{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.999538779258728, "class": 1 } ], "prob": 0.9995388, "class": 1, "models": [ { "m": "az", "prob": 0.9758908, "class": 0 }, { "m": "az/native", "prob": 0.9961278, "class": 0 }, { "m": "az/pe", "prob": 0.9995388, "class": 1 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T15:06:21Z" }, "path": "500109", "raw": { "v": "4", "fs": [ { "f": "KO₁₂(Er₃P₃Al₃As₄C₁₀CaDyEu₂I₆La₂S₂Xe)H₇(MgOs₂Cm₁₁Cr₃Db₂DsPo₃)Md₆(Bi₈SiBkPa₂)", "k": { "hashes.imphash": "f0070935b15a909b9dc00be7997e6112", "build.target_arch": "x86", "pe.linker_version": "3.0", "pe.timestamp_is_zero": true, "binary.top_complex_unnamed[0].cc": 24, "binary.top_complex_unnamed[0].bbs": 26, "binary.top_complex_unnamed[0].addr": "0x44d7a0", "binary.top_complex_unnamed[0].size": 468 }, "x": 140, "id": 0, "is": [ "WriteFile", "WriteConsoleW", "WaitForSingleObject", "VirtualQuery", "VirtualFree", "VirtualAlloc", "SwitchToThread", "SetWaitableTimer", "SetUnhandledExceptionFilter", "SetProcessPriorityBoost", "SetEvent", "SetErrorMode", "SetConsoleCtrlHandler", "LoadLibraryA", "LoadLibraryW", "GetSystemInfo", "GetSystemDirectoryA", "GetStdHandle", "GetQueuedCompletionStatus", "GetProcessAffinityMask", "GetProcAddress", "GetEnvironmentStringsW", "GetConsoleMode", "FreeEnvironmentStringsW", "ExitProcess", "DuplicateHandle", "CreateThread", "CreateIoCompletionPort", "CreateEventA", "CloseHandle", "AddVectoredExceptionHandler" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "image_base": 4194304.0, "entry_section": ".text", "size_of_image": 4616192.0, "file_alignment": 512.0, "characteristics": 771.0, "entry_point_rva": 318240.0, "size_of_headers": 4096.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 1.0, "computed_checksum": 4548610.0, "section_alignment": 4096.0, "timestamp_anomaly": true, "timestamp_is_zero": true, "number_of_sections": 5.0, "resource_timestamp": 0.0, "linker_major_version": 3.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 4511744.0 }, "binary": { "code_size": 2005504.0, "func_count": 3.0, "entry_point": 318240.0, "code_entropy": 6.06, "data_entropy": 4.98, "func_density": 0.0, "import_count": 31.0, "string_count": 4636.0, "avg_func_size": 3313.67, "section_count": 5.0, "avg_complexity": 11.33, "import_density": 0.02, "max_complexity": 24.0, "string_density": 2.37, "overall_entropy": 4.21, "avg_basic_blocks": 14.0, "avg_section_size": 902144.0, "dependency_count": 1.0, "entropy_variance": 2.32, "avg_string_length": 23.7, "complexity_per_kb": 0.01, "max_string_length": 26116.0, "wide_string_count": 11.0, "writable_sections": 2.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 0.8, "data_to_file_ratio": 0.04, "entry_point_is_rva": true, "text_to_file_ratio": 0.44, "total_basic_blocks": 42.0, "executable_sections": 1.0, "func_analysis_depth": 2.0, "high_entropy_strings": 2.0, "string_length_stddev": 389.15, "largest_section_ratio": 0.51, "sentence_string_count": 496.0, "sentence_string_ratio": 0.11, "behavioral_import_ratio": 0.13, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 455, "@.data" ], [ 496, ".idata" ], [ 536, ".symtab" ], [ 2010103, "main" ], [ 2010127, "time" ], [ 2010757, "Zone" ], [ 2010771, "aead" ], [ 2010778, "algo" ], [ 2010806, "auth" ], [ 2010813, "base" ], [ 2010820, "bias" ], [ 2010897, "code" ], [ 2010939, "data" ], [ 2010946, "date" ], [ 2010953, "dial" ], [ 2010974, "done" ], [ 2011016, "elem" ], [ 2011023, "emit" ], [ 2011044, "eofc" ], [ 2011065, "fail" ], [ 2011079, "feed" ], [ 2011086, "file" ], [ 2011170, "free" ], [ 2011205, "goid" ], [ 2011254, "head" ], [ 2011289, "idle" ], [ 2011296, "info" ], [ 2011303, "init" ], [ 2011324, "ipad" ], [ 2011331, "itoa" ], [ 2011380, "line" ], [ 2011401, "load" ], [ 2011422, "make" ], [ 2011464, "mode" ], [ 2011478, "mono" ], [ 2011485, "more" ], [ 2011492, "move" ], [ 2011513, "name" ], [ 2011562, "node" ], [ 2011576, "note" ], [ 2011618, "once" ], [ 2011632, "open" ], [ 2011667, "path" ], [ 2011786, "read" ], [ 2011828, "root" ], [ 2011849, "rune" ], [ 2011891, "seal" ], [ 2011898, "seek" ], [ 2011905, "seen" ], [ 2011912, "sema" ], [ 2011940, "size" ], [ 2012017, "tail" ], [ 2012024, "take" ], [ 2012038, "test" ], [ 2012045, "text" ], [ 2012052, "time" ], [ 2012066, "trie" ], [ 2012108, "used" ], [ 2012115, "user" ], [ 2012150, "wait" ], [ 2012157, "wake" ], [ 2012213, "zero" ], [ 2012227, "zone" ], [ 2018587, "bufio" ], [ 2019339, "align" ], [ 2019347, "alloc" ], [ 2019363, "anon0" ], [ 2019371, "arena" ], [ 2019379, "array" ], [ 2019395, "build" ], [ 2019419, "cache" ], [ 2019427, "cause" ], [ 2019491, "clear" ], [ 2019499, "clone" ], [ 2019507, "close" ], [ 2019531, "codes" ], [ 2019547, "count" ], [ 2019555, "csema" ], [ 2019571, "datap" ], [ 2019579, "delay" ], [ 2019587, "delta" ], [ 2019595, "dense" ], [ 2019603, "dialc" ], [ 2019619, "donec" ], [ 2019635, "edata" ], [ 2019659, "equal" ], [ 2019667, "erase" ], [ 2019683, "errno" ], [ 2019691, "error" ], [ 2019699, "etext" ], [ 2019707, "evict" ], [ 2019731, "extra" ], [ 2019739, "final" ], [ 2019803, "frame" ], [ 2019811, "freem" ], [ 2019819, "frees" ], [ 2019851, "group" ], [ 2019867, "hash0" ], [ 2019875, "heap0" ], [ 2019883, "heap1" ], [ 2019891, "heap2" ], [ 2019899, "hello" ], [ 2019907, "idxhi" ], [ 2019915, "idxlo" ], [ 2019923, "incgo" ], [ 2019931, "index" ], [ 2019939, "inner" ], [ 2019947, "input" ], [ 2019955, "inter" ], [ 2019963, "inuse" ], [ 2019971, "is224" ], [ 2020027, "isdir" ], [ 2020043, "isutc" ], [ 2020059, "label" ], [ 2020075, "large" ], [ 2020083, "level" ], [ 2020091, "limit" ], [ 2020107, "local" ], [ 2020139, "midle" ], [ 