{ "llm": { "conf": 0.6684577, "grade": "benign", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.9976981, "class": "benign" }, "outcome": "benign", "interpretation": "Legitimate Firefox maintenance service" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.9976981, "rte": "az", "prob": 0.9976981 }, { "cls": 0, "raw": 0.9983505, "rte": "az/native", "prob": 0.9983505 }, { "cls": 0, "raw": 0.9972081, "rte": "az/pe", "prob": 0.9972081 } ], "prob": 0.9976981, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.9976981282234192, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-29T06:00:48Z" }, "path": "Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_7_2.vir", "raw": { "v": "8", "rev": "c1ea9", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000{Y7o]4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000{+lC*YIO!wYIO!wYIO!wbjSLXY?[[xU(\u003c7$JzP/*U(\u0026.\u003cS8iWcU(\u003c4%fhR\u0026ZvxG", "ln": 0 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000Jyk36p?*1gBr?O2Br?O2Br?N:2Tnp?GtXFwP$A9D0h]{v8IouKf*U\u003cuGua7bGMxAVQR5rF0o?V\u003e003fiZ+FdQ.=qX$bVKZw%afI/1onB}p.k}[gSti8R#)21q=X*:Xb#ZhsbPj3FK6oHk/Vd\u003c%8[LB/nFqQ*H%\u003cjk(*}d1rc4].#FtxZZ(9C0rraM*yG0W0rrakjJG!*%8[LB/m?1.rGf.m\u003eOKv30enjg7G14?muzh0:3xY4\u003eVv/:%bj$ZmlgzGxIuGk0o=]L%nL{V=n\u003e}9sY)M5\u003e+5v+0enjh4/WneFK6ojxMh3U0paujL/Mb\u003c(W0lS:uY?aB{d\u0026%G$[jMIu0RRJG6Ce008k=0rraNZ\u0026QF(qh{p10rrak^8XGMq0viz%nO1#\u003e?4(}0b97*k(*c4@@r0{\u003eWuHL09JE*Eg#UYG$}*M@$N!Ik(:.{exHfT\u003e^QM\u003e%4}]]iSGdo{jHo(m^y+4p@#06\u003e+4\u003eO%4}]biSGd.gXK#nKPbpWI]+bmirf5q-{1ou003XW:W2}bB{d\u0026%G$}*NGt1R]0007H7Mhr5I+TKO\u003eW(BE0qCbG8]a-6\u003e(pX-GjP\u0026sJywwIwScQ=:3\u003eJy:W2{Emt9VnkMH*0LZ(41G$[jMZw[ll@$N!Ik(:.{YVACt\u003eO%K3%4}}8irf5i-0\u003e[60001UJHQ1H0o*P^004.*Bq!1NJFi(6003XG:3xY4\u003e\u003ceiE%bj$Z//e%igXKp\u003e*Ji^q0:YMw:3xZ\u003e1.=Mek(*b\u003c@R#)]\u003eUTtu09JD.=GDFY004.*BU0Fbk.hi3p?Yvsk(*bB@R#)]\u003eVx?B0e5h#\u003e:hnF%bj$Z?-7PogR=owazqFgk(*b1@R#)]\u003eM%lH09JE*BP8mtI]+a{h#\u0026}mZ(ahJ0@@sdunG\u0026g\u003e*hu\u003c", "ln": 928 }, { "b": "jnTaey9lU\u003eI3O:H0Z3pb\u003c1[!?I3P3VuTv2xs\u0026m--0098-[VI])P?(p!05IMIGD}9e0rw4hbP3HZ08((#I.#Sdk(-.ds5\u0026mn1667pxAe2jFkIlUI9@QGI75zPI$?@8@%%^c0rra1rCzRoy5}#F004KF%jia$Gz$(YGHC[w0e?\u003cGFK6ooso3-Hr/6i\u00269rjGCtQg2o}#mgWcij8DGztDSGDg6[06w*zG-}FS0e[:Ky:o.h\u003eNSm8%9\u003e1GI9@QaG$[i", "ln": 3111 }, { "b": "6?\u003ciB0enjh4/WneFK6ojxLtQQ0pd}wXxEksJG9f2%nRr5dGxE5Z\u0026Zd!6*Nso08NvQ+S#l{TC}}$@R#)]@$Ml0k(=Mj%8!?K6*Nso08Nt.