{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9521276354789734, "class": 0 } ], "prob": 0.95212764, "class": 0, "models": [ { "m": "az", "prob": 0.95212764, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:06:55Z" }, "path": "376499", "raw": { "v": "4", "fs": [ { "f": "Md₂(Si)", "k": { "hash.imp": "ca87c02f24583556d1d2f14dd0e4df14", "pe.timestamp": 760284611, "hash.authenti": "7d3db6049ad6e5821b1be84a3cd4820c30218348849acff7b9e0b430acab645f", "hash.rich_header": "3a4041c3cd93a66d55d50ba6d9a10b66378721aaddde16de09a9fdfe3b1466e4", "build.target_arch": "x86", "pe.linker_version": "11.8", "pe.resource_types[0]": "RT_VERSION", "pe.rich_header.xor_key": "0xd57e80d9", "pe.debug_entries[0].size": 807822251, "pe.debug_entries[1].size": 3549500075, "pe.data_directories[0].rva": 25296, "pe.data_directories[1].rva": 114688, "pe.data_directories[2].rva": 118784, "pe.data_directories[3].rva": 49344, "pe.data_directories[4].rva": 24576, "pe.data_directories[5].rva": 55296, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 120, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 1032, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 496, "pe.data_directories[3].name": "debug", "pe.data_directories[3].size": 56, "pe.data_directories[4].name": "iat", "pe.data_directories[4].size": 96, "pe.data_directories[5].name": "delay_import", "pe.data_directories[5].size": 2344, "pe.debug_directory_types[0]": 1017175591, "pe.debug_directory_types[1]": 2134770598, "pe.debug_entries[0].type_id": 1017175591, "pe.debug_entries[1].type_id": 2134770598, "pe.version_info.company_name": "Microsoft Corporation", "pe.version_info.file_version": "5.1.7601.17514 (win7sp1_rtm.101119-1850)", "pe.version_info.product_name": "Microsoft® Windows® Operating System", "pe.debug_entries[0].timestamp": 461779030, "pe.debug_entries[1].timestamp": 1626549845, "pe.version_info.internal_name": "storeview.exe", "pe.dll_characteristics.guard_cf": true, "pe.rich_header_compids[0].count": 7, "pe.rich_header_compids[1].count": 18, "pe.rich_header_compids[2].count": 1, "pe.rich_header_compids[3].count": 1, "pe.rich_header_compids[4].count": 1, "pe.version_info.legal_copyright": "© Microsoft Corporation. All rights reserved.", "pe.version_info.product_version": "5.1.7601.17514", "binary.top_complex_unnamed[0].cc": 13, "binary.top_complex_unnamed[1].cc": 9, "binary.top_complex_unnamed[2].cc": 9, "binary.top_complex_unnamed[3].cc": 8, "binary.top_complex_unnamed[4].cc": 8, "binary.top_complex_unnamed[5].cc": 7, "binary.top_complex_unnamed[6].cc": 7, "binary.top_complex_unnamed[7].cc": 7, "pe.dll_characteristics.nx_compat": true, "pe.rich_header_compids[0].compid": 9664521, "pe.rich_header_compids[1].compid": 65536, "pe.rich_header_compids[3].compid": 14373389, "pe.rich_header_compids[4].compid": 14569997, "pe.version_info.file_description": "Store View Mode Lock EXE", "binary.top_complex_unnamed[0].bbs": 27, "binary.top_complex_unnamed[1].bbs": 19, "binary.top_complex_unnamed[2].bbs": 19, "binary.top_complex_unnamed[3].bbs": 15, "binary.top_complex_unnamed[4].bbs": 14, "binary.top_complex_unnamed[5].bbs": 14, "binary.top_complex_unnamed[6].bbs": 11, "binary.top_complex_unnamed[7].bbs": 14, "pe.rich_header_compids[1].product": "Unknown", "pe.rich_header_compids[2].product": "Unknown", "pe.version_info.original_filename": "storeview.exe", "binary.top_complex_unnamed[0].addr": "0x4037fc", "binary.top_complex_unnamed[0].size": 981, "binary.top_complex_unnamed[1].addr": "0x4021dc", "binary.top_complex_unnamed[1].size": 1168, "binary.top_complex_unnamed[2].addr": "0x401a46", "binary.top_complex_unnamed[2].size": 964, "binary.top_complex_unnamed[3].addr": "0x401e0a", "binary.top_complex_unnamed[3].size": 929, "binary.top_complex_unnamed[4].addr": "0x402f7e", "binary.top_complex_unnamed[4].size": 470, "binary.top_complex_unnamed[5].addr": "0x402d2e", "binary.top_complex_unnamed[5].size": 