{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9005639553070068, "class": 0, "threshold": 0.9989520311355591 } ], "prob": 0.90056396, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.90056396, "class": 0 }, { "m": "az/native", "prob": 0.2942346, "class": 0 }, { "m": "az/pe", "prob": 0.020304568, "class": 0 } ], "version": "v17.17", "threshold": 0.99895203, "analyzed_at": "2026-05-30T00:23:37Z" }, "path": "c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c.exe", "raw": { "v": "5", "fs": [ { "f": "O(As)H(Cm)Md", "x": 40, "ff": { "i": [ [ "msvcrt", "memset" ], [ "msvcrt", "printf" ], [ "msvcrt", "memcpy" ], [ "msvcrt", "memmove" ], [ "msvcrt", "rand" ], [ "msvcrt", "wcslen" ], [ "msvcrt", "strcmp" ], [ "msvcrt", "srand" ], [ "msvcrt", "strtol" ], [ "msvcrt", "wsystem" ], [ "msvcrt", "vsnprintf" ], [ "msvcrt", "vsnwprintf" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "controlfp" ], [ "msvcrt", "argc" ], [ "msvcrt", "argv" ], [ "msvcrt", "environ" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "exit" ], [ "kernel32", "FileTimeToSystemTime" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "HeapSize" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "GetLastError" ], [ "kernel32", "Sleep" ], [ "kernel32", "WriteFile" ], [ "kernel32", "HeapFree" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "SleepEx" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "ExpandEnvironmentStringsW" ], [ "ntdll", "NtQuerySystemInformation" ], [ "ntdll", "RtlGetNtVersionNumbers" ], [ "winhttp", "WinHttpOpen" ], [ "winhttp", "WinHttpConnect" ], [ "winhttp", "WinHttpOpenRequest" ], [ "winhttp", "WinHttpSendRequest" ], [ "winhttp", "WinHttpReceiveResponse" ], [ "winhttp", "WinHttpQueryDataAvailable" ], [ "winhttp", "WinHttpReadData" ], [ "winhttp", "WinHttpCloseHandle" ], [ "bcrypt", "BCryptEnumProviders" ], [ "bcrypt", "BCryptFinalizeKeyPair" ], [ "bcrypt", "BCryptFreeBuffer" ], [ "bcrypt", "BCryptGenRandom" ], [ "bcrypt", "BCryptHashData" ] ], "m": { "pe": { "checksum": 44016.0, "checksum_valid": 1.0, "computed_checksum": 44016.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 12288.0, "entropy": 5.09, "size_bytes": 12288.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.12, "data_entropy": 4.06, "string_count": 102.0, "entropy_variance": 2.22, "avg_string_length": 12.63, "max_string_length": 77.0, "code_to_data_ratio": 0.73, "string_length_stddev": 10.3, "largest_section_ratio": 0.67, "sentence_string_count": 4.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 48.0 }, "sections": { "count": 3.0, "code_size": 8192.0, "entropy_max": 5.12, "entropy_mean": 3.58, "name_entropy": 2.58, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 5.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 392, "u8", ".text" ], [ 472, "u8", ".pdata" ], [ 7248, "u8", "M H9" ], [ 8770, "url", "\u0002i\u0002i\u0002i\u0002i\u0002i\u0002i\u0003i" ], [ 8808, "wide", "%c%c%c%c" ], [ 8850, "u8", "v5.mrmpzjjhn3sgtq5w.pro" ], [ 8902, "url", "t/v5/%hs/%hs/%hs/\u0006llx\u0006llx/\u0006x/%ls.bin" ], [ 8988, "u8", "ERROR %lu in #%i" ], [ 9034, "u8", "/~isapi/isapiv5.dll/v5/ucph/yzxt/240602043720407/000bd2001063/000007/kjig.bin" ], [ 9184, "u8", "TrollAV/5.0" ], [ 9394, "u8", "Retrying %ls" ], [ 9410, "wide", "%%tmp%%\\%hs.exe" ], [ 9442, "u8", "http://%ls%ls --\u003e %ls" ], [ 9464, "wide", "%s %06x" ], [ 9497, "u8", "Grupa Sendbajt, User Id: %s" ], [ 9527, "u8", "2086378643" ], [ 9538, "u8", "d1=%s, executing..." ], [ 9569, "u8", "d3=%s, executing..." ], [ 9600, "u8", "d5=%s, executing..." ], [ 9631, "u8", "d9=%s, executing..." ], [ 9662, "u8", "da=%s, executing..." ], [ 10664, "u8", "msvcrt.dll" ], [ 10677, "u8", "memset" ], [ 10686, "u8", "printf" ], [ 10695, "u8", "memcpy" ], [ 