{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 } ], "prob": 0.9815004, "class": 1, "oprob": 0.9059974, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T04:01:46Z" }, "path": "104682", "raw": { "v": "4", "fs": [ { "f": "K₂O₉(Al₂C₇P₄As₈Co₂DyEr₃IXe)H₆(CmHfOs₅Po₃UDb)Md₄(SiBi₃Pt₂)", "x": 90, "id": 0, "is": [ "DeleteCriticalSection", "LeaveCriticalSection", "EnterCriticalSection", "InitializeCriticalSection", "VirtualFree", "VirtualAlloc", "LocalFree", "LocalAlloc", "GetVersion", "GetCurrentThreadId", "InterlockedDecrement", "InterlockedIncrement", "VirtualQuery", "WideCharToMultiByte", "RemoveDirectoryA", "MultiByteToWideChar", "lstrlenA", "lstrcpynA", "LoadLibraryExA", "GetThreadLocale", "GetStartupInfoA", "GetProcAddress", "GetModuleHandleA", "GetModuleFileNameA", "GetLocaleInfoA", "GetLastError", "GetCommandLineA", "FreeLibrary", "FindFirstFileA", "FindClose", "CreateDirectoryA", "ExitProcess", "ExitThread", "CreateThread", "WriteFile", "UnhandledExceptionFilter", "RtlUnwind", "RaiseException", "GetStdHandle", "GetKeyboardType", "LoadStringA", "MessageBoxA", "CharNextA", "RegQueryValueExA", "RegOpenKeyExA", "RegCloseKey", "SysFreeString", "SysReAllocStringLen", "SysAllocStringLen", "TlsSetValue", "TlsGetValue", "LocalAlloc", "GetModuleHandleA", "RegSetValueExA", "RegQueryValueExA", "RegQueryInfoKeyA", "RegOpenKeyExA", "RegFlushKey", "RegEnumKeyExA", "RegDeleteValueA", "RegDeleteKeyA", "RegCreateKeyExA", "RegCloseKey", "lstrcpyA", "WriteFile", "WaitForSingleObject", "VirtualQuery", "VirtualAlloc", "Sleep", "SizeofResource", "SetThreadLocale", "SetFilePointer", "SetEvent", "SetErrorMode", "SetEndOfFile", "ResumeThread", "ResetEvent", "ReadFile", "MultiByteToWideChar", "MulDiv", "LockResource", "LoadResource", "LoadLibraryA", "LeaveCriticalSection", "InitializeCriticalSection", "GlobalUnlock", "GlobalSize", "GlobalReAlloc", "GlobalHandle", "GlobalLock", "GlobalGetAtomNameA", "GlobalFree", "GlobalFindAtomA", "GlobalDeleteAtom", "GlobalAlloc", "GlobalAddAtomA", "GetVersionExA", "GetVersion", "GetUserDefaultLCID", "GetTickCount", "GetThreadLocale", "GetSystemInfo", "GetStringTypeExA", "GetStdHandle", "GetProcAddress", "GetModuleHandleA", "GetModuleFileNameA", "GetLocaleInfoA", "GetLocalTime", "GetLastError", "GetFullPathNameA", "GetFileAttributesA", "GetExitCodeThread", "GetDiskFreeSpaceA", "GetDateFormatA", "GetCurrentThreadId", "GetCurrentProcessId", "GetComputerNameA", "GetCPInfo", "GetACP", "FreeResource", "InterlockedIncrement", "InterlockedExchange", "InterlockedDecrement", "FreeLibrary", "FormatMessageA", "FindResourceA", "EnumCalendarInfoA", "EnterCriticalSection", "DeleteFileA", "DeleteCriticalSection", "CreateThread", "CreateProcessA", "CreateMutexA", "CreateFileA", "CreateEventA", "CompareStringA", "CloseHandle", "VerQueryValueA", "GetFileVersionInfoSizeA", "GetFileVersionInfoA", "UnrealizeObject", "StretchBlt", "SetWindowOrgEx", "SetWinMetaFileBits", "SetViewportOrgEx", "SetTextColor", "SetStretchBltMode", "SetROP2", "SetPixel", "SetMapMode", "SetEnhMetaFileBits", "SetDIBColorTable", "SetBrushOrgEx", "SetBkMode", "SetBkColor", "SelectPalette", "SelectObject", "SaveDC", "RestoreDC", "RectVisible", "RealizePalette", "Polyline", "PlayEnhMetaFile", "PatBlt", "MoveToEx", "MaskBlt", "LineTo", "LPtoDP", "IntersectClipRect", "GetWindowOrgEx", "GetWinMetaFileBits", "GetTextMetricsA", "GetTextExtentPoint32A", "GetSystemPaletteEntries", "GetStockObject", "GetPixel", "GetPaletteEntries", "GetObjectA", "GetEnhMetaFilePaletteEntries", "GetEnhMetaFileHeader", "GetEnhMetaFileDescriptionA", "GetEnhMetaFileBits", "GetDeviceCaps", "GetDIBits", "GetDIBColorTable", "GetDCOrgEx", "GetCurrentPositionEx", "GetClipBox", "GetBrushOrgEx", "GetBitmapBits", "ExcludeClipRect", "DeleteObject", "DeleteEnhMetaFile", "DeleteDC", "CreateSolidBrush", "CreatePenIndirect", "CreatePalette", "CreateHalftonePalette", "CreateFontIndirectA", "CreateEnhMetaFileA", "CreateDIBitmap", "CreateDIBSection", "CreateCompatibleDC", "CreateCompatibleBitmap", "CreateBrushIndirect", "CreateBitmap", "CopyEnhMetaFileA", "CloseEnhMetaFile", "BitBlt", "CreateWindowExA", "WindowFromPoint", "WinHelpA", "WaitMessage", "UpdateWindow", "UnregisterClassA", "UnpackDDElParam", "UnhookWindowsHookEx", "TranslateMessage", "TranslateMDISysAccel", "TrackPopupMenu", "SystemParametersInfoA", "ShowWindow", "ShowScrollBar", "ShowOwnedPopups", "ShowCursor", "SetWindowsHookExA", "SetWindowTextA", "SetWindowPos", "SetWindowPlacement", "SetWindowLongA", "SetTimer", "SetScrollRange", "SetScrollPos", "SetScrollInfo", "SetRect", "SetPropA", "SetParent", "SetMenuItemInfoA", "SetMenu", "SetForegroundWindow", "SetFocus", "SetDlgItemTextA", "SetCursor", "SetClassLongA", "SetCapture", "SetActiveWindow", "SendMessageA", "SendDlgItemMessageA", "ScrollWindow", "ScreenToClient", "ReuseDDElParam", "RemovePropA", "RemoveMenu", "ReleaseDC", "ReleaseCapture", "RegisterWindowMessageA", "RegisterClipboardFormatA", "RegisterClassA", "RedrawWindow", "PtInRect", "PostQuitMessage", "PostMessageA", "PeekMessageA", "OffsetRect", "OemToCharA", "MsgWaitForMultipleObjects", "MessageBoxA", "MapWindowPoints", "MapVirtualKeyA", "LoadStringA", "LoadKeyboardLayoutA", "LoadIconA", "LoadCursorA", "LoadBitmapA", "KillTimer", "IsZoomed", "IsWindowVisible", "IsWindowEnabled", "IsWindow", "IsRectEmpty", "IsIconic", "IsDialogMessageA", "IsChild", "InvalidateRect", "IntersectRect", "InsertMenuItemA", "InsertMenuA", "InflateRect", "GetWindowThreadProcessId", "GetWindowTextLengthA", "GetWindowTextA", "GetWindowRect", "GetWindowPlacement", "GetWindowLongA", "GetWindowDC", "GetTopWindow", "GetSystemMetrics", "GetSystemMenu", "GetSysColorBrush", "GetSysColor", "GetSubMenu", "GetScrollRange", "GetScrollPos", "GetScrollInfo", "GetPropA", "GetParent", "GetWindow", "GetMessageTime", "GetMenuStringA", "GetMenuState", "GetMenuItemInfoA", "GetMenuItemID", "GetMenuItemCount", "GetMenu", "GetLastActivePopup", "GetKeyboardState", "GetKeyboardLayoutList", "GetKeyboardLayout", "GetKeyState", "GetKeyNameTextA", "GetIconInfo", "GetForegroundWindow", "GetFocus", "GetDesktopWindow", "GetDCEx", "GetDC", "GetCursorPos", "GetCursor", "GetClipboardData", "GetClientRect", "GetClassNameA", "GetClassInfoA", "GetCapture", "GetActiveWindow", "FrameRect", "FindWindowExA", "FindWindowA", "FillRect", "EqualRect", "EnumWindows", "EnumThreadWindows", "EndPaint", "EnableWindow", "EnableScrollBar", "EnableMenuItem", "DrawTextA", "DrawMenuBar", "DrawIconEx", "DrawIcon", "DrawFrameControl", "DrawEdge", "DispatchMessageA", "DestroyWindow", "DestroyMenu", "DestroyIcon", "DestroyCursor", "DeleteMenu", "DefWindowProcA", "DefMDIChildProcA", "DefFrameProcA", "CreatePopupMenu", "CreateMenu", "CreateIcon", "ClientToScreen", "CheckMenuItem", "CallWindowProcA", "CallNextHookEx", "BeginPaint", "CharNextA", "CharLowerBuffA", "CharLowerA", "CharUpperBuffA", "CharToOemA", "AdjustWindowRectEx", "ActivateKeyboardLayout", "Sleep", "SafeArrayPtrOfIndex", "SafeArrayGetUBound", "SafeArrayGetLBound", "SafeArrayCreate", "VariantChangeType", "VariantCopy", "VariantClear", "VariantInit", "CreateStreamOnHGlobal", "IsAccelerator", "OleDraw", "OleSetMenuDescriptor", "OleUninitialize", "OleInitialize", "CoTaskMemFree", "ProgIDFromCLSID", "StringFromCLSID", "CoCreateInstance", "CoGetClassObject", "CoUninitialize", "CoInitialize", "IsEqualGUID", "GetErrorInfo", "GetActiveObject", "VariantClear", "VariantInit", "SafeArrayCreateVector", "SysFreeString", "ImageList_SetIconSize", "ImageList_GetIconSize", "ImageList_Write", "ImageList_Read", "ImageList_GetDragImage", "ImageList_DragShowNolock", "ImageList_SetDragCursorImage", "ImageList_DragMove", "ImageList_DragLeave", "ImageList_DragEnter", "ImageList_EndDrag", "ImageList_BeginDrag", "ImageList_Remove", "ImageList_DrawEx", "ImageList_Draw", "ImageList_GetBkColor", "ImageList_SetBkColor", "ImageList_ReplaceIcon", "ImageList_Add", "ImageList_GetImageCount", "ImageList_Destroy", "ImageList_Create", "InitCommonControls", "Shell_NotifyIconA", "ShellExecuteExA", "ShellExecuteA", "InternetSetOptionA", "InternetReadFile", "InternetOpenUrlA", "InternetOpenA", "InternetCloseHandle", "HttpQueryInfoA", "CoInternetCreateZoneManager", "CoInternetCreateSecurityManager", "SHGetSpecialFolderLocation", "SHGetPathFromIDListA", "SHGetMalloc" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "rsrc_size": 32768.0, "subsystem": 2.0, "timestamp": 708992537.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 4.81, "entry_section": "CODE", "size_of_image": 712704.0, "timestamp_day": 19.0, "file_alignment": 512.0, "resource_count": 9.0, "timestamp_year": 1992.0, "characteristics": 33166.0, "entry_point_rva": 613168.0, "size_of_headers": 1024.0, "timestamp_month": 6.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 11.0, "computed_checksum": 692725.0, "dos_stub_modified": true, "section_alignment": 4096.0, "number_of_sections": 8.0, "resource_timestamp": 991004466.0, "timestamp_pre_2000": true, "linker_major_version": 2.0, "linker_minor_version": 25.0, "api_hashing_indicators": 1.0, "resource_timestamp_day": 27.0, "resource_timestamp_year": 2001.0, "export_timestamp_present": false, "resource_timestamp_month": 5.0, "resource_timestamp_present": true }, "binary": { "code_size": 609280.0, "file_size": 691712.0, "entry_point": 613168.0, "code_entropy": 7.18, "data_entropy": 3.06, "import_count": 442.0, "string_count": 2213.0, "section_count": 8.0, "avg_complexity": 4.19, "function_count": 1744.0, "import_density": 0.74, "max_complexity": 79.0, "string_density": 3.72, "overall_entropy": 3.48, "avg_basic_blocks": 6.2, "avg_section_size": 86336.0, "dependency_count": 11.0, "entropy_variance": 2.81, "function_density": 2.93, "avg_function_size": 201.85, "avg_string_length": 14.87, "complexity_per_kb": 0.01, "max_string_length": 290.0, "wide_string_count": 212.0, "writable_sections": 4.0, "avg_string_entropy": 3.12, "code_to_data_ratio": 7.48, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.05, "total_basic_blocks": 10810.0, "executable_sections": 1.0, "string_length_stddev": 16.17, "largest_section_ratio": 0.88, "sentence_string_count": 116.0, "sentence_string_ratio": 0.05, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0, "high_complexity_functions": 13.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 80, "This program must be run under Win32\r\n$7" ], [ 504, "CODE" ], [ 624, ".idata" ], [ 664, ".tls" ], [ 704, ".rdata" ], [ 743, "P.reloc" ], [ 783, "P.rsrc" ], [ 1178, "Real" ], [ 1230, "LongBool" ], [ 1270, "String" ], [ 1282, "WideString" ], [ 1314, "OleVariant0" ], [ 1330, "HRESULT" ], [ 1456, "System" ], [ 1469, "IInterface" ], [ 1517, "IDispatch" ], [ 1717, "TInterfacedObject" ], [ 2316, "SVWUQ" ], [ 2428, "SVWU" ], [ 6007, "QSVW" ], [ 10012, "SOFTWARE\\Borland\\Delphi\\RTL" ], [ 10040, "FPUMaskValue" ], [ 10446, "SVW3" ], [ 10904, "SVW1" ], [ 11378, "YYZX" ], [ 11637, "SPRQ" ], [ 12206, "ZTUWVSPRTj" ], [ 12441, "r6t0" ], [ 12806, "Uh2\u003e@" ], [ 14696, "SVWRP" ], [ 16170, "Jx f" ], [ 16585, "PSVW" ], [ 19240, "kernel32.dll" ], [ 19256, "GetLongPathNameA" ], [ 19836, "Software\\Borland\\Locales" ], [ 19864, "Software\\Borland\\Delphi\\Locales" ], [ 22474, "odSelected" ], [ 22485, "odGrayed" ], [ 22494, "odDisabled\todChecked\todFocused\todDefault" ], [ 22535, "odHotLight" ], [ 22546, "odInactive\todNoAccel" ], [ 22567, "odNoFocusRect" ], [ 22581, "odReserved1" ], [ 22593, "odReserved2" ], [ 