{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9852588176727295, "class": 0 } ], "prob": 0.9852588, "class": 0, "models": [ { "m": "az", "prob": 0.888439, "class": 0 }, { "m": "az/native", "prob": 0.69024414, "class": 0 }, { "m": "az/pe", "prob": 0.9852588, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T13:00:19Z" }, "path": "8588", "raw": { "v": "4", "fs": [ { "f": "KO₇(As₇C₄DyEr₄EuPXe)H₃(DbPoCm₃)Md₂(SiBi₅)", "k": { "hash.imp": "0fbf32532db2d14e7ac3ea5fae7eb05b", "pe.timestamp": 1409484769, "hash.authenti": "e6302e2aa61dbe9fe31e50c525e9829b0cb8e4a33a8fa46f707dc10d03bf54b1", "build.target_arch": "x86", "pe.linker_version": "8.0", "pe.resource_types[0]": "RT_VERSION", "pe.data_directories[0].rva": 79480, "pe.data_directories[1].rva": 81920, "pe.data_directories[2].rva": 90112, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 680, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.version_info.file_version": "1.0.0.0", "pe.dll_characteristics.no_seh": true, "pe.version_info.internal_name": "7p63jyia.dll", "pe.version_info.legal_copyright": " ", "pe.version_info.product_version": "1.0.0.0", "pe.dll_characteristics.nx_compat": true, "pe.version_info.file_description": " ", "pe.version_info.original_filename": "7p63jyia.dll", "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rsrc", "pe.section_characteristics[2].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.section_characteristics[0].raw_size": 73728, "pe.section_characteristics[1].raw_size": 4096, "pe.section_characteristics[2].raw_size": 4096, "pe.section_characteristics[0].virtual_size": 71380, "pe.section_characteristics[1].virtual_size": 680, "pe.section_characteristics[2].virtual_size": 12, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 8192, "pe.section_characteristics[1].virtual_address": 81920, "pe.section_characteristics[2].virtual_address": 90112, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "42000040" }, "x": 6, "id": 0, "is": [ "CorDllMain" ], "ms": { "pe": { "entry": 79566.0, "machine": 332.0, "checksum": 0.0, "is_dotnet": true, "rsrc_size": 4096.0, "subsystem": 3.0, "timestamp": 1409484769.0, "image_base": 4194304.0, "clr_version": "2.5", "rsrc_entropy": 0.69, "entry_section": ".text", "size_of_image": 98304.0, "file_alignment": 4096.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 8450.0, "size_of_headers": 4096.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 1.0, "computed_checksum": 134595.0, "section_alignment": 8192.0, "resource_timestamp": 0.0, "dll_characteristics": 34112.0, "has_export_timestamp": false, "linker_major_version": 8.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0 }, "file": { "size": 86016.0 }, "binary": { "code_size": 73728.0, "code_entropy": 5.27, "import_count": 1.0, "string_count": 967.0, "section_count": 3.0, "import_density": 0.01, "string_density": 13.43, "overall_entropy": 1.99, "avg_section_size": 27306.67, "dependency_count": 1.0, "entropy_variance": 2.33, "avg_string_length": 24.05, "max_string_length": 2727.0, "wide_string_count": 12.0, "avg_string_entropy": 3.59, "code_to_data_ratio": 9.0, "rsrc_to_file_ratio": 0.05, "text_to_file_ratio": 0.86, "string_length_stddev": 88.13, "largest_section_ratio": 0.86, "sentence_string_count": 6.0, "sentence_string_ratio": 0.01 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 455, "@.reloc" ], [ 9653, "@.F+Lr" ], [ 41077, "\u003cModule\u003e" ], [ 41086, "7p63jyia.dll" ], [ 41099, "XmlSerializationWriterPublisherSettingsManager" ], [ 41146, "Microsoft.Xml.Serialization.GeneratedAssembly" ], [ 41192, "XmlSerializationReaderPublisherSettingsManager" ], [ 41239, "XmlSerializer1" ], [ 