{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8748640418052673, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.87486404, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/native", "prob": 0.3083004, "class": 0 }, { "m": "az/pe", "prob": 0.0041841003, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T12:03:38Z" }, "path": "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 4, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 12731880.0, "entropy": 7.98, "size_bytes": 12731880.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 199, "u8", "LRich" ], [ 472, "u8", ".text" ], [ 551, "u8", "@.data" ], [ 592, "u8", ".rsrc" ], [ 631, "u8", "@.reloc" ], [ 3071, "u8", "4224" ], [ 3082, "u8", "202u" ], [ 94810, "u8", "u4h8" ], [ 97590, "u8", "vWSVW" ], [ 99635, "u8", "QSVW3" ], [ 104888, "wide", "advapi32.dll" ], [ 104944, "wide", "user32.dll" ], [ 105096, "wide", "Error Unknown" ], [ 105202, "u8", "StabNew.exe" ], [ 105214, "u8", "_CallRandomFunction@0" ], [ 158316, "u8", ".rdata" ], [ 158332, "u8", ".edata" ], [ 158348, "u8", ".rdata$voltmd" ], [ 158372, "u8", ".rdata$zzzdbg" ], [ 158476, "u8", ".data" ], [ 158492, "u8", ".bss" ], [ 158978, "u8", "GetTickCount" ], [ 158994, "u8", "QueryPerformanceCounter" ], [ 159020, "u8", "GetSystemTimeAsFileTime" ], [ 159046, "u8", "GetWindowsDirectoryW" ], [ 159070, "u8", "GetLocalTime" ], [ 159086, "u8", "GetWindowsDirectoryA" ], [ 159110, "u8", "QueryPerformanceFrequency" ], [ 159138, "u8", "GetVersionExA" ], [ 159154, "u8", "GetSystemDirectoryA" ], [ 159176, "u8", "GetTickCount64" ], [ 159194, "u8", "GetTimeZoneInformation" ], [ 159220, "u8", "GetTempPathA" ], [ 159236, "u8", "Sleep" ], [ 159244, "u8", "GetSystemDirectoryW" ], [ 159266, "u8", "GetVersionExW" ], [ 159282, "u8", "GetTempPathW" ], [ 159298, "u8", "LoadLibraryW" ], [ 159314, "u8", "FormatMessageW" ], [ 159330, "u8", "KERNEL32.dll" ], [ 159346, "u8", "GetWindowTextLengthW" ], [ 159370, "u8", "SetScrollInfo" ], [ 159386, "u8", "GetMessageW" ], [ 159400, "u8", "DispatchMessageA" ], [ 159420, "u8", "GetMenu" ], [ 159430, "u8", "GetFocus" ], [ 159442, "u8", "LoadCursorA" ], [ 159456, "u8", "GetDC" ], [ 159464, "u8", "IsWindowVisible" ], [ 159482, "u8", "SetWindowPos" ], [ 159498, "u8", "MessageBoxW" ], [ 159512, "u8", "ScreenToClient" ], [ 159530, "u8", "GetSystemMetrics" ], [ 159550, "u8", "SetWindowTextW" ], [ 159568, "u8", "GetClassNameA" ], [ 159584, "u8", "GetScrollInfo" ], [ 159600, "u8", "ShowWindow" ], [ 159614, "u8", "DispatchMessageW" ], [ 159634, "u8", "SetSysColors" ], [ 159650, "u8", "GetDlgCtrlID" ], [ 159666, "u8", "ClientToScreen" ], [ 159684, "u8", "RegisterClassW" ], [ 159702, "u8", "MapWindowPoints" ], [ 159720, "u8", "SetWindowTextA" ], [ 159738, "u8", "MessageBoxA" ], [ 159752, "u8", "GetMonitorInfoA" ], [ 159770, "u8", "GetSysColor" ], [ 159784, "u8", "MoveWindow" ], [ 159798, "u8", "AdjustWindowRect" ], [ 159818, "u8", "SetMenu" ], [ 159828, "u8", "RegisterClassA" ], [ 159846, "u8", "TranslateMessage" ], [ 159866, "u8", "LoadIconW" ], [ 159878, "u8", "LoadCursorW" ], [ 159892, "u8", "GetClassNameW" ], [ 159908, "u8", "GetWindowDC" ], [ 159922, "u8", "GetDlgItem" ], [ 159936, "u8", "DrawTextW" ], [ 159948, "u8", "GetWindowTextLengthA" ], [ 159972, "u8", "GetParent" ], [ 159984, "u8", "InvalidateRect" ], [ 160002, "u8", "ReleaseDC" ], [ 160014, "u8", "BeginPaint" ], [ 160028, "u8", "EndPaint" ], [ 160040, "u8", "GetWindowTextW" ], [ 160056, "u8", "USER32.dll" ], [ 160076, "u8", "CreateFontA" ], [ 