22605, "odComboBoxEdit" ], [ 22620, "Windows" ], [ 25800, "Magellan MSWHEEL" ], [ 25828, "MSWHEEL_ROLLMSG" ], [ 25844, "MSH_WHEELSUPPORT_MSG" ], [ 25868, "MSH_SCROLL_LINES_MSG" ], [ 26890, "Exception`u@" ], [ 26977, "EHeapException" ], [ 27069, "EOutOfMemory" ], [ 27161, "EInOutErrorpv@" ], [ 27248, "EExternal" ], [ 27337, "EExternalException" ], [ 27432, "EIntError" ], [ 27609, "ERangeError0x@" ], [ 27697, "EIntOverflow" ], [ 27789, "EMathError" ], [ 27877, "EInvalidOp" ], [ 27965, "EZeroDivide" ], [ 28052, "EOverflow" ], [ 28141, "EUnderflow" ], [ 28229, "EInvalidPointer" ], [ 28321, "EInvalidCast" ], [ 28413, "EConvertError" ], [ 28505, "EAccessViolation" ], [ 28601, "EPrivilege" ], [ 28689, "EStackOverflow" ], [ 28780, "EControlC" ], [ 28869, "EVariantError" ], [ 28961, "EAssertionFailed" ], [ 29057, "EAbstractError" ], [ 29149, "EIntfCastError" ], [ 29241, "EOSError" ], [ 29329, "ESafecallException" ], [ 29509, "TThreadLocalCounter" ], [ 29728, "$TMultiReadExclusiveWriteSynchronizer" ], [ 31396, "True" ], [ 31412, "False" ], [ 31844, "SVWQ" ], [ 31860, "PWVS" ], [ 34900, "INFNAN" ], [ 40384, "AMPM" ], [ 43061, "QQQQQQSVW3" ], [ 43709, "QQQQQSVW" ], [ 45357, "TErrorRec" ], [ 45486, "TExceptRec" ], [ 45883, "r3t7" ], [ 50016, "mmmm d, yyyy" ], [ 50760, "GetDiskFreeSpaceExA" ], [ 55100, "oleaut32.dll" ], [ 55116, "VariantChangeTypeEx" ], [ 55184, "VarIdiv" ], [ 55232, "VarI4FromStr" ], [ 55248, "VarR4FromStr" ], [ 55264, "VarR8FromStr" ], [ 55280, "VarDateFromStr" ], [ 55296, "VarCyFromStr" ], [ 55312, "VarBoolFromStr" ], [ 55328, "VarBstrFromCy" ], [ 55344, "VarBstrFromDate" ], [ 55360, "VarBstrFromBool" ], [ 55657, "TCustomVariantType" ], [ 55682, "TCustomVariantType," ], [ 55711, "Variants" ], [ 55801, "EVariantInvalidOpError" ], [ 55901, "EVariantTypeCastError" ], [ 56001, "EVariantOverflowError" ], [ 56101, "EVariantInvalidArgError" ], [ 56201, "EVariantBadVarTypeError" ], [ 56301, "EVariantBadIndexError" ], [ 56401, "EVariantArrayLockedError" ], [ 56505, "EVariantArrayCreateError" ], [ 56609, "EVariantNotImplError" ], [ 56709, "EVariantOutOfMemoryError" ], [ 56813, "EVariantUnexpectedErrorP" ], [ 56913, "EVariantDispatchError" ], [ 71713, "QQQQSV" ], [ 75871, "FSVQ" ], [ 76043, "FSVW" ], [ 77396, "Empty" ], [ 77412, "Null" ], [ 77428, "Smallint" ], [ 77448, "Integer" ], [ 77464, "Single" ], [ 77480, "Double" ], [ 77496, "Currency" ], [ 77516, "Date" ], [ 77548, "Dispatch" ], [ 77568, "Error" ], [ 77584, "Boolean" ], [ 77600, "Variant" ], [ 77616, "Unknown" ], [ 77632, "Decimal" ], [ 77660, "ShortInt" ], [ 77680, "Byte" ], [ 77696, "Word" ], [ 77712, "LongWord" ], [ 78084, "Array" ], [ 81930, "tagMULTI_QI" ], [ 81966, "IPersist" ], [ 82014, "IPersistStream(LA" ], [ 82070, "IDataObject" ], [ 82103, "ActiveX" ], [ 82121, "tagEXCEPINFO" ], [ 82173, "ITypeInfo" ], [ 82222, "IOleObject" ], [ 82274, "IOleWindow" ], [ 82326, "IOleInPlaceUIWindow\\MA" ], [ 82386, "IOleInPlaceActiveObject\\MA" ], [ 82450, "IOleInPlaceFrame" ], [ 82506, "IOleInPlaceObject\\MA" ], [ 82562, "IDropTarget" ], [ 82614, "IOleControl" ], [ 82666, "IPersistStreamInitXLA" ], [ 82726, "IPerPropertyBrowsing" ], [ 82786, "IPicture" ], [ 82834, "IOleCommandTarget" ], [ 83138, "TAlignment" ], [ 83162, "taLeftJustify" ], [ 83176, "taRightJustify" ], [ 83191, "taCenter" ], [ 83214, "TLeftRight" ], [ 83277, "bdLeftToRight" ], [ 83291, "bdRightToLeft" ], [ 83305, "bdRightToLeftNoAlign" ], [ 83326, "bdRightToLeftReadingOnly" ], [ 83382, "ssShift" ], [ 83410, "ssRight" ], [ 83418, "ssMiddle" ], [ 83427, "ssDouble" ], [ 83474, "THelpContext" ], [ 83501, "THelpType" ], [ 83524, "htKeyword\thtContext" ], [ 83545, "ClassesdRA" ], [ 83557, "TShortCut" ], [ 83581, "TNotifyEvent" ], [ 83598, "Sender" ], [ 83605, "TObject" ], [ 83697, "EStreamError" ], [ 83789, "EFileStreamError" ], [ 83885, "EFCreateError" ], [ 83977, "EFOpenError`TA" ], [ 84065, "EFilerError" ], [ 84153, "EReadError" ], [ 84241, "EWriteErrorhUA" ], [ 84329, "EClassNotFound" ], [ 84421, "EResNotFound" ], [ 84513, "EListError" ], [ 84601, "EBitsError" ], [ 84689, "EStringListError" ], [ 84785, "EComponentError" ], [ 84877, "EOutOfResources" ], [ 84969, "EInvalidOperation" ], [ 85165, "TThreadList" ], [ 85363, "TPersistent" ], [ 85382, "TPersistentXYA" ], [ 85404, "Classes" ], [ 85611, "TInterfacedPersistent" ], [ 85638, "TInterfacedPersistentHZA" ], [ 85686, "IStringsAdapter" ], [ 85959, "TStrings" ], [ 85974, "TStrings4[A" ], [ 86010, "TStringItem" ], [ 86269, "TStringList\f]A" ], [ 86286, "TStringListd\\A" ], [ 86425, "TStream" ], [ 86537, "THandleStream" ], [ 86657, "TFileStream" ], [ 86773, "TCustomMemoryStreamT_A" ], [ 86901, "TMemoryStream" ], [ 87021, "TResourceStream" ], [ 87433, "TStreamAdapter" ], [ 87525, "TClassFinder" ], [ 87775, "TReader" ], [ 87861, "EThread" ], [ 87953, "TThread" ], [ 87966, "TComponentName" ], [ 87986, "IDesignerNotify" ], [ 88445, "TComponent" ], [ 88665, "TBasicActionLink" ], [ 88841, "TBasicAction" ], [ 88902, "TIdentMapEntry" ], [ 89148, "TRegGroup" ], [ 89237, "TRegGroups" ], [ 92484, "TIntConst" ], [ 95409, "PRQB" ], [ 96964, "Strings" ], [ 104179, "TPropFixup" ], [ 104273, "TPropIntfFixup" ], [ 104788, "Owner" ], [ 111049, "QQQQ3" ], [ 115533, "QQQQQQQS" ], [ 119380, "Left" ], [ 122788, "TPUtilWindow" ], [ 124169, "EInvalidGraphicd" ], [ 124261, "EInvalidGraphicOperation" ], [ 124294, "TFontPitch" ], [ 124317, "fpDefault" ], [ 124328, "fpVariable" ], [ 124339, "fpFixed" ], [ 124361, "TFontName" ], [ 124378, "TFontCharset" ], [ 124406, "TFontStyle" ], [ 124437, "fsItalic" ], [ 124446, "fsUnderline" ], [ 124458, "fsStrikeOut" ], [ 124486, "TFontStyles" ], [ 124509, "TPenStyle" ], [ 124533, "psSolid" ], [ 124548, "psDot\tpsDashDot" ], [ 124564, "psDashDotDot" ], [ 124577, "psClear" ], [ 124585, "psInsideFrame" ] ], "sz": 691712, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 442.