initialization (srand)", "spans": [ [ 205940, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::internet-settings-key", "atk": "T1112", "conf": 0.85, "crit": 3, "desc": "Internet Settings registry key access", "spans": [ [ 46410, 59 ] ] }, { "id": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Open registry key via import symbol ANSI", "spans": [ [ 205864, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "atk": "T1112", "conf": 0.85, "crit": 2, "desc": "Query registry value via import symbol", "spans": [ [ 205868, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "atk": "T1112", "conf": 0.85, "crit": 2, "desc": "Set registry value via WinAPI ANSI", "spans": [ [ 205872, 0 ] ] }, { "id": "micro-behaviors/os/security/descriptor::get-security-info", "conf": 0.9, "crit": 3, "desc": "Query object security descriptor import", "spans": [ [ 205876, 15 ] ] }, { "id": "micro-behaviors/os/security/descriptor::set-entries-in-acl", "conf": 0.9, "crit": 3, "desc": "Builds Windows ACL entries", "spans": [ [ 205884, 16 ] ] }, { "id": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "conf": 0.9, "crit": 2, "desc": "Get Windows installation directory", "spans": [ [ 205600, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/network::hyperv-adapter-name", "conf": 0.9, "crit": 3, "desc": "Hyper-V virtual adapter name", "spans": [ [ 88130, 7 ] ] }, { "id": "micro-behaviors/process/create/exec::winexec", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "WinExec command execution API", "spans": [ [ 205684, 7 ] ] }, { "id": "micro-behaviors/process/create/spawn::create-process-a", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "Create process (ANSI)", "spans": [ [ 205672, 14 ] ] }, { "id": "micro-behaviors/process/sync/mutex::create-mutex", "mbc": "C0042", "conf": 0.9, "crit": 3, "desc": "CreateMutex API call", "spans": [ [ 205656, 12 ] ] }, { "id": "micro-behaviors/process/sync/mutex::open-mutex", "mbc": "C0042", "conf": 0.85, "crit": 3, "desc": "OpenMutex API call", "spans": [ [ 205636, 10 ] ] }, { "id": "micro-behaviors/process/terminate/kill::exit-process", "conf": 0.9, "crit": 2, "desc": "Exit current process", "spans": [ [ 205532, 0 ] ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process", "mbc": "C0018", "conf": 0.95, "crit": 3, "desc": "Process termination via TerminateProcess", "spans": [ [ 205664, 16 ] ] }, { "id": "micro-behaviors/time/query::get-tick-count", "conf": 0.9, "crit": 3, "desc": "Get tick count", "spans": [ [ 205588, 12 ] ] }, { "id": "micro-behaviors/ui/window/station::create-desktop-a", "conf": 0.8, "crit": 3, "desc": "Create a new Windows desktop object", "spans": [ [ 205772, 14 ] ] }, { "id": "micro-behaviors/ui/window/station::set-thread-desktop-import", "conf": 0.9, "crit": 3, "desc": "Attach thread to desktop", "spans": [ [ 50126, 16 ] ] }, { "id": "objectives/anti-analysis/debugger-detect/check::bad-read-ptr", "atk": "T1622", "mbc": "B0001", "conf": 0.82, "crit": 3, "desc": "IsBadReadPtr anti-debug style probe", "spans": [ [ 205616, 12 ] ] }, { "id": "objectives/anti-analysis/debugger-detect/check::bad-write-ptr", "atk": "T1622", "mbc": "B0001", "conf": 0.82, "crit": 3, "desc": "IsBadWritePtr anti-debug style probe", "spans": [ [ 205620, 13 ] ] }, { "id": "objectives/anti-analysis/vm-detect/vendor::vendor-hyperv-dash--rx-2", "atk": "T1497.001", "conf": 0.6, "crit": 3, "desc": "Matches '(hyper-v(detect hypervisor)'", "spans": [ [ 88088, 49 ] ] }, { "id": "objectives/command-and-control/dropper/staging-xor::dotnet-encoded-http-url", "atk": "T1027", "conf": 0.85, "crit": 3, "desc": ".NET assembly decodes an embedded HTTP(S) URL", "spans": [ [ 44618, 57 ] ] }, { "id": "objectives/credential-access/financial/credit-card/card-number::pe-card-brand-choice", "atk": "T1056.002", "conf": 0.9, "crit": 4, "desc": "Visa or MasterCard phishing choice", "spans": [ [ 45143, 