{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T16:16:43Z" }, "path": "c456e8fa5cd496f1293870881ce5052a1e288ada68d414de521d64a782792792.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 229949.0, "icon_count": 2.0, "checksum_valid": 0.0, "resource_count": 3.0, "has_version_info": 1.0, "computed_checksum": 219233.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 203008.0, "entropy": 5.72, "size_bytes": 203008.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.56, "overlay_size": 5376.0, "string_count": 1121.0, "overlay_ratio": 0.03, "overlay_entropy": 7.26, "entropy_variance": 6.35, "avg_string_length": 111.41, "max_string_length": 34278.0, "code_to_data_ratio": 1.0, "string_length_stddev": 1149.11, "largest_section_ratio": 0.94, "sentence_string_count": 17.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 190976.0, "entropy_max": 5.56, "entropy_mean": 3.64, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 455, "u8", "@.reloc" ], [ 96724, "u8", "BSJB" ], [ 98136, "u8", "UInt32" ], [ 98143, "u8", "ToInt32" ], [ 98151, "u8", "\u003cModule\u003e" ], [ 98160, "u8", "LoadLibraryA" ], [ 98173, "u8", "System.IO" ], [ 98183, "u8", "ProjectData" ], [ 98195, "u8", "mscorlib" ], [ 98204, "u8", "System.Collections.Generic" ], [ 98231, "u8", "Microsoft.VisualBasic" ], [ 98257, "u8", "Versioned" ], [ 98267, "u8", "ReadToEnd" ], [ 98277, "u8", "Round" ], [ 98283, "u8", "set_Method" ], [ 98294, "u8", "CompareMethod" ], [ 98308, "u8", "Replace" ], [ 98316, "u8", "ToDouble" ], [ 98325, "u8", "AppWinStyle" ], [ 98337, "u8", "set_Name" ], [ 98346, "u8", "get_AccessibleName" ], [ 98365, "u8", "set_AccessibleName" ], [ 98384, "u8", "CallByName" ], [ 98395, "u8", "CallType" ], [ 98404, "u8", "SecurityProtocolType" ], [ 98425, "u8", "GetType" ], [ 98433, "u8", "WebResponse" ], [ 98445, "u8", "Create" ], [ 98452, "u8", "ComVisibleAttribute" ], [ 98472, "u8", "AssemblyTitleAttribute" ], [ 98495, "u8", "AssemblyTrademarkAttribute" ], [ 98522, "u8", "TargetFrameworkAttribute" ], [ 98547, "u8", "AssemblyFileVersionAttribute" ], [ 98576, "u8", "AssemblyDescriptionAttribute" ], [ 98605, "u8", "CompilationRelaxationsAttribute" ], [ 98637, "u8", "AssemblyProductAttribute" ], [ 98662, "u8", "AssemblyCopyrightAttribute" ], [ 98689, "u8", "AssemblyCompanyAttribute" ], [ 98714, "u8", "WriteByte" ], [ 98724, "u8", "ToByte" ], [ 98798, "u8", ".exe" ], [ 98803, "u8", "NewLateBinding" ], [ 98818, "u8", "System.Runtime.Versioning" ], [ 98844, "u8", "ToString" ], [ 98853, "u8", "GetString" ], [ 98863, "u8", "Math" ], [ 98868, "u8", "get_Length" ], [ 98879, "u8", "StartsWith" ], [ 98894, "u8", "Marshal" ], [ 98902, "u8", "Decimal" ], [ 98910, "u8", "Panel" ], [ 98916, "u8", "kernel32.dll" ], [ 98929, "u8", "Shell" ], [ 98935, "u8", "set_SecurityProtocol" ], [ 98956, "u8", "Control" ], [ 98964, "u8", "MemoryStream" ], [ 98977, "u8", "System" ], [ 98984, "u8", "Join" ], [ 98989, "u8", "Conversion" ], [ 99000, "u8", "Interaction" ], [ 99012, "u8", "System.Reflection" ], [ 99030, "u8", "MissingManifestResourceException" ], [ 99063, "u8", "StringComparison" ], [ 99080, "u8", "Button" ], [ 99087, "u8", "StreamReader" ], [ 99100, "u8", "System.Resources.ResourceManager" ], [ 99133, "u8", "ServicePointManager" ], [ 99153, "u8", "CreateProjectError" ], [ 99172, "u8", "ClearProjectError" ], [ 99190, "u8", "SetProjectError" ], [ 99206, "u8", ".ctor" ], [ 99212, "u8", ".cctor" ], [ 99219, "u8", "UIntPtr" ], [ 99227, "u8", "System.Runtime.InteropServices" ], [ 99258, "u8", "Microsoft.VisualBasic.CompilerServices" ], [ 99297, "u8", "System.Runtime.CompilerServices" ], [ 99329, "u8", "System.Resources" ], [ 99346, "u8", "Strings" ], [ 99354, "u8", "Equals" ], [ 99361, "u8", "System.Windows.Forms" ], [ 99382, "u8", "Contains" ], [ 99391, "u8", "Conversions" ], [ 99403, "u8", "StringSplitOptions" ], [ 99422, "u8", "GetProcAddress" ], [ 99437, "u8", "Concat" ], [ 99444, "u8", "Format" ], [ 99451, "u8", "Object" ], [ 99458, "u8", "VirtualProtect" ], [ 99473, "u8", "LateGet" ], [ 99481, "u8", "System.Net" ], [ 99492, "u8", "op_Explicit" ], [ 99504, "u8", "Split" ], [ 99510, "u8", "Convert" ], [ 99518, "u8", "WebRequest" ], [ 99529, "u8", "set_Timeout" ], [ 99541, "u8", "RichTextBox" ], [ 99553, "u8", "ToArray" ], [ 