160090, "u8", "GetTextExtentPoint32A" ], [ 160120, "u8", "CreateHatchBrush" ], [ 160140, "u8", "Chord" ], [ 160148, "u8", "CreateFontW" ], [ 160162, "u8", "GetStockObject" ], [ 160180, "u8", "GetTextMetricsW" ], [ 160198, "u8", "SetTextColor" ], [ 160214, "u8", "LineTo" ], [ 160224, "u8", "CreatePen" ], [ 160236, "u8", "Rectangle" ], [ 160248, "u8", "SelectClipRgn" ], [ 160264, "u8", "GetObjectW" ], [ 160278, "u8", "MoveToEx" ], [ 160290, "u8", "SetBkColor" ], [ 160304, "u8", "Ellipse" ], [ 160314, "u8", "DeleteObject" ], [ 160330, "u8", "CreateSolidBrush" ], [ 160350, "u8", "CreateDCA" ], [ 160362, "u8", "GetTextMetricsA" ], [ 160380, "u8", "GetObjectA" ], [ 160392, "u8", "GDI32.dll" ], [ 163735, "u8", "xpMi" ], [ 165565, "u8", "xGKeNF" ], [ 166584, "u8", "Q.pjz" ], [ 168035, "u8", "AYoKj" ], [ 170979, "u8", "jlSm" ], [ 171043, "u8", "83 d" ], [ 171833, "u8", "aanz" ], [ 172769, "u8", "wCir" ], [ 172935, "u8", "P1TR0" ], [ 174757, "u8", "1VeHFs" ], [ 176113, "u8", "zrJj" ], [ 176836, "u8", "60EB" ], [ 178331, "u8", "7B0mu" ], [ 178816, "u8", "QX57" ], [ 179843, "u8", "8FOQ" ], [ 180078, "u8", "qhFyi" ], [ 180382, "u8", "3u54J" ], [ 181458, "u8", "wOaiF" ], [ 182345, "u8", "2x n" ], [ 182723, "u8", "AotGvg" ], [ 183232, "u8", "nUWsD" ], [ 184453, "u8", "5OWL" ], [ 187432, "u8", "bIweU" ], [ 188216, "u8", "0Tlr@/*2\u003e" ], [ 189401, "u8", "4MUJ" ], [ 189427, "u8", "2MB 0" ], [ 189674, "u8", "CHEZos" ], [ 190137, "u8", "Kkrn" ], [ 191353, "u8", "Wax2eC1KA" ], [ 193095, "u8", "P3xsn" ], [ 194085, "u8", "UO6F" ], [ 194518, "u8", "OMFC" ], [ 196160, "u8", "G4KP" ], [ 197287, "u8", "v-evu6" ], [ 197602, "u8", "5F6S" ], [ 197992, "u8", "ofJvd" ], [ 200475, "u8", "Ty r" ], [ 205081, "u8", "yv3Kz" ], [ 205590, "u8", "gpSm" ], [ 206982, "u8", "dMGBV" ], [ 208184, "u8", "V_S6" ], [ 211151, "u8", "tv4u" ], [ 212751, "u8", "/8]a7dx" ], [ 214202, "u8", "ja4k" ], [ 215795, "u8", "9gw3F" ], [ 217691, "u8", "mbDb" ], [ 222056, "u8", "p bu3" ], [ 225324, "u8", "/5pP" ], [ 225820, "u8", "Cwmu" ], [ 229603, "u8", "PgbPM" ], [ 231688, "u8", "2KCGA" ], [ 232249, "u8", "L_V3" ], [ 232726, "u8", "Fmdt" ], [ 234272, "u8", "cytzS" ], [ 234882, "u8", "/HW8" ], [ 235799, "u8", "rnGoH" ], [ 236812, "u8", "s6AOU" ], [ 237639, "u8", "soJa" ], [ 237932, "u8", "dAcs" ], [ 237989, "u8", "88GD" ], [ 238818, "u8", "9WYB" ], [ 239167, "u8", "obN3S" ], [ 240075, "u8", "JwFPLA" ], [ 242206, "u8", "a I\\eo" ], [ 243186, "u8", "d3gvXt" ], [ 244354, "u8", "hk4VT" ], [ 245931, "u8", "wQAj3" ], [ 247653, "u8", "512WF" ], [ 248171, "u8", "Rt.x" ], [ 250350, "u8", "T39A" ], [ 252136, "u8", "J3gxM" ], [ 252966, "u8", "Rzsd" ], [ 253551, "u8", "VNRP" ], [ 254236, "u8", "7VNH" ], [ 254583, "u8", "VRMJ3" ], [ 254774, "u8", "97yz" ], [ 255066, "u8", "NqJ16" ], [ 255079, "u8", "Jghkh" ], [ 255439, "u8", "uVKdX" ], [ 256565, "u8", "UP8M" ], [ 256593, "u8", "CCsbz" ], [ 256756, "u8", "V3qEOwl.0?wJ" ], [ 259100, "u8", "ig9u" ], [ 259213, "u8", "J)a[" ], [ 259963, "u8", "/1Yq" ], [ 260274, "u8", "5i3tiP" ], [ 260791, "u8", "Hw2US" ], [ 262208, "u8", "8N I" ], [ 263179, "u8", "ewIx" ], [ 263195, "u8", "8CIE" ], [ 263463, "u8", "8l p" ], [ 266310, "u8", "lYqd" ], [ 267833, "u8", "BYlRC" ], [ 269912, "u8", "lD zS" ], [ 269997, "u8", "Sxgv" ], [ 274415, "u8", "2\u003ez(6" ], [ 274588, "u8", ".q@dJZJfga" ], [ 276131, "u8", "nfM3gN" ], [ 276364, "u8", "yyrUJ" ], [ 277497, "u8", "88UP" ], [ 278263, "u8", "gqLox" ], [ 278279, "u8", "tgYCE" ], [ 278902, "u8", "n}u{" ], [ 281495, "u8", "savo" ], [ 