{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9996335506439209, "class": 1 } ], "prob": 0.99963355, "class": 1, "oprob": 0.99963355, "models": [ { "m": "az", "prob": 0.9919762, "class": 0 }, { "m": "az/native", "prob": 0.99960953, "class": 0 }, { "m": "az/pe", "prob": 0.99963355, "class": 0 } ], "oclass": 0, "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T00:17:35Z" }, "path": "84445", "raw": { "v": "4", "fs": [ { "f": "KO₄(C₆As₈ErI)H₂(Os₃Po₂)Md₂(SiBi₅)", "x": 124, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "VirtualAlloc", "VirtualFree", "ExitProcess", "RegCloseKey", "PatBlt", "GetAdaptersInfo", "CoCreateGuid", "ORDINAL 6", "UrlEscapeA", "GetDC", "VerQueryValueA", "ORDINAL 56" ], "ms": { "pe": { "signer": "VeriSign Class 3 Code Signing 2010 CA, Pinball Corporation., VeriSign Class 3 Public Primary Certification Authority - G5, VeriSignMPKI-2-8", "machine": 332.0, "checksum": 290654.0, "rsrc_size": 7680.0, "subsystem": 2.0, "timestamp": 1341329947.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.64, "entry_section": "UPX1", "has_signature": true, "size_of_image": 585728.0, "timestamp_day": 3.0, "checksum_valid": true, "file_alignment": 512.0, "primary_signer": "Pinball Corporation.", "resource_count": 8.0, "signature_type": "developer", "timestamp_year": 2012.0, "characteristics": 258.0, "entry_point_rva": 576672.0, "size_of_headers": 4096.0, "timestamp_month": 7.0, "checksum_matches": true, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 10.0, "manifest_present": true, "certificate_count": 1.0, "computed_checksum": 290654.0, "section_alignment": 4096.0, "number_of_sections": 3.0, "resource_timestamp": 0.0, "dll_characteristics": 33088.0, "rich_header_present": true, "linker_major_version": 10.0, "version_info_present": true, "api_hashing_indicators": 1.0, "certificate_table_size": 3768.0, "export_timestamp_present": false, "resource_timestamp_present": false, "entry_in_nonstandard_section": true }, "binary": { "code_size": 229376.0, "file_size": 241848.0, "entry_point": 576672.0, "wx_sections": 2.0, "code_entropy": 3.96, "import_count": 15.0, "string_count": 249.0, "has_signature": true, "section_count": 3.0, "avg_complexity": 16.5, "function_count": 2.0, "import_density": 0.07, "max_complexity": 32.0, "string_density": 1.11, "overall_entropy": 4.19, "avg_basic_blocks": 30.5, "avg_section_size": 79018.66, "dependency_count": 10.0, "entropy_variance": 3.25, "function_density": 0.01, "avg_function_size": 252.0, "avg_string_length": 11.01, "complexity_per_kb": 0.07, "max_string_length": 364.0, "wide_string_count": 10.0, "writable_sections": 3.0, "avg_string_entropy": 2.55, "code_to_data_ratio": 29.87, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.03, "total_basic_blocks": 61.0, "executable_sections": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 25.03, "largest_section_ratio": 0.95, "sentence_string_count": 8.0, "sentence_string_ratio": 0.03, "behavioral_import_ratio": 0.27, "function_analysis_depth": 2.0, "entry_in_nonstandard_section": true, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 216, "RichYPY" ], [ 488, "UPX0" ], [ 528, "UPX1" ], [ 568, ".rsrc" ], [ 987, "3.08" ], [ 3328, "Wnwi" ], [ 3698, "w4b3" ], [ 5235, "9p5x" ], [ 9392, "/uDm" ], [ 11766, "y009" ], [ 14065, "ZNBV" ], [ 17516, "9erl" ], [ 17725, "EFLZ" ], [ 19416, "ap2jt3" ], [ 23594, "EF7W0" ], [ 24353, "T1R8D" ], [ 27958, "048o" ], [ 28524, "Xpva" ], [ 29346, "by0i" ], [ 32191, "/7KI" ], [ 34770, "Hljy" ], [ 36220, "7D MW" ], [ 36999, "8DXA" ], [ 39706, "WVQS" ], [ 41436, "6HS T" ], [ 44828, "FWW2" ], [ 45370, "OMDFR" ], [ 50827, "CN6B" ], [ 52727, "CCCI" ], [ 54143, "Fbi.f" ], [ 55463, "taZ@.