2020155, "minus" ], [ 2020171, "mpool" ], [ 2020179, "mutex" ], [ 2020211, "ndone" ], [ 2020227, "nfree" ], [ 2020259, "nonce" ], [ 2020267, "npage" ], [ 2020283, "nrune" ], [ 2020299, "nwait" ], [ 2020307, "on100" ], [ 2020315, "outer" ], [ 2020323, "param" ], [ 2020347, "pidle" ], [ 2020371, "pread" ], [ 2020379, "probe" ], [ 2020387, "proto" ], [ 2020411, "quest" ], [ 2020419, "queue" ], [ 2020483, "reset" ], [ 2020491, "reuse" ], [ 2020515, "round" ], [ 2020523, "rsema" ], [ 2020539, "runes" ], [ 2020571, "seges" ], [ 2020659, "slice" ], [ 2020667, "space" ], [ 2020683, "spine" ], [ 2020707, "state" ], [ 2020723, "suite" ], [ 2020731, "sweep" ], [ 2020747, "table" ], [ 2020771, "timer" ], [ 2020779, "trace" ], [ 2020787, "treap" ], [ 2020835, "valid" ], [ 2020843, "value" ], [ 2020875, "wbuf1" ], [ 2020883, "wbuf2" ], [ 2020899, "write" ], [ 2020907, "wsema" ], [ 2020915, "crypto" ], [ 2020931, "errors" ], [ 2020947, "regexp" ], [ 2022018, "_defer" ], [ 2022027, "_panic" ], [ 2022036, "accept" ], [ 2022045, "active" ], [ 2022090, "allocs" ], [ 2022108, "append" ], [ 2022117, "arenas" ], [ 2022135, "arglen" ], [ 2022144, "argmap" ], [ 2022162, "attach" ], [ 2022171, "binder" ], [ 2022189, "bitmap" ], [ 2022198, "broken" ], [ 2022207, "bucket" ], [ 2022216, "buffer" ], [ 2022234, "cached" ], [ 2022243, "cancel" ], [ 2022252, "chains" ], [ 2022261, "chunks" ], [ 2022270, "cipher" ], [ 2022279, "client" ], [ 2022288, "closed" ], [ 2022297, "common" ], [ 2022306, "concat" ], [ 2022315, "condfn" ], [ 2022324, "config" ], [ 2022333, "cookie" ], [ 2022351, "cutoff" ], [ 2022360, "cutset" ], [ 2022369, "cycles" ], [ 2022378, "decref" ], [ 2022387, "delete" ], [ 2022405, "digest" ], [ 2022423, "divmod" ], [ 2022441, "domain" ], [ 2022459, "efence" ], [ 2022468, "eflags" ], [ 2022477, "encode" ], [ 2022486, "etypes" ], [ 2022495, "exited" ], [ 2022504, "expand" ], [ 2022513, "factor" ], [ 2022522, "family" ], [ 2022531, "fields" ], [ 2022540, "finder" ], [ 2022567, "fnonce" ], [ 2022576, "frames" ], [ 2022594, "future" ], [ 2022603, "gc_sys" ], [ 2022612, "gcdata" ], [ 2022639, "handle" ], [ 2022648, "hangul" ], [ 2022666, "hevent" ], [ 2022720, "incref" ], [ 2022729, "inflow" ], [ 2022738, "insert" ], [ 2022747, "int31n" ], [ 2022756, "intbuf" ], [ 2022810, "isdone" ], [ 2022828, "labels" ], [ 2022837, "layout" ], [ 2022846, "length" ], [ 2022855, "lineno" ], [ 2022864, "locabs" ], [ 2022873, "lookup" ], [ 2022891, "mapped" ], [ 2022900, "mcache" ], [ 2022909, "mcount" ], [ 2022918, "method" ], [ 2022927, "misses" ], [ 2022945, "nbytes" ], [ 2022954, "nchunk" ], [ 2022963, "needed" ], [ 2022972, "nelems" ], [ 2022981, "newval" ], [ 2022990, "nmidle" ], [ 2023008, "noscan" ], [ 2023017, "notify" ], [ 2023026, "npages" ], [ 2023035, "npidle" ], [ 2023044, "num1xx" ], [ 2023062, "nwrite" ], [ 2023071, "offset" ], [ 2023080, "oldnew" ], [ 2023089, "oldval" ], [ 2023116, "opaque" ], [ 2023134, "palloc" ], [ 2023143, "params" ], [ 2023152, "parent" ], [ 2023161, "parked" ], [ 2023170, "pcfile" ], [ 2023179, "period" ] ], "sz": 4511744, "ts": [ { "c": 0.6000000238418579, "d": "Compile() call", "e": [ "Compile(" ], "i": "micro-behaviors/data/db/linq::compile-call", "l": 3 }, { "d": "net/http package import", "e": [ "…qnanotime returning zeronet/http: abort Handlernetwork n…", "internal/x/net/http/httpproxy", "net/http.(*b", "net/http.readSetCookies", "net/http/internal", "internal/x/net/http2/hpack.(*Decoder).parseHeaderFieldRepr", "…neSets odd length []runenet/http: TLS handshake timeoutn…", "net/http.http2SettingID.String", "internal/x/net/http2/hpack.(*dynamicTable).add", "…/http: invalid method %qnet/http: use last responsenot a…", "net/http.http2connError.Error", "…me not unique on networknet/http: request canceledno CSI…", "net/http.(*http2Framer).WriteDataPadded", "net/http.http2FrameHeader.String", "…d allocation in sysAllocnet/http: skip alternate protoco…", "internal/x/net/http2/hpack.(*headerFieldTable).idToIndex" ], "i": "objectives/command-and-control/beacon/poll::net-http-import", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "Go binary uses os/exec", "e": [ "os/exec.(*Error).Error", "os/exec", "os/exec.(*Cmd).Wait", "os/exec.(*Cmd).Start.func2", "os/exec.(*Cmd).Start.func1" ], "i": "micro-behaviors/process/create/system::go-os-exec-pclntab", "l": 2, "m": "E1059" }, { "c": 0.699999988079071, "d": "Go bytes.Buffer I/O", "e": [ ".WriteTo" ], "i": "micro-behaviors/data/buffer::go-bytes-buffer-io", "l": 2 }, { "a": "T1547.001", "c": 0.7799999713897705, "d": "Scheduled task ONLOGON trigger", "e": [ "/SC ONLOGON" ], "i": "objectives/persistence/login/scheduled-task/cli::schtasks-onlogon-trigger", "l": 4 }, { "c": 0.8500000238418579, "d": "Direct NT API access", "e": [ "…hablenotesleep not on g0ntdll.dll not foundnwait \u003e wo…" ], "i": "micro-behaviors/os/syscall/invoke::ntdll-import", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "c": 0.8399999737739563, "d": "Large binary with few imports", "e": [ "binary.import_count = 31.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.8999999761581421, "d": "Get console input/output mode", "e": [ "GetConsoleMode" ], "i": "micro-behaviors/fs/file/handle::get-console-mode", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.699999988079071, "d": "Go socksCommand string", "e": [ "*http.socksCommand" ], "i": "objectives/command-and-control/channel/tunnel/proxy::go-socks-cmd", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 31.