{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.2942346, "class": 0 }, { "m": "az/pe", "prob": 0.0041841003, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T13:33:25Z" }, "path": "c25b3a3d7779cb89772454a756ce48ed3744cf233564d309b6f8d19bd8e26fa4.dll", "raw": { "v": "5", "fs": [ { "f": "Md₂(Bi₂Si)", "x": 7, "ff": { "i": [ [ "msvcrt", "p___mb_cur_max" ], [ "msvcrt", "p__iob" ], [ "msvcrt", "amsg_exit" ], [ "msvcrt", "errno" ], [ "msvcrt", "fileno" ], [ "msvcrt", "initterm" ], [ "msvcrt", "lock" ], [ "msvcrt", "setmode" ], [ "msvcrt", "unlock" ], [ "msvcrt", "abort" ], [ "msvcrt", "atoi" ], [ "msvcrt", "calloc" ], [ "msvcrt", "exit" ], [ "msvcrt", "fflush" ], [ "msvcrt", "fputc" ], [ "msvcrt", "free" ], [ "msvcrt", "fwrite" ], [ "msvcrt", "localeconv" ], [ "msvcrt", "malloc" ], [ "msvcrt", "memchr" ], [ "msvcrt", "memcpy" ], [ "msvcrt", "memset" ], [ "msvcrt", "realloc" ], [ "msvcrt", "setlocale" ], [ "msvcrt", "signal" ], [ "msvcrt", "strchr" ], [ "msvcrt", "strerror" ], [ "msvcrt", "strlen" ], [ "msvcrt", "strncmp" ], [ "msvcrt", "vfprintf" ], [ "msvcrt", "wcslen" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "GetLastError" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "IsDBCSLeadByteEx" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "Sleep" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "VirtualFree" ], [ "kernel32", "VirtualProtect" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "WideCharToMultiByte" ] ], "m": { "pe": { "has_cfg": 0.0, "checksum": 0.0, "has_manifest": 1.0, "checksum_valid": 0.0, "resource_count": 1.0, "checksum_stripped": 1.0, "computed_checksum": 112450.0, "tls_callback_count": 2.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 24.0, "base_relocation_entry_count": 1539.0 }, "file": { "size": 110872.0, "entropy": 6.39, "size_bytes": 110872.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 6.51, "data_entropy": 0.23, "overlay_size": 6424.0, "string_count": 619.0, "overlay_ratio": 0.06, "overlay_entropy": 7.32, "entropy_variance": 5.1, "avg_string_length": 10.81, "max_string_length": 456.0, "code_to_data_ratio": 0.93, "string_length_stddev": 22.3, "largest_section_ratio": 0.76, "sentence_string_count": 41.0, "sentence_string_ratio": 0.07, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 48.0 }, "sections": { "count": 6.0, "code_size": 83968.0, "entropy_max": 6.51, "entropy_mean": 3.98, "name_entropy": 3.24, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode.$" ], [ 368, "u8", ".text" ], [ 447, "u8", "@.data" ], [ 488, "u8", ".tls" ], [ 528, "u8", ".rsrc" ], [ 567, "u8", "@.reloc" ], [ 1040, "u8", "USWV" ], [ 1810, "u8", "fffff." ], [ 4625, "u8", "ffffff." ], [ 6557, "u8", ";l$$~*ffff." ], [ 7712, "u8", "USWVP" ], [ 11584, "u8", "SWVP" ], [ 14832, "u8", "USWVPkA" ], [ 15397, "u8", "/ not" ], [ 16689, "u8", "uLffff." ], [ 22818, "u8", "inde" ], [ 27134, "u8", "gffffffff." ], [ 27736, "u8", "HKPS" ], [ 28914, "u8", "tXSWV" ], [ 30192, "u8", "Vhpn" ], [ 36384, "u8", "uBSWP" ], [ 39621, "u8", "jih0l" ], [ 41024, "u8", "USWVP1" ], [ 41155, "u8", "UQSWj" ], [ 41440, "u8", "SWV1" ], [ 43103, "u8", "PQSU" ], [ 43544, "u8", "PQVU" ], [ 43979, "u8", "PQSV" ], [ 49254, "u8", "D$ HPS" ], [ 55144, "u8", "Mpgx" ], [ 55163, "u8", "uZFpR9" ], [ 61476, "u8", "SQUP" ], [ 63596, "u8", "9MZuc" ], [ 67287, "u8", "C F9" ], [ 67575, "u8", "G E9" ], [ 