+%qu}J8tN*KO/7Tp/iji\u003e(7LY\u003eU\u0026V90e{uaG](ii%aQeWr@@v450:$cJFihX%nS8uaDqGW%nL{Vv(TI?GtXRDH2qR7@@v=D4#3hE0051rI1H-EJzP.l0yqyOB[)MgBBN$a0SSjWH2zX8%4)FgJFie", "ln": 4009 }, { "b": "%1\u0026y%(7e1T0e]d^00-G7G$}*H@$N!Ik(:.{p%.Gd\u003eTs}u%4}}Nd/YN4-0?R[bPGSVq=-]kwpM@CG$}*X@$N!Ik(=MjDupne6*Nso08NvY={mV}4E\u003cz$q0tXB004U\u00264cY[T0094vbPM1Ih2)RVI$\u0026o1bPGUXBr?#=D)yWMr@S[BFi:f?Z\u0026ZT%6*Nso08NtC^lN=@:)Yofq0roS008oG0@@rY9N(@k0cI[ir$76RbP6vo=GHz*%nMkQZ\u0026ZT%6*Nr", "ln": 5043 }, { "b": "@$L@[k(=)jbN^H:0AYpoxN\u0026wGG$}*U@$N!Ik(:4{1onBz8VHKqFK6ojxJiOH0o?O\u003c%nL{VEi[{]GtXg0I.#5@k(*@oso3\u0026+C?kjY\u003e=s1G%4}]ncia3Gs)ht0004@D\u003ePRnL06MzD0049MxY]J#0ri^8FK6o6GzMZg\u003c5P\u0026T/fGA2BN5]aq0v*6001?fGtXgJ@S9K].\u00264hld2U#IurYkf\u003e/taK0e5ij.=qSYGx%.Op.k}[gStht@8lS$xG(Fc05Jv", "ln": 6428 }, { "b": "I@!lZF:wE1005Y?5jcvM-efc)I#\u0026$Vq=M\u003e1Jyk3eIbU-Cp=5chl)JQJp(BN{D)x?H1xyqabRn%gJdsg]I-0+Jk(=/-2.tnwG$}?L%jh?$Duphc!\u003e*57/fGA2:(@^8q0roL004U\u00264fa]yj]$Y:I*M=!s8722^${Er6OTtB9@\u003c!/xAlWJ0o/{o%nL{Vp9Y/tGtXgkDrxzx0SSjWoE7DLs5rSmrSr!)Fi:f?Z\u0026Z1:!\u003e*2W/G/J6O?{zal)KgqD)xW", "ln": 6895 }, { "b": "bl8:gD$U!1k(*aj\u0026@x3P\u003e/aRy05JwZ-0!UhbZZb!.%ngNxXL/M\u003ePF)+%4}}d9rl6}{e%\u003c/If70O%8YI6I-0txk(*@o%8YIa%ji951DuwaE1L@PD\u0026Sw?}#uXIZZ(a30001KD)B7t4${XT004-cBt))a*D+\u00266=eFZ5q0p[1003e8I+Ks?9A}VR7YTL\u0026Z\u0026Zo6\u003cL8%2\u003e=A+y%4}]^9rl7xsU[*#xLnWDk(*bm\u0026S5{O\u003eT=={0e2UA7YWYwy93M21zPZ", "ln": 8655 }, { "b": "o+mp8GtXfO.0r6w6*Nso08M-$xI^\u003eT0o*oe%nL{Vsp+DjGtXEZ:brW\u0026uTtLktJ=b3004@subIrY3@ZebI-14Qk(=)jbOj3\u003c0002*gWQa%y5}smp(B1-y:pA=y:pqa!}H[Zde$2EFK6o0761U\u003eBo:Rq(9HA\u003c0b8Sr0pT.7rAk2DbQuj^!}H[Y\u003c=8UN5kVwbxAJ++0rmc^b(XPEFi:f?Z\u0026W+1s5YcvbPM?0jB/Y$G$}/wI*M=}Jyk3eIYCSAk(+T", "ln": 12121 }, { "b": "004T.\u003cn!z!0@@sNw=8MdBQmgQ00014I%#NC\u003cI%Z!@@r2#\u003eNdv\u003c0e[\u003eX+R5}@.\u00265V#\u003e+XBZ0k?/{(}{XZI-4eUk(+0^hiZM%0rpTIhipo]0eTex%jiaXI:^L9/BJN=0001S}Z.D3pxVsC1AFVZ\u003eXq\u003cM0e{uam*8%R[n?af00\u0026M8jmEp)I]HVX}#:@2-=qI+q%jxv003e8G$}*BJyBEv-=smtq%r:b003e8G$}^+.t:NkJu2Fd6}x?v0hC=Flid2", "ln": 16921 }, { "b": "p(dTs@$M8@k(=\u0026rH5VmtH1*X+gR=*-yx4jeq2.mwFK6o\u0026Z\u0026T0P1nDQjslOV\u0026004\u003cA@8)fRZ\u0026T)7p?{2hI.#5%k(+T1y5[p+G$}^-H1*Yn%8[n6^O6Svs=l2Lyct:jI4\u0026lvI+Ta1{/ABTk#qs@q!=qE0rpS7Z\u0026ZB)B]pD4{Y7m@\u003e=3At0lk6?0002+aDn?/y5?8]S.SP{sY{D]BqfvQ}#y*B%8[n6cINMus+B/}(Je(TuT3\u0026{\u003cZ2=7I%KG5[RZ9", "ln": 20504 }, { "b": "ve{pd\u003e!*o#08R[fuJp7U-1mTrC)e\u0026D%lytJEJeuf4GyO\u003e\u003eTaRn%as]609K}^3\u0026(jauTv3Qy7a=-[\u003c9ot1R?1qGu%NOEDii1I//qV{79C7G$}*F\u003eXqKD0lk6P0002..wSyOI]U366-XlK{c]DQBoWwf3\u0026]RWr{mN^003eOw=8Ke\u003eS/aE%5\u003eoPIgaE9mG0e+%nRo*0002+:bt6CI*:U!