41254, "PublisherSettingsManagerSerializer" ], [ 41289, "XmlSerializerContract" ], [ 41311, "System.Xml" ], [ 41322, "System.Xml.Serialization" ], [ 41347, "XmlSerializationWriter" ], [ 41370, "XmlSerializationReader" ], [ 41393, "XmlSerializer" ], [ 41407, "XmlSerializerImplementation" ], [ 41435, "Write15_PublisherManager" ], [ 41466, "Linkury.Personalization.Settings.PublisherSettingsManager" ], [ 41524, "PublisherSettingsManager" ], [ 41549, "Write14_PublisherSettingsManager" ], [ 41582, "ContextMenuStripElement" ], [ 41606, "Write13_ContextMenuStripElement" ], [ 41638, "ContextMenuStripElementType" ], [ 41666, "Write12_ContextMenuStripElementType" ], [ 41702, "LayoutItem" ], [ 41713, "Write11_LayoutItem" ], [ 41732, "LayoutParameter" ], [ 41748, "Write10_LayoutParameter" ], [ 41772, "LayoutElement" ], [ 41786, "Write9_LayoutElement" ], [ 41807, "ToolBarPanelEdgeStyle" ], [ 41829, "Write8_ToolBarPanelEdgeStyle" ], [ 41858, "TransitionAdsConfigurations" ], [ 41886, "Write7_TransitionAdsConfigurations" ], [ 41921, "ViralSettings" ], [ 41935, "Write6_ViralSettings" ], [ 41956, "PublisherBrowserSettings" ], [ 41981, "Write5_PublisherBrowserSettings" ], [ 42013, "ChangePropertiesPublisherData" ], [ 42043, "Write4_ChangePropertiesPublisherData" ], [ 42080, "ChangeTypes" ], [ 42092, "Write2_ChangeTypes" ], [ 42111, "Browsers" ], [ 42120, "Write1_Browsers" ], [ 42136, "InitCallbacks" ], [ 42150, ".ctor" ], [ 42156, "Read15_PublisherManager" ], [ 42180, "Read14_PublisherSettingsManager" ], [ 42212, "Read13_ContextMenuStripElement" ], [ 42243, "mscorlib" ], [ 42252, "System.Collections" ], [ 42271, "Hashtable" ], [ 42281, "_ContextMenuStripElementTypeValues" ], [ 42316, "get_ContextMenuStripElementTypeValues" ], [ 42354, "Read12_ContextMenuStripElementType" ], [ 42389, "Read11_LayoutItem" ], [ 42407, "Read10_LayoutParameter" ], [ 42430, "_LayoutElementValues" ], [ 42451, "get_LayoutElementValues" ], [ 42475, "Read9_LayoutElement" ], [ 42495, "_ToolBarPanelEdgeStyleValues" ], [ 42524, "get_ToolBarPanelEdgeStyleValues" ], [ 42556, "Read8_ToolBarPanelEdgeStyle" ], [ 42584, "Read7_TransitionAdsConfigurations" ], [ 42618, "Read6_ViralSettings" ], [ 42638, "Read5_PublisherBrowserSettings" ], [ 42669, "Read4_ChangePropertiesPublisherData" ], [ 42705, "Read2_ChangeTypes" ], [ 42723, "Read1_Browsers" ], [ 42738, "id39_RemoveOtherExtensionsWhiteList" ], [ 42774, "id44_ExtensionNameFF" ], [ 42795, "id166_FacebookMessage" ], [ 42828, "id14_FirefoxExtensionName" ], [ 42854, "id61_PlayItIconPath" ], [ 42874, "id113_DefaultInterval" ], [ 42896, "id99_ProtectorsHomePageURLChrome" ], [ 42929, "id97_ProtectorsDomainsWhiteList" ], [ 42961, "id178_SetNewTab" ], [ 42977, "id70_SimilarSitesTracingQuery" ], [ 43018, "id123_TrayWindowInfoDSLabel" ], [ 43046, "id42_AdPanelUrl" ], [ 43062, "id158_TopDomainsMaximum" ], [ 43086, "id155_TopDomainsListSize" ], [ 43111, "id182_InstallExtension" ], [ 43134, "id69_SimilarSitesTracingEnabled" ], [ 43166, "id129_ViralSettings" ], [ 43186, "id92_UseChromeNewTab" ], [ 43207, "id26_SearchNameIE" ], [ 43225, "id151_LayoutParameter" ], [ 43247, "id84_InstallSilently" ], [ 43268, "id104_ProtectorsSearchDomain" ], [ 43297, "id58_ShortcutLocationType" ], [ 43323, "id5_ThankYouPageURL" ], [ 43343, "id17_AutoCompleteDescription" ], [ 43372, "id115_PrivateInvestigationEndpoint" ], [ 43418, "id40_ContactUsURL" ], [ 43457, "id106_ProtectorsSearchUrlIE" ], [ 43496, "id134_ContextMenuStripItemList" ], [ 43527, "id144_RightEdgeExpanded" ], [ 43551, "id8_ComponentsInstallerEndpoint" ], [ 43583, "id82_LinkuryExeDir" ], [ 43602, "id127_PublisherBrowserSettingsList" ], [ 