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1547.001", "c": 0.699999988079071, "d": "schtasks /create command", "e": [ "schtasks /CREATE" ], "i": "objectives/persistence/login/scheduled-task/cli::schtasks-create-cmd", "l": 4 }, { "c": 0.8500000238418579, "d": "Go XOR stream operations", "e": [ "XORKeyStream" ], "i": "objectives/command-and-control/backdoor/dispatch/shell::go-xor-encoding", "l": 1, "m": "B0030" }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext exec command token", "e": [ "exec" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-exec-command-token", "l": 1, "m": "B0025" }, { "a": "T1547.001", "c": 0.7799999713897705, "d": "Scheduled task highest runlevel", "e": [ "/RL HIGHEST" ], "i": "objectives/persistence/login/scheduled-task/cli::schtasks-runlevel-highest", "l": 4 }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "chacha20poly1305: ciphertext too large", "ciphertext" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-1", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 4636.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.9200000166893005, "d": "DNP3 link-layer sync header bytes", "e": [ "43 03 00 00", "ef 05 30 00", "db 0d 00 9b", "cb 05 30 00", "ef 05 26 00", "06 06 05 08", "16 00 a8 0c", "4b 0b 00 00", "2e 04 02 03", "7d 04 00 ba", "14 02 14 02", "70 00 04 04", "43 07 00 ab" ], "i": "micro-behaviors/communications/dnp3::sync-header", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "a": "T1070.004", "c": 0.949999988079071, "d": "Regex component marker", "e": [ " ping=" ], "i": "objectives/evasion/self-delete/file/delay::ping-self-delete--rx-2", "l": 1 }, { "a": "T1567.002", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "*sync.poolLocalInternal", "*sync.readOnly", "sync.(*Map).Load", "*[]*sync.entry", "sync/atomic", "*http.finishAsyncByteRead", "*sync.copyChecker", "**sync.Pool", "**sync.entry", "sync.(*Map).missLocked", "*sync.notifyList", "sync.(*copyChecker).check", "*[]sync.Pool", "*[8]*sync.entry", "*[0]*sync.Pool", "*[]*sync.Pool" ], "i": "well-known/tool/dual-use/megacmd::megacmd-binary-name--rx-5", "l": 1, "m": "B0030" }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1046", "c": 0.6000000238418579, "d": "Kerberos port 88", "e": [ "88" ], "i": "objectives/discovery/network/scan/internal-port::kerberos-port", "l": 1, "m": "E1046" }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "500109" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher" ], "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "l": 2 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go HTTP/2 frame headers/control", "e": [ "http2HeadersFrame", "http2ContinuationFrame" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http2-frame-headers", "l": 1 }, { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Go crypto/tls serverHello internal type", "e": [ "serverHello" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-internal-serverhello", "l": 1 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "…ode_PointSERVER_TRAFFIC_SECRET_0SetEnvironmentVariable…", "setTrafficSecret", "handshakeSecret", "expMasterSecret", "masterSecret", "earlySecret", "nextTrafficSecret", "resumptionSecret", "…LIENT_HANDSHAKE_TRAFFIC_SECRETCentral Brazilian Standa…", "…ERVER_HANDSHAKE_TRAFFIC_SECRETTLS: sequence number wra…", "trafficSecret", "master secret", "deriveSecret", "preMasterSecret", "…dard TimeCLIENT_TRAFFIC_SECRET_0CertGetCertificateChai…" ], "i": "micro-behaviors/data/text/keywords/lexicon::secret", "l": 1 }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "mcache_sys", "stackcache", "cache", "frameCache", "cachealloc", "cacheStart", "cached", "allocCache", "mcache", "goidcache", "cacheKey", "cacheSpan", "freqcache", "sudogcache", "cacheEnd", "cacheZone" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-2", "l": 1, "m": "B0023" }, { "a": "T1071.001", "c": 0.699999988079071, "d": "X-Forwarded-For proxy header", "e": [ "…iewOfFileWinsta0\\DefaultX-Forwarded-For]\n\tmorebuf={pc:accept-en…", "X-Forwarded-For" ], "i": "micro-behaviors/communications/http/headers::x-forwarded-for", "l": 3, "m": "C0002" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "d": "SYSTEMROOT environment variable", "e": [ "… 1user defined signal 2%SystemRoot%\\system32\\%v.WithValue(…" ], "i": "micro-behaviors/os/env/vars/system-info::systemroot-var", "l": 2 }, { "c": 1.0, "d": ".bat extension", "e": [ ".bat" ], "i": "objectives/command-and-control/dropper/builder::bat-ext", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go TLS handshake internal types", "e": [ "HelloMsg", "clientHandshakeState", "serverHandshakeState" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-handshake-internals", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.21" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext hello beacon token", "e": [ "hello" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-hello-beacon-token", "l": 1, "m": "B0025" }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive download tool marker", "e": [ "downloadFile" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-download-archive-tool", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "…)close of closed channelcommand not implementedcouldn't…", "…untcheckdead: runnable gcommand not supportedconcurrent…" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Go crypto/tls peerCertificates internal type", "e": [ "peerCertificates" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-internal-peercertificates", "l": 1 }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.8999999761581421, "d": "Get Windows system directory path", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 31.