{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T12:23:16Z" }, "path": "ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 5, "ff": { "i": [ [ "mscoree", "CorExeMain" ] ], "m": { "pe": { "checksum": 983025.0, "checksum_valid": 1.0, "computed_checksum": 983025.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 979624.0, "entropy": 5.96, "size_bytes": 979624.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.95, "overlay_size": 5288.0, "string_count": 3809.0, "overlay_ratio": 0.01, "overlay_entropy": 7.25, "entropy_variance": 8.55, "avg_string_length": 20.89, "max_string_length": 11907.0, "code_to_data_ratio": 1.0, "string_length_stddev": 206.58, "largest_section_ratio": 0.99, "sentence_string_count": 7.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 973312.0, "entropy_max": 5.95, "entropy_mean": 3.03, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 1820, "u8", "iX c" ], [ 1976, "u8", "iX e" ], [ 2132, "u8", "iX w" ], [ 2288, "u8", "iX d" ], [ 3224, "u8", "iX a" ], [ 7436, "u8", "iX b" ], [ 112713, "u8", "iX JQ" ], [ 216652, "u8", "iX()" ], [ 666566, "u8", "6c3c" ], [ 667077, "u8", "d4d4" ], [ 667140, "u8", "/c2b2b2b2Z" ], [ 667376, "u8", "2b2b" ], [ 668291, "u8", "5e5e" ], [ 668302, "u8", "9b2b" ], [ 668732, "u8", "%u%k=a p" ], [ 668852, "u8", "74d4Z" ], [ 669567, "u8", "h8h8" ], [ 669650, "u8", "}/q p\"f5e" ], [ 670297, "u8", "w\u0026v\u0026a1a1a1a1_" ], [ 671076, "u8", "4d4d" ], [ 672139, "u8", "8h8h" ], [ 672308, "u8", "e7h9" ], [ 673118, "u8", "u%u%u'i8h" ], [ 673750, "u8", "f5e%u%u" ], [ 673851, "u8", ".%u%k16f06S" ], [ 674068, "u8", "3c3a" ], [ 675085, "u8", "x(x(a1a p" ], [ 677594, "u8", "i6f6e" ], [ 678330, "u8", "HqLGw" ], [ 678340, "u8", "Tufw" ], [ 678654, "u8", "Jjxf" ], [ 685361, "u8", "nh864bxi" ], [ 685437, "u8", "MrwGL7" ], [ 685726, "u8", "/0114" ], [ 685745, "u8", "MZggg" ], [ 686671, "u8", "z5pXUb" ], [ 687094, "u8", "Tcjq" ], [ 688603, "u8", "brbBpY" ], [ 688745, "u8", "EEZQ" ], [ 690147, "u8", "y09In" ], [ 690404, "u8", "KTZP1" ], [ 690855, "u8", "G am" ], [ 691635, "u8", "NM4H" ], [ 692608, "u8", "ErSIC" ], [ 694607, "u8", "hJ}(" ], [ 694718, "u8", "8m8w" ], [ 698312, "u8", "UHP8" ], [ 700811, "u8", "hGgu" ], [ 701472, "u8", "r5ne" ], [ 702181, "u8", "/Qz8v" ], [ 702216, "u8", "dqXEn" ], [ 702277, "u8", "ZKHG" ], [ 703782, "u8", "Hhvd" ], [ 706500, "u8", "NSMZ" ], [ 707176, "u8", "SHY5TvTB" ], [ 708037, "u8", "h]s{" ], [ 708362, "u8", "/z4nwu" ], [ 709704, "u8", "nHPy7" ], [ 710291, "u8", "TYjKT" ], [ 710466, "u8", "HURO" ], [ 712435, "u8", "WIZ9" ], [ 712594, "u8", "MiBhloW" ], [ 713297, "u8", "fikTq" ], [ 713807, "u8", "9MBiY7" ], [ 714290, "u8", "7DFX" ], [ 714333, "u8", "Ulrz" ], [ 715107, "u8", "VAL3" ], [ 715877, "u8", "QDVO" ], [ 715885, "u8", "zihT5" ], [ 715960, "u8", "Jdrlq" ], [ 717249, "u8", "4uwd" ], [ 717304, "u8", "Urex" ], [ 719057, "u8", "fZsj" ], [ 719853, "u8", "YEQQQ" ], [ 719872, "u8", "Zjeu" ], [ 720415, "u8", "f;.7 Fl" ], [ 720545, "u8", "h96s" ], [ 721823, "u8", "hWgg" ], [ 724386, "u8", "HVWX" ], [ 724663, "u8", "aUyqi" ], [ 724983, "u8", "7OZX" ], [ 726772, "u8", "YOHA" ], [ 727116, "u8", "xNty" ], [ 729207, "u8", "cVyk" ], [ 729767, "u8", "t5ub" ], [ 730427, "u8", "XJZYW" ], [ 731113, "u8", "h mTn" ], [ 733091, "u8", "ARCD" ], [ 733769, "u8", "CWKM" ], [ 735245, "u8", "035Y" ], [ 735604, "u8", "alWr" ], [ 735783, "u8", "Dvtn" ], [ 736225, "u8", "aeh8Q" ], [ 738939, "u8", "4c2y" ], [ 739144, "u8", "fudr13" ], [ 739545, "u8", "Dhts" ], [ 739860, "u8", "VMSN" ], [ 