\u003eNfJN09NitI%M8.ax8t$*L{Txy6MMgIcY4x]q:(u40ro", "ln": 23687 }, { "b": "C{PeamNv8h{a(\u003eG5jcwNB]ls\u003cr/G\u0026Kqub0}{\u003cd5-mU%1^5\u003c=NOZ\u003eIF*51*T}\u003cZ2=8s7(c8k(*{17\u003eL3NI-6\u003cKk(=\u0026rxN(ae09xiKgx*O^li7XTJZiUDQx0+I0rpRa1Yb:%0bdQSk(:#Y1v+YT%je$fp.k}[xRpwK09t{3mNvaP!?WFa5jcwgTD2NDsecf[lid5pgx*O^li7YuJZiUDQyY)Y0rpRa1Yb:%0bg2Bk(:#Y6H\u003ey?%je$fp.k}[xZy-", "ln": 35034 }, { "b": "000000000000000000000000000000000000000000000000000000000000qV3K}KO/aVBO(dtv/clbjP2iWd/oqE4eZbade%qF5Dq+h}2go]\u0026qJ-S+(dRyY-4{iSqV!$L(pW-G-g#LAq/\u003eruJ6%9m/Az*f-z7M9r2%s2l1S6(IQ.-/.\u003e*J+kztvWex", "ln": 92112 }, { "b": "sNMm\u003csL0MN00000%0@a\u003c000003\u0026*nc6Awak]Zq!X]W:9z00000%0@a\u003c000003ig5a1onA42\u003ed\u0026{2?PdTz2!RSv/QAEASxUJwDjs.wb{ACyYBCnlVm0lCXIm@A=kD0B8}rYk\u003e45tDr0igP@gcQvQS^\u0026vqG:#v{%E[z/bKP1POLr3JHeb000009rl8P1onA400000Mh*{21onA400000Jq@%]2MK\u0026800000JSo6{2MK\u0026800000J@Pf}2MK\u002680000", "ln": 92884 }, { "b": "zVBhCwb{fvwb)5s3ig5a00000002)%hukAhfAs6j4fc.neDu)[zuaOPBo0A-wDlPFzVB[Wx8(PBaolD.z#:qDv/Q6uaol0NzVB!Taok*IASx.LBPumUwDlPFBo3vZ4fc.n00000002)%hukAhfAs9k4fc.neDu)[zuaOPBo0A-wDlPFzVB[Wx8(P", "ln": 93434 }, { "b": "0a=dv01w]n000000000008-!P05aye05jD.015YT03znc0cwi.0a=dE0b}{W03zn-0b?\u0026W0bhBJ0bhBP0bhBw0bITH0d1SR03zn-0b8vz03zne08-!@03znU0b?\u003cT0a=cM0cwiO0at\u003eB03znW0b.^D0a=c.015Z90b8vD0cnb.0bhBJ0aV7z0aM0", "ln": 94591 }, { "b": "01w]n0000008-!P05aye05BP:015YT03znc0cwi.0a=dE0b}{W03zn-0b?\u0026W0cFo.0a=cM08iC(07^e:03znK0b?\u003cF0a=cM0a(jK0b?\u003cO03zn-0b8vD0cnb.0at\u003eG0cncK0bRZB0bITX03znL0cFoZ0bhBJ0a#oO0b.^B0cwiP0cOuN03znK0b?\u003cF", "ln": 94903 }, { "b": "yYFeHyxd]CyYF.XaolG-xAhPzaolAZwDl=KBPujTBo0A-zVBwHaok)Kve$9zyYFeHzuaqHaok*Izu7^Vo-O8(nDqA:eDxnXzVBROz#:OLyYF2Dwb).Lc\u0026+[2v/QrBASvJ*aol0NBPupVv/QPJx-J5Kzu7^Vw=M\u0026KzVBROaok*IaoloVve$xHx-JqRwDi?Mv/QAEzua.TBo3sYBPt[KBo3jVASviZzVB!Taol0NASy1Tz2+WUl\u0026.36yYEffve$0wzu8o?4fc.n00000quePPfAr)egYN%+3ihTTaol9QzuaeDzVBUPA@Y[OA@ZpZwDlPFBo0A-zVBUPwDh", "ln": 95192 }, { "b": "000ua3ig5a00000002Z[x-ISyASy1TA@ZaUw=M]MaokBxx-JhOBPt?IyYCNTlJwRpd/ZW(qug?tzua+Ux-I#IwDi?MoAn=bvGpAGve$rFC(N*A002Lvli9x7li7^3wDl-JzuakFyYDl\u003eg5@{bwb{ACyYBCn002G8B3TRUz^@+E002G8B4ggYwDkhoB4o!-r://!wDkhoB5MT(r://!wDkqtx([5$y?XiblVM).x\u003e7N/q!oDXx(v(TCMp9KwNPW(mrSlWBvyBQ002xbwNPW(q!o/OAa\u003cfgwKQ\u0026B002@eBw#{]wNPaFBywV{m%elXvqZf#wDk8rwNPW(ra{q-vpTs}z!@x!zdN./002@eBw#{]wNPa*z/oC\u003ex(dB40038ex((*.A-uZ)wNPa*z/oC\u003ex(dB4lT:!EvQS+ZA@XNzz/YF?xMvV)wn(E9y/Ca=wPv+J002xbwNPW(ra{q-vpP", "ln": 95746 }, { "b": "lVM:DBy!x@zdmB1x\u003e6?JzFJqNq!p5swObv[y\u0026\u00266Yy^.