+_" ], [ 58148, "HLPT" ], [ 64591, "9s3k" ], [ 65309, "YNOV" ], [ 65507, "/THy" ], [ 68038, "HUYW" ], [ 69779, "NVKDS" ], [ 72063, "Pxwl" ], [ 73424, "GLQV" ], [ 78506, "h.19" ], [ 78665, "OeIEgkm" ], [ 79292, "RYZVWQ" ], [ 83559, "LTH3" ], [ 83892, "2\u003ef|" ], [ 90671, "L60O" ], [ 93177, "7NSP" ], [ 93483, "T6QV" ], [ 98258, "L_0X" ], [ 98366, "MF9F" ], [ 99074, "I6VE" ], [ 102339, "T8W7K" ], [ 102496, "FO8U" ], [ 108936, "809v" ], [ 109034, "/Q S" ], [ 110050, "t@j.h\u003e74e" ], [ 110548, "ceco" ], [ 112161, "041H" ], [ 114647, "HHQM" ], [ 114952, "xti_mrp" ], [ 116079, "9d v" ], [ 118204, "W4 8" ], [ 118829, "C840" ], [ 121691, "UYNC" ], [ 121739, "WTXH" ], [ 121916, "SEV2" ], [ 124153, "44UT" ], [ 125072, "6x9m" ], [ 130108, "GJFN" ], [ 130254, "CZSV9" ], [ 131468, "/CW7" ], [ 132662, "Sh a" ], [ 134061, "W2X9" ], [ 135342, "p1244" ], [ 135553, "`5V\u003e=`" ], [ 135637, "Ljez" ], [ 136208, "S28B" ], [ 137092, "Ve m" ], [ 140395, "V dm" ], [ 141097, "bjqu6" ], [ 142040, "6S0J" ], [ 142064, "Qjih" ], [ 144491, "6Q4S" ], [ 147276, "FWHT" ], [ 148841, "ka0w" ], [ 148915, "LEX7" ], [ 149807, "SLDA" ], [ 152208, "bad allocation8CorExitPrw" ], [ 152261, "SetThrezStackGu~" ], [ 152280, "aranteBkJV" ], [ 152577, "Octo" ], [ 152607, "Apri" ], [ 153537, "9:;\u003c=\u003e?@ABCDEFGHIJKLMNO" ], [ 153573, "YZ[\\d`abcdefgh" ], [ 153591, "ijklmnopqrstuvwxyz{|}~" ], [ 153682, "floo9" ], [ 153701, "exp10" ], [ 153766, "PY 8PX" ], [ 153774, "700WP" ], [ 153884, "uvUnk_j" ], [ 154292, "Windowd" ], [ 154302, "#[.UserObjectInform" ], [ 154355, "ageBoxbU" ], [ 154370, "C Complpe" ], [ 154436, "Type" ], [ 154606, "4sig" ], [ 154616, "/new" ], [ 154639, "RTTI" ], [ 154721, "//efaultUb" ], [ 154843, "OGO__unrg" ], [ 155682, "qJr\\v:UJ6V8YV" ], [ 156228, "ance" ], [ 156233, "Resu" ], [ 157205, "Y6YAPY%" ], [ 157270, "z\u003cproxy-auth" ], [ 157452, "\u003c\u003cSt6=P" ], [ 157498, "lor_btnf" ], [ 158715, "GN95" ], [ 159036, "N3F\u003c\u003c" ], [ 159085, "to2ef" ], [ 159094, "7widt" ], [ 159265, "5sock" ], [ 159479, "VL83O" ], [ 159759, "COMMA" ], [ 160224, "AXWIN Fr" ], [ 160442, "_Qwbout:blankP" ], [ 161594, "AYCM" ], [ 162090, "xP3XZmhlt;knVb{-QY79S*0(fwdrU" ], [ 162153, "DJT?cG_O/FAj52%esL" ], [ 162241, "UJW0" ], [ 162725, "JFolrPathAC" ], [ 163394, ".html" ], [ 163587, "g!`4KWPCMSG_SuI\"" ], [ 163797, "60718" ], [ 163809, "5517928" ], [ 164499, ".wn." ], [ 165264, "UF0A" ], [ 165571, "PSCSIDISK" ], [ 167026, "Jgwl" ], [ 167820, "\u003cEi\u003e" ], [ 167856, "YI9J" ], [ 169339, "Afgo" ], [ 170870, "H4WG" ], [ 171953, "9999-ONF" ], [ 172642, "Narr" ], [ 173354, "/OMM" ], [ 173569, "/OZ8" ], [ 173737, "ai0q8" ], [ 174662, "/Zjr" ], [ 176399, "/vDB" ], [ 176443, "Fvwv" ], [ 178179, "HMXB" ], [ 179049, "Qkkbal" ], [ 179974, "ManifVtLner@SAfG" ], [ 180020, "_MODULE70" ], [ 180085, "Obzrv" ], [ 180239, "o\u003cD_b2d07pb_ac99_4c58j" ], [ 180268, "e(24e5316b5\\33|" ], [ 180303, "2UIA" ], [ 180606, "Mdip" ], [ 180766, "Poly" ], [ 180776, "DropTar.a{" ], [ 180910, "Pqud" ], [ 180981, "JFIF" ], [ 191398, "MMYV" ], [ 194871, "a6xb" ], [ 196340, "3ydo" ], [ 202364, "J9FV" ], [ 204372, "EFPS0" ], [ 207929, "6YXR" ], [ 