10704, "u8", "memmove" ], [ 10721, "u8", "wcslen" ], [ 10747, "u8", "strtol" ], [ 10756, "u8", "_wsystem" ], [ 10767, "u8", "_vsnprintf" ], [ 10780, "u8", "_vsnwprintf" ], [ 10794, "u8", "__set_app_type" ], [ 10811, "u8", "_controlfp" ], [ 10824, "u8", "__argc" ], [ 10833, "u8", "__argv" ], [ 10842, "u8", "_environ" ], [ 10853, "u8", "__getmainargs" ], [ 10869, "u8", "exit" ], [ 10874, "u8", "kernel32.dll" ], [ 10889, "u8", "FileTimeToSystemTime" ], [ 10912, "u8", "GetProcessHeap" ], [ 10929, "u8", "HeapAlloc" ], [ 10941, "u8", "HeapSize" ], [ 10952, "u8", "HeapReAlloc" ], [ 10966, "u8", "CreateFileW" ], [ 10980, "u8", "GetLastError" ], [ 10995, "u8", "Sleep" ], [ 11003, "u8", "WriteFile" ], [ 11015, "u8", "HeapFree" ], [ 11026, "u8", "CloseHandle" ], [ 11040, "u8", "SleepEx" ], [ 11050, "u8", "GetCommandLineW" ], [ 11068, "u8", "ExpandEnvironmentStringsW" ], [ 11094, "u8", "ntdll.dll" ], [ 11106, "u8", "NtQuerySystemInformation" ], [ 11133, "u8", "RtlGetNtVersionNumbers" ], [ 11156, "u8", "winhttp.dll" ], [ 11170, "u8", "WinHttpOpen" ], [ 11184, "u8", "WinHttpConnect" ], [ 11201, "u8", "WinHttpOpenRequest" ], [ 11222, "u8", "WinHttpSendRequest" ], [ 11243, "u8", "WinHttpReceiveResponse" ], [ 11268, "u8", "WinHttpQueryDataAvailable" ], [ 11296, "u8", "WinHttpReadData" ], [ 11314, "u8", "WinHttpCloseHandle" ], [ 11333, "u8", "bcrypt.dll" ], [ 11346, "u8", "BCryptEnumProviders" ], [ 11368, "u8", "BCryptFinalizeKeyPair" ], [ 11392, "u8", "BCryptFreeBuffer" ], [ 11411, "u8", "BCryptGenRandom" ], [ 11429, "u8", "BCryptHashData" ] ], "v": { "file.stem": "c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c", "pe.imphash": "dfa65e24b8e7fdb69f6a45a8b3fe2339", "pe.machine": "x86_64", "pe.subsystem": "windows_cui", "file.basename": "c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c.exe", "pe.image_base": 4194304, "pe.image_size": 20480, "pe.machine_id": 34404, "pe.os_version": "4.0", "pe.entry_point": 11520, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.file_alignment": 512, "pe.image_hash.sha1": "d4117f00dfd4d10db1eaf95a707503e6c1fea625", "pe.image_hash.sha256": "94722f2efdaa45c52da081ae5ed0b2f108758414a9ad2e1062f8d906f55c9607", "pe.image_hash.sha384": "7a7d800a6e925155cc7fc38baf14315e8fcc7206e802108869905780ff730d3bedd779de64a02855ed63a79a22cc2256", "pe.image_hash.sha512": "c955286d3b4f7188d52ceb88bced8912661f12a25231e8e0e700c8352f13ff1e6923e41a08bb2f1a95e921cb3e16c629964b4652194f4f67290d6c8dee73d089", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "large_address_aware", "pe.characteristics_raw": 559, "pe.linker_major_version": 6, "pe.data_directories[0].rva": 13280, "pe.data_directories[1].rva": 16384, "pe.data_directories[2].rva": 13400, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "exception", "pe.data_directories[1].size": 192, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 424, "pe.coff.dos_header_pe_pointer": 128 }, "id": "pe", "sc": [ [ ".text", 512, 8192, 5.12, "r-x" ], [ ".data", 8704, 3072, 4.06, "rw-" ], [ ".pdata", 11776, 512, 1.56, "r--" ] ] }, "id": 0, "sz": 12288, "ts": [ { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory copy operation", "e": [ "memcpy" ], "i": "micro-behaviors/mem/c-runtime/functions::memcpy", "l": 2, "el": [ "0x3468" ] }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 3072)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.9900000095367432, "d": "WINHTTP.dll string", "e": [ "WINHTTP.dll" ], "i": "objectives/command-and-control/dropper/elex-loader::winhttp-dll-string", "l": 1, "el": [ "0x2b94" ] }, { "a": "T1071.001", "c": 0.800000011920929, "d": "Close WinHTTP handle object", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle", "l": 3, "m": "C0002", "el": [ "0x35c0" ] }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Read