#TwN/?2A+P9a00000mq^l+q*ACawO\u003eaVv{%g+B47rNlVl*Xvrb{TBAh8kxgm4Bm}D^gvru6Iz/PY6BvyAOm}D^oz!0i(wL3=Kz:!)Jm}D^wx(dAJz/PY6BvyAOm}D^xB7GwWwObv[y\u0026\u0026u?v{%g+pgn0J00000nPN]", "ln": 96288 }, { "b": "Dh}QUeDwcrp5\u003em]yxenMeDwAzqucW%Dh}QUeDw-Ir@-j2JpoakbbWWaP@gcQrC(O\u0026z*c7wwQ4Y@Acb/jzu6Upv@(IB0rr9100000000000@@r3ao^@D0000000000PZUkEae?B8q/#%To(B[Hrcq:Ls7L[xra{yOmSJhyq^\u003c+Fq/#$*vr??Mo(B]Wvr??Mrcq+[wmo--r@", "ln": 96608 }, { "b": "000000a=dF04!gJ08\u0026\u003c$009c61o!#m2NH?C3\u003eiWS5d]J*6CRx17-skh9337xar.{NbQB=+c[cR@eg\u0026FcfFLssg=mfIi5%2YjuU\u003e)kTv.7l}6Nnnj=ADoIFnTp/ga?r8($2sxO*itWpVyu$0IOwmYv=xLzi%y\u0026a6dAb/]tBAI+JCZjQZE0{D[0aM1s0cnbu0961#07D@u05%@U0961#07D@u05jEi089wY000000961]07^eT08AO.07u\u003e/04q-cy?$K200SA61][V701Ybj1][\u0026e5cLA\u003cmfJ?#1Qc+q08JT", "ln": 97559 }, { "b": "2llXpfI\u003eP40000wd1Eb7Fb/MHu$-}YxLmUS2y7ibCw}Hb2MK\u0026g00\u0026Mf2MK\u00268rrb}$mf3i=gxofge=XotoAm-^00000o\u003ewx!vp%drz*ks-m}D^dv@#BdwMJO-wn=U(m}D^ovrlJRv@#BdwL^q:B-mrXm}D^xB7Gw/vRPE:Bv*vZz/PY6BzkVhr@-j2m}D^sA=kD0B8$z%zE^Wfq/(C\u0026x(v\u003e?0rr91v5lc?0SSi2xR^#{0@@r3Aht\u002621onA4C+)Xa1POJ5H]0xq1][S6KFLky2lj-7N597G2MK\u00268PRT{O2(\u003c@9Shh=W3ig", "ln": 97908 }, { "b": "6-Xjl2=o(/761sm5t?.[7YTKo7]xO082%TpaF}B88uo:qd5Gog8VP\u003crfS4bo8#]%sihO$w9rl6tk=c*E9SMfuntXVM9@(ovp]lIUaohxwsF!v:aPIGxv5ui\u0026a]?PyxR[5}bldYzAhC]3bME/AC=0+bb(^]BFtLQjcia2CH]9DrcJBbDKFUqzdf6tFN5idHdGxCGPR+0Pd/YLHShq\u0026Xec2UIU+\u003cX^eDt+JXtzK(f8$$LZ[%x$huiZS:FIl6hVJ*T^568eh#\u0026{U/RQ}mirf3V\u0026he^uj]+M.\u003e+ZSCkl7V-[tnFKkMy=:{[*sSk(Z(+0h\u00269.lJv8^2=x@*l\u0026Wh!5t}!]mGrz*7]GU1m/SI?aG4H9nDn.\u003cd5Puhn=O?\u003efSdhpo8[}(ihY4xp5\u003em]k=l)Fpxgv{nt!-NpYHE}p]uOVrSAa1sF[B+r@-j2v5Do\u003cs]XK5xS1b@wDhYgAhL#4E/GDG/XeQ\u003e0r-x5C=9?c0T5G6GR}9o0%wP7KF+wA1oXY8C-+n(1Q1/9OtOTM1{s]aShz]Y2lU2bW5lg\u00262M$bcZ]6D#2)pkd9f\u0026!\u00263J{Cf++)-b3\u003clLg/R.1n4fMUh\u003cFLoz4G(+i[twLL4*h\u003ej@hh*X5cI$k2=H2?5D\u00267lrfoDD5^egmy(}0-69Fpn6Ssp$6A!yoaGdNa6:aHpet$\u0026m76BQqih/ay7Z6*sm5SxK83x{tp]DUW8uZ3ut=o{*8W3cvxSah%90ulwBF}F99rVuxFt+:l9S#DyJhP2x9%qMzN5ApJaoRVAQ]lMVaP}=BU=6?/a{m(CYR[9@blN#D:F.x8bM[8E!tLUkb)jhF\u0026hw{wciKqG)5ihIcJ\u003czH{]3EUdfGRJ1GsV!dG/.K5ud}}d*b?L9h#j7ecC}Md5/GjeD=4Nk=E3Hf9zmPoSpqTg6vNSsGaN^gZ0^Uwt}\u0026{h3r)VAh=b6huT0WE5PyihV%9XH]AVui0oiYL=l}GirPrZPS7iSiS]A.TF[F=i%kJ-Xt.:]j{g\u0026=-hM35klH@^^5xqhkM?5!*]iNtk)de/\u003e=3\u0026FlJ^w?]R?", "ln": 98240 }, { "b": "[Bu8v].4}L}1:^-@qDS{009c61o!#m2NH?C3\u003eiWS5d]J*6CRx17-skh9337xar.{NbQB=+c[cR@eg\u0026FcfFLssg=mfIi5%2YjuU\u003e)kW!biwmYv=xLzi%y\u0026a6dAb/]tBAI+JCZjQttWpVyu$0IOwmYv=xLzi%y\u0026a6dAb/]tBAI+JCZjQZE0{D[FpSr8GOteoH(41EJe-\u003cUKDCY\u0026L:dM3N3\u003czjOsMmzPRn9PQ[%@^ShV!