211104, "u12i" ], [ 211376, "Qyzj" ], [ 212407, "g29o" ], [ 215128, "2ihs" ], [ 215892, "0426" ], [ 220247, "Terminat" ], [ 220388, "hare6" ], [ 220539, "Buffe" ], [ 220905, "cc9oiwx" ], [ 221667, "2DLS" ], [ 221886, "Argu" ], [ 222478, "Nbwk" ], [ 225120, "hkio" ], [ 226833, "/tPa" ], [ 227918, "O366U" ], [ 229990, "XPTPSW" ], [ 231330, "wide", "JPEG" ], [ 231340, "wide", "MICI" ], [ 233407, "wwwwwwwxp" ], [ 234903, "X1CC" ], [ 236082, "wide", "VS_VERSION_INFO" ], [ 236174, "wide", "StringFileInfo" ], [ 236234, "wide", "FileDescription" ], [ 236268, "wide", "Installer" ], [ 236294, "wide", "FileVersion" ], [ 236346, "wide", "ProductVersion" ], [ 236402, "wide", "VarFileInfo" ], [ 236434, "wide", "Translation" ], [ 236468, "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e\u003cse" ], [ 236834, "\u003capplication\u003e" ], [ 236853, "\u003csupportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"\u003e\u003c/supportedOS\u003e" ], [ 236932, "\u003csupportedOS Id=\"{35138b9a-5d96-4fbd-8e2d-a2440225f93a}\"\u003e\u003c/supportedOS\u003e" ], [ 237011, "\u003c/application\u003e" ], [ 237031, "\u003c/compatibility\u003e\u003c/assembly\u003e" ], [ 237380, "KERNEL32.DLL" ], [ 237393, "ADVAPI32.dll" ], [ 237406, "GDI32.dll" ], [ 237416, "IPHLPAPI.DLL" ], [ 237429, "ole32.dll" ], [ 237439, "OLEAUT32.dll" ], [ 237452, "SHLWAPI.dll" ], [ 237464, "USER32.dll" ], [ 237475, "VERSION.dll" ], [ 237487, "WS2_32.dll" ], [ 237500, "LoadLibraryA" ], [ 237514, "GetProcAddress" ], [ 237530, "VirtualProtect" ], [ 237546, "VirtualAlloc" ], [ 237560, "VirtualFree" ], [ 237574, "ExitProcess" ], [ 237588, "RegCloseKey" ], [ 237610, "GetAdaptersInfo" ], [ 237628, "CoCreateGuid" ], [ 237642, "UrlEscapeA" ], [ 237662, "VerQueryValueA" ], [ 238142, "Z0X03" ], [ 238310, "VeriSign, Inc.1" ], [ 238335, "VeriSign Trust Network1;09" ], [ 238367, "2Terms of use at https://www.verisign.com/rpa (c)101.0," ], [ 238525, "Washington1" ], [ 238565, "Pinball Corporation.1\u003e0\u003c" ], [ 238595, "5Digital ID Class 3 - Microsoft Software Validation v21" ], [ 238660, "Pinball Corporation.0" ], [ 239017, "90705" ], [ 239027, "/http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D" ], [ 239117, "https://www.verisign.com/rpa0" ], [ 239196, "http://ocsp.verisign.com0;" ], [ 239233, "/http://csc3-2010-aia.verisign.com/CSC3-2010.cer0" ], [ 239731, "VeriSign Trust Network1:08" ], [ 239763, "1(c) 2006 VeriSign, Inc. - For authorized use only1E0C" ], [ 239823, "\u003cVeriSign Class 3 Public Primary Certification Authority - G50" ], [ 240429, "i0g0e" ], [ 240463, "https://www.verisign.com/cps0*" ], [ 240578, "image/gif0!0" ], [ 240626, "#http://logo.verisign.com/vslogo.gif04" ], [ 240680, "#http://crl.verisign.com/pca3-g5.crl04" ], [ 240746, "http://ocsp.verisign.com0" ], [ 240827, "VeriSignMPKI-2-80" ], [ 240904, "3130" ] ], "sz": 241848, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Code Signing 2010 CA", "e": [ "VeriSign Class 3 Code Signing 2010 CA" ], "i": "metadata/signed/developer::verisign-class-3-code-signing-2010-ca", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: Pinball Corporation.", "e": [ "Pinball Corporation." ], "i": "metadata/signed/developer::pinball-corporation.", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSign Class 3 Public Primary Certification Authority - G5", "e": [ "VeriSign Class 3 Public Primary Certification Authority - G5" ], "i": "metadata/signed/developer::verisign-class-3-public-primary-certification-authority---g5", "l": 2 }, { "c": 1.0, "d": "Authenticode chain CN: VeriSignMPKI-2-8", "e": [ "VeriSignMPKI-2-8" ], "i": "metadata/signed/developer::verisignmpki-2-8", "l": 2 }, { "c": 1.0, "d": "Signed by Pinball Corporation.", "e": [ "Pinball Corporation." ], "i": "metadata/signed/leaf::pinball-corporation.", "l": 3 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "PSCSIDISK" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.95" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 585728.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "binary.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging::has-high-entropy-regions", "l": 1 }, { "c": 0.800000011920929, "d": "Manifest requires administrator privileges", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator" ], "i": "micro-behaviors/os/privilege/manifest::require-administrator", "l": 3 }, { "a": "T1071", "c": 0.8999999761581421, "d": "OLE automation DLL import", "e": [ "OLEAUT32.dll" ], "i": "objectives/command-and-control/backdoor/binary::oleaut32-import-reference", "l": 1, "m": "B0025" }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.19" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualProtect loader API string", "e": [ "VirtualProtect" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualprotect-string", "l": 1, "m": "B0030" }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "a": "T1016", "c": 0.8999999761581421, "d": "Enumerate local adapters via GetAdaptersInfo", "e": [ "GetAdaptersInfo" ], "i": "micro-behaviors/os/network/interface::get-adapters-info", "l": 3 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 249.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.55" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.800000011920929, "d": "PE version resource structure", "e": [ "VS_VERSION_INFO" ], "i": "metadata/package/versioning::pe-version-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening::pe-dep", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.699999988079071, "d": "PE FileVersion metadata field", "e": [ "FileVersion" ], "i": "metadata/package/versioning::pe-fileversion-field", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 241848.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "FileVersion field marker", "e": [ "FileVersion" ], "i": "well-known/malware/worm/ludbaruma::fileversion-field", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics/markers::low-function-count-marker", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 1.0, "d": "ProductVersion field marker", "e": [ "ProductVersion" ], "i": "well-known/malware/worm/ludbaruma::productversion-field", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.19" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1341329947.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening::pe-aslr", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE signature is present", "e": [ "pe.has_signature = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-has-signature-png", "l": 1, "m": "F0001.006" }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.function_count = 2.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics::no-functions", "l": 2 }, { "c": 0.699999988079071, "d": "PE ProductVersion metadata field", "e": [ "ProductVersion" ], "i": "metadata/package/versioning::pe-productversion-field", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 7680.