70993, "u8", "gfffff." ], [ 71474, "u8", "Bffff." ], [ 74702, "u8", "SUWS" ], [ 74804, "u8", "PWUS" ], [ 84193, "u8", "Afffff." ], [ 85152, "u8", "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263" ], [ 85368, "u8", "sysFatal" ], [ 85377, "u8", "fatal.nim" ], [ 86288, "u8", "out of memory" ], [ 86303, "u8", "SIGINT: Interrupted by Ctrl-C." ], [ 86335, "u8", "SIGSEGV: Illegal storage access. (Attempt to read from nil?)" ], [ 86397, "u8", "SIGABRT: Abnormal termination." ], [ 86429, "u8", "SIGFPE: Arithmetic error." ], [ 86456, "u8", "SIGILL: Illegal operation." ], [ 86484, "u8", "unknown signal" ], [ 86500, "u8", "could not load:" ], [ 86517, "u8", "(bad format; library may be wrong architecture)" ], [ 86568, "u8", "could not import:" ], [ 86587, "u8", "Error: unhandled exception:" ], [ 86619, "u8", "@value out of range" ], [ 86640, "u8", "virtualFree failing!" ], [ 86661, "u8", "RangeDefect" ], [ 86695, "u8", "@index out of bounds, the container is empty" ], [ 86755, "u8", "@ not in 0 .." ], [ 86772, "u8", "IndexDefect" ], [ 86787, "u8", "@value out of range:" ], [ 86824, "u8", "OverflowDefect" ], [ 86843, "u8", "@over- or underflow" ], [ 86865, "u8", "DivByZeroDefect" ], [ 86887, "u8", "@division by zero" ], [ 86911, "u8", "@[[reraised from:" ], [ 87120, "u8", "inet_ntop" ], [ 87130, "u8", "GetModuleFileNameW" ], [ 87149, "u8", "FindFirstFileW" ], [ 87164, "u8", "FormatMessageW" ], [ 87179, "u8", "LocalFree" ], [ 87189, "u8", "GetLastError" ], [ 87202, "u8", "FindClose" ], [ 87215, "u8", "@Ws2_32.dll" ], [ 87288, "u8", "OSError" ], [ 87296, "u8", "raiseOSError" ], [ 87309, "u8", "oserrors.nim" ], [ 87335, "u8", "@Additional info:" ], [ 87359, "u8", "@unknown OS error" ], [ 87416, "u8", "lstrcmpiW" ], [ 88048, "u8", "MultiByteToWideChar" ], [ 88068, "u8", "WideCharToMultiByte" ], [ 88088, "u8", "lstrlenW" ], [ 88112, "u8", "deques.nim" ], [ 88208, "u8", "RtlGetCurrentPeb" ], [ 88231, "u8", "@ntdll.dll" ], [ 88276, "u8", "BCryptGenRandom" ], [ 88295, "u8", "@Bcrypt.dll" ], [ 88403, "u8", "@Failed to initializes baseState in random module as sysrand.urandom doesn't work." ], [ 90672, "u8", "ktalLPSpyCvcMtKf" ], [ 90836, "u8", "Unknown pseudo relocation protocol version %d." ], [ 90886, "u8", "Unknown pseudo relocation bit size %d." ], [ 90928, "u8", "%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p." ], [ 91011, "u8", "Address %p has no image-section" ], [ 91043, "u8", "VirtualQuery failed for %d bytes at address %p" ], [ 91092, "u8", "VirtualProtect failed with code 0x%x" ], [ 91131, "u8", "Mingw-w64 runtime failure:" ], [ 91572, "wide", "(null)" ], [ 91586, "u8", "(null)" ], [ 91608, "u8", "aCoc" ], [ 91712, "u8", "2ZGU" ], [ 91772, "u8", "Infinity" ], [ 91792, "u8", "___lc_codepage_func" ], [ 91812, "u8", "__lc_codepage" ], [ 91824, "wide", "emsvcrt.dll" ], [ 91885, "u8", "O8M2" ], [ 92420, "u8", "hrG.dll" ], [ 92448, "u8", "HidD_GetHidGuid" ], [ 92464, "u8", "NimMain" ], [ 92934, "u8", "__p___mb_cur_max" ], [ 92954, "u8", "__p__iob" ], [ 92966, "u8", "_amsg_exit" ], [ 92980, "u8", "_errno" ], [ 92990, "u8", "_fileno" ], [ 93000, "u8", "_initterm" ], [ 93020, "u8", "_setmode" ], [ 93032, "u8", "_unlock" ], [ 93042, "u8", "abort" ], [ 93050, "u8", "atoi" ], [ 93058, "u8", "calloc" ], [ 93068, "u8", "exit" ], [ 93076, "u8", "fflush" ], [ 93094, "u8", "free" ], [ 93102, "u8", "fwrite" ], [ 