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 442.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 691712.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2213.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.88" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "Connect", "Connect", "Connect", "GetFolder" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 442.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI DIB section creation for BMP capture", "e": [ "CreateDIBSection" ], "i": "micro-behaviors/hardware/display/screen::create-dib-section", "l": 2, "m": "C0014" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary", "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "Query user locale identifier", "e": [ "GetUserDefaultLCID" ], "i": "micro-behaviors/os/sysinfo/platform::get-user-default-lcid", "l": 2 }, { "a": "T1113", "c": 0.699999988079071, "d": "System.Drawing.Bitmap class reference", "e": [ "Bitmap" ], "i": "micro-behaviors/hardware/display/screen::bitmap-fromscratch-str", "l": 1, "m": "C0014" }, { "c": 0.800000011920929, "d": "Query current foreground window", "e": [ "GetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::get-foreground-window", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "binary.import_count = 442.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "c": 0.7799999713897705, "d": "Register custom clipboard format", "e": [ "RegisterClipboardFormatA" ], "i": "micro-behaviors/os/clipboard/access::register-clipboard-format-a", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "HttpQueryInfo API name as string", "e": [ "HttpQueryInfoA" ], "i": "micro-behaviors/communications/http/get::http-query-info-str", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 712704.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Create process (ANSI)", "e": [ "CreateProcessA" ], "i": "micro-behaviors/process/create/spawn::create-process-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA", "GetModuleHandleA", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 1.0, "d": ".bat extension", "e": [ ".bat", ".bat", ".bat", ".bat" ], "i": "objectives/command-and-control/dropper/builder::bat-ext", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "a": "T1112", "c": 0.8799999952316284, "d": "Create registry key ANSI", "e": [ "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-create-key-ex-a", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 0.800000011920929, "d": "Copy COM automation variant", "e": [ "VariantCopy" ], "i": "micro-behaviors/os/com/invoke::variant-copy", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.12" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2213.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1055.012", "c": 0.800000011920929, "d": "CreateProcess API string reference", "e": [ "CreateProcessA" ], "i": "objectives/evasion/process/injection/hollowing::create-process-string", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "a": "T1036.005", "c": 0.8199999928474426, "d": "Microsoft short company name", "e": [ "Microsoft" ], "i": "objectives/evasion/masquerade/version-resource::microsoft-company-name-short", "l": 1 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy image list", "e": [ "ImageList_Destroy" ], "i": "micro-behaviors/ui/controls/widget::image-list-destroy", "l": 2 }, { "d": ".bat extension reference", "e": [ ".bat", ".bat", ".bat", ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc", "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.48" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "QQQQQSVW", "QQQQQQQS", "MDICLIENT", "MAINICON", "QQQQQQQQSV", "QQQQQQQQSVW", "OPENNEWWIN", "BBCANCEL", "BBIGNORE", "PREVIEWGLYPH", "DLGTEMPLATE", "PACKAGEINFO", "TNOTIFYFORM", "MAINICON" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "Create image list", "e": [ "ImageList_Create" ], "i": "micro-behaviors/ui/controls/widget::image-list-create", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassA" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 442.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry key metadata ANSI", "e": [ "RegQueryInfoKeyA" ], "i": "micro-behaviors/os/registry/access::reg-query-info-key-a-symbol", "l": 2 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI GetDIBits pixel readback", "e": [ "GetDIBits" ], "i": "micro-behaviors/hardware/display/screen::gdi-getdibits", "l": 2, "m": "C0014" }, { "c": 0.949999988079071, "d": "php variable encoded in wide string", "e": [ "No help found for %s#No context-sensitive help installed$No topic-based help system installed", "Invalid ImageList Index)Failed to read ImageList data from stream(Failed to write ImageList data to ...", "%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group", "$Error creating variant or safe array)Variant or safe array index out of bounds" ], "i": "metadata/lang/encoded/wide::php-variable-encoded", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey", "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 0.20)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "c": 0.9599999785423279, "d": "tb0713 Microsoft company marker", "e": [ "Microsoft" ], "i": "well-known/malware/trojan/shellobject/hijack::tb0713-short-company", "l": 1 }, { "c": 0.949999988079071, "d": "Initialize WinInet session", "e": [ "InternetOpenA" ], "i": "micro-behaviors/communications/http/get::internet-open", "l": 3 }, { "c": 0.699999988079071, "d": "Initialize common controls library", "e": [ "InitCommonControls" ], "i": "micro-behaviors/ui/controls/widget::init-common-controls", "l": 2 }, { "a": "T1056.001", "c": 0.800000011920929, "d": "MapVirtualKey P/Invoke string reference", "e": [ "MapVirtualKeyA" ], "i": "micro-behaviors/hardware/input/keyboard::map-virtual-key-str", "l": 3, "m": "E1056.001" }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery", "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.19" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection", "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.7799999713897705, "d": "Initialize COM subsystem", "e": [ "CoInitialize" ], "i": "micro-behaviors/os/com/invoke::co-initialize", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 442.