$TGwUeU^7HuW6^uKXvGh.YUh4]Z})[9-kP:p:JqPF+*1CV^9Zp\u003c!yAd4/Xb0k*$.", "ln": 107792 }, { "b": "l\u0026Wh!f^xm+mGrz*f^xK\u003ck#4yWw=M-HASxOHwDlAAzua.TBo2.HyYFnK00000x-J2JA@ZpZve$9zyYBCnz2^#Ax-J2JBo2\u003eLzua8BzuaeDwDl=KwDl-JB]VjRv/Q6ueDxF+zua.TBo2.HyYFnKe=YX/zVBzI00000nP5P\u003evqG:]zF78kwPz%dv}u^bx([2hw]zZ1wGV5kwN/B^x\u003ep*ce?Nb7nP5P\u003evqG:]zF78kwPz%dv}vnBe=U\u003eKlVm9-wft=dBrCpnB97\u0026by-)!gA=#ebwIb8Fc)-yM00000ra]?=B7Gxnx\u003e7Y%CvtLnx(n0lvqG:\u003ewft@ov}f7\u003eB7PMhy\u003cu0XBPuvXx8(@Lve%*rwDhYgrD8O\u003evpT7\u0026xcqnbA=#ebwGUY0azC.mByx04wN)zCe=U\u003eKlVm9-wft:", "ln": 110380 }, { "b": "00000ra]?=B7Gxnx\u003e7Y%CvtLnB-p#lvpS}WaAIWnv}x.5w{4{aC(N*ABPupVx-J2JA@ZpZve$9zyYBCnz2^#Ax-J2JBo2\u003eLzua8BzuaeDwDl=KwDl-JB]VjRv/Q6ueDx[[zuawJzua.TBo2.HyYFnKe=YX/zVBzI00000rC(I*B97\u0026by?W^1aAIamC4\u003eC$e?O:RlVm9-wft=dBrCZzx(n0lvqG:5B7Gxnx\u003e7ZbarS6UwgmGUra]?=B7Gxnx\u003e7Y%CvtLnB-7]hB97\u0026by?mc1B9g#5wPI{8B.\u003e(t00000v/QfxwDliuyxb{^v/Q6uASygY00000o-P8iDh}TVyYFnKve%14ve$0wzua+UwDlPFve$fBv/Q6u00000q/(C*Bw(:\u003eC4\u003eC$lV^u+l${ZYvru0)wPw]9vqfK?wg!#Ec)-yM00000yYFwNx8(#M00000z2^#Ax-J2JBo2\u003eLzua8BzuaeDwDl=KwDl-JB]VjRv/Q6ue=YX/zVBzI00000z2:", "ln": 110736 }, { "b": "00000aohYF00000Ck#sSzua.TBo2.HfAttTl\u0026Z=#w=MltBPujTBn#pvc\u0026!b+BPujTyYC):0000000000qVH.ow=M]MCk#4KASxUJtMvE#x-ISyASy1TA@ZaUw=M]MtMv?9x-J2Jwb{JFCk#W:tMva\u003eBPuBZASxUJzua+UrSDXhASydXx-J5Kzu9]wrrc[px-J2JA@ZpZve$9zyYEYuo-P8iDh}TVyYFnKve%14ve$0wzua+UwDlPFve$fBv/Q6uqVHweASym.x-ISywDhYgl\u0026Z{3A@ZdVyYE(zC(Q\u003eBwDl-JA@Y[OzVBUP0000000000o(Ct(y\u00260JOvqfR3wD", "ln": 111232 }, { "b": "x(+y(pGeDDz/P(fv@%sCnPV80vrjELc2vS5lVm9-wnS=paAz4gz*2Xmw[=6)aAIHkv\u003eF(Dc)-yM00000z2^#Ax-J2JBo2\u003eLzua8BzuaeDwDl=KwDl-JB]VjRv/Q6ue=YC.CMqpP00000lVm9-wnS=payPkdwO#33w[=6)aAIHkv\u003eF(Dc)-yM00000lVm9-wft=dBrCgfCP.6sA=#ebwGU@2Bz9oHasFKDdf6tFmRN9Uwft@8A=#ebwGU@2Bz8!sz-P0!y\u0026.ielVh", "ln": 112356 }, { "b": "w[=Gjx(\u003e)GBzbkdB7Gxnx\u003e7Y%x(+zmz/^agay/CaBzkk[y-)kaze:AhwO#PjBzb98az$+4woe(nzY\u0026I2azC.mByx04wN(]}z/M$yAa:i1wmY*8Bz\u0026pCz/PRCarS6UwgmGUzVBONwb(Pf00000ra]?=zE[2mB7Gxnx\u003e7Y%vRGZ*A^n^qz/](baz#at", "ln": 113332 }, { "b": "wO@SkAaAy0wIe4CvruTkazbt7wDhYglVm9-wft=dBrCQnvpQG)A=k!qB-p(1By^7CByxolB0b7ey?iODB-p(1By/FBwQ4=eA+funA=bD0aAITkBAIT=ash7evq{g4D1?ee00000eDvH900000f931)wDlVHyYE(zv/Q6u00000q/(C*BzkS9aA.Tlvru66Ab](bwPI]nvriMkxK@rcwPz%dv}u=%zxK1iB8#5lzxHR=0000000000o\u00261@1rz#D", "ln": 115224 }, { "b": "B9g#5wPI]nwPz*fAXms(B-p(1By^7CByxolB0bgraAITsy?