93112, "u8", "localeconv" ], [ 93126, "u8", "malloc" ], [ 93136, "u8", "memchr" ], [ 93146, "u8", "memcpy" ], [ 93156, "u8", "memset" ], [ 93166, "u8", "realloc" ], [ 93176, "u8", "setlocale" ], [ 93188, "u8", "signal" ], [ 93208, "u8", "strerror" ], [ 93220, "u8", "strlen" ], [ 93230, "u8", "strncmp" ], [ 93240, "u8", "vfprintf" ], [ 93252, "u8", "wcslen" ], [ 93262, "u8", "DeleteCriticalSection" ], [ 93286, "u8", "EnterCriticalSection" ], [ 93326, "u8", "GetModuleHandleW" ], [ 93346, "u8", "GetProcAddress" ], [ 93364, "u8", "InitializeCriticalSection" ], [ 93392, "u8", "IsDBCSLeadByteEx" ], [ 93412, "u8", "LeaveCriticalSection" ], [ 93436, "u8", "LoadLibraryA" ], [ 93474, "u8", "Sleep" ], [ 93482, "u8", "TlsGetValue" ], [ 93496, "u8", "VirtualAlloc" ], [ 93512, "u8", "VirtualFree" ], [ 93526, "u8", "VirtualProtect" ], [ 93544, "u8", "VirtualQuery" ], [ 93580, "u8", "msvcrt.dll" ], [ 93591, "u8", "KERNEL32.dll" ], [ 99928, "u8", "\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e" ], [ 102063, "u8", "0A1M1V1b1i1s1" ], [ 102593, "u8", "\u003c-\u003c\u003c\u003cK\u003cZ\u003ci\u003cx\u003c" ], [ 103788, "u8", "T6X6\\6`6d6h6l6p6t6x6|6" ], [ 104510, "u8", "Z0X03" ], [ 104678, "u8", "Western Cape1" ], [ 104701, "u8", "Durbanville1" ], [ 104723, "u8", "Thawte1" ], [ 104740, "u8", "Thawte Certification1" ], [ 104771, "u8", "Thawte Timestamping CA0" ], [ 104851, "u8", "Symantec Corporation100." ], [ 104881, "u8", "'Symantec Time Stamping Services CA - G20" ], [ 105282, "u8", "http://ocsp.thawte.com0" ], [ 105332, "u8", "80604" ], [ 105342, "u8", ".http://crl.thawte.com/ThawteTimestampingCA.crl0" ], [ 105452, "u8", "TimeStamp-2048-10" ], [ 105776, "u8", "201229235959Z0b1" ], [ 105815, "u8", "Symantec Corporation1402" ], [ 105845, "u8", "+Symantec Time Stamping Services Signer - G40" ], [ 106275, "u8", "http://ts-ocsp.ws.symantec.com07" ], [ 106318, "u8", "+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\u003c" ], [ 106370, "u8", "50301" ], [ 106380, "u8", "+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(" ], [ 106450, "u8", "TimeStamp-2048-20" ], [ 106559, "u8", "b07x" ], [ 106879, "u8", "VeriSign, Inc.1" ], [ 106904, "u8", "VeriSign Trust Network1;09" ], [ 106936, "u8", "2Terms of use at https://www.verisign.com/rpa (c)101.0," ], [ 106997, "u8", "%VeriSign Class 3 Code Signing 2010 CA0" ], [ 107054, "u8", "150518235959Z0" ], [ 107094, "u8", "California1" ], [ 107115, "u8", "Newark1" ], [ 107132, "u8", "Logitech1\u003e0\u003c" ], [ 107150, "u8", "5Digital ID Class 3 - Microsoft Software Validation v21" ], [ 107215, "u8", "Logitech0" ], [ 107359, "u8", "WuJnz" ], [ 107560, "u8", "90705" ], [ 107570, "u8", "/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D" ], [ 107660, "u8", "https://www.verisign.com/rpa0" ], [ 107739, "u8", "http://ocsp.verisign.com0;" ], [ 107776, "u8", "/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0" ], [ 108274, "u8", "VeriSign Trust Network1:08" ], [ 108306, "u8", "1(c) 2006 VeriSign, Inc. - For authorized use only1E0C" ], [ 108366, "u8", "\u003cVeriSign Class 3 Public Primary Certification Authority - G50" ], [ 108446, "u8", "200207235959Z0" ], [ 108972, "u8", "i0g0e" ], [ 109006, "u8", "https://www.verisign.com/cps0*" ], [ 109121, "u8", "image/gif0!0" ], [ 109169, "u8", "#http://logo.verisign.com/vslogo.gif04" ], [ 