741056, "u8", "DdAci" ], [ 741136, "u8", "5whwur" ], [ 743357, "u8", "NOH3" ], [ 743429, "u8", "14nb" ], [ 744409, "u8", "2b5h" ], [ 746431, "u8", "i6oyb" ], [ 748041, "u8", "gZ.ceiU" ], [ 748854, "u8", "ipez" ], [ 751095, "u8", "iaYq" ], [ 751526, "u8", "7B0R" ], [ 751633, "u8", "tFyz" ], [ 751663, "u8", "QJcpr" ], [ 752237, "u8", "lcYv" ], [ 752353, "u8", "/hbN" ], [ 754595, "u8", "/oDo" ], [ 757305, "u8", "665O" ], [ 758388, "u8", "N8WK" ], [ 759244, "u8", "taKh5" ], [ 764082, "u8", "GUVW" ], [ 764535, "u8", "357p" ], [ 764798, "u8", "2hov" ], [ 765110, "u8", "mrex8" ], [ 766843, "u8", "GWGNU" ], [ 768371, "u8", "fK012" ], [ 769789, "u8", "uwyNC" ], [ 770352, "u8", "GsOK5" ], [ 772204, "u8", "Wbjrj" ], [ 772906, "u8", "CQSU" ], [ 773299, "u8", "AJSM" ], [ 774000, "u8", "GqMIx" ], [ 774394, "u8", "O|U.w DQ" ], [ 776948, "u8", "Ji.s" ], [ 777159, "u8", "LNPKf" ], [ 777761, "u8", "gVzk" ], [ 788539, "u8", "yqiHO" ], [ 792771, "u8", "GMSEX9" ], [ 793064, "u8", "YjVT1" ], [ 793074, "u8", "81kEPx9z" ], [ 793743, "u8", "XVT0Hj" ], [ 795228, "u8", "Z9F6" ], [ 795702, "u8", "aopm" ], [ 796526, "u8", "4HWF" ], [ 798375, "u8", "wH}{" ], [ 799018, "u8", "i01y" ], [ 799653, "u8", "gUse" ], [ 801396, "u8", "631a" ], [ 801780, "u8", "OiBWW" ], [ 802551, "u8", "/nez" ], [ 803375, "u8", "89rb" ], [ 803726, "u8", "c27r" ], [ 804410, "u8", "k5vo" ], [ 806123, "u8", "nyUn" ], [ 806259, "u8", "lPETtf" ], [ 807217, "u8", "gQOZyKqr" ], [ 807937, "u8", "uHyl" ], [ 809352, "u8", "rxLtHqw" ], [ 809398, "u8", "/4X2" ], [ 810260, "u8", "Uzqh" ], [ 813944, "u8", "k:'w'w' X" ], [ 814563, "u8", "8g7g" ], [ 815563, "u8", "/eg6" ], [ 816672, "u8", "S4FH" ], [ 818484, "u8", "/d\t d" ], [ 818630, "u8", "3b2a1a1a1" ], [ 818785, "u8", "i9h8" ], [ 819092, "u8", "B'w p p p" ], [ 819641, "u8", "p p p m='tj" ], [ 820075, "u8", "/i9i8h_" ], [ 820664, "u8", "b2b1a" ], [ 820724, "u8", "c3c1a" ], [ 824517, "u8", "9i9b" ], [ 827128, "u8", "853c" ], [ 847835, "u8", "g78h" ], [ 847847, "u8", "h82b" ], [ 849266, "u8", "b2 p" ], [ 851222, "u8", "p 3c" ], [ 853612, "u8", "a1 p" ], [ 867308, "u8", "f6 p" ], [ 871631, "u8", "a13c" ], [ 871876, "u8", "e55e5" ], [ 872073, "u8", "h87g" ], [ 872236, "u8", "g77g" ], [ 872335, "u8", "b21a" ], [ 872401, "u8", "c3 p" ], [ 875897, "u8", "/y\tW" ], [ 876289, "u8", "e5e5a" ], [ 877021, "u8", "JtToZY" ], [ 877044, "u8", "vhSpzZgg" ], [ 879621, "u8", "e57g" ], [ 880943, "u8", "IHDR" ], [ 881019, "u8", "IDATHK" ], [ 882130, "u8", "mTQgb" ], [ 882244, "u8", "IIix6" ], [ 882900, "u8", "Xgs2ou" ], [ 882980, "u8", "cfVn" ], [ 884101, "u8", "-}RMH[dmqQ" ], [ 884561, "u8", "IEND" ], [ 885159, "u8", "LBDXXfn" ], [ 885497, "u8", "lfQLMd" ], [ 885688, "u8", "Edic" ], [ 885719, "u8", "yMtm" ], [ 888751, "u8", "EEZMb" ], [ 888764, "u8", "5nZYS" ], [ 889627, "u8", "hKWfz" ], [ 893564, "u8", "o6r/jq5" ], [ 893964, "u8", "udBw" ], [ 894002, "u8", "nEZnw" ], [ 894263, "u8", "fLhu" ], [ 894626, "u8", "nIhr" ], [ 894837, "u8", "LLJwCu" ], [ 895743, "u8", "cLSdK" ], [ 899039, "u8", "iLka" ], [ 899137, "u8", "eQui" ], [ 901354, "u8", "8QFV" ], [ 901940, "u8", "ILI1" ], [ 902084, "u8", "mNyi" ], [ 903173, "u8", "JMPB" ], [ 905639, "u8", "522C" ], [ 905768, "u8", "BSJB" ], [ 907825, "u8", "MS.Win32" ], [ 907834, "u8", "Microsoft.Win32" ], [ 907850, "u8", "UInt32" ], [ 907857, "u8", "ToInt32" ], [ 907865, "u8", "\u003cModule\u003e" ], [ 907874, "u8", "LoadLibraryA" ], [ 907887, "u8", "HWND" ], [ 907892, "u8", "System.IO" ], [ 907902, "u8", "fabdaaffecbcabcffedaa" ], [ 