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 442.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "MoveToEx" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1 }, { "c": 0.800000011920929, "d": "Convert OLE automation variant", "e": [ "VariantChangeType" ], "i": "micro-behaviors/os/com/object::variant-change-type", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit thread execution", "e": [ "ExitThread" ], "i": "micro-behaviors/process/thread/create::exit-thread", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1744.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2213.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "Overrides WndProc method", "e": [ "WndProcPtr%.8X%.8X" ], "i": "objectives/collection/clipboard/monitor::wndproc-override", "l": 1 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 442.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry subkeys via import", "e": [ "RegEnumKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-enum-key-ex-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1744.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "c": 0.699999988079071, "d": "Create brush object", "e": [ "CreateBrushIndirect" ], "i": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep", "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "d": "password keyword", "e": [ "PasswordCharX" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 442.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError", "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "a": "T1071.001", "c": 0.949999988079071, "d": "Read data from internet handle", "e": [ "InternetReadFile" ], "i": "micro-behaviors/communications/http/get::internet-read-file", "l": 3, "m": "C0002" }, { "c": 0.6399999856948853, "d": "System Action delegate token", "e": [ "Action" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::action-delegate-token", "l": 1 }, { "c": 0.800000011920929, "d": "Uses internet communication API imports", "e": [ "InternetOpenA" ], "i": "micro-behaviors/communications/http::has-internet-communication-apis", "l": 2 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "d": "overflow keyword", "e": [ "Variant overflow", "Floating point overflow", "Stack overflow\rControl-C hit", "Integer overflow Invalid floating point operation" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection", "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1105, T1204.002", "c": 0.8999999761581421, "d": "Italian staged download status", "e": [ "Download", "Download", "Download", "DOWNLOAD", "DOWNLOAD", "Download", "Download", "Download" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst", "l": 1, "m": "E1105" }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage::enum-windows", "l": 2 }, { "c": 0.8999999761581421, "d": "version.dll sideloading target", "e": [ "version.dll" ], "i": "objectives/command-and-control/dropper/sideload::sideload-target-version", "l": 1 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle", "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 10810.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "a": "T1547.001", "c": 0.800000011920929, "d": "Filters files by .lnk extension", "e": [ "\\Run DesktopLightning.lnk", "\\Uninstall DesktopLightning.lnk" ], "i": "objectives/persistence/login/startup/registry::lnk-endswith-filter", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1744.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Map virtual key code", "e": [ "MapVirtualKeyA" ], "i": "micro-behaviors/hardware/input/keyboard::map-virtual-key", "l": 2, "m": "E1056.001" }, { "c": 0.800000011920929, "d": "Convert Shell folder ID to path (ANSI)", "e": [ "SHGetPathFromIDListA" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-path-from-idlist-a", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query computer/host name", "e": [ "GetComputerNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-computer-name", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "explorerbar" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "c": 0.699999988079071, "d": "Check if window is enabled", "e": [ "IsWindowEnabled" ], "i": "micro-behaviors/ui/window/manage::is-window-enabled", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA", "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Open URL via WinInet", "e": [ "InternetOpenUrlA" ], "i": "micro-behaviors/communications/http/get::internet-open-url", "l": 3 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc", "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "c": 0.9599999785423279, "d": "Elex Internet Explorer product resource", "e": [ "Internet Explorer" ], "i": "well-known/malware/trojan/elex/worm::elex-internet-explorer-product-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection", "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "a": "T1105", "c": 0.9399999976158142, "d": "Embedded stage screen capture APIs", "e": [ "CreateDIBSection" ], "i": "objectives/command-and-control/dropper/staging/signed-bundle::embedded-stage-screen-capture", "l": 1, "m": "B0024" }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread", "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve special folder location via Shell32", "e": [ "SHGetSpecialFolderLocation" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-special-folder-location", "l": 2 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.75, "d": "Get window device context", "e": [ "GetWindowDC" ], "i": "micro-behaviors/ui/window/manage::get-window-dc", "l": 2 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "a": "T1036", "c": 0.8199999928474426, "d": "System tray icon manipulation", "e": [ "Shell_NotifyIconA" ], "i": "micro-behaviors/ui/window/notify::shell-notify-icon", "l": 3 }, { "c": 0.75, "d": "Find window by class/title (ANSI)", "e": [ "FindWindowA" ], "i": "micro-behaviors/ui/window/manage::find-window-a-import", "l": 2 }, { "c": 0.8500000238418579, "d": "High code section entropy", "e": [ "binary.code_entropy = 7.18" ], "i": "metadata/binary/metrics/pe-details::high-code-entropy-go", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 442.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile", "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.800000011920929, "d": "Borland CODE section name", "e": [ "CODE (perms: r-x)" ], "i": "metadata/lang/compiler/managed::borland-section-code", "l": 1 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://www.DesktopLightning.com/app/comm.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-endpoint-url", "l": 1 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "RegisterClipboardFormatA", "GetClipboardData", "…st be between %d and %d Clipboard does not support Icons/…", "TClipboardFormats", "Unsupported clipboard format" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetReadFile API name as string", "e": [ "InternetReadFile" ], "i": "micro-behaviors/communications/http/get::internet-read-file-str", "l": 1 }, { "c": 0.75, "d": "Read data from clipboard", "e": [ "GetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::get-clipboard-data", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "c": 0.699999988079071, "d": "Remove directory (ANSI)", "e": [ "RemoveDirectoryA" ], "i": "micro-behaviors/fs/directory/rmdir::remove-directory-a", "l": 2 }, { "c": 0.9700000286102295, "d": "VirLock GUI noise import pair", "e": [ "UnpackDDElParam" ], "i": "well-known/malware/virus/virlock::gui-noise-imports", "l": 1 }, { "c": 0.8999999761581421, "d": "GUI import cluster GetActiveWindow", "e": [ "GetActiveWindow" ], "i": "metadata/binary/symbols::gui-import-cluster-getactivewindow", "l": 1 }, { "a": "T1059.003", "c": 0.8999999761581421, "d": "ShellExecuteExA ANSI extended API", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/system::shell-execute-ex-a", "l": 3, "m": "E1059.003" }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll virtual key state", "e": [ "GetKeyState" ], "i": "micro-behaviors/hardware/input/keyboard::get-key-state", "l": 2, "m": "E1056.001" }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 2, "m": "C0014" }, { "c": 0.75, "d": "Query active window title length", "e": [ "GetWindowTextLengthA" ], "i": "micro-behaviors/ui/window/manage::get-window-text-length", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetOpen API name as string", "e": [ "InternetOpenA" ], "i": "micro-behaviors/communications/http/get::internet-open-str", "l": 1 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "InternetCloseHandle API name", "e": [ "InternetCloseHandle" ], "i": "micro-behaviors/communications/http/get::internet-close-handle-str", "l": 1 }, { "c": 0.8500000238418579, "d": "COM Both threading model", "e": [ "Both" ], "i": "objectives/persistence/system/registry/com::threadingmodel-both-word", "l": 1 }, { "d": "COMPUTERNAME environment variable", "e": [ "GetComputerNameA" ], "i": "micro-behaviors/os/env/vars/system-info::computername-var", "l": 2 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload::find-resource-a", "l": 2 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 691712.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceA", "GetDiskFreeSpaceExA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8999999761581421, "d": "CreateMutex API call", "e": [ "CreateMutexA", "sub.kernel32.dll_CreateMutexA" ], "i": "micro-behaviors/process/sync/mutex::create-mutex", "l": 2, "m": "C0042" }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage::get-window-thread-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "d": "hide keyword", "e": [ "hide" ], "i": "micro-behaviors/data/text/keywords::hide", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 708992537.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "TResourceManager" ], "i": "micro-behaviors/data/embedded/payload::dotnet-resource-manager-token", "l": 1, "m": "F0001.006" }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextA" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.48" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId", "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2213.