510, "binary.top_complex_unnamed[6].addr": "0x401000", "binary.top_complex_unnamed[6].size": 428, "binary.top_complex_unnamed[7].addr": "0x404080", "binary.top_complex_unnamed[7].size": 388, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".qdata", "pe.section_characteristics[2].name": ".rdata", "pe.section_characteristics[3].name": ".data", "pe.section_characteristics[4].name": ".CRT", "pe.section_characteristics[5].name": ".rsrc", "pe.section_characteristics[6].name": ".reloc", "pe.dll_characteristics.dynamic_base": true, "pe.rich_header.entries[0].use_count": 7, "pe.rich_header.entries[1].use_count": 18, "pe.rich_header.entries[2].use_count": 1, "pe.rich_header.entries[3].use_count": 1, "pe.rich_header.entries[4].use_count": 1, "pe.rich_header.entries[0].product_id": 147, "pe.rich_header.entries[1].product_id": 1, "pe.rich_header.entries[3].product_id": 219, "pe.rich_header.entries[4].product_id": 222, "pe.rich_header.entries[0].build_number": 30729, "pe.rich_header.entries[0].product_name": "Linker_VS2008_LTCG_RTM", "pe.rich_header.entries[1].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[2].product_name": "unknown", "pe.rich_header.entries[3].build_number": 21005, "pe.rich_header.entries[3].product_name": "C_VS2012", "pe.rich_header.entries[4].build_number": 21005, "pe.rich_header.entries[4].product_name": "Linker_VS2012_LTCG", "pe.section_characteristics[0].raw_size": 13312, "pe.section_characteristics[1].raw_size": 1024, "pe.section_characteristics[2].raw_size": 1536, "pe.section_characteristics[3].raw_size": 2560, "pe.section_characteristics[4].raw_size": 74752, "pe.section_characteristics[5].raw_size": 1536, "pe.section_characteristics[6].raw_size": 512, "pe.section_characteristics[0].virtual_size": 12918, "pe.section_characteristics[1].virtual_size": 769, "pe.section_characteristics[2].virtual_size": 1374, "pe.section_characteristics[3].virtual_size": 6636, "pe.section_characteristics[4].virtual_size": 74473, "pe.section_characteristics[5].virtual_size": 1032, "pe.section_characteristics[6].virtual_size": 496, "pe.dll_characteristics.terminal_server_aware": true, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 20480, "pe.section_characteristics[2].virtual_address": 24576, "pe.section_characteristics[3].virtual_address": 28672, "pe.section_characteristics[4].virtual_address": 36864, "pe.section_characteristics[5].virtual_address": 114688, "pe.section_characteristics[6].virtual_address": 118784, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "60000020", "pe.section_characteristics[2].characteristics_hex": "40000040", "pe.section_characteristics[3].characteristics_hex": "c0000040", "pe.section_characteristics[4].characteristics_hex": "40000040", "pe.section_characteristics[5].characteristics_hex": "40000040", "pe.section_characteristics[6].characteristics_hex": "42000040" }, "x": 5, "id": 0, "is": [ "JetMakeKey", "EnumJobsW", "WaitForInputIdle", "SetCursor", "GetUserObjectInformationA", "AnimateWindow", "GetSysColorBrush", "GetThreadDesktop", "GetColorProfileHeader", "WaitForSingleObject", "GetSystemDefaultLocaleName", "LocalLock", "GetSystemTimeAsFileTime", "WriteTapemark", "GetCommandLineA", "GetFileTime", "GetCurrentThreadId", "GetConsoleScreenBufferInfo", "DeleteTimerQueueEx" ], "ms": { "pe": { "entry": 21144.0, "machine": 332.0, "checksum": 0.0, "rsrc_size": 1536.0, "subsystem": 2.0, "timestamp": 760284611.0, "image_base": 4194304.0, "rsrc_entropy": 2.51, "entry_section": ".qdata", "size_of_image": 122880.0, "file_alignment": 512.0, "resource_count": 1.0, "resource_types": [ "RT_VERSION" ], "characteristics": 258.0, "has_rich_header": true, "size_of_headers": 1024.0, "export_timestamp": 0.0, "has_version_info": true, "import_dll_count": 5.0, "computed_checksum": 141760.