907924, "u8", "aaaaeedcccadeecfdfcdfaeaba" ], [ 907951, "u8", "dacbfbbebba" ], [ 907963, "u8", "bfeebcdefebfcba" ], [ 907979, "u8", "abafebfcbdba" ], [ 907992, "u8", "cefcacbbdcfffafda" ], [ 908010, "u8", "bcdededbea" ], [ 908021, "u8", "eeffbeadaafddea" ], [ 908037, "u8", "eeaffcccbeaeffaabfa" ], [ 908057, "u8", "ProjectData" ], [ 908069, "u8", "aaabbbab" ], [ 908078, "u8", "aeaadaacefdcecab" ], [ 908095, "u8", "adfaddfabeedbfadeab" ], [ 908115, "u8", "aabfcfccecbabb" ], [ 908130, "u8", "bdcecfbababcbecbbdcfcbbbb" ], [ 908156, "u8", "dcbdfcabddffeefdacccb" ], [ 908178, "u8", "cbddbddebefeadcefcfefbfdeb" ], [ 908205, "u8", "mscorlib" ], [ 908214, "u8", "aabceffbceddcdbc" ], [ 908231, "u8", "fcfeeffdbccfaadebaabbcc" ], [ 908255, "u8", "adaabffaaddafacaabcdfec" ], [ 908279, "u8", "Microsoft.VisualBasic" ], [ 908301, "u8", "dbeadeadbbbcabfbabfdabefedad" ], [ 908330, "u8", "Thread" ], [ 908337, "u8", "fddfeeddbcaaabefbdbbbd" ], [ 908360, "u8", "bedafbbbd" ], [ 908370, "u8", "aeafafddbaebafaabadfefdbd" ], [ 908396, "u8", "ffbaeccbbddfcbeccd" ], [ 908415, "u8", "aababfecd" ], [ 908425, "u8", "ccfeebfecd" ] ], "v": { "file.stem": "ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1603173528, "file.basename": "ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c.exe", "pe.image_base": 4194304, "pe.image_size": 991232, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 981326, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.cert_table_size": 5288, "pe.image_hash.sha1": "8e23f19289d84205f3d3246e67ecccc84cff3496", "pe.image_hash.sha256": "200534e009a2212afd2350b158a6d30cfb86a66d7434359949032116264ea30c", "pe.image_hash.sha384": "9cda782fdfba095544f739c681c44f261c2f0417c32835bc28cd621d0d1a89d902de11a2f3b8ac4711a036ed164e110a", "pe.image_hash.sha512": "acf9805774d1a2eca9f08c1ffde895bc97fd419f5b740ea8c6ed9c906f8027b09e8cd2d117c46150a9adfc99235fcf4e9981f790aaed86e683044dba51cf1140", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=CN,L=Guangzhou,OU=贝伊伊丝伊贝艾儿丝儿伊贝伊伊儿儿,O=艾儿丝伊贝丝艾丝伊儿伊伊伊,CN=伊艾伊艾丝艾丝伊儿儿", "pe.signatures[0].serial": "053d4ddd898da402b6f46c192c8fac7a", "pe.signatures[0].subject": "C=CN,L=Guangzhou,OU=贝伊伊丝伊贝艾儿丝儿伊贝伊伊儿儿,O=艾儿丝伊贝丝艾丝伊儿伊伊伊,CN=伊艾伊艾丝艾丝伊儿儿", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 981236, "pe.data_directories[1].rva": 974336, "pe.data_directories[2].rva": 983040, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-10-20T05:58:48Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 5288, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-10-20T05:58:48Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "29dc0590093319e833282eb4f32bf37cc36c5f48", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "200534e009a2212afd2350b158a6d30cfb86a66d7434359949032116264ea30c", "pe.signatures[0].thumbprint_sha256": "44c06bddba2b4c63d335df33e6cb804cfdd6f884e9b8172079311b2a663ebce0", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ ".text", 512, 973312, 5.95, "r-x" ], [ ".reloc", 973824, 512, 0.1, "r--" ] ] }, "id": 0, "sz": 979624, "ts": [ { "c": 1.0, "d": ".NET assembly detected via BSJB CLR metadata signature", "e": [ "BSJB at offset 0xdd228" ], "i": "metadata/dotnet/bsjb-signature", "l": 2, "el": [ "0xdd228" ] }, { "c": 1.0, "d": "Authenticode chain CN: 伊艾伊艾丝艾丝伊儿儿", "e": [ "伊艾伊艾丝艾丝伊儿儿" ], "i": "metadata/signed/unknown::伊艾伊艾丝艾丝伊儿儿", "l": 2 }, { "c": 1.0, "d": "Signed by 艾儿丝伊贝丝艾丝伊儿伊伊伊", "e": [ "艾儿丝伊贝丝艾丝伊儿伊伊伊" ], "i": "metadata/signed/leaf::艾儿丝伊贝丝艾丝伊儿伊伊伊", "l": 3 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 3809.