282419, "u8", "io5i" ], [ 283096, "u8", "rWcy" ], [ 286061, "u8", "j;dy jo" ], [ 286349, "u8", "ElB61" ], [ 289128, "u8", "8 NSU" ], [ 289602, "u8", "\u003c\u003c6 P" ], [ 289820, "u8", "Cv.t" ], [ 290230, "u8", "0xsLY" ], [ 290680, "u8", "Piss7T" ], [ 292444, "u8", "RZOT" ], [ 293079, "u8", "f77Ea" ], [ 293785, "u8", "fnKc" ], [ 294424, "u8", "4AapL" ], [ 294915, "u8", "e9ghF" ], [ 295011, "u8", ".abe" ], [ 299069, "u8", "eTib" ], [ 299502, "u8", "CACK" ], [ 301673, "u8", "TmqXNm" ], [ 302877, "u8", "ZYVQ" ], [ 304894, "u8", "mtu3D" ], [ 305848, "u8", "wHsb" ], [ 306102, "u8", "6DR2jJ" ], [ 306248, "u8", "M_NW" ], [ 307721, "u8", "HVc4IA" ], [ 308455, "u8", "NPK4" ], [ 309104, "u8", ".qxm" ], [ 310442, "u8", "LRGTE" ], [ 310681, "u8", "RBRnE" ], [ 313433, "u8", "pdVLSZ" ], [ 314703, "u8", "Ysxf" ], [ 317015, "u8", "22vg" ], [ 318170, "u8", "w42o" ], [ 318902, "u8", "x v $jv" ], [ 319071, "u8", "hfKYf" ], [ 319813, "u8", "V9JY7" ], [ 320586, "u8", "1QZld" ], [ 320810, "u8", ".N6 A!T4Mf" ], [ 321211, "u8", "fpzCk" ], [ 321498, "u8", "egLq" ], [ 322915, "u8", "QKSZ" ], [ 325175, "u8", "BS2\u003e" ], [ 325291, "u8", "cy76" ], [ 326006, "u8", "IJS5e" ] ], "v": { "file.stem": "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1755540976, "file.basename": "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe", "pe.image_base": 4194304, "pe.image_size": 12734464, "pe.machine_id": 332, "pe.os_version": "6.0", "pe.entry_point": 11616, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 8168, "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.linker_major_version": 14, "pe.linker_minor_version": 44, "pe.signatures[0].issuer": "CN=StreamBlaze.Synergy,C=Italy,ST=Apulia,L=Lecce", "pe.signatures[0].serial": "0098f1d22399c415fa", "pe.signatures[0].subject": "CN=StreamBlaze.Synergy,C=Italy,ST=Apulia,L=Lecce", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2027-08-18T18:16:17Z", "pe.signatures[0].not_before": "2025-08-17T18:16:17Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 224, "pe.signatures[0].thumbprint_sha1": "550799c815ad76ec0de32e5d0d0113fb536528eb", "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "8f3462dd0c1be2c76bd57f1d3f2d6d14a8abb1235ad0afdfb168b92eb40c2eaa", "pe.signatures[0].thumbprint_sha256": "cce018fe79c9ea7c96f93e8685c12dbaf2b606409dc5ff1bbcdd9e2fbfe68598", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 12731880, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: StreamBlaze.Synergy", "e": [ "StreamBlaze.Synergy" ], "i": "metadata/signed/unknown::streamblaze.synergy", "l": 2 }, { "c": 1.0, "d": "Signed by StreamBlaze.Synergy", "e": [ "StreamBlaze.Synergy" ], "i": "metadata/signed/leaf::streamblaze.synergy", "l": 3 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA", "GetWindowsDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2, "el": [ "0x26d6e", "0x26d46" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.75, "d": "Get window device context", "e": [ "GetWindowDC" ], "i": "micro-behaviors/ui/window/manage/control::get-window-dc", "l": 2, "el": [ "0x270a4" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0xbbc96" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0xbbe3c" ] }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2, "el": [ "0x27288" ] }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "MoveToEx" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1, "el": [ "0x27216" ] }, { "c": 0.7799999713897705, "d": "Short CamelCase Run value token", "e": [ "N12On" ], "i": "objectives/persistence/login/registry/autostart::short-camel-on-run-value-token", "l": 1, "el": [ "0x2cf5bc" ] }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExW", "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform/locale::get-version-ex", "l": 2, "el": [ "0x26e22", "0x26da2" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ "(ID=", "[ID:" ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0xc0beb0", "0xc0c7d0" ] }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "\"Queue Connection opened to backup", ")Queue Connection opened to configuration", "(Storage Connection opened to monitoring", "$Storage Connection opened to update", "%SETTINGS Connection opened to update", "(Interface Connection opened to analysis", ",Interface Connection opened to verification", "-Security Connection opened to initialization", ")Engine Connection opened to optimization", ")Interface Connection opened to execution", "'Core Connection opened to optimization", "\u0026CACHE Connection opened to scheduling", ")Database Connection opened to processing", "*Interface Connection opened to monitoring", "+Settings Connection opened to optimization", ".Analytics Connection opened to optimization\u003e\u003e" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012", "el": [ "0xc104e8", "0xc0c830", "0xc0c0b0", "0xc11d16", "0xc10332", "0xc0d7a2", "0xc0de84", "0xc0e40c", "0xc11e12", "0xc0f6c0", "0xc0e07e", "0xc11666", "0xc11858", "0xc10fd0", "0xc11250", "0xc10664" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1486", "c": 1.0, "d": "Backup file extension", "e": [ ".Backup ", ".BACKUP " ], "i": "objectives/impact/ransom/native::ext-backup", "l": 1, "m": "C0027", "el": [ "0xc12f2a", "0xc1c8ce" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x19af2" ] }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2, "el": [ "0x27138" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathW", "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2, "el": [ "0x26e32", "0x26df4" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x199b8" ] }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA", "GetSystemDirectoryW" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2, "el": [ "0x26db2", "0x26e0c" ] }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz" ], "i": "micro-behaviors/dylib/library/family::xz-ref", "l": 2, "el": [ "0x50007" ] }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0xbbcf2" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetWindowTextLengthW", "GetSystemDirectoryA", "GetWindowTextLengthA", "GetSystemTimeAsFileTime", "GetTimeZoneInformation", "BitnovalabsClusterFlowManager", "GetWindowsDirectoryA", "GetWindowsDirectoryW", "QueryPerformanceFrequency", "GetSystemDirectoryW" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x26e72", "0x26db2", "0x270cc", "0x26d2c", "0x26dda", "0xbbfb0", "0x26d6e", "0x26d46", "0x26d86", "0x26e0c" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x19af2" ] }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 12731880 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cSettings Monitoring synchronization started at 09:40:29.037", "\u003cStorage Monitoring authentication started at 09:44:29.037\u003c\u003c" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1, "el": [ "0xc18826", "0xc108b6" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 } ], "sha": "c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-08/c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7.exe", "type": "pe" } ], "tv": "ca5ef" } }