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "a": "T1489", "c": 0.699999988079071, "d": "Versioned service stop context", "e": [ "VS_VERSION_INFO" ], "i": "objectives/impact/services/stop::versioned-service-stop-context", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "WS2_32 Winsock DLL import", "e": [ "WS2_32.dll" ], "i": "micro-behaviors/communications/socket/init::ws2-32-dll-marker", "l": 2 }, { "c": 1.0, "d": "Compatibility alias", "e": [ "GetAdaptersInfo" ], "i": "micro-behaviors/os/sysinfo/network::get-adapters-info", "l": 1 }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ "UPX1 (size: 229376, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 15.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "c": 0.949999988079071, "d": "links WS2_32.dll (ORDINAL 56)", "e": [ "WS2_32.dll" ], "i": "metadata/dylib::ws2_32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (UrlEscapeA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links OLEAUT32.dll (ORDINAL 6)", "e": [ "OLEAUT32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links IPHLPAPI.DLL (GetAdaptersInfo)", "e": [ "IPHLPAPI.DLL" ], "i": "metadata/dylib::iphlpapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegCloseKey)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links VERSION.dll (VerQueryValueA)", "e": [ "VERSION.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (PatBlt)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ... +1 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (GetDC)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CoCreateGuid)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "c": 0.8999999761581421, "d": "PE version resource metadata", "e": [ "ProductVersion", "FileVersion", "VS_VERSION_INFO" ], "i": "metadata/package/versioning::version-resource-metadata", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX0", "UPX1" ], "i": "well-known/malware/trojan/shellobject/markers::misleading-upx-sections", "l": 1 }, { "a": "T1071", "c": 0.9300000071525574, "d": "UPX admin network fingerprinting loader", "e": [ "\u003crequestedExecutionLevel level=\"requireAdministrator", "GetAdaptersInfo", "GetProcAddress", "UPX1", "UPX0", "WS2_32.dll" ], "i": "objectives/command-and-control/backdoor::upx-admin-network-fingerprint-loader", "l": 4 }, { "a": "T1071", "c": 0.9599999785423279, "d": "UPX admin dynamic network loader", "e": [ "VirtualProtect", "GetProcAddress", "\u003crequestedExecutionLevel level=\"requireAdministrator", "VirtualFree", "binary.entry_in_nonstandard_section = 1.00", "UPX0", "UPX1", "GetAdaptersInfo", "WS2_32.dll", "binary.function_count = 2.00", "VirtualAlloc" ], "i": "objectives/command-and-control/backdoor::upx-admin-dynamic-network-loader", "l": 5 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload::minimal-pe-dynamic-load", "l": 3, "m": "B0032" }, { "a": "T1027.002", "c": 0.949999988079071, "d": "UPX dynamic loader stub", "e": [ "binary.entry_in_nonstandard_section = 1.00", "VirtualProtect", "VirtualFree", "binary.function_count = 2.00", "UPX0", "GetProcAddress", "UPX1", "VirtualAlloc" ], "i": "objectives/anti-static/pack/detect::upx-dynamic-loader-stub", "l": 3, "m": "F0001" } ], "sha": "ccddb900145ef751b9525d5ece5819d35ba29e0b7a8eaa6d0cbf5ddf5ab9d7aa", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/84445", "type": "pe" } ], "tv": "b2c18" } }