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "timestamp_pre_2000": true, "debug_timestamp_max": 1626549845.0, "debug_timestamp_min": 461779030.0, "dll_characteristics": 49472.0, "has_export_timestamp": false, "linker_major_version": 11.0, "linker_minor_version": 8.0, "debug_directory_types": [ 1017175591.0, 2134770598.0 ], "has_resource_timestamp": false, "debug_directory_entries": 2.0, "delay_load_import_count": 1.0, "number_of_rva_and_sizes": 16.0, "debug_timestamp_unique_count": 2.0, "entry_in_nonstandard_section": true, "debug_timestamp_nonzero_count": 2.0 }, "file": { "size": 96256.0 }, "binary": { "code_size": 14336.0, "func_count": 34.0, "code_entropy": 5.5, "data_entropy": 5.84, "func_density": 2.43, "import_count": 19.0, "string_count": 105.0, "avg_func_size": 383.18, "section_count": 7.0, "avg_complexity": 4.71, "import_density": 1.36, "max_complexity": 13.0, "string_density": 7.5, "overall_entropy": 5.55, "avg_basic_blocks": 8.47, "avg_section_size": 13604.57, "dependency_count": 5.0, "entropy_variance": 1.67, "avg_string_length": 11.95, "complexity_per_kb": 0.34, "max_string_length": 46.0, "wide_string_count": 18.0, "avg_string_entropy": 2.87, "code_to_data_ratio": 0.18, "data_to_file_ratio": 0.03, "rsrc_to_file_ratio": 0.02, "text_to_file_ratio": 0.14, "total_basic_blocks": 288.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 8.74, "debug_reference_count": 2.0, "largest_section_ratio": 0.78, "sentence_string_count": 4.0, "sentence_string_ratio": 0.04, "writable_section_count": 1.0, "executable_section_count": 2.0, "nonstandard_section_count": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 116, "xor", "ihy_WerObjec" ], [ 184, "Rich" ], [ 456, ".text" ], [ 575, "@.data" ], [ 616, ".CRT" ], [ 655, "@.rsrc" ], [ 695, "@.reloc" ], [ 1010, "xor", "GetUserObjectI;" ], [ 1343, "stack", "5@{\u003c" ], [ 1468, "stack", "y^k)" ], [ 1512, "stack", "y^k)" ], [ 5233, "stack", "[5\\p" ], [ 5614, "stack", "\u003c*M\u003c" ], [ 5680, "stack", "\u003c*M\u003c" ], [ 6257, "stack", "2On{" ], [ 6328, "stack", "\u003c:M\u003c" ], [ 6412, "stack", "\u003c*M\u003c" ], [ 9624, "stack", "gW.\u003e" ], [ 14321, "xor", "GetUserObjectIn3" ], [ 15523, "HDPC" ], [ 15528, "6547547" ], [ 15536, "strdline" ], [ 15847, "xor", "GztUs@rObnectonfoPmat" ], [ 15936, "RSDSO" ], [ 15960, "tz_SS_k47gSjm.pdb" ], [ 16310, "ESENT.dll" ], [ 16332, "WINSPOOL.DRV" ], [ 16348, "AnimateWindow" ], [ 16364, "GetSysColorBrush" ], [ 16384, "GetThreadDesktop" ], [ 16404, "GetUserObjectInformationA" ], [ 16432, "SetCursor" ], [ 16444, "WaitForInputIdle" ], [ 16462, "USER32.dll" ], [ 16476, "GetColorProfileHeader" ], [ 16498, "mscms.dll" ], [ 16510, "DeleteTimerQueueEx" ], [ 16532, "GetConsoleScreenBufferInfo" ], [ 16562, "GetCurrentThreadId" ], [ 16584, "GetFileTime" ], [ 16598, "GetCommandLineA" ], [ 16616, "WriteTapemark" ], [ 16632, "GetSystemTimeAsFileTime" ], [ 16658, "LocalLock" ], [ 16670, "GetSystemDefaultLocaleName" ], [ 16700, "WaitForSingleObject" ], [ 16720, "KERNEL32.dll" ], [ 18452, "Kygh" ], [ 19441, "xor", "GetUserObjectIna\\G" ], [ 23903, "xor", "GetUserObject3" ], [ 28078, "xor", "GetUserObjectInfor" ], [ 32406, "xor", "GetUserObjectInfoH" ], [ 37267, "KNOMJ" ], [ 38468, "NOEJ" ], [ 38768, "NOBJ" ], [ 39068, "NOAJ" ], [ 39368, "NOHJ" ], [ 40268, "NOOJ" ], [ 40426, "l`V0dfs58f#Ud" ], [ 40568, "NOGJ" ], [ 41095, "xor", "GetUserObjectInformationAGetUsP0" ], [ 42198, "U.hqm" ], [ 43473, "G35TP" ], [ 43502, "7YQP" ], [ 45384, "xor", "GetUserObjec" ], [ 49571, "xor", "GetUserObjectInfo" ], [ 51911, "/0 x" ], [ 57961, "gooMYW5" ], [ 60318, "X37U" ], [ 60432, "6H6S" ], [ 63979, "Sv.z" ], [ 64531, "C0P1" ], [ 68831, "/VnS5h" ], [ 71881, "Ypmc" ], [ 72310, "\u003cJ16\u003e" ], [ 72723, ".ynh" ], [ 81497, "LOHV" ], [ 84322, "xor", "GetUserObjectInformatb" ], [ 88708, "xor", "GetUserObjeN" ], [ 90682, "6UBN" ], [ 93031, "xor", "GetUserObjectInforman%" ], [ 93409, "zo75" ], [ 94310, "wide", "VS_VERSION_INFO" ], [ 94402, "wide", "StringFileInfo" ], [ 94462, "wide", "CompanyName" ], [ 94488, "wide", "Microsoft Corporation" ], [ 94538, "wide", "FileDescription" ], [ 94572, "wide", "Store View Mode Lock EXE" ], [ 