43637, "id34_HomePageURLFF" ], [ 43656, "id177_SetAddressBarSearch" ], [ 43682, "id118_ROTXmlOperationsUrl" ], [ 43708, "id53_PostUninstallUrl" ], [ 43730, "id18_FavIconUrl" ], [ 43746, "id38_NewTabURLIE" ], [ 43763, "id6_GooglePublisherToolbarChannel" ], [ 43797, "id173_ChangeRequestTimeDays" ], [ 43825, "id98_ProtectorsSearchUrlChrome" ], [ 43856, "id130_TransitionAdsConfigurations" ], [ 43890, "id89_BlackListServerFilePath" ], [ 43919, "id19_SearchUrl" ], [ 43934, "id146_Position" ], [ 43949, "id101_ProtectorsSearchUrlFF" ], [ 43977, "id136_ExeName" ], [ 43991, "id176_SetBrowserSettingsSilently" ], [ 44024, "id100_ProtectorsNewTabURLChrome" ], [ 44056, "id48_AboutTextDesignedFor" ], [ 44082, "id49_AboutTextPublisherDescription" ], [ 44117, "id171_ChangePropertiesPublisherData" ], [ 44153, "id46_ExtensionNameChrome" ], [ 44178, "id175_SetDefaultSearchEngine" ], [ 44207, "id112_DefaultMaxOrders" ], [ 44230, "id1_PublisherManager" ], [ 44251, "id131_LayoutItemList" ], [ 44284, "id3_PublisherSettingsManager" ], [ 44313, "id150_ParametersList" ], [ 44334, "id142_LeftEdgeExpanded" ], [ 44357, "id125_TakeNewTab" ], [ 44374, "id59_ConfigurationNumber" ], [ 44399, "id75_UseNotificationBrowserSetter" ], [ 44442, "id91_BlackListGetFileInterval" ], [ 44483, "id157_GlobalTimeDelta" ], [ 44505, "id119_TrayWindowHeaderLabel" ], [ 44533, "id78_LogoPictureTooltip" ], [ 44557, "id85_BumbleBStateStatisticsEndpoint" ], [ 44593, "id54_RadioURL" ], [ 44607, "id161_SearchEnginesListUrl" ], [ 44634, "id103_ProtectorsNewTabURLFF" ], [ 44673, "id21_SearchUrlChrome" ], [ 44694, "id66_DisplaySimilarSites" ], [ 44719, "id9_HistoryWrapperEndpoint" ], [ 44746, "id32_HomePageURL" ], [ 44763, "id10_SocialNetsWrapperEndpoint" ], [ 44794, "id107_HostsFileMonitorLinkuryDomains" ], [ 44831, "id57_BrowserShortcutName" ], [ 44856, "id180_RefreshExtension" ], [ 44879, "id124_TakeDefaultSearch" ], [ 44903, "id65_ServicesIconPath" ], [ 44925, "id133_MiniLayoutItemList" ], [ 44950, "id105_ProtectorsHomePageURLIE" ], [ 44980, "id135_ContextMenuStripItem" ], [ 45007, "id64_ShareItIconPath" ], [ 45028, "id168_Browser" ], [ 45042, "id79_LogoPictureClickUrl" ], [ 45067, "id56_BrowserShortcutURL" ], [ 45091, "id76_SmartBarName" ], [ 45109, "id132_LayoutItem" ], [ 45126, "id36_NewTabURLChrome" ], [ 45147, "id11_ComparativeSearchLink" ], [ 45174, "id126_IsXButtonMode" ], [ 45194, "id120_TrayWindowInfoLabel" ], [ 45220, "id15_PublisherGuid" ], [ 45239, "id102_ProtectorsHomePageURLFF" ], [ 45269, "id23_SearchUrlIE" ], [ 45286, "id110_GetApprovedInstllationFunction" ], [ 45323, "id184_PerformRollback" ], [ 45345, "id86_BumbleBStatisticsEndpoint" ], [ 45376, "id51_MainPublisherLogoPath" ], [ 45403, "id122_TrayWindowInfoNTLabel" ], [ 45431, "id169_Enabled" ], [ 45445, "id4_CloudEndpoint" ], [ 45463, "id7_AutomaticUpdatesEndpoint" ], [ 45492, "id45_ExtensionNameIE" ], [ 45513, "id63_FAQURL" ], [ 45525, "id33_HomePageURLChrome" ], [ 45548, "id145_LayoutElement" ], [ 45568, "id30_HelpURL" ], [ 45581, "id160_DbName" ], [ 45605, "id162_SearchEnginesFile" ], [ 45629, "id12_TiredUsersConfigXML" ], [ 45654, "id35_HomePageURLIE" ], [ 45673, "id147_Priority" ], [ 45688, "id172_ChangeType" ], [ 45705, "id22_InstantSearchUrlChrome" ], [ 45733, "id93_UseChromeDefaulSearch" ], [ 45760, "id156_DomainTimeDelta" ], [ 45782, "id41_HTMLComponentUrl" ], [ 45804, "id111_TaskbarNotifierExePath" ], [ 45833, "id148_IsRemoveable" ], [ 45852, "id94_SearchProvidersPriorityListDS" ], [ 45887, "id121_TrayWindowInfo2Label" ], [ 45914, "id181_ReInstallExtension" ], [ 45939, "id62_SearchItIconPath" ], [ 45961, "id77_IsPowerVersion" ], [ 