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.75, "d": "Runtime interop services", "e": [ "System.Runtime.InteropServices" ], "i": "metadata/lang/compiler/managed::runtime-interop", "l": 2, "el": [ "0xde365" ] }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2, "el": [ "0xee76c" ] }, { "c": 0.949999988079071, "d": "DigiCert timestamp certificate chain", "e": [ "DigiCert SHA2 Assured ID Timestamping CA" ], "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain", "l": 2, "el": [ "0xee50e" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 3809.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0xedb3e" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0xde134" ] }, { "c": 0.800000011920929, "d": "System namespace reference", "e": [ "System.IO" ], "i": "metadata/lang/compiler/managed::system-namespace", "l": 2, "el": [ "0xdda74" ] }, { "c": 0.8600000143051147, "d": "VB CallByName late binding", "e": [ "43 61 6C 6C 42 79 4E 61 6D 65" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-callbyname-token", "l": 1, "el": [ "0xddde2" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 3809.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8999999761581421, "d": "mscorlib reference", "e": [ "mscorlib" ], "i": "metadata/lang/compiler/managed::mscorlib", "l": 2, "el": [ "0xddbad" ] }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "System.Resources.ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token", "l": 1, "m": "F0001.006", "el": [ "0xde283" ] }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": ".NET Metadata Root (BSJB)", "e": [ "BSJB" ], "i": "metadata/binary/framework::dotnet-metadata", "l": 2 }, { "c": 0.8500000238418579, "d": ".NET Framework reference", "e": [ ".NETFramework,Version=v4.0" ], "i": "metadata/lang/compiler/managed::framework-reference", "l": 2, "el": [ "0xeb03f" ] }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.9399999976158142, "d": "Dominant largest PE section", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "metadata/binary/layout::large-dominant-section", "l": 1 }, { "c": 0.8500000238418579, "d": "Visual Basic runtime reference", "e": [ "Microsoft.VisualBasic", "Microsoft.VisualBasic.CompilerServices" ], "i": "metadata/lang/compiler/managed::visual-basic-runtime", "l": 2, "el": [ "0xddbf7", "0xde384" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 0.699999988079071, "d": "Reflection method namespace token", "e": [ "System.Reflection" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "l": 1, "el": [ "0xde1e1" ] }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 5.95" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.949999988079071, "d": "PE has exactly two sections", "e": [ "sections.count = 2.00" ], "i": "well-known/malware/virus/virlock::two-section-layout", "l": 1 }, { "c": 0.8999999761581421, "d": "PNG image magic in text section", "e": [ "89 50 4E 47 0D 0A 1A 0A" ], "i": "metadata/binary/resource::png-magic-in-text", "l": 1, "el": [ "0xd7124" ] }, { "c": 0.699999988079071, "d": "PE import table has exactly one entry", "e": [ "imports.count = 1.00" ], "i": "metadata/binary/symbols/imports::single-import-raw", "l": 1 }, { "c": 0.800000011920929, "d": "Windows Forms UI framework", "e": [ "System.Windows.Forms" ], "i": "metadata/lang/compiler/managed::winforms-ui", "l": 2, "el": [ "0xde40b" ] }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "ToString", "Strings", "GetString", "CompareString" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0xde0de", "0xde3ec", "0xde0e7", "0xde0d0" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ID token (repeated)", "e": [ " ID " ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id", "l": 1, "m": "B0007.003", "el": [ "0xee50e" ] }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0xddf91" ] }, { "c": 1.0, "d": "NO_SEH (SafeSEH not used)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-no-seh", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1562.