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1547.001", "c": 0.699999988079071, "d": "CurrentVersion Run path", "e": [ "-Software\\Microsoft\\Windows\\CurrentVersion\\Run" ], "i": "objectives/persistence/login/startup/registry::currentversion-run", "l": 1 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitCommonControlsEx", "DrawThemeBackground", "GetThemeBackgroundContentRect", "HitTestThemeBackground", "GetThemeSysColorBrush", "EnableThemeDialogTexture", "GetThemeAppProperties", "SetThemeAppProperties", "GetCurrentThemeName", "DrawThemeParentBackground", "SetLayeredWindowAttributes", "OleCreatePropertyFrame", "OleCreateFontIndirect", "OleCreatePictureIndirect", "RegisterAsDropTarget", "MainBrowserTitleChange" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Compatibility alias", "e": [ "ShellExecuteExA" ], "i": "micro-behaviors/process/create/exec::shell-execute-ex-a", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Remove Windows input hook", "e": [ "UnhookWindowsHookEx" ], "i": "micro-behaviors/hardware/input/keyboard::unhook-windows-hook", "l": 2, "m": "E1056.001" }, { "a": "T1547.001", "c": 0.699999988079071, "d": "SOFTWARE CurrentVersion Run path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ], "i": "objectives/persistence/login/startup/registry::software-run-key", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1071", "c": 0.75, "d": "PHP URL endpoint (often used for C2)", "e": [ "http://www.DesktopLightning.com/app/comm.php?", "http://www.desktoplightning.com/app/index.php?", "http://www.desktoplightning.com/uninstalled.php?", "http://www.desktoplightning.com/app/notification.php?" ], "i": "objectives/command-and-control/infrastructure/domain::php-url", "l": 3, "m": "C0002" }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll mouse cursor position", "e": [ "GetCursorPos" ], "i": "micro-behaviors/hardware/input/keyboard::get-cursor-pos", "l": 2, "m": "E1056.001" }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "GetKeyboardState P/Invoke string reference", "e": [ "GetKeyboardState" ], "i": "micro-behaviors/hardware/input/keyboard::get-keyboard-state-str", "l": 2, "m": "E1056.001" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1744.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1071.001", "c": 0.949999988079071, "d": "InternetOpenUrl downloader API string", "e": [ "InternetOpenUrlA" ], "i": "micro-behaviors/communications/http/get::dynamic-wininet-api-set", "l": 3 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp predates 2000", "e": [ "pe.timestamp_pre_2000 = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "l": 1 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Delete registry key via import", "e": [ "RegDeleteKeyA" ], "i": "micro-behaviors/os/registry/manipulate::reg-delete-key-a-symbol", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1056.001", "c": 0.800000011920929, "d": "Forward events in Windows hook chain", "e": [ "CallNextHookEx" ], "i": "micro-behaviors/hardware/input/keyboard::call-next-hook-ex", "l": 2, "m": "E1056.001" }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "SetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-setpixel", "l": 2 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1547.001", "c": 0.75, "d": "Accesses Windows registry Run key", "e": [ "CurrentVersion\\Run" ], "i": "objectives/persistence/login/startup/registry::windows-registry-run-access", "l": 3 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "c": 0.699999988079071, "d": "Registry Run key", "e": [ "\\Run ", "\\Run" ], "i": "objectives/persistence/login/registry/autostart::run-key", "l": 3 }, { "c": 0.8500000238418579, "d": ".NET Clipboard class reference (WinForms)", "e": [ "Clipboard" ], "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "l": 3 }, { "a": "T1056.001", "c": 0.8999999761581421, "d": "Install global Windows input hook", "e": [ "SetWindowsHookExA" ], "i": "micro-behaviors/hardware/input/keyboard::set-windows-hook", "l": 2, "m": "E1056.001" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1744.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1744.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-getpixel", "l": 2 }, { "c": 0.949999988079071, "d": "links gdi32.dll (UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, ... +64 more)", "e": [ "gdi32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links oleaut32.dll (SysFreeString, SysReAllocStringLen, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, ... +12 more)", "e": [ "oleaut32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links wininet.dll (InternetSetOptionA, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle, ... +1 more)", "e": [ "wininet.dll" ], "i": "metadata/dylib::wininet/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links kernel32.dll (DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, ... +114 more)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comctl32.dll (ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ... +18 more)", "e": [ "comctl32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links advapi32.dll (RegQueryValueExA, RegOpenKeyExA, RegCloseKey, RegSetValueExA, RegQueryValueExA, ... +8 more)", "e": [ "advapi32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links shell32.dll (Shell_NotifyIconA, ShellExecuteExA, ShellExecuteA, SHGetSpecialFolderLocation, SHGetPathFromIDListA, ... +1 more)", "e": [ "shell32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links version.dll (VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA)", "e": [ "version.