$k5AbYSsx(mMavqYP#B-p(1By=OsvriMez/^ayBZ[])B8$@oy+tX/lVm9-wft=dBrC^Fx()]eB-p(1By^7CByxolB0bKCx(4Pdvq{g4D1?eeaA8cuw)]y\u0026B-I4owPz*fAXms(0000", "ln": 115732 }, { "b": "BrCToBrCEtaA}\u003cuBy=OoxKL{}zF782v}f7\u003eB0bysazbt7wIb8Fc)-yM00000BPuvXwb{3rBo2\u003eLASvY(wDl@PwDhYgnP5P\u003evqG:5wnc6}v@#TfC{4lGwmoN\u003eAV!\u003egB.\u003eOhzF%RtvR3V)wPRH7ze0)0wg^\u0026Z00000mriA!AV!\u003e9wN/H\u0026zF78aw/#hewGVbmwmoM", "ln": 116280 }, { "b": "ByxolB08ONc1FC80000007gWEy?aVaz/^ayByxiiaAhvtv}x.5ay]RaaARJAv}xX5x\u003ez6?vru66v}YB-yANheA=k$vz/cXuAaAy0wPxzmCX5GIrD8FSBzkS9aA.Tlvru6kB97\u0026jB-PeTasFKDdf6tF07gWEy?aVaz/^aCA+PSbaAg[fwnb{]aAITkBy=OpzY\u003cf", "ln": 117151 }, { "b": "00000lUgpWmRM:JlUgpWx\u003ez6?vru6LzC$T}A+cw9vqfK?wg!#Ec)-yM00000lUgpWx\u003ez6?vru66wnbM%zF%RtzddJ@xDR2gB9h5maA8oyzEEx[e*8n+c1FC8lUgpWm}D^qvqPNOBAh8kxcp!{x(4u\u003ee*8n+c1FC8rC(kOy?j-hzY\u0026F8y\u0026r/(By=OiwO(vaC{3Y", "ln": 118316 }, { "b": "Bzku3v{%E\u003cay/7@v@0XtasFKDdf6tFmriA!AV/pray!#6Bzku3v{%E\u003caARTDB95KmxK$W?e*8n+c1FC8q!nmoB7]o8p\u0026Zn!vrcS)z!\u0026{4p\u0026Zn[x(4u[wDhYgq!nmqwnccZA+PYhy?ml\u003c00000q!np7v@3jap\u0026Zn[x(4u[wDhYgq!nspwNPW(m@i9MvqF+Xx)aibwOkMOq!nspwNPW(p*[0Fw[=6)p\u0026Zn[x(4u[wDhYgq!nspwNPW(p?sV:vqYT]BwN0(C4\u003e=7xjR5yq!nspwNPW(q*Aj?z!%b$oLFxWp\u0026Zn[x(4u[wDhYgq!nspwNPW(rbVL-zCUv/C4\u003e=7xjR5yq!nvdvS=rWA+PYhy?ml\u003c00000q!nynvpB4:l$HgCxjk)@z/ex(x)aibwOkMOq!nKqAaK6hz/f09wL^zYC4\u003e=7xjR5yq!nKrv@=c?B7EWDB7Ff*x(w3aBA{Y6x)aibwOkMOq!nKrv@=c?B7Fi\u003ez//z:A+PYhy?ml\u003c00000q!nKrv@=c?B7FA\u003eA+/xbxh-w-p\u0026Zn[x(4u[wDhYgq!nTvvpR=Dx)a6dp\u0026Zn[x(4u[wDhYgq!nTvv@1!IzeTDup\u0026Zn[x(4u[wDhYgq!nWiv}YN]wKf*oz/]@tp\u0026Zn[x(4u[wDhYgq!nWizEEf?r=q!%zdMK:x)aibwOkMOq!n^Cz!rZ1wM9qXxkzcQA=kD0B8$e#x)aibwOkMOq!n\u003cry**^:y/2d^C4\u003e=7xjR5yq!n\u003crzeTJcq!Qq}wn=Wfp\u0026Zn[x(4u[wDhYgq!n\u003crB98tvwL^zYC4\u003e=7xjR5yq!n)sv%8*aBA{Y6x)aibwOkMOq!n)vB-.ejCwZk$x)aibwOkMOq!n)MzEU$BwO#P^A+PYhy?ml\u003c00000q!n)MB97#gmq^o.A=k\u0026jwO#P^A+PYhy?ml\u003c00000q!n)MB97#gp\u0026ZF^x(4uSA+PYhy?ml\u003c00000q!n)MB97#gBzkP6p\u0026Zn[x(4u[wDhYgq!n{pyH{p=zE)\u003cfxLzAZA+PYhy?ml\u003c00000q!n{rvO?8VC4\u003e=7xjR5yq!n{xzdM)?zE(T+x)aibwOkMOq!n{GB-RUowj7xGwkcGIl1szoB8$e#x)aibwOkMOq!n%Dwn+%[p\u0026Zn[x(4u[wDhYgq!n%DB8L(ev}*3@wjZVTB-ZD2x)aibwOkMO00000lVm9-wft=dBrCHhByw)3aARKqwO}", "ln": 119372 }, { "b": "00000000000000000000000000000000000p.k}[[BeZz0@@r3qD2$Z.Bog]sare4N$E{pt]9#o0SSi2v(^\u003e7B.LV5B6JN2Dnn\u0026Gy*?G#tYKy(eP07WwO-@xgCSrDy?baKfFCgmfFCgmfFCg=vS=y3wl:4ZyaT4iA+e\u003c3CWbuez!