109223, "u8", "#http://crl.verisign.com/pca3-g5.crl04" ], [ 109289, "u8", "http://ocsp.verisign.com0" ], [ 109370, "u8", "VeriSignMPKI-2-80" ], [ 109447, "u8", "3130" ], [ 109885, "u8", "%VeriSign Class 3 Code Signing 2010 CA" ], [ 110332, "u8", "75uJe" ], [ 110429, "u8", "'Symantec Time Stamping Services CA - G2" ] ], "v": { "file.stem": "c25b3a3d7779cb89772454a756ce48ed3744cf233564d309b6f8d19bd8e26fa4", "pe.imphash": "b120b41ab7cc9378a051406dc87e8fb8", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1726732767, "file.basename": "c25b3a3d7779cb89772454a756ce48ed3744cf233564d309b6f8d19bd8e26fa4.dll", "pe.image_base": 268435456, "pe.image_size": 122880, "pe.machine_id": 332, "pe.os_version": "6.0", "pe.entry_point": 4496, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 6424, "pe.image_hash.sha1": "5717a8ab8706d7c36ca4e52ca2de3630fb73f8db", "pe.load_config.size": 188, "pe.image_hash.sha256": "7d13b714449e7761e3e8f4c4e8222cb6648c80d1ab97992b0d7df769aeaf67af", "pe.image_hash.sha384": "bfe2b653b6c4d701b96752ddf7d566c2260643925948e622bb3d90a468ce910fd166a04962b4beab56a6f736e2dfe4a7", "pe.image_hash.sha512": "b2fe7fa6b069747dad9edc9ed7a77962f3d515f4273e487517e47dbddaae216967b712d4991b88fe3999d1e46bfaca81602365f1f06bca8d2ce2bb7245215a70", "pe.resource_types[0]": "RT_MANIFEST", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8450, "pe.inflated_sections[0]": ".data", "pe.linker_major_version": 14, "pe.signatures[0].issuer": "CN=VeriSign Class 3 Code Signing 2010 CA,OU=Terms of use at https://www.verisign.com/rpa (c)10,OU=VeriSign Trust Network,O=VeriSign\\, Inc.,C=US", "pe.signatures[0].serial": "60698458b2a66cae5253f8e7aeed3ac6", "pe.signatures[0].subject": "CN=Logitech,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Logitech,L=Newark,ST=California,C=US", "pe.tls_callbacks[0].addr": "0x1000f750", "pe.tls_callbacks[1].addr": "0x1000f7e0", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 97500, "pe.data_directories[1].rva": 97592, "pe.data_directories[2].rva": 114688, "pe.data_directories[3].rva": 104448, "pe.data_directories[4].rva": 118784, "pe.data_directories[5].rva": 95920, "pe.data_directories[6].rva": 97248, "pe.data_directories[7].rva": 97852, "pe.dll_characteristics_raw": 320, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2015-05-18T23:59:59Z", "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 92, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 60, "pe.data_directories[2].name": "resource", "pe.data_directories[2].size": 548, "pe.data_directories[3].name": "certificate", "pe.data_directories[3].size": 6424, "pe.data_directories[4].name": "base_relocation", "pe.data_directories[4].size": 3288, "pe.data_directories[5].name": "tls", "pe.data_directories[5].size": 24, "pe.data_directories[6].name": "load_config", "pe.data_directories[6].size": 188, "pe.data_directories[7].name": "iat", "pe.data_directories[7].size": 200, "pe.manifest.dependencies[0]": "Microsoft.Windows.Common-Controls@6.0.0.0", "pe.signatures[0].not_before": "2013-03-19T00:00:00Z", "pe.coff.dos_header_pe_pointer": 120, "pe.base_relocations.block_count": 24, "pe.base_relocations.entry_count": 1539, "pe.signatures[0].thumbprint_sha1": "a485d9c359b201ff0402237a686eb52425384248", "pe.base_relocations.padding_count": 