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1055.012", "c": 0.8500000238418579, "d": "NtUnmapViewOfSection call", "e": [ "…SIZEMeroitic_HieroglyphsNtUnmapViewOfSectionNtWriteVirtualMemoryProc…" ], "i": "objectives/evasion/process/injection/hollowing::nt-unmap-section", "l": 1, "m": "E1055.012" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "*runtime.divMagic", "*[67]runtime.divMagic", "*[]runtime.divMagic" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-7", "l": 1, "m": "C0027" }, { "a": "T1082,T1041", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "*runtime.systeminfo" ], "i": "objectives/exfiltration/stealer/system-info::windows-recon-output-file--rx-1", "l": 1 }, { "a": "T1071.001", "c": 0.75, "d": "HTTP POST method string in binary", "e": [ "POST" ], "i": "micro-behaviors/communications/http/post::post-string-pe", "l": 3, "m": "C0002" }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 4636.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1110.001", "c": 0.8999999761581421, "d": "Weak password master", "e": [ "master" ], "i": "objectives/lateral-movement/brute-force/password::weak-pass-master", "l": 1, "m": "E1110" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.21" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "a": "T1552.001", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "*chan http.requestAndChan", "*http.requestBodyReadError", "*http.requestAndChan" ], "i": "objectives/supply-chain/credential-theft/registry::js-creds-to-http--rx-20", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "maxHeaderStringLen", "*http.http2HeadersFrameParam", "*http.http2MetaHeadersFrame", "extraHeaders", "writeHeaders", "encodeHeaders", "*http.headerSorter", "pastHeaders", "traceHeaders", "*http.http2HeadersFrame", "http2HeadersFrame", "lastHeaderStream", "makeHeadersCopier", "processHeaders", "*http.http2headersOrContinuation" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-6", "l": 1 }, { "a": "T1485", "c": 1.0, "d": "Go math/rand package", "e": [ "math/rand" ], "i": "objectives/impact/wipe/disk/overwrite::go-math-rand", "l": 1 }, { "c": 0.8799999952316284, "d": "Go PE retains .symtab section", "e": [ ".symtab" ], "i": "metadata/lang/compiler/systems::go-pe-symtab", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Go proxy detection internal", "e": [ "isProxy" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-proxy-is-proxy", "l": 1 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "masterSecret", "resumptionSecret", "setTrafficSecret", "earlySecret", "deriveSecret", "trafficSecret", "preMasterSecret", "master secret", "nextTrafficSecret", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "handshakeSecret", "expMasterSecret" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-5", "l": 1, "m": "C0027" }, { "c": 0.800000011920929, "d": "Duplicate object handle", "e": [ "DuplicateHandle" ], "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle", "l": 2 }, { "d": "Embedded gzip compressed data", "e": [ "1F 8B 08" ], "i": "micro-behaviors/data/embedded/payload/compression::gzip-magic", "l": 2 }, { "c": 0.949999988079071, "d": "Dense embedded domain list", "e": [ "cipher.ctr", "sync.Pool", "net.IPNet", "fmt.buffer", "net.Addr", "big.Word", "cpu.option", "url.URL", "big.ErrNaN", "big.Int", "cipher.cbc", "cipher.gcm", "hpack.node", "os.File", "net.IPMask", "exec.Error" ], "i": "metadata/package/quality::dense-domain-list", "l": 1 }, { "c": 0.800000011920929, "d": "Get environment strings", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "d": "certificate string reference", "e": [ "Certificate", "certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "c": 0.8199999928474426, "d": "Go AES key size validation string", "e": [ "…n't send additional datacrypto/aes: invalid key size crypto/des: invalid key…" ], "i": "micro-behaviors/crypto/symmetric/aes/library::go-aes-invalid-key-size", "l": 3, "m": "C0021.001" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 11.33" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token", "e": [ "_ID_", " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003" }, { "a": "T1140", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "maxPayloadSizeForWrite", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato" ], "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "l": 1, "m": "B0023" }, { "d": "encoding/base64 package import", "e": [ "encoding/base64" ], "i": "objectives/command-and-control/beacon/poll::encoding-base64-import", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file", "l": 2 }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "MNOPQRSTUV", "RSTUVWXYZ", "CLNTSRVR", "CEGIKMOQSU" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "transport endpoint is already connected", "transport endpoint is not connected", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-13", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Go net/http http2Transport internal type", "e": [ "http2Transport" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http-internal-http2transport", "l": 1 }, { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "a": "T1055.012", "c": 0.75, "d": "NtSetContextThread call", "e": [ "AllowedNtSetContextThreadOmsk St" ], "i": "objectives/evasion/process/injection/hollowing::nt-set-context", "l": 4, "m": "E1055.012" }, { "c": 0.8500000238418579, "d": "Writable user path fragment", "e": [ "\\AppData\\Local\\Temp" ], "i": "objectives/persistence/system/registry/com::writable-user-path-fragment", "l": 1 }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "trafficSecret", "resumptionSecret", "expMasterSecret", "setTrafficSecret", "nextTrafficSecret", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "preMasterSecret", "earlySecret", "deriveSecret", "master