45981, "id74_UseSetHomePageMenuItem" ], [ 46009, "id73_DisplayFloatingWindow" ], [ 46036, "id81_LinkuryInstallationFolder" ], [ 46067, "id31_PrivacyURL" ], [ 46083, "id153_ParameterValue" ], [ 46104, "id52_MainPublisherIconPath" ], [ 46131, "id149_IsSizeModeSupported" ], [ 46157, "id13_Version" ], [ 46180, "id50_InstallationName" ], [ 46202, "id128_PublisherBrowserSettings" ], [ 46233, "id80_EnablesMultimedia" ], [ 46256, "id27_SearchNameFF" ], [ 46274, "id141_LeftEdgeNormal" ], [ 46295, "id37_NewTabURLFF" ], [ 46312, "id25_SearchNameChrome" ], [ 46334, "id164_BlacklistUrl" ], [ 46353, "id152_ParameterName" ], [ 46373, "id137_ContextMenuStripElement" ], [ 46403, "id24_SearchUrlFF" ], [ 46420, "id83_DefaultLanguageISO" ], [ 46444, "id88_MaxMindEndpoint" ], [ 46465, "id159_ViewsPerDay" ], [ 46483, "id90_BlackListLocalFilePath" ], [ 46532, "id167_TwitterMessage" ], [ 46553, "id179_ReEnableExtension" ], [ 46577, "id183_ProprietaryData" ], [ 46599, "id20_NonSearch" ], [ 46624, "id71_GeneralTracingEnabled" ], [ 46651, "id72_GeneralSitesTracingQuery" ], [ 46681, "id16_PublisherName" ], [ 46700, "id143_RightEdgeNormal" ], [ 46722, "id174_SetHomepage" ], [ 46740, "id28_SearchDomain" ], [ 46758, "id95_SearchProvidersPriorityListNT" ], [ 46793, "id163_BlacklistFile" ], [ 46813, "id43_AdPresenterLink" ], [ 46844, "id47_PublisherIconPath" ], [ 46867, "id87_EncryptURL" ], [ 46883, "id29_TellAFriendURL" ], [ 46914, "InitIDs" ], [ 46922, "ContextMenuStripElementTypeValues" ], [ 46956, "LayoutElementValues" ], [ 46976, "ToolBarPanelEdgeStyleValues" ], [ 47004, "CreateReader" ], [ 47017, "CreateWriter" ], [ 47030, "XmlReader" ], [ 47040, "CanDeserialize" ], [ 47055, "Serialize" ], [ 47065, "Deserialize" ], [ 47077, "get_Reader" ], [ 47088, "get_Writer" ], [ 47099, "readMethods" ], [ 47111, "get_ReadMethods" ], [ 47127, "writeMethods" ], [ 47140, "get_WriteMethods" ], [ 47157, "typedSerializers" ], [ 47174, "get_TypedSerializers" ] ], "sz": 86016, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x8938" ], "i": "metadata/dotnet/bsjb-signature", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.05" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 1.99" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 1.99" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 98304.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "Firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1409484769.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "Derived string condition", "e": [ "DefaultSearchEngine" ], "i": "objectives/discovery/host/browser::inline__search-engine-id__any_3", "l": 1 }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "binary.section_count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ReadElementString", "WriteElementStringRaw", "ToString", "WriteElementString", "String", "set_VersionString", "StringFileInfo", "get_VersionString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Reactor PrivateImplementationDetails GUID", "e": [ "3C 50 72 69 76 61 74 65 49 6D 70 6C 65 6D 65 6E 74 61 74 69 6F 6E 44 65 74 61 69 6C 73 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D" ], "i": "objectives/anti-static/obfuscation/tools/managed::reactor-private-implementation-details-guid", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "8588" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.75, "d": "XML serialization capability", "e": [ "System.Xml.Serialization", "XmlSerializer" ], "i": "micro-behaviors/data/serialize/unsafe::xml-serializer", "l": 3 }, { "c": 0.949999988079071, "d": "mscoree name reference", "e": [ "mscoree.dll" ], "i": "metadata/binary/framework::mscoree-name", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 4096.