%i6Bx\u0026r]ze:AhwO#QhtY0[-zGGDcvqYN^B7Gxnx\u003e7ZVzddc@By/t#zEWm0wPz%dv}voiwmtJs00000=J0}B=J0}B0000000000098J=GD-..0000000000%nSc000000kMy=:ddxI500000000000rr91ipGil4dDK.00000000000000000000xD/+yrpAfN00000000000SSi2wBI\u003e+Apuc[4dDK.00000xD^", "ln": 120624 }, { "b": "002*%m}D^ovrlJVA=M8s006CclVM:DBy^):wO#P\u003e00006y\u0026:Ysv@lg0r@^ZIlU{WZwK{lEwnC/S\u003eM0$\u003cwNPW(ra{q-vpPuri%4]-BvG$XwM9q?wDpD+lVM:DBy!o?z!0v1B5@twpxTNbvpR\u0026wy?iOD.t(@zwNPW(mRMWIr@/JdoMaAHy^@CRwDnLblVl{?mRMV", "ln": 123332 }, { "b": "A=kD0B8}rY2)9RdBvgg\u003eA+fcgp\u0026ZF:wPI[)ODqq)BwN0@v)KToA+frk007%Vm}D^wwO(xQx(4uQvqPNS0018xm}D^gA+PYdrc-B]r@?aYs8@1%wKZxIwDiexp\u0026ZF:wPI]GgdC$#B97E-4*kZHz!0v1B2bNDwQ5q#008J?lVM:DBy!A\u0026z!%8#y\u0026zf=q/l2.B7/Gl007mCo(Ch^mRMWIr@+(ZqCGUOgCQN[y?%7Kf9j*=vpSqUA+PA7k(=llCxm.zx(n38r@=l0mn+]%e[w^m008J\u003cq/(C*Bw(:\u003eC4\u003eC$lV^u+l${ZYvru0)wPy\u0026L\u003e(K^{Bw(:\u003eC4\u003eC$q/(C\u0026B-NJ.To8phxk8BewPyZXA=#ebwKyMWy!d#LwnC*$r@!rZlVM:DBy!xZA=#ebwMF\u003ciwDk8lz/YF*wPz%dv}whtzE^M{008o:l$HgCBy!xZA=#ebwDizCpJf(.q:Tn/zEEf?A-Skv\u003eMjW]Bw(:\u003eC4\u003eC$pHX6Iv@$TXv%8*aBA)\u0026^76moJwO$BTA=#ebwMF\u003ciJr8Q*x([5$y?Xibq!oDYA+PSvl$HBHA+L", "ln": 123644 }, { "b": "xII#MwMF\u003ciy5*RtzGG]qy/s[=C4\u003eC$002H\u003cqfuC\u003cC#Fo{C4\u003eC$lVl\u003cOx\u003eHGEr02%exg3GNB7F0QC(TMuqE%GtwPQ%Yy\u0026%qTCVK\u003eBtMEuaBw(:XB-IhrC%(j+v@=p5Bz(g/vpK9NK]N\u003c\u0026wNPW(s7Mh:okXV(zC$mW007HGlVND\u003eBvP[:nmuNMp*[xMz2\u0026q\u003clVND\u003eBw=W^wNPT\u003elVl\u003c:wQ5p%ZYl-xD2N\u003c\u003ev@VT9A+dQRzGGDmBu])b.Vi5AD2N\u003c)A+b", "ln": 124314 }, { "b": "l1B.MB97x1yH}xWA+PYhy?ml\u003cA@X]oqfuC\u003cC#Fo{C4\u003eC$q/(C\u0026B-P#@000VlpJf(.q:Tn/zEEf?AZoW9k$1:tp!rC#e[w^m006k6lVND\u003eBwl*?lU{WZwDo:JlVND\u003eBwWf(A^pC\u0026ygQ)%002T(lUgpWm}D^qvqPNOBAh8kxib6kkMBe.A=:=\u003ewO1kuA==2cx\u003e7N[wKyxNBy/Ys001\u003eRlUgpWmRM:JlUgpWx\u003ez6?vru6LzC$T}A+bjJ5=+pgA=:V+", "ln": 124666 }, { "b": "B4f\u003eWwMiwXwDj7Vm}D^hzGY-mz/fA6zGF*0A+PA7B5@twODhi2wO1qFC4\u003e#nzF-%5Bw)p4x(mN8r@=\u003ennPNphvS=r@wPyQ/wPIB2Bo3dWnPNZGz!0v1B8M7*wNPX6A+e6/wPIB2Bo1o5nm=jGq!ZL?001qCmq^iUAZK\u003eYBzkk[y/s[PBzkVh005.}oL4TQwKyGLBzkk[y/s[PBzkVh004JMrC(FUzE^M{wjp-MwPh:9z/e3Uy\u0026\u003cle002p*q!p5JzFiD@wb", "ln": 125558 }, { "b": "z!@#^008{1q!p5ux(4uSz!T9hwPyj:005e.mR)i*xHVYLwKpJKw[u17007^Pm}D^fz/fSmy?k$g008\u0026$pJZ+#B-Z2.vS=rZBAh8kxib6khuMGYvq]aQl2pvQv/RX)lVl*Xvrb{TBAh8kxib6kMif/Fo\u003c@0tBAh8kxib6kao+XPBw)o(nmuyDy?iOD?uu#3x()]Nz/fSmy?lVF\u003e(:{@Bvy7TpI97gy?iOD00000000000000000000000000000000000000", "ln": 126076 }, { "b": "000000000000000000000000000000000000000000000000000000000000%nSc000000%nSc0Fc(nR00000000000000000000000000000000000000000000000000000000000000000000000000000000puB*NU]gqA0rr91761sm0SSi20SSi20@@r30SSi21on", "ln": 