secret", "handshakeSecret", "masterSecret" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-4", "l": 1, "m": "C0027" }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "…GoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFai…", "…:\n untyped locals %s %s HTTP/1.1\r\n, not a function01234…" ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "d": ".bat extension reference", "e": [ ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-word", "l": 1 }, { "a": "T1071.001", "c": 0.6600000262260437, "d": "Accept-Encoding header", "e": [ "Accept-Encoding", "…id Value\u003eASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDir…" ], "i": "micro-behaviors/communications/http/headers::headers-encoding", "l": 2, "m": "C0002" }, { "a": "T1071.001", "d": "Authorization header", "e": [ "Authorization" ], "i": "micro-behaviors/communications/http/request/client::auth-header-dup", "l": 3, "m": "C0002" }, { "a": "T1622", "c": 0.8600000143051147, "d": "GetEnvironmentVariable profiler check", "e": [ "GetEnvironmentVariableW" ], "i": "objectives/anti-analysis/debugger-detect/check::getenv-profiling-api", "l": 1, "m": "B0001" }, { "a": "T1562.001", "c": 0.8999999761581421, "d": "SafeBoot cleanup targets major EDR vendor", "e": [ "eset", "eSet", "eseT" ], "i": "objectives/impact/degrade/edr/teardown::safeboot-edr-vendor--rx-3", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "a": "T1204.002", "c": 0.8500000238418579, "d": "PowerShell archive file extension marker", "e": [ ".zip" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extension", "l": 1 }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "crypto/md5", "crypto/aes", "crypto/hmac", "crypto/rand", "crypto/ecdsa", "crypto/rsa", "crypto/x509", "crypto/sha256", "crypto/sha1", "crypto/rc4", "crypto", "crypto/tls", "*crypto.Hash", "crypto/cipher", "crypto/des", "crypto/dsa" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-5", "l": 1, "m": "B0040" }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "*x509.pkcs1PublicKey", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "*x509.publicKeyInfo", "*func() crypto.PublicKey", "publicKey", "*ecdsa.PublicKey" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "*[16]string", "*[10]string", "*[12]string", "setString", "string", "stringType", "*[24]string", "*[26]string", "readString", "initString", "*[11]string", "fmtString", "stringSeq", "strings", "padString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "a": "T1204.002", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "consolederivedexpiresfloat32float64gctracehttp://invalidlookup max-agenil keynop -\u003e panic: refererrefreshrunningserial:signal sy" ], "i": "objectives/command-and-control/dropper/execution/clickfix::schtasks-remote-unc-xml--rx-2", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle" ], "i": "micro-behaviors/fs/file/handle::get-std-handle", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "internal/x/crypto/hkdf", "*func() crypto.PublicKey", "*cryptobyte.BuilderContinuation", "crypto/internal/randutil", "crypto/rand", "cryptobyte: internal error", "*map[crypto.Hash][]uint8", "crypto/md5", "crypto/sha1", "…o/aes: invalid key size crypto/des: invalid key size c…", "…start third-party app %scrypto/aes: output not full bl…", "…s: output not full blockcrypto/des: output not full bl…", "crypto/dsa", "crypto/aes", "…dn't get current processcrypto/rsa: decryption errorde…", "crypto" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr", "l": 1 }, { "a": "T1106", "c": 0.699999988079071, "d": "NtWriteVirtualMemory syscall setup", "e": [ "…yphsNtUnmapViewOfSectionNtWriteVirtualMemoryProcessIdToSessionIdQuer…" ], "i": "micro-behaviors/os/syscall/raw::nt-write-ssn", "l": 4, "m": "F0004" }, { "c": 0.800000011920929, "d": "Go crypto/aes import", "e": [ "crypto/aes", "crypto/aes.encryptBlockGo", "crypto/aes: input not full block", "… wait third-party app %scrypto/aes: input not full blockcr…", "crypto/aes: output not full block", "…n't send additional datacrypto/aes: invalid key size crypt…", "crypto/aes: invalid buffer overlap", "…start third-party app %scrypto/aes: output not full blockc…" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-aes", "l": 1 }, { "a": "T1555", "c": 0.800000011920929, "d": "EA Origin config target", "e": [ "eadOpenThreadToken", "eateProcessWithUserToken", "ea Standard TimeLibya Standard TimeLsaAddAccount" ], "i": "objectives/credential-access/gaming/launcher::ea-origin-config-target", "l": 1 }, { "a": "T1071.001", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "consolederivedexpiresfloat32float64gctracehttp://invalidlookup max-agenil keynop -\u003e panic: refererrefreshrunningserial:signal sy" ], "i": "micro-behaviors/communications/http/llm::gpt-proxy-websocket-upstream--rx-15", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 4636.