9, "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "24f5a7e7317f5f52ca17c814c2233035dd82a1a0", "pe.manifest.assembly_identity.name": "winim", "pe.signatures[0].thumbprint_sha256": "457d5697ddc3ce877de6d19db71342fe6f0c1200dd2e49fb2b06429e5eb2648f", "pe.signatures[0].signature_algorithm": "sha1WithRSAEncryption", "pe.manifest.assembly_identity.version": "1.0.0.0", "pe.signatures[0].signature_digest_algorithm": "sha1", "pe.load_config.guard_cf_check_function_pointer": 268532892 }, "x": [ [ "HidD_GetHidGuid" ], [ "NimMain" ] ], "id": "pe", "sc": [ [ ".text", 1024, 83968, 6.51, "r-x" ], [ ".rdata", 84992, 8704, 4.73, "r--" ], [ ".data", 93696, 512, 2.78, "rw-" ], [ ".tls", 94208, 5632, 0.0, "rw-" ], [ ".rsrc", 99840, 1024, 3.41, "r--" ], [ ".reloc", 100864, 3584, 6.43, "r--" ] ] }, "id": 0, "sz": 110872, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Logitech", "e": [ "Logitech" ], "i": "metadata/signed/unknown::logitech", "l": 2 }, { "c": 1.0, "d": "Signed by Logitech", "e": [ "Logitech" ], "i": "metadata/signed/leaf::logitech", "l": 3 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "TEB to PEB access for module enumeration", "e": [ "64 A1 18 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::teb-peb-access", "l": 1, "m": "B0032.014", "el": [ "0x49c" ] }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4e", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014", "el": [ "0xf741", "0xf83c" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.8999999761581421, "d": "Free memory (C runtime)", "e": [ "free" ], "i": "micro-behaviors/mem/c-runtime/functions::free-dup", "l": 2, "el": [ "0x17e78" ] }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x17e8c" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 512)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2, "el": [ "0x17ef0" ] }, { "c": 0.7799999713897705, "d": "Get module handle Unicode", "e": [ "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::get-module-handle-wide", "l": 2, "el": [ "0x17ec8" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.76" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "0x1545a" ] }, { "c": 0.8999999761581421, "d": "String length", "e": [ "strlen" ], "i": "micro-behaviors/data/string/library::strlen", "l": 2, "el": [ "0x17ea8" ] }, { "c": 0.8500000238418579, "d": "Inline PE signature validation constant", "e": [ "3c 0e", "3c 11", "3c 31", "3c 08" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-signature-check", "l": 1, "el": [ "0xf744", "0xf640", "0xf8fa", "0xf83f" ] }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE has multiple TLS callbacks", "e": [ "pe.tls_callback_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-multi-callbacks", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Wide string length", "e": [ "wcslen" ], "i": "micro-behaviors/data/string/library::wcslen", "l": 2, "el": [ "0x17eb4" ] }, { "c": 0.699999988079071, "d": "Binary with very few exports (1-2)", "e": [ "exports.count = 2.00" ], "i": "metadata/binary/metrics/structural::minimal-exports", "l": 3 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2, "el": [ "0x17ec0" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0x17ee4" ] }, { "a": "T1055.012", "c": 0.8999999761581421, "d": "PE TLS callback table present", "e": [ "pe.tls_callback_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/tls::pe-tls-callbacks-metric", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x16ca2" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1, "el": [ "0x17ef4" ] }, { "c": 0.8500000238418579, "d": "DLL filename extension present", "e": [ "c25b3a3d7779cb89772454a756ce48ed3744cf233564d309b6f8d19bd8e26fa4.dll" ], "i": "objectives/evasion/masquerade/dll/name::dll-basename", "l": 2 }, { "c": 0.75, "d": "String to integer conversion (atoi)", "e": [ "atoi" ], "i": "micro-behaviors/data/string/conversion::atoi", "l": 1, "el": [ "0x17e64" ] }, { "c": 1.0, "d": "PE carries side-by-side assembly manifest", "e": [ "{\"assembly_identity\":{\"name\":\"winim\",\"version\":\"1.0.0.0\"},\"dependencies\":[\"Microsoft.Windows.Common-Controls@6.0.0.0\"]}" ], "i": "metadata/build/manifest::pe-has-manifest", "l": 2, "el": [ "value:pe.manifest" ] }, { "c": 0.8999999761581421, "d": "Allocate zeroed memory", "e": [ "calloc" ], "i": "micro-behaviors/mem/c-runtime/functions::calloc", "l": 2, "el": [ "0x17e68" ] }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.51)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "0x17edc" ] }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2, "el": [ "0x17ee8" ] }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "0x17e90" ] }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021", "el": [ "0x17ef4" ] }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2, "el": [ "0x17ed0" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "@ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2, "el": [ "0x158a7" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Limited string comparison", "e": [ "strncmp" ], "i": "micro-behaviors/data/string/library::strncmp", "l": 2, "el": [ "0x17eac" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2, "el": [ "0x17ef8" ] }, { "a": "T1036.001", "c": 0.8399999737739563, "d": "Symantec timestamp string in overlay", "e": [ "+Symantec Time Stamping Services Signer - G40" ], "i": "objectives/evasion/masquerade/binary::overlay-symantec-string", "l": 1, "el": [ "0x19d75" ] }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2, "el": [ "0x17ebc" ] }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2, "el": [ "0x17e60" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.51" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Reallocate memory", "e": [ "realloc" ], "i": "micro-behaviors/mem/c-runtime/functions::realloc", "l": 2, "el": [ "0x17e94" ] }, { "c": 1.0, "d": "Depends on Common-Controls v6", "e": [ "[Microsoft.Windows.Common-Controls@6.0.0.0]" ], "i": "metadata/build/manifest::pe-common-controls-v6", "l": 2, "el": [ "value:pe.manifest.dependencies" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "c25b3a3d7779cb89772454a756ce48ed3744cf233564d309b6f8d19bd8e26fa4.dll" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PE signature validation in code", "e": [ "3c 11", "3c 08", "3c 31", "3c 0e" ], "i": "objectives/anti-static/obfuscation/imports::pe-signature-check", "l": 1, "m": "B0032.014", "el": [ "0xf640", "0xf83f", "0xf8fa", "0xf744" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Allocate memory (C runtime)", "e": [ "malloc" ], "i": "micro-behaviors/mem/c-runtime/functions::malloc", "l": 2, "el": [ "0x17e84" ] }, { "a": "T1027", "c": 1.0, "d": "Hardcoded alphabet array for filename randomization", "e": [ "30 30 30 31 30 32 30 33 30 34" ], "i": "objectives/command-and-control/dropper/standalone::mutated-exe-randomizer-string", "l": 