WinHTTP response body", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data", "l": 3, "m": "C0002", "el": [ "0x35b8" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Connect WinHTTP to remote host", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-connect", "l": 3, "m": "C0002", "el": [ "0x3590" ] }, { "c": 0.8999999761581421, "d": "Heap memory allocation", "e": [ "HeapAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "l": 2, "el": [ "0x3508" ] }, { "c": 0.8999999761581421, "d": "Wide string length", "e": [ "wcslen" ], "i": "micro-behaviors/data/string/library::wcslen", "l": 2, "el": [ "0x3480" ] }, { "c": 0.8999999761581421, "d": "Heap memory deallocation", "e": [ "HeapFree" ], "i": "micro-behaviors/mem/alloc/heap::heap-free", "l": 2, "el": [ "0x3540" ] }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2, "el": [ "0x3530" ] }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query system information", "e": [ "NtQuerySystemInformation" ], "i": "micro-behaviors/os/exception/handler::query-system-information", "l": 2, "m": "C0046", "el": [ "0x3570" ] }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineW" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2, "el": [ "0x3558" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Send WinHTTP request to server", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request", "l": 3, "m": "C0002", "el": [ "0x35a0" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Heap memory reallocation", "e": [ "HeapReAlloc" ], "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "l": 2, "el": [ "0x3518" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP read API string reference", "e": [ "WinHttpReadData" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data-text", "l": 1, "m": "C0002", "el": [ "0x2c20" ] }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1, "el": [ "0x3498" ] }, { "c": 0.8999999761581421, "d": "Formatted console output", "e": [ "printf" ], "i": "micro-behaviors/os/stdio::printf", "l": 2, "el": [ "0x3460" ] }, { "c": 0.8799999952316284, "d": "Small string table footprint", "e": [ "binary.string_count = 102.00" ], "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table", "l": 1 }, { "c": 0.8999999761581421, "d": "Convert FILETIME to SYSTEMTIME", "e": [ "FileTimeToSystemTime" ], "i": "micro-behaviors/time/query::filetime-to-systemtime", "l": 2, "el": [ "0x34f8" ] }, { "c": 0.699999988079071, "d": "Windows %TEMP% or %TMP% environment reference", "e": [ "%tmp%" ], "i": "micro-behaviors/fs/path/temp::win-temp-env", "l": 2, "el": [ "0x24c2" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP send request text reference", "e": [ "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request-text", "l": 1, "m": "C0002", "el": [ "0x2bd6" ] }, { "c": 0.8999999761581421, "d": "Memory fill operation", "e": [ "memset" ], "i": "micro-behaviors/mem/c-runtime/functions::memset", "l": 2, "el": [ "0x3458" ] }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "0x3520" ] }, { "c": 0.8999999761581421, "d": "String comparison", "e": [ "strcmp" ], "i": "micro-behaviors/data/string/library::strcmp", "l": 2, "el": [ "0x3488" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "ntdll.dll" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2, "el": [ "0x2b56" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2, "el": [ "0x2b12" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP request API string reference", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request-text", "l": 1, "m": "C0002", "el": [ "0x2bc1" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x24c2" ] }, { "a": "T1071.001", "c": 0.8199999928474426, "d": "WinHTTP close-handle API string", "e": [ "WinHttpCloseHandle" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle-text", "l": 1, "m": "C0002", "el": [ "0x2c32" ] }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Query WinHTTP buffered response bytes", "e": [ "WinHttpQueryDataAvailable" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-data-available", "l": 3, "m": "C0002", "el": [ "0x35b0" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Create WinHTTP HTTP request handle", "e": [ "WinHttpOpenRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request", "l": 3, "m": "C0002", "el": [ "0x3598" ] }, { "c": 0.8999999761581421, "d": "Get process heap handle", "e": [ "GetProcessHeap" ], "i": "micro-behaviors/mem/alloc/heap::get-process-heap", "l": 2, "el": [ "0x3500" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0xe3e" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Memory move with overlap", "e": [ "memmove" ], "i": "micro-behaviors/mem/c-runtime/functions::memmove", "l": 2, "el": [ "0x3470" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Initialize WinHTTP session", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open", "l": 3, "m": "C0002", "el": [ "0x3588" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 48.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP connect API string reference", "e": [ "WinHttpConnect" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-connect-text", "l": 1, "m": "C0002", "el": [ "0x2bb0" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP query-data API string reference", "e": [ "WinHttpQueryDataAvailable" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-query-data-available-text", "l": 1, "m": "C0002", "el": [ "0x2c04" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Receive WinHTTP server response", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response", "l": 3, "m": "C0002", "el": [ "0x35a8" ] }, { "a": "T1071.001", "c": 0.8799999952316284, "d": "WinHTTP DLL name string reference", "e": [ "winhttp.dll" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-dll-name-text", "l": 1, "m": "C0002", "el": [ "0x2b94" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x234a" ] }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP receive response text reference", "e": [ "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response-text", "l": 1, "m": "C0002", "el": [ "0x2beb" ] }, { "c": 0.8999999761581421, "d": "Windows BCrypt DLL name", "e": [ "bcrypt.dll" ], "i": "micro-behaviors/crypto/symmetric/aes/cng::bcrypt-dll-name", "l": 1, "m": "C0021", "el": [ "0x2c45" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.8399999737739563, "d": "WinHTTP open API string reference", "e": [ "WinHttpOpen" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-open-text", "l": 1, "m": "C0002", "el": [ "0x2ba2" ] }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2, "el": [ "0x3538" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".pdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2, "el": [ "0x3528" ] }, { "c": 0.20000000298023224, "d": "tmp keyword", "e": [ "tmp" ], "i": "micro-behaviors/data/text/keywords/lexicon::tmp", "l": 1, "el": [ "0x24c2" ] }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 102.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "CTS CreateFileW import", "e": [ "CreateFileW" ], "i": "well-known/malware/worm/cts::create-file-w-import", "l": 1, "el": [ "0x3520" ] }, { "a": "T1620", "c": 0.8199999928474426, "d": "RegPhantom compact driver size", "e": [ "c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c.exe" ], "i": "well-known/malware/rootkit/regphantom::compact-callback-driver-size", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ExpandEnvironmentStringsW" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x2b3c" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "FileTimeToSystemTime", "WinHttpQueryDataAvailable" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x2a89", "0x2c04" ] }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x2a7a" ] }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x24c2" ] }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 12288 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2, "el": [ "0x2ad6" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 48.