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1567", "c": 1.0, "d": "Regex component marker", "e": [ "TiredUsersConfigXML", "get_TiredUsersConfigXML", "set_TiredUsersConfigXML", "id12_TiredUsersConfigXML", ":CloudEndpoint, :ThankYouPageURL, :GooglePublisherToolbarChannel, :AutomaticUpdatesEndpoint, :ComponentsInstallerEndpoint, :Hist" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.Security" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "UUID formatted route segment", "e": [ "98F23796-DACA-45A3-8F13-FEE03F19EC48" ], "i": "objectives/command-and-control/channel/http/stego::uuid-format-route-segment", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 0.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 967.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.8500000238418579, "d": "Large zero-entropy placeholder section", "e": [ ".reloc (size: 4096, entropy: 0.02, perms: r--)" ], "i": "metadata/binary/section/metrics::null-placeholder-section", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Console subsystem on dw20 claim", "e": [ "pe.subsystem = 3.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem", "l": 1, "m": "F0004" }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "1.0.0.0" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "c": 1.0, "d": ".NET binary (PE with BSJB metadata)", "e": [ "pe.is_dotnet = 1.00" ], "i": "metadata/binary/metrics/threshold::dotnet-binary", "l": 1 }, { "c": 1.0, "d": "Modification of HTTP context items", "e": [ "set_Item" ], "i": "micro-behaviors/communications/http/server/managed::http-item-setter", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.59" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Zero recovered functions", "e": [ "binary.func_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "MoveToElement", "MoveToNextAttribute", "MoveToContent" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "binary.import_count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "id62_SearchItIconPath", "get_MainPublisherLogoPath", "get_SearchItIconPath", "get_MainPublisherIconPath", "get_PlayItIconPath", "id52_MainPublisherIconPath", "id65_ServicesIconPath", "id61_PlayItIconPath", "id90_BlackListLocalFilePath", "id47_PublisherIconPath", "id51_MainPublisherLogoPath", "id111_TaskbarNotifierExePath", "get_PublisherIconPath", "get_ShareItIconPath", "id64_ShareItIconPath", "id89_BlackListServerFilePath" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 0.00" ], "i": "metadata/binary/anomaly/format::low-function-count-marker", "l": 1 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{98F23796-DACA-45A3-8F13-FEE03F19EC48}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 3, "m": "C0042" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.86" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree.dll (CorDllMain)", "e": [ "mscoree.dll" ], "i": "metadata/dylib::mscoree/dll", "l": 2 }, { "c": 1.0, "d": ".NET Assembly (mscoree.dll)", "e": [ "BSJB", "mscoree.dll" ], "i": "metadata/binary/framework::dotnet-assembly", "l": 2 }, { "a": "B0030", "c": 0.9300000071525574, "d": "GUID mutex with crypto and network", "e": [ "StringFileInfo", "ToString", "WriteElementString", "{98F23796-DACA-45A3-8F13-FEE03F19EC48}", "set_VersionString", "get_VersionString", "WriteElementStringRaw", "ReadElementString", "String" ], "i": "objectives/command-and-control/beacon/mutex::mutex-guid-crypto-http-coordination", "l": 1 } ], "sha": "c377c2e3f7473f2e8cc4c76eac0a616bb7b3c3d19e796de629f10c8edff4e635", "path": "8588", "type": "pe" } ], "tv": "51ad9" } }