94630, "wide", "FileVersion" ], [ 94656, "wide", "5.1.7601.17514 (win7sp1_rtm.101119-1850)" ], [ 94674, "xor", "veCUFeCOVjEc\\I" ], [ 94712, "xor", "veDUBeCOSj\\cYI_" ], [ 94746, "wide", "InternalName" ], [ 94772, "wide", "storeview.exe" ], [ 94806, "wide", "LegalCopyright" ], [ 94836, "wide", "© Microsoft Corporation. All rights reserved." ], [ 94934, "wide", "OriginalFilename" ], [ 95002, "wide", "ProductName" ], [ 95028, "wide", "Microsoft® Windows® Operating System" ], [ 95110, "wide", "ProductVersion" ], [ 95178, "wide", "VarFileInfo" ], [ 95210, "wide", "Translation" ], [ 95822, "xor", "GetesenObj" ], [ 96003, "xor", "uiFEAq@WPvWCF" ] ], "sz": 96256, "ts": [ { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 105.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.03" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.949999988079071, "d": "PE ProductName field is populated", "e": [ "Microsoft® Windows® Operating System" ], "i": "metadata/package/versioning::pe-product-name-present", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 2560)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 760284611.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.699999988079071, "d": "PE FileDescription metadata field", "e": [ "FileDescription" ], "i": "metadata/package/versioning::pe-filedescription-field", "l": 2 }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "376499" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.949999988079071, "d": "PE FileDescription field is populated", "e": [ "Store View Mode Lock EXE" ], "i": "metadata/package/versioning::pe-file-description-present", "l": 1 }, { "c": 0.699999988079071, "d": "PE CompanyName metadata field", "e": [ "CompanyName" ], "i": "metadata/package/versioning::pe-companyname-field", "l": 2 }, { "c": 1.0, "d": "PE first resource is RT_VERSION", "e": [ "RT_VERSION" ], "i": "metadata/binary/resource::pe-resource-version-first", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 122880.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 34.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "Windows operating system product string", "e": [ "Microsoft® Windows® Operating System" ], "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "40", "48" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 5.55" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.949999988079071, "d": "PE LegalCopyright field is populated", "e": [ "© Microsoft Corporation. All rights reserved." ], "i": "metadata/package/versioning::pe-legal-copyright-present", "l": 1 }, { "c": 0.949999988079071, "d": "Case-mangled GetUserObjectInformation token", "e": [ "GetUserObjectInform" ], "i": "well-known/malware/ransomware/stop_djvu::case-mangled-getuserobjectinformation", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 1536.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low average string entropy (dictionary text)", "e": [ "binary.avg_string_entropy = 2.87" ], "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy", "l": 1 }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2 }, { "c": 0.8500000238418579, "d": "Windows spooler library dependency", "e": [ "WINSPOOL.DRV" ], "i": "micro-behaviors/os/service/export::winspool-drv-dependency", "l": 2 }, { "c": 0.8999999761581421, "d": "Get system time as FILETIME", "e": [ "GetSystemTimeAsFileTime" ], "i": "micro-behaviors/time/query::get-system-time-as-filetime", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.02" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.949999988079071, "d": "PE version info numeric fields present", "e": [ "5.1.7601.17514 (win7sp1_rtm.101119-1850)" ], "i": "metadata/binary/anomaly/format::version-info-file-version-present", "l": 1 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "Microsoft Corporation company in version info", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "Control Flow Guard enabled", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-cfg", "l": 2 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "GetConsoleScreenBufferInfo API", "e": [ "GetConsoleScreenBufferInfo" ], "i": "micro-behaviors/os/sysinfo/console::console-screen-buffer-info", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 34.