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "GetValue" ], "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3", "l": 1, "m": "B0047", "el": [ "0xddf4c" ] }, { "c": 0.8999999761581421, "d": ".NET WPF namespace reference", "e": [ "System.Windows" ], "i": "well-known/game/mod::wpf-namespace-ref", "l": 1, "el": [ "0xde18f" ] }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Windows GetProcAddress API string", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-text", "l": 2, "el": [ "0xde43e" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0xd145" ] }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 3809.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, no_seh, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1027", "c": 0.8500000238418579, "d": "Sparse import table", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 3809.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "AssemblyTitleAttribute", "AssemblyTrademarkAttribute", "AssemblyCopyrightAttribute", "AssemblyProductAttribute", "AssemblyDescriptionAttribute", "CompilationRelaxationsAttribute", "AutomationIdProperty", "InvalidOperationException", "AssemblyFileVersionAttribute", "CastNativeWindowHandleToIntPtr", "TargetFrameworkAttribute", "AssemblyCompanyAttribute", "ComVisibleAttribute", "TextPatternRangeEndpoint", "MissingManifestResourceException", "SupportedTextSelection" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0xdde50", "0xdde67", "0xddf0e", "0xddef5", "0xddeb8", "0xdded5", "0xde5e1", "0xde235", "0xdde9b", "0xde334", "0xdde82", "0xddf29", "0xdde3c", "0xde509", "0xde214", "0xde1ca" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "a": "T1222.001", "c": 0.8999999761581421, "d": "Hidden VirtualProtect string reference", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect-text-pe", "l": 1, "el": [ "0xde4a5" ] }, { "c": 1.0, "d": ".NET BSJB metadata marker", "e": [ "BSJB" ], "i": "metadata/binary/framework::bsjb-marker", "l": 1 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 973312, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.8399999737739563, "d": "Binary has 80 or fewer imports", "e": [ "imports.count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1, "el": [ "0xdda62" ] }, { "a": "T1027.009", "c": 0.550000011920929, "d": ".NET resource manager access", "e": [ "ResourceManager" ], "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager", "l": 1, "el": [ "0xde283" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 1.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.99" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links mscoree (CorExeMain)", "e": [ "mscoree" ], "i": "metadata/dylib::mscoree", "l": 2, "el": [ "1 symbols" ] }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Low-import PE without dominant resources", "e": [ "imports.count = 1.00" ], "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc", "l": 1 } ], "sha": "ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-10/ca60958a09d1cd5817504857d90b846a9ce6f6ee1bed7686318b3741108b709c.exe", "type": "pe" } ], "tv": "52045" } }