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links URLMON.DLL (CoInternetCreateZoneManager, CoInternetCreateSecurityManager)", "e": [ "URLMON.DLL" ], "i": "metadata/dylib::urlmon/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CreateStreamOnHGlobal, IsAccelerator, OleDraw, OleSetMenuDescriptor, OleUninitialize, ... +9 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (GetKeyboardType, LoadStringA, MessageBoxA, CharNextA, CreateWindowExA, ... +165 more)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "a": "T1497", "c": 0.8999999761581421, "d": "Input and foreground window check for sandbox evasion", "e": [ "GetKeyState", "GetForegroundWindow" ], "i": "objectives/anti-analysis/sandbox-detect/input::input-foreground-sandbox-gate", "l": 4 }, { "c": 0.800000011920929, "d": "Thread synchronization via message queue", "e": [ "PeekMessageA", "CreateThread" ], "i": "micro-behaviors/process/threading/async::thread-message-sync", "l": 2 }, { "c": 0.8999999761581421, "d": "WinInet request and response workflow", "e": [ "InternetOpenUrlA", "InternetOpenA", "InternetReadFile" ], "i": "micro-behaviors/communications/http/get::wininet-http-flow", "l": 3 }, { "a": "T1105", "c": 0.8999999761581421, "d": "WinInet download write and execute chain", "e": [ "InternetReadFile", "InternetOpenA", "DeleteFileA", "GetLastError", "CreateProcessA", "WriteFile" ], "i": "objectives/command-and-control/dropper/delivery/download::wininet-download-write-exec", "l": 4 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Windows hook install and chain-management APIs", "e": [ "UnhookWindowsHookEx", "SetWindowsHookExA", "CallNextHookEx" ], "i": "micro-behaviors/hardware/input/keyboard::windows-hook-lifecycle", "l": 2, "m": "E1056.001" }, { "a": "T1113", "c": 0.9399999976158142, "d": "Windows GDI active window capture primitives", "e": [ "CreateCompatibleDC", "CreateCompatibleBitmap", "GetDesktopWindow", "GetWindowDC", "BitBlt", "GetDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-window-capture-primitives", "l": 2, "m": "C0014" }, { "a": "T1027", "c": 0.8999999761581421, "d": "WinInet APIs resolved dynamically", "e": [ "InternetReadFile", "InternetOpenA", "InternetCloseHandle", "InternetReadFile", "HttpQueryInfoA" ], "i": "micro-behaviors/communications/http/get::wininet-dynamic-load", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1113", "c": 0.9300000071525574, "d": "Windows GDI screenshot primitives", "e": [ "CreateCompatibleDC", "CreateCompatibleBitmap", "GetDesktopWindow", "BitBlt", "GetDIBits" ], "i": "micro-behaviors/hardware/display/screen::gdi-screen-capture-primitives", "l": 2, "m": "C0014" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegCreateKeyExA", "RegSetValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "c": 0.800000011920929, "d": "Mutex-based single instance enforcement", "e": [ "CreateMutexA", "sub.kernel32.dll_CreateMutexA", "GetLastError", "ExitProcess" ], "i": "micro-behaviors/process/sync/mutex::mutex-instance-check", "l": 2, "m": "C0042" }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "LoadResource", "SizeofResource", "LockResource", "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 1 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "LockResource", "LoadResource", "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource extraction API chain", "e": [ "FindResourceA", "LoadResource", "LoadLibraryExA", "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-loader-api-chain", "l": 1 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.function_count = 1744.00", "binary.overall_entropy = 3.48" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1010", "c": 0.8500000238418579, "d": "Process discovery via window enumeration", "e": [ "GetWindowThreadProcessId", "GetWindowTextA", "EnumWindows" ], "i": "objectives/discovery/process/window::window-process-discovery", "l": 1 }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "RegisterClipboardFormatA", "Unsupported clipboard format", "GetClipboardData", "GetClipboardData", "TClipboardFormats", "…st be between %d and %d Clipboard does not support Icons/…" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key enumeration API chain", "e": [ "RegOpenKeyExA", "RegQueryInfoKeyA", "RegEnumKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-enumeration-api-chain", "l": 3 }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI window capture with screen context", "e": [ "GetDC", "CreateCompatibleDC", "GetForegroundWindow", "BitBlt", "GetWindowTextA", "GetWindowDC", "CreateCompatibleBitmap", "GetWindowTextLengthA", "GetDesktopWindow" ], "i": "objectives/collection/screenshot/capture::gdi-window-capture", "l": 2, "m": "C0014" }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI screen capture via DIB section (BMP format)", "e": [ "BitBlt", "CreateDIBSection" ], "i": "objectives/collection/screenshot/capture::gdi-dib-capture", "l": 2, "m": "C0014" }, { "c": 0.8199999928474426, "d": "Hardcoded uppercase mutex name", "e": [ "QQQQQQQQSV", "CreateMutexA", "BBIGNORE", "BBCANCEL", "MDICLIENT", "sub.kernel32.dll_CreateMutexA", "QQQQQQQS", "MAINICON", "QQQQQQQQSVW", "DLGTEMPLATE", "PACKAGEINFO", "TNOTIFYFORM", "PREVIEWGLYPH", "OPENNEWWIN", "QQQQQSVW" ], "i": "micro-behaviors/process/sync/mutex::named-uppercase-mutex", "l": 2, "m": "C0042" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegOpenKeyExA", "RegOpenKeyExA", "RegCreateKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1497.003", "c": 0.9100000262260437, "d": "Timer-gated key polling anti-analysis", "e": [ "GetProcAddress", "SetTimer", "GetKeyState", "KillTimer" ], "i": "objectives/anti-analysis/timing/evasion::ui-timer-keypoll-gate", "l": 2, "m": "B0003.003" }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetDiskFreeSpaceExA", "GetSystemInfo", "GetTickCount", "GetDiskFreeSpaceA", "GetSystemMetrics" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "a": "T1497.001", "c": 0.8799999952316284, "d": "User-interaction trigger APIs (mouse/keyboard/window monitoring)", "e": [ "GetCursorPos", "GetForegroundWindow", "GetKeyState", "EnumWindows" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::user-interaction-trigger-cluster", "l": 3 } ], "sha": "d0063ffa2eb090d47fcff01b0a70c92d756266813e9a8ccbce46ade10b95eca6", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/104682", "type": "pe" } ], "tv": "2a0fe" } }