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.71" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1204.002", "c": 0.7599999904632568, "d": "Short PDB marker", "e": [ "tz_SS_k47gSjm.pdb" ], "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker", "l": 1, "m": "B0024" }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".reloc", ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1036.005", "c": 0.949999988079071, "d": "Microsoft company version identity", "e": [ "Microsoft Corporation" ], "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Microsoft vendor marker in resource section", "e": [ "Microsoft Corporation" ], "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.87" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 19.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "binary.import_count = 19.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".data (entropy: 7.24, perms: rw-)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Packed loader code-to-data ratio below 0.4", "e": [ "binary.code_to_data_ratio = 0.18" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-low-code-to-data-ratio", "l": 1, "m": "B0032" }, { "a": "T1612", "c": 0.8500000238418579, "d": "PE has few icon resources", "e": [ "pe.icon_count = 0.00" ], "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six", "l": 1, "m": "B0023" }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp predates 2000", "e": [ "pe.timestamp_pre_2000 = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "l": 1 }, { "c": 0.8999999761581421, "d": "Claims Microsoft Corp in version resource", "e": [ "Microsoft Corporation", "Microsoft Corporation." ], "i": "metadata/binary/vendor::microsoft-corp-versioninfo", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 1.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 19.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetConsoleScreenBufferInfo", "GetUserObjectInformationA", "GetSystemDefaultLocaleName", "GetUserObjectInformatb", "GetSystemTimeAsFileTime" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 7.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data (entropy: 7.24, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ "binary.code_to_data_ratio = 0.18" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-0--inline-29196", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.code_to_data_ratio = 0.18" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-0--inline-29187", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (WaitForSingleObject, GetSystemDefaultLocaleName, LocalLock, GetSystemTimeAsFileTime, WriteTapemark, ... +5 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ESENT.dll (JetMakeKey)", "e": [ "ESENT.dll" ], "i": "metadata/dylib::esent/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links USER32.dll (WaitForInputIdle, SetCursor, GetUserObjectInformationA, AnimateWindow, GetSysColorBrush, ... +1 more)", "e": [ "USER32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links WINSPOOL.DRV (EnumJobsW)", "e": [ "WINSPOOL.DRV" ], "i": "metadata/dylib::winspool/drv", "l": 2 }, { "c": 0.949999988079071, "d": "links mscms.dll (GetColorProfileHeader)", "e": [ "mscms.dll" ], "i": "metadata/dylib::mscms/dll", "l": 2 }, { "c": 1.0, "d": "Modern PE hardening (ASLR + DEP + CFG)", "e": [ "true" ], "i": "metadata/hardening/mitigation::pe-modern-hardening", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor → base64", "e": [ "\u003cbinary data\u003e \u003cxor+base64\u003e" ], "i": "metadata/encoded-payload/xor-base64", "l": 3 } ], "sha": "d4125a838e66f9f47d0677f9f59458cf3bb161ffe5d9dbad18a01853e686f55f", "path": "376499", "type": "pe" } ], "tv": "46790" } }