1, "m": "E1027", "el": [ "0x14ca0" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x154af" ] }, { "c": 0.8999999761581421, "d": "Variadic formatted output", "e": [ "vfprintf" ], "i": "micro-behaviors/os/stdio::vfprintf", "l": 2, "el": [ "0x17eb0" ] }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2, "el": [ "0x17ed8" ] }, { "c": 0.8999999761581421, "d": "MinGW pseudo relocation message", "e": [ "VirtualProtect failed with code", "Unknown pseudo relocation" ], "i": "metadata/binary/framework::mingw-pseudoreloc-runtime", "l": 2, "el": [ "0x163d4", "0x162d4" ] }, { "c": 0.8999999761581421, "d": "Install signal handler", "e": [ "signal" ], "i": "micro-behaviors/os/signal/handler::signal", "l": 2, "el": [ "0x17e9c" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x17ec4" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x10bf" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "@value out of range:", "%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.", "@value out of range", "TlsGetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0x15303", "0x16330", "0x1525b", "0x16d2a" ] }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2, "el": [ "0x17eec" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 619.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Inline PE header walk sequence", "e": [ "4e", "48" ], "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk", "l": 1, "el": [ "0xf741", "0xf83c" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Find character in string", "e": [ "strchr" ], "i": "micro-behaviors/data/string/library::strchr", "l": 2, "el": [ "0x17ea0" ] }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "sections.count = 6.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetModuleFileNameW", "MultiByteToWideChar", "InitializeCriticalSection", "WideCharToMultiByte" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x1545a", "0x157f0", "0x16cb4", "0x15804" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 83968, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "VirtualAlloc API string reference", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string", "l": 1, "el": [ "0x16d38" ] }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2, "el": [ "0x17ecc" ] }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "@ntdll.dll" ], "i": "objectives/evasion/anti-av/platform/defender::ntdll-dll-str", "l": 1, "el": [ "0x158a7" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 48.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 48.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.949999988079071, "d": "links msvcrt (p___mb_cur_max, p__iob, amsg_exit, errno, fileno, ... +26 more)", "e": [ "msvcrt" ], "i": "metadata/dylib::msvcrt", "l": 2, "el": [ "31 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (DeleteCriticalSection, EnterCriticalSection, GetLastError, GetModuleHandleW, GetProcAddress, ... +12 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "17 symbols" ] }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleW" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2, "el": [ "0x17ecc", "0x17ec8" ] } ], "sha": "c25b3a3d7779cb89772454a756ce48ed3744cf233564d309b6f8d19bd8e26fa4", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-09/c25b3a3d7779cb89772454a756ce48ed3744cf233564d309b6f8d19bd8e26fa4.dll", "type": "pe" } ], "tv": "ca5ef" } }