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.699999988079071, "d": "Go socksAddr string", "e": [ "*http.socksAddr" ], "i": "objectives/command-and-control/channel/tunnel/proxy::go-socks-addr", "l": 1 }, { "c": 1.0, "d": "Regex component marker", "e": [ "Upgrade Required", "0601021504Z0700476837158203125: cannot parse :ValidateLabels\u003cinvalid Value\u003eASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDi" ], "i": "objectives/lateral-movement/social-engineering/lures::fake-software-update-cond-1--inline-28793", "l": 1 }, { "d": "Stream string fragment", "e": [ "*func([]uint8) cipher.Stream", "*cipher.StreamReader" ], "i": "objectives/execution/interpreter/script/wsh-fragments::adodb-fragment-stream-dup", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "copyTrailers", "trailer", "trailers", "pastTrailers", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "net/http.http2commaSeparatedTrailers", "consolederivedexpiresfloat32float64gctracehttp://invalidlookup max-agenil keynop -\u003e panic: refererrefreshrunningserial:signal sy", "0601021504Z0700476837158203125: cannot parse :ValidateLabels\u003cinvalid Value\u003eASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDi", "processTrailers", "resTrailer", "encodeTrailers", "readTrailer" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-2", "l": 1, "m": "C0027" }, { "a": "T1567", "c": 1.0, "d": "Regex component marker", "e": [ "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "too many users" ], "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "l": 1 }, { "c": 0.8999999761581421, "d": "Modbus write single register frame", "e": [ "00 09", "00 00", "03 00", "06 04", "00 48", "08 00", "00 0a", "00 0b", "0c 00", "00 05" ], "i": "micro-behaviors/communications/modbus::write-single-register", "l": 1 }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509" ], "i": "micro-behaviors/crypto/certificate/usage::x509-string", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "…t full blockcrypto/des: output not full blockcrypto: r…", "crypto/cipher: output smaller than input", "crypto/aes: output not full block", "input/output error", "…party app %scrypto/aes: output not full blockcrypto/de…", "crypto/des: output not full block" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.8399999737739563, "d": "Read wide environment block", "e": [ "GetEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::get-environment-strings-wide", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP endpoint state error", "e": [ "transport endpoint is already connected", "transport endpoint is not connected" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint", "l": 2 }, { "c": 0.800000011920929, "d": "Release wide environment block", "e": [ "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::free-environment-strings-wide", "l": 2 }, { "c": 0.800000011920929, "d": "Five section PE layout", "e": [ "binary.section_count = 5.00" ], "i": "metadata/binary/section/metrics::five-section-pe", "l": 1 }, { "d": "Cookie Domain attribute", "e": [ "…140625: inuse: : status=; Domain=Accuracy(AuthorityBassa…" ], "i": "micro-behaviors/communications/http/cookies::domain-attribute", "l": 3 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "chacha20poly1305: ciphertext too large", "ciphertext" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-1", "l": 1, "m": "C0027" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go HTTP/2 framer internals", "e": [ "http2FrameH", "http2FrameT" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http2-framer-internals", "l": 1 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "500109" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "500109" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "baseAddress" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-1", "l": 1 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:" ], "i": "micro-behaviors/communications/http/request/client::user-agent-header", "l": 2, "m": "C0002" }, { "c": 1.0, "d": "Makefile all target", "e": [ "syscall: string with NUL passed to StringToUTF16" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "500109" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/2.0", "HTTP/1.1" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "c": 0.699999988079071, "d": "Go socksUsernamePassword string", "e": [ "*http.socksUsernamePassword" ], "i": "objectives/command-and-control/channel/tunnel/proxy::go-socks-auth", "l": 1 }, { "c": 0.75, "d": "HTTP/2 client connection preface", "e": [ "PRI * HTTP/2.0" ], "i": "micro-behaviors/communications/http/protocol::http2-preface", "l": 3 }, { "c": 0.699999988079071, "d": "Go base64 encoding", "e": [ ".Encode" ], "i": "micro-behaviors/data/encode/base64::go-base64-encode", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1486", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "crypto/tls.(*encryptedExtensionsMsg).marshal.func1", "crypto/tls.(*encryptedExtensionsMsg).marshal.func1.1.1", "crypto/aes.encryptBlockGo", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "encrypt", "encryptTicket", "crypto/tls.(*encryptedExtensionsMsg).marshal.func1.1" ], "i": "objectives/impact/ransom/encrypt/hybrid::rust-ransomware-module-set--rx-4", "l": 1, "m": "B0040" }, { "c": 0.800000011920929, "d": "Go crypto/cipher import", "e": [ "crypto/cipher: invalid buffer overlap", "crypto/cipher.(*gcm).Open", "crypto/cipher: message too large for GCM", "crypto/cipher", "crypto/cipher.NewCTR", "crypto/cipher.(*cbcEncrypter).CryptBlocks", "crypto/cipher: incorrect GCM tag size", "crypto/cipher: output smaller than input", "crypto/cipher: incorrect nonce length given to GCM", "crypto/cipher: input not full blocks" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-cipher", "l": 1 }, { "c": 0.8600000143051147, "d": "VirtualAlloc then VirtualProtect strings", "e": [ "VirtualAllocExVirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtualalloc-virtualprotect-pair", "l": 1 }, { "c": 0.699999988079071, "d": "Windows Temp directory path", "e": [ "\\Temp" ], "i": "micro-behaviors/fs/path/temp::win-temp-path", "l": 2 }, { "a": "T1105", "c": 0.8600000143051147, "d": "RAT screen capture command", "e": [ "record" ], "i": "objectives/command-and-control/remote-command/tasking::rat-screen-capture-command", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 3.