99561, "u8", "Copy" ], [ 99566, "u8", "Empty" ], [ 190363, "u8", "\\pg\u003eTpg\u003eTpgpg" ], [ 190587, "u8", "RSA1" ], [ 190736, "u8", ".NETFramework,Version=v4.0" ], [ 190767, "u8", "FrameworkDisplayName" ], [ 190788, "u8", ".NET Framework 4.7.2" ], [ 190812, "u8", "Opera Software" ], [ 190832, "u8", "Opera Internet Browser" ], [ 190860, "u8", "Copyright Opera Software 2020" ], [ 191454, "u8", "mscoree.dll" ], [ 196010, "wide", "VS_VERSION_INFO" ], [ 196102, "wide", "StringFileInfo" ], [ 196138, "wide", "040904b0" ], [ 196162, "wide", "Comments" ], [ 196180, "wide", "Opera Software" ], [ 196218, "wide", "CompanyName" ], [ 196282, "wide", "FileDescription" ], [ 196316, "wide", "Opera Internet Browser" ], [ 196370, "wide", "FileVersion" ], [ 196430, "wide", "LegalCopyright" ], [ 196460, "wide", "Copyright Opera Software 2020" ], [ 196526, "wide", "OriginalFilename" ], [ 196560, "wide", "Opera Internet Browser.exe" ], [ 196622, "wide", "ProductName" ], [ 196702, "wide", "ProductVersion" ], [ 196766, "wide", "Assembly Version" ], [ 196834, "wide", "LegalTrademarks" ], [ 196906, "wide", "VarFileInfo" ], [ 196938, "wide", "Translation" ], [ 196968, "u8", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ], [ 197698, "u8", "N0L0" ], [ 197873, "u8", "1705" ], [ 198019, "u8", "Guangzhou1" ], [ 198046, "u8", "201012053837Z" ], [ 198061, "u8", "211012053837Z0" ], [ 198452, "u8", "C0A0" ], [ 198595, "u8", "Q8maI" ], [ 199386, "u8", "20201012053838Z" ], [ 199477, "u8", "DigiCert Inc1" ], [ 199500, "u8", "www.digicert.com110/" ], [ 199526, "u8", "(DigiCert SHA2 Assured ID Timestamping CA0" ], [ 199586, "u8", "301017000000Z0L1" ], [ 199625, "u8", "DigiCert, Inc.1$0\"" ], [ 199650, "u8", "TIMESTAMP-SHA256-2019-10-150" ], [ 200083, "u8", "https://www.digicert.com/CPS0" ], [ 200132, "wide", "RAny use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability" ], [ 200556, "u8", "j0h02" ], [ 200566, "u8", ",http://crl3.digicert.com/sha2-assured-ts.crl02" ], [ 200618, "u8", ",http://crl4.digicert.com/sha2-assured-ts.crl0" ], [ 200694, "u8", "http://ocsp.digicert.com0O" ], [ 200731, "u8", "Chttp://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0" ], [ 201170, "u8", "www.digicert.com1$0\"" ], [ 201197, "u8", "DigiCert Assured ID Root CA0" ], [ 201228, "u8", "160107120000Z" ], [ 201243, "u8", "310107120000Z0r1" ], [ 201825, "u8", "http://ocsp.digicert.com0C" ], [ 201862, "u8", "7http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" ], [ 201937, "u8", "4http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:" ], [ 201997, "u8", "4http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P" ], [ 202058, "u8", "I0G08" ], [ 202497, "u8", "(DigiCert SHA2 Assured ID Timestamping CA" ], [ 202619, "u8", "201012053838Z0+" ] ], "v": { "file.stem": "c456e8fa5cd496f1293870881ce5052a1e288ada68d414de521d64a782792792", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 3482177349, "file.basename": "c456e8fa5cd496f1293870881ce5052a1e288ada68d414de521d64a782792792.exe", "pe.image_base": 4194304, "pe.image_size": 221184, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.version.os": "unknown", "pe.entry_point": 199150, "pe.headers_size": 512, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 5376, "pe.image_hash.sha1": "d132be53bee402391a498924f667cec0558717b9", "pe.version.company": "Opera Software", "pe.version.comments": "Opera Software", "pe.image_hash.sha256": "8fb64256936feb0b02ec658495e3be0f82d00f17ceaa95cb6a81007717316ed7", "pe.image_hash.sha384": "4d0e470bc07db45de8d47314bdf4c7a3ff05ac8fdaa86b4278f5a5689c69c0b4e6058ecfe279803562ccf4d105f1e62d", "pe.image_hash.sha512": "74215cb428c1263501b7f359d42ec785a3f66bf344bd489b716207a082e405da591994993ffb73ab51fe3fa4c0ba7707f561fec7f0a04380d8d33d3f2c5fbb09", "pe.resource_types[0]": "RT_ICON", "pe.resource_types[1]": "RT_GROUP_ICON", "pe.resource_types[2]": "RT_VERSION", "pe.section_alignment": 8192, "pe.subsystem_version": "6.0", "pe.version.copyright": "Copyright Opera Software 2020", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.version.trademarks": "Opera Software", "pe.characteristics_raw": 34, "pe.clr.runtime_version": "2.5", "pe.version.description": "Opera Internet Browser", "pe.linker_major_version": 