37 ] ] }, { "id": "objectives/credential-access/financial/credit-card/keyword::pe-atm-pin-prompt", "atk": "T1056.002", "conf": 0.95, "crit": 4, "desc": "ATM PIN phishing prompt", "spans": [ [ 44821, 26 ] ] }, { "id": "objectives/credential-access/financial/credit-card/keyword::pe-auth-failed-banking-lure", "atk": "T1056.002", "conf": 0.9, "crit": 4, "desc": "Authorization failure banking lure", "spans": [ [ 45446, 74 ] ] }, { "id": "objectives/credential-access/financial/credit-card/keyword::pe-card-number-prompt", "atk": "T1056.002", "conf": 0.94, "crit": 4, "desc": "Card number phishing prompt", "spans": [ [ 45074, 30 ] ] }, { "id": "objectives/credential-access/financial/credit-card/keyword::pe-cvv2-prompt", "atk": "T1056.002", "conf": 0.95, "crit": 4, "desc": "CVV2 phishing prompt", "spans": [ [ 44911, 54 ] ] }, { "id": "objectives/discovery/system/fingerprint/info::native-host-runtime-fields", "atk": "T1082", "conf": 0.85, "crit": 3, "desc": "Native computer identity field", "spans": [ [ 76833, 8 ] ] }, { "id": "objectives/evasion/masquerade/process/name::internet-explorer-name", "atk": "T1036.005", "mbc": "F0004", "conf": 0.82, "crit": 3, "desc": "Internet Explorer executable name", "spans": [ [ 46241, 12 ] ] }, { "id": "objectives/persistence/login/registry/com-hijack::clsid-guid-string", "atk": "T1546.015", "conf": 0.86, "crit": 3, "desc": "Embedded CLSID persistence GUID", "spans": [ [ 47103, 38 ] ] }, { "id": "objectives/persistence/login/registry/com-hijack::web-event-logger-name", "atk": "T1546.015", "conf": 0.92, "crit": 3, "desc": "Web Event Logger autoload name", "spans": [ [ 46956, 16 ] ] }, { "id": "well-known/malware/backdoor/padodor::berbew-receiver-marker", "conf": 0.99, "crit": 3, "desc": "Berbew X-okRecv11 protocol marker", "spans": [ [ 46186, 10 ] ] }, { "id": "well-known/malware/backdoor/padodor::berbew-vvpupkin-banner", "conf": 0.99, "crit": 4, "desc": "Berbew V. V. Pupkin author banner", "spans": [ [ 44552, 65 ] ] }, { "id": "metadata/binary/layout/overlay::low-overlay-entropy", "conf": 0.9, "crit": 3, "desc": "Low-entropy data follows mapped binary image", "spans": [ [ 57344, 46793 ] ] }, { "id": "metadata/binary/layout/overlay::overlay-dominates-third", "conf": 0.92, "crit": 3, "desc": "Overlay exceeds one-third" }, { "id": "metadata/binary/layout/ratio::overlay-over-35pct", "conf": 0.94, "crit": 3, "desc": "PE overlay exceeds thirty-five percent" }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/section/label::multiple-nonstandard-section-names", "conf": 0.9, "crit": 3, "desc": "Multiple nonstandard PE section names" }, { "id": "metadata/binary/section/permission::writable-text-section", "conf": 0.92, "crit": 4, "desc": "Writable .text section", "spans": [ [ 1024, 46 ] ] }, { "id": "metadata/hardening/memory::wx-section", "conf": 1.0, "crit": 3, "desc": "Writable and exe section (W^X violation)", "spans": [ [ 1024, 31 ], [ 52736, 28 ] ] }, { "id": "metadata/hardening/mitigation::no-aslr-bit", "conf": 1.0, "crit": 2, "desc": "ASLR bit not set in DLL Characteristics" }, { "id": "metadata/lang/encoded/xor::shell-interpreter-cmd", "conf": 0.95, "crit": 3, "desc": "cmd interpreter marker encoded", "spans": [ [ 45351, 10 ], [ 45362, 10 ] ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 3, "desc": "PE lacks signature record" }, { "id": "micro-behaviors/communications/http/client/wininet::wininet-dll-name-reference", "conf": 0.72, "crit": 3, "desc": "WinInet DLL name reference", "spans": [ [ 50856, 11 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 44659, 16 ], [ 75492, 18 ], [ 92373, 22 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL", "spans": [ [ 44659, 16 ], [ 75492, 28 ], [ 92373, 36 ] ] }, { "id": "micro-behaviors/dylib/load/runtime::load-library-a", "atk": "T1574.002", "conf": 0.95, "crit": 2, "desc": "Dynamic library loading via LoadLibraryA", "spans": [ [ 205624, 0 ] ] }, { "id": "micro-behaviors/fs/path/application/executable::browser-apps-iexplore", "conf": 0.5, "crit": 3, "desc": "Browser app iexplore", "spans": [ [ 46241, 8 ] ] }, { "id": "micro-behaviors/os/module/load::get-proc-address-import", "conf": 0.9, "crit": 3, "desc": "Resolve exports with GetProcAddress", "spans": [ [ 205576, 14 ] ] }, { "id": "micro-behaviors/os/registry/access::reg-set-value-ex-text", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Set registry value API name in text", "spans": [ [ 50530, 0 ] ] }, { "id": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "atk": "T1112", "conf": 0.88, "crit": 3, "desc": "Create registry key ANSI", "spans": [ [ 50458, 15 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "atk": "T1082", "conf": 0.9, "crit": 3, "desc": "Query computer/host name", "spans": [ [ 205544, 16 ] ] }, { "id": "micro-behaviors/os/sysinfo/hostname::get-user-name", "atk": "T1033", "conf": 0.9, "crit": 3, "desc": "Query current username", "spans": [ [ 205852, 12 ] ] }, { "id": "micro-behaviors/process/create/exec::cmd-exe-reference", "conf": 0.8, "crit": 3, "desc": "References Windows cmd.exe interpreter", "spans": [ [ 45353, 8 ] ] }, { "id": "micro-behaviors/process/create/thread::create-thread", "atk": "T1129", "conf": 0.95, "crit": 3, "desc": "Create thread in current process", "spans": [ [ 205700, 12 ] ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process-name-text", "mbc": "C0018", "conf": 0.92, "crit": 3, "desc": "TerminateProcess API name in binary strings", "spans": [ [ 49674, 16 ] ] }, { "id": "micro-behaviors/ui/window/control::create-window-ex", "conf": 0.85, "crit": 2, "desc": "Create window (extended)", "spans": [ [ 205804, 0 ] ] }, { "id": "objectives/anti-analysis/vm-detect/vendor::vendor-hyperv-dash--rx-3", "atk": "T1497.001", "conf": 0.6, "crit": 3, "desc": "Matches 'virtual)hyper-v) hypervisor'", "spans": [ [ 88088, 49 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::many-wx-sections", "atk": "T1045", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Multiple W+X sections (packer pattern)" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "atk": "T1055", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Writable and executable sections" }, { "id": "objectives/anti-static/obfuscation/encoding/content::encoded-cmd-exe", "atk": "T1059.003", "conf": 0.85, "crit": 4, "desc": "Encoded cmd.exe reference", "spans": [ [ 45351, 10 ] ] }, { "id": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "atk": "T1070.006", "conf": 0.78, "crit": 3, "desc": "PE header timestamp after 2030" }, { "id": "objectives/persistence/login/registry/com-hijack::clsid-inprocserver32-format", "atk": "T1546.015", "conf": 0.92, "crit": 3, "desc": "References CLSID InProcServer32 path only", "spans": [ [ 47069, 23 ] ] }, { "id": "objectives/persistence/login/registry/com-hijack::shellserviceobjectdelayload-key", "atk": "T1546.015", "conf": 0.94, "crit": 3, "desc": "ShellServiceObjectDelayLoad registry path", "spans": [ [ 46973, 69 ] ] }, { "id": "objectives/persistence/system/registry/com-hijack::clsid-registry-path", "conf": 0.88, "crit": 3, "desc": "References CLSID registry path only", "spans": [ [ 47069, 8 ] ] }, { "id": "objectives/persistence/system/registry/com-hijack::inprocserver32-write", "atk": "T1546.015", "conf": 0.82, "crit": 3, "desc": "References CLSID InProcServer32 path only", "spans": [ [ 47069, 23 ] ] }, { "id": "metadata/hardening/mitigation::modern-pe-without-aslr", "conf": 1.0, "crit": 3, "desc": "Modern PE without ASLR enabled", "uses": [ 6, 72 ] }, { "id": "metadata/lang/encoded/xor::shell-interpreter-encoded", "conf": 0.9, "crit": 3, "desc": "Encoded shell interpreter (xor)", "uses": [ 73 ], "spans": [ [ 45351, 10 ], [ 45362, 10 ] ] }, { "id": "micro-behaviors/communications/http/client/wininet::url-cache-enumeration", "conf": 