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1562.001", "c": 1.0, "d": "ntdll.dll string reference", "e": [ "ntdll.dll" ], "i": "objectives/evasion/anti-av/platform/defender::ntdll-dll-str", "l": 1, "el": [ "0x2b56" ] }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 48.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 48.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027.007", "c": 1.0, "d": "ntdll.dll as wide string (runtime resolver)", "e": [ "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::ntdll-wide-string", "l": 1, "m": "B0032.014", "el": [ "0x2b56" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.67" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links ntdll (NtQuerySystemInformation, RtlGetNtVersionNumbers)", "e": [ "ntdll" ], "i": "metadata/dylib::ntdll", "l": 2, "el": [ "2 symbols" ] }, { "c": 0.949999988079071, "d": "links winhttp (WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, WinHttpSendRequest, WinHttpReceiveResponse, ... +3 more)", "e": [ "winhttp" ], "i": "metadata/dylib::winhttp", "l": 2, "el": [ "8 symbols" ] }, { "c": 0.949999988079071, "d": "links kernel32 (FileTimeToSystemTime, GetProcessHeap, HeapAlloc, HeapSize, HeapReAlloc, ... +9 more)", "e": [ "kernel32" ], "i": "metadata/dylib::kernel32", "l": 2, "el": [ "14 symbols" ] }, { "c": 0.949999988079071, "d": "links msvcrt (memset, printf, memcpy, memmove, rand, ... +14 more)", "e": [ "msvcrt" ], "i": "metadata/dylib::msvcrt", "l": 2, "el": [ "19 symbols" ] }, { "c": 0.949999988079071, "d": "links bcrypt (BCryptEnumProviders, BCryptFinalizeKeyPair, BCryptFreeBuffer, BCryptGenRandom, BCryptHashData)", "e": [ "bcrypt" ], "i": "metadata/dylib::bcrypt", "l": 2, "el": [ "5 symbols" ] }, { "a": "T1071.001", "c": 0.9300000071525574, "d": "Dynamically resolved WinHTTP downloader flow", "e": [ "WinHttpOpen", "WinHttpReceiveResponse", "WinHttpQueryDataAvailable", "WinHttpReadData", "winhttp.dll", "WinHttpConnect", "WinHttpCloseHandle", "WinHttpOpenRequest", "WinHttpSendRequest" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-downloader-flow-text", "l": 3, "m": "C0002", "el": [ "0x2ba2", "0x2beb", "0x2c04", "0x2c20", "0x2b94", "0x2bb0", "0x2c32", "0x2bc1", "0x2bd6" ] }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "WinHTTP request response data flow", "e": [ "WinHttpOpenRequest", "WinHttpReadData", "WinHttpSendRequest", "WinHttpQueryDataAvailable", "WinHttpReceiveResponse" ], "i": "micro-behaviors/communications/http/client/winhttp::winhttp-request-flow", "l": 3, "m": "C0002", "el": [ "0x3598", "0x35b8", "0x35a0", "0x35b0", "0x35a8" ] }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "Runtime API string decryption (DLL names without loader imports)", "e": [ "imports.count = 48.00", "kernel32.dll", "ntdll.dll" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::runtime-api-decryption", "l": 4, "m": "B0032.014", "el": [ "", "0x2a7a", "0x2b56" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "\u003cbinary data\u003e \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3, "el": [ "offset:8902" ] } ], "sha": "c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2024-06/c4c0ea837ac1cf899db4cfedf2fc23d0d183d35707e59bd47ac0c394738f8f6c.exe", "type": "pe" } ], "tv": "ca5ef" } }