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext sleep command token", "e": [ "sleep" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-sleep-command-token", "l": 1, "m": "B0025" }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password" ], "i": "objectives/command-and-control/channel/tunnel/dmw::dmw-tunnel-pwd", "l": 1 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "…0CertGetCertificateChainCreateProcessWithLogonWCreateProcessW…", "…figWCheckTokenMembershipCreateProcessAsUserWCryptAcquireConte…", "…nCreateProcessWithLogonWCreateProcessWithTokenWDeleteVolumeMo…" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "500109" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "scanner word", "e": [ "Scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go HTTP/2 transport internals", "e": [ "http2clientStream", "http2noDialClientConnPool" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http2-transport-internals", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 31.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.30000001192092896, "d": "HTTP configuration field (headers)", "e": [ "headers:" ], "i": "micro-behaviors/communications/http/request/client::http-config-headers", "l": 2 }, { "c": 0.8199999928474426, "d": "GetSystemDirectory API string", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-system-directory-string", "l": 2 }, { "c": 0.949999988079071, "d": "Unicode console output", "e": [ "WriteConsoleW" ], "i": "micro-behaviors/hardware/display/screen::write-console-w", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/rsa import", "e": [ "crypto/rsa.EncryptPKCS1v15", "…dn't get current processcrypto/rsa: decryption errordestin…", "crypto/rsa", "crypto/rsa.VerifyPKCS1v15", "…/dsa: invalid public keycrypto/rsa: verification errorfail…" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-rsa", "l": 1 }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "loop ending" ], "i": "micro-behaviors/crypto/symmetric/xor/loop::asm-loop-control-transfer", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 31.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go HTTP/2 frame types", "e": [ "http2GoAwayFrame", "http2DataFrame", "http2SettingsFrame", "http2PingFrame" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http2-frame-types", "l": 1 }, { "c": 0.9200000166893005, "d": "Large binary with few functions", "e": [ "binary.func_count = 3.00" ], "i": "metadata/package/metrics::recovered-function-count-under-10", "l": 2 }, { "d": "COMPUTERNAME environment variable", "e": [ "…idle)GODEBUG: value \"GetComputerNameWGetCurrentThreadGetDesk…" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2 }, { "d": "password keyword", "e": [ "password", "passwordSet", "*http.socksUsernamePassword", "…ot DER)invalid username/password versionleafCounts[maxBi…", "…port %qinvalid username/passwordmissing stack in newstac…" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "0601021504Z0700476837158203125: cannot parse :ValidateLabels\u003cinvalid Value\u003eASCII_Hex_DigitAccept-Enc..." ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.7200000286102295, "d": "Go AES-CBC decrypter runtime string", "e": [ "cipher.NewCBCDecrypter: IV length must equal block size" ], "i": "micro-behaviors/crypto/symmetric/aes/library::go-cbc-decrypter-string", "l": 3, "m": "C0021.001" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "cipher.ctr" ], "i": "micro-behaviors/crypto/symmetric/aes/ctr::ctr-mode-term--rx-4", "l": 1, "m": "C0021.001" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "Return-Path", "syscall.FullPath", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "pkgPath", "reflect.name.pkgPath", "setPath", "lookPathErr", "volAndPath", "consolederivedexpiresfloat32float64gctracehttp://invalidlookup max-agenil keynop -\u003e panic: refererrefreshrunningserial:signal sy", "application/registry.SplitKeyAndPath", "0601021504Z0700476837158203125: cannot parse :ValidateLabels\u003cinvalid Value\u003eASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDi", "appendNameToPath" ], "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-5", "l": 1, "m": "F0012" }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "*func(tls.ConnectionState, error)", "Connection", "isConnected", "*func() tls.ConnectionState", "d filevalue out of range (%d bytes omitted) already registered called using nil * t.spanKey.npages= , g-\u003eatomicstatus=, gp-\u003eato", "*http.http2ConnectionError", "closeIdleConnections", "0601021504Z0700476837158203125: cannot parse :ValidateLabels\u003cinvalid Value\u003eASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDi" ], "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "l": 1, "m": "F0012" }, { "a": "T1573", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "can not access a needed shared library", "link in too many shared librarie", "accessing a corrupted shared library", "attempting to link in too many shared libraries", "cannot exec a shared library directly", "shared", "sharedKey" ], "i": "micro-behaviors/crypto/asymmetric/kem::kyber-encapsulation-terms--rx-5", "l": 1, "m": "C0027" }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "can not access a needed shared library", "sharedKey", "accessing a corrupted shared library", "shared", "attempting to link in too many shared libraries", "link in too many shared librarie", "cannot exec a shared library directly" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-6", "l": 1, "m": "C0027" }, { "c": 0.7200000286102295, "d": "Winsock connect API string", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::ws2-connect-api-string", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Go TLS cipher suite internals", "e": [ "cipherSuite", "SignatureScheme", "cipherSuiteTLS13" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-cipher-internals", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "d": "overflow keyword", "e": [ "…rtificatevarint integer overflowwork.nwait \u003e work.nproc%…", "…rk - bad statusmarkBits overflowmissing closing )missing…", "newoverflow", "overflowmissing closing )missing", "…i Rulechacha20: counter overflowcorrupted semaphore tick…", "…ssnon-minimal tagrecord overflowrecovery failedruntime e…", "… fileprogToPointerMask: overflowrestartg: unexpected sta…", "…e= runtime: split stack overflowruntime: stat underflow:…", "record overflow", "…on-Go function at pc=oldoverflow is not niloperation was…", "setoverflow", "noverflow", "…host unreachableinteger overflowinvalid argumentinvalid …", "… data for runtime: stat overflow: val strconv: ε \u003e (den\u003c…", "overflow", "…tokencryptobyte: length overflowgcstopm: not waiting for…" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "footerWritten" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-3", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW", "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.7200000286102295, "d": "Go AES-CBC encrypter runtime string", "e": [ "cipher.NewCBCEncrypter: IV length must equal block size" ], "i": "micro-behaviors/crypto/symmetric/aes/library::go-cbc-encrypter-string", "l": 3, "m": "C0021.001" }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "…cyinvalid address familykernel32.dll not foundmalformed HTTP…" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt" ], "i": "micro-behaviors/crypto/library/keyword::encrypt-fn", "l": 3 }, { "c": 0.8600000143051147, "d": "Query Windows system directory", "e": [ "GetSystemDirectoryA" ], "i": "micro-behaviors/fs/path/system::get-system-directory-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8799999952316284, "d": "Configure waitable timer", "e": [ "SetWaitableTimer" ], "i": "micro-behaviors/time/schedule/waitable::set-waitable-timer", "l": 2 }, { "c": 0.8500000238418579, "d": "Query process CPU affinity", "e": [ "GetProcessAffinityMask" ], "i": "micro-behaviors/process/control/affinity::get-process-affinity-mask", "l": 1 }, { "c": 0.8999999761581421, "d": "Register vectored exception handler", "e": [ "AddVectoredExceptionHandler" ], "i": "micro-behaviors/os/exception/error-handling::add-vectored-exception-handler", "l": 2, "m": "B0001" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 4636.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1005", "c": 0.8999999761581421, "d": "GetThreadContext API reference", "e": [ "…eHandleWGetSystemMetricsGetThreadContextIV for ECDSA CTRImperial…" ], "i": "micro-behaviors/process/inject/runtime/call::get-thread-context-dup", "l": 2 }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-w", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "c": 0.699999988079071, "d": "Long NOP sled byte sequence", "e": [ "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90" ], "i": "objectives/anti-analysis/self-modify/runtime::nop-sled", "l": 3 }, { "c": 0.6000000238418579, "d": "TCP connection reset error", "e": [ "…can't scan our own stackconnection reset by peerdouble traceGCSweepStart…", "connection reset by peer" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-reset", "l": 3 }, { "c": 0.6000000238418579, "d": "TCP connection refused error", "e": [ "connection refused" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-refused", "l": 3 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 3.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.8600000143051147, "d": "Register console control handler", "e": [ "SetConsoleCtrlHandler" ], "i": "micro-behaviors/os/console/control::set-console-ctrl-handler", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP connection timeout error", "e": [ "…nnelconnection error: %sconnection timed outcouldn't get serversfloa…", "connection timed out" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-timeout", "l": 3 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (WriteFile, WriteConsoleW, WaitForSingleObject, VirtualQuery, VirtualFree, ... +26 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.8799999952316284, "d": "Enumerate process environment block", "e": [ "GetEnvironmentStringsW", "FreeEnvironmentStringsW" ], "i": "micro-behaviors/os/env/access::environment-block-enumeration", "l": 2 }, { "c": 0.800000011920929, "d": "X.509 certificate handling (legitimate)", "e": [ "x509" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-handling", "l": 2 }, { "c": 0.9200000166893005, "d": "Resolves VirtualAlloc and VirtualProtect", "e": [ "binary.import_count = 31.00", "GetProcAddress", "VirtualAllocExVirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::getprocaddr-memory-loader-primitives", "l": 4 }, { "a": "T1195.002", "c": 0.8199999928474426, "d": "Plaintext command protocol vocabulary", "e": [ "hello", "sleep", "exec" ], "i": "objectives/supply-chain/trojanized/backdoor::plaintext-command-vocabulary", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: hex → base64", "e": [ "\u003cbinary data\u003e \u003chex+base64\u003e" ], "i": "metadata/encoded-payload/hex-base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "0601021504Z0700476837158203125: cannot p \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 } ], "sha": "c8f8d3da0181df66d2a7ecc1b17601465b5f4f9e9f1bda10b9ec83acee869e6b", "path": "500109", "type": "pe" } ], "tv": "db300" } }