0.91, "crit": 3, "desc": "WinInet URL cache enumeration workflow", "uses": [ 15, 16 ], "spans": [ [ 205520, 23 ], [ 205524, 22 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-create-key-api", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry key creation API", "uses": [ 82 ], "spans": [ [ 50458, 15 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-open-key-api", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Registry key open API", "uses": [ 34 ], "spans": [ [ 205864, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-query-value-api", "atk": "T1112", "conf": 0.88, "crit": 2, "desc": "Registry value query API", "uses": [ 35 ], "spans": [ [ 205868, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-set-value-api", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry value write API", "uses": [ 36 ], "spans": [ [ 205872, 14 ] ] }, { "id": "micro-behaviors/process/sync/mutex::mutex-api", "mbc": "C0042", "conf": 0.85, "crit": 2, "desc": "Mutex creation/access API", "uses": [ 43, 44 ], "spans": [ [ 205636, 0 ] ] }, { "id": "objectives/credential-access/financial/credit-card/keyword::pe-card-verification-phish", "atk": "T1056.002", "conf": 0.98, "crit": 5, "desc": "Card-verification phishing prompt set", "uses": [ 54, 55, 56, 57, 58 ], "spans": [ [ 44821, 26 ], [ 44911, 54 ], [ 45074, 30 ], [ 45143, 37 ], [ 45446, 74 ] ] }, { "id": "objectives/persistence/login/registry/com-hijack::shellservice-com-hijack", "atk": "T1546.015", "conf": 0.97, "crit": 5, "desc": "Shell service COM hijack persistence", "uses": [ 36, 61, 62, 82, 94, 95 ], "spans": [ [ 46956, 16 ], [ 46973, 69 ], [ 47069, 23 ], [ 47103, 38 ], [ 50458, 15 ], [ 205872, 14 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-read-api-chain", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Registry key open and query chain", "uses": [ 102, 103 ], "spans": [ [ 205864, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-write-api-chain", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Registry key and value write chain", "uses": [ 101, 102, 104 ], "spans": [ [ 50458, 0 ], [ 205864, 0 ] ] }, { "id": "well-known/malware/backdoor/padodor::berbew-karton-card-phishing-backdoor", "atk": "T1056.002", "mbc": "B0030", "conf": 0.999, "crit": 5, "desc": "Berbew/Karton card-phishing backdoor identity", "uses": [ 63, 64, 106 ], "spans": [ [ 44552, 65 ], [ 44821, 26 ], [ 44911, 54 ], [ 45074, 30 ], [ 45143, 37 ], [ 45446, 74 ], [ 46186, 10 ] ] }, { "id": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "atk": "T1112", "conf": 0.92, "crit": 3, "desc": "Registry open create and write APIs", "uses": [ 33, 34, 35, 36, 81, 82, 101, 102, 103, 104, 108, 109 ], "spans": [ [ 46410, 59 ], [ 50458, 15 ], [ 50530, 14 ], [ 205864, 13 ], [ 205868, 16 ], [ 205872, 14 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 42 ], "spans": [ [ 205672, 14 ] ] }, { "id": "objectives/anti-analysis/vm-detect/vendor::vendor-hyperv-dash", "atk": "T1497.001", "conf": 0.6, "crit": 3, "desc": "Hyper-V hypervisor vendor string", "uses": [ 52, 89 ], "spans": [ [ 88088, 49 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain-ansi", "atk": "T1027.009", "mbc": "B0032", "conf": 0.8, "crit": 1, "desc": "ANSI module-path and file-I/O import chain", "uses": [ 21, 22, 23, 24, 28 ], "spans": [ [ 205564, 0 ] ] }, { "id": "objectives/command-and-control/dropper/execution/copy-stage::unsigned-copyfile-exec", "atk": "T1105,T1059,T1112", "conf": 0.8, "crit": 4, "desc": "Unsigned file copier creates a process", "uses": [ 20, 42 ], "spans": [ [ 205608, 9 ], [ 205672, 14 ] ] }, { "id": "objectives/command-and-control/dropper/execution/winexec::unsigned-winexec-copyfile", "atk": "T1105,T1059,T1489", "conf": 0.93, "crit": 5, "desc": "Unsigned WinExec payload copies a file", "uses": [ 20, 41 ], "spans": [ [ 205608, 9 ], [ 205684, 7 ] ] }, { "id": "objectives/command-and-control/dropper/execution/winexec::unsigned-winexec-deletefile", "atk": "T1105,T1059,T1489", "conf": 0.93, "crit": 5, "desc": "Unsigned WinExec payload deletes a file", "uses": [ 19, 41 ], "spans": [ [ 205684, 7 ], [ 205704, 11 ] ] }, { "id": "objectives/command-and-control/dropper/execution/winexec::unsigned-winexec-terminate", "atk": "T1105,T1059,T1489", "conf": 0.93, "crit": 5, "desc": "Unsigned WinExec payload kills processes by name", "uses": [ 41, 87 ], "spans": [ [ 49674, 16 ], [ 205684, 7 ] ] }, { "id": "objectives/command-and-control/dropper/execution/wininet-stage::wininet-cache-wipe-copy", "atk": "T1105,T1070.004", "conf": 0.94, "crit": 5, "desc": "WinInet cache wipe then copies a file", "uses": [ 14, 20 ], "spans": [ [ 205516, 19 ], [ 205608, 9 ] ] }, { "id": "objectives/command-and-control/dropper/execution/wininet-stage::wininet-cache-wipe-exec", "atk": "T1105,T1070.004", "conf": 0.94, "crit": 5, "desc": "WinInet cache wipe then creates a process", "uses": [ 14, 42 ], "spans": [ [ 205516, 19 ], [ 205672, 14 ] ] }, { "id": "objectives/evasion/indicator-removal/history::selective-url-cache-record-removal", "atk": "T1070.004", "mbc": "E1070", "conf": 0.93, "crit": 4, "desc": "Enumerates and deletes URL cache records", "uses": [ 14, 100 ], "spans": [ [ 205516, 19 ], [ 205520, 23 ], [ 205524, 22 ] ] }, { "id": "objectives/evasion/masquerade/binary::detached-signature-overlay", "atk": "T1036.001", "conf": 0.95, "crit": 4, "desc": "Detached or malformed signature in overlay", "uses": [ 1 ] }, { "id": "objectives/persistence/login/self-install/copy::windir-copy-winexec-dropper", "atk": "T1547.001", "conf": 0.92, "crit": 3, "desc": "Drop into Windows directory and WinExec", "uses": [ 19, 20, 22, 26, 39, 41 ], "spans": [ [ 205600, 20 ], [ 205608, 9 ], [ 205640, 11 ], [ 205684, 7 ], [ 205688, 9 ], [ 205704, 11 ] ] }, { "id": "objectives/anti-analysis/vm-detect/vendor::vendor-hyperv", "atk": "T1497.001", "conf": 0.7, "crit": 3, "desc": "Hyper-V hypervisor vendor string", "uses": [ 113 ], "spans": [ [ 88088, 49 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "atk": "T1027.009", "mbc": "B0032", "conf": 0.8, "crit": 1, "desc": "Module-path and file-I/O import chain", "uses": [ 114 ], "spans": [ [ 205564, 0 ] ] }, { "id": "objectives/command-and-control/dropper/execution/copy-stage::unsigned-copyfile-registry", "atk": "T1105,T1059,T1112", "conf": 0.8, "crit": 4, "desc": "Unsigned file copier writes registry keys", "uses": [ 20, 111 ], "spans": [ [ 46410, 59 ], [ 50458, 15 ], [ 50530, 14 ], [ 205608, 9 ], [ 205864, 13 ], [ 205868, 16 ], [ 205872, 14 ] ] }, { "id": "objectives/command-and-control/dropper/execution/copy-stage::unsigned-exec-registry", "atk": "T1105,T1059,T1112", "conf": 0.8, "crit": 4, "desc": "Unsigned process creator writes registry keys", "uses": [ 42, 111 ], "spans": [ [ 46410, 59 ], [ 50458, 15 ], [ 50530, 14 ], [ 205672, 14 ], [ 205864, 13 ], [ 205868, 16 ], [ 205872, 14 ] ] }, { "id": "objectives/command-and-control/dropper/execution/wininet-stage::wininet-cache-wipe-registry", "atk": "T1105,T1070.004", "conf": 0.94, "crit": 5, "desc": "WinInet cache wipe then writes registry keys", "uses": [ 14, 111 ], "spans": [ [ 46410, 59 ], [ 50458, 15 ], [ 50530, 14 ], [ 205516, 19 ], [ 205864, 13 ], [ 205868, 16 ], [ 205872, 14 ] ] }, { "id": "objectives/persistence/login/self-install/copy::windir-dropper-registry-persist", "atk": "T1547.001", "conf": 0.95, "crit": 4, "desc": "Windows-directory dropper with registry persistence", "uses": [ 111, 123 ], "spans": [ [ 46410, 59 ], [ 50458, 15 ], [ 50530, 14 ], [ 205600, 20 ], [ 205608, 9 ], [ 205640, 11 ], [ 205684, 7 ], [ 205688, 9 ] ] }, { "id": "third_party/SigBase/SUSP/Imphash/Mar23", "conf": 0.9, "crit": 3, "desc": "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)" } ], "type": "pe" } ], "rev": "e86a6", "v": "8" } }