48, "pe.signatures[0].issuer": "C=CN,L=Guangzhou,OU=Э尔尔维艾艾艾Э比比艾Э尔尔比维Э艾比比尔尔比维,O=Э艾Э比尔尔吉维维比比比比维维艾,CN=比艾Э维Э吉Э尔艾Э比比", "pe.signatures[0].serial": "384761846f149b8823b40fbb7dfe3289", "pe.version.file_version": "70.0.3728.189", "pe.version.product_name": "Opera Internet Browser", "pe.signatures[0].subject": "C=CN,L=Guangzhou,OU=Э尔尔维艾艾艾Э比比艾Э尔尔比维Э艾比比尔尔比维,O=Э艾Э比尔尔吉维维比比比比维维艾,CN=比艾Э维Э吉Э尔艾Э比比", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "no_seh", "pe.dll_characteristics[4]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 199060, "pe.data_directories[1].rva": 204800, "pe.data_directories[2].rva": 197632, "pe.data_directories[3].rva": 212992, "pe.data_directories[4].rva": 8192, "pe.data_directories[5].rva": 8200, "pe.dll_characteristics_raw": 34144, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-10-12T05:38:37Z", "pe.version.product_version": "70.0.3728.189", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 5480, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 5376, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 12, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 8, "pe.data_directories[5].name": "clr_runtime_header", "pe.data_directories[5].size": 72, "pe.signatures[0].not_before": "2020-10-12T05:38:37Z", "pe.signatures[0].self_issued": true, "pe.version.original_filename": "Opera Internet Browser.exe", "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "9ec5e2329f3c371939467c420de467585bcc555e", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "8fb64256936feb0b02ec658495e3be0f82d00f17ceaa95cb6a81007717316ed7", "pe.signatures[0].thumbprint_sha256": "4814d56141605254280da0179b3c472d7cc2f244d13add3147d112bdf40331d0", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 190976, 5.56, "r-x" ], [ ".rsrc", 191488, 5632, 5.29, "r--" ], [ ".reloc", 197120, 512, 0.08, "r--" ] ] }, "id": 0, "sz": 203008, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0x179d4" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0x179d4" ] }, { "c": 1.0, "d": "Authenticode chain CN: 比艾Э维Э吉Э尔艾Э比比", "e": [ "比艾Э维Э吉Э尔艾Э比比" ], "i": "metadata/signed/unknown::比艾э维э吉э尔艾э比比", "l": 2 }, { "c": 1.0, "d": "Signed by Э艾Э比尔尔吉维维比比比比维维艾", "e": [ "Э艾Э比尔尔吉维维比比比比维维艾" ], "i": "metadata/signed/leaf::э艾э比尔尔吉维维比比比比维维艾", "l": 3 }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0x30dc4" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "Copyright Opera Software 2020" ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1, "el": [ "value:pe.version.copyright" ] }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0x18421" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x3000e" ] }, { "c": 1.0, "d": "PE has RT_GROUP_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-group-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Opera Internet Browser" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1, "el": [ "value:pe.version.description" ] }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0x1839b" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x17ec1" ] }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "0x18050" ] }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "70.0.3728.189" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1121.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.949999988079071, "d": "DigiCert timestamp certificate chain", "e": [ "DigiCert SHA2 Assured ID Timestamping CA" ], "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain", "l": 2, "el": [ "0x30b66" ] }, { "a": "T1140", "c": 0.8999999761581421, "d": "VB LateGet dispatch token", "e": [ "LateGet" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token", "l": 1, "m": "B0030", "el": [ "0x18491" ] }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic.CompilerServices", "Microsoft.VisualBasic" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0x183ba", "0x17fb7" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Opera Internet Browser" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1, "el": [ "value:pe.version.product_name" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x2e83e" ] }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x2e98c" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x18264" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0x1845e" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Strings", "ToString", "StringComparison", "GetString", "StringSplitOptions", "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x18412", "0x1821c", "0x182f7", "0x18225", "0x1844b", "0x2fe06" ] }, { "a": "T1140", "c": 0.9200000166893005, "d": "VB NewLateBinding dispatch helper", "e": [ "NewLateBinding" ], "i": "objectives/command-and-control/dropper/staging/embedded::vb-newlatebinding", "l": 1, "m": "B0030", "el": [ "0x181f3" ] }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "System.Resources.ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0x1831c" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "c456e8fa5cd496f1293870881ce5052a1e288ada68d414de521d64a782792792.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 1121.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.56" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2, "el": [ "0x2fe7a" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0x30b66" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x2ebde" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x2ffae" ] }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0x2e910" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0x182c4" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x2fdaa" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0x18421" ] }, { "c": 1.0, "d": "PE has RT_ICON in resources list", "e": [ "[RT_ICON, RT_GROUP_ICON, RT_VERSION]" ], "i": "metadata/binary/resource::pe-resource-icon-list", "l": 2, "el": [ "value:pe.resource_types" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x181ee" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO", "System.Net" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0x17f7d", "0x18499" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8199999928474426, "d": "Repeated padding marker string block", "e": [ "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX", "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX" ], "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker", "l": 1, "el": [ "0x30168", "0x30168", "0x30168", "0x30168", "0x30168" ] }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2, "el": [ "0x2feba" ] }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0x17f93" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "c456e8fa5cd496f1293870881ce5052a1e288ada68d414de521d64a782792792.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "0x1831c" ] }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 2.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1121.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "c456e8fa5cd496f1293870881ce5052a1e288ada68d414de521d64a782792792.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1222.001", "c": 0.8999999761581421, "d": "Hidden VirtualProtect string reference", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect-text-pe", "l": 1, "el": [ "0x18482" ] }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 3.00" ], "i": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources", "l": 1 }, { "c": 0.7200000286102295, "d": "WinForms Button control token", "e": [ "Button" ], "i": "micro-behaviors/ui/controls/widget::winforms-button", "l": 1, "el": [ "0x18308" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1, "el": [ "0x17f70" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyFileVersionAttribute", "CompilationRelaxationsAttribute", "AssemblyTitleAttribute", "TargetFrameworkAttribute", "AssemblyDescriptionAttribute", "AssemblyProductAttribute", "ComVisibleAttribute", "AssemblyCompanyAttribute", "AssemblyCopyrightAttribute", "AssemblyTrademarkAttribute", "MissingManifestResourceException", "FrameworkDisplayName" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x180f3", "0x1812d", "0x180a8", "0x180da", "0x18110", "0x1814d", "0x18094", "0x18181", "0x18166", "0x180bf", "0x182d6", "0x2e92f" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 190976, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x2ffd0" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.94" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] } ], "sha": "c456e8fa5cd496f1293870881ce5052a1e288ada68d414de521d64a782792792", "path": "c456e8fa5cd496f1293870881ce5052a1e288ada68d414de521d64a782792792.exe", "type": "pe" } ], "tv": "176d6" } }