126416 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000625c8Xgaohy(7YTKoh#\u0026@e000000000000000000310rr91pYHGC000000000000000000310rr91xAe3.000000000000000000312)pkdFb/MH0000000000000", "ln": 131536 }, { "b": "wPI%8wkEqXC4\u003e=7xjVcF3lQDlarR^?zf65)B8u7Ri=X!KB.bSowN[kOwN/\u003e8x(v(.wP?T3az+RjwO:HNA+flkx(W=JwnM3#x(!xpvruBda%q2xl1szoB8%F*w)]H%wG\u0026lIj{\u0026zParS^1zf65)B8u7Ri=X!KB.bSowN[RTx)aibwOkN}j{\u0026zPjtgL)uTX1)B#8g2wN/\u003e6x([R:3oP$UB6\u0026u%zfvY@BAhIBBv*vZz:1HJauTdLze-{9x\u003c$^)x([RyCX}nmB3gZ\u0026", "ln": 132167 }, { "b": "x\u003c$^)x([RMB$\u003eg83lQDlauT7KAbok#vruj4zAXyIarR^HauTZ/AbY-oBy!#UqY[UxjTbkjwIvZPvkfI?vRf79eI}6Ji4XP1vkPR[ia=XUfKVW[vl4+Aa$(a!arR^HarS^/B-qqrA=+(6pG5xcwizb-f\u003eJs5hE!W7eJtB}f!CjqgDv3Ehdy2Di5t80w\u0026sfNwmmzREiHsd3lQDlarR^?B9hCvz/P@hwkubDnN%$dDO/d^w?(tSgC7EuvMu1%g=c{svQRobeO3+1whEZKvk.WMidh#7j{\u0026zParR^HjACT:AbP=swN[Onaw39bb6#a6f/7^#iBKG%wh#L1g?HiceJvq%wg.jBg=c)wgbSV7gHUXQffPZ=arR^HauTZ/AbY-oBy!#UqY[UxjTbk:gb7Bqg=mizf/p^CeI]m[h7-k]w[rLFfGrPOwO0VdgIes?a$(a!arR^HjtgbZAbok#vruj4zAXyIauRq!z/6D4Bzkh#y?X0pj{\u003cz9vrlH3zdmsbj{\u0026LqgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr91d/^H60rr91d/^H60rts:00000000c400062000000000000000004PL00031qVH[tASx!NzuaqHmGvc5yYF2", "ln": 132410 }, { "b": "003sb00031fAr^bfAr^bfAr{fvGn7Z000\u0026o00031lJz38z2!zMwDlPFBo3vZ002s=4/=RgoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002W)x-ISywDlPFA@Y+KiSHo5o-N#\u0026oAlgng5}pO002E*6954klJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[zVC7-x-I@HyYE(zaoj\u003ehzVB[WzuahEve$xHx-J5Kzu6Up001zE00031mGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up001RK2lj=8mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qgxo3cfArZ9f-RgN001+O2lj=8pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qgxo3cfArZ9f-RgN001bw00031nDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE001$U2MK(9oAnS7x8(uuyYEAmASxIFwb{fvz2^#AASx\u003ePA@Vgu002Z[zVC7-x-I@HyYE(z003417xsEopxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE003\u003cove$0wzua+UwDlPFve$fBv/Q6uA@Y+KASym.x-ISywDjs.wDl@PwDhYg001XM2MK(9pYLIozVBqFBPt[KBo25ove$cAwDhYg002E*x-JeNwDlrxzVC1Z001[S4/=Rgli8cdx-I@Hwb]g3l\u0026Wh!001+OfAr*ch2]uhg5%3ehukDihVLYngYPxkfAq7M002y!00031rSDLdASwMex-I@HwDkp4zuanGzVx+q001nA1onA4q#*}sve$fBA@Z1Rve$xHx-J5Kzu6Up00000UMK}a00000000000000g003a40012[cONkdh84oHr4@8wA4(.{Og}Me+}ODq[I6.(%1C\u0026QiX:U\u0026tRQsPN\u003e-IH?za7C[?G[]cO!4An?$6nzzEwg!?Vtx)Lj\u002616/e\u0026CybqIs([YeeaV7S8g=dVUBU]doLR!*=Per#k.zG+0*Cxf[4Ma}Tl]vN]FhJ6sI-3$YR.$}vYFWL-:#dK6!?#ku]!(R72SreJ6GdZ8q8R]xyC{t]U@iySp=JeGT#D+Gh-Wo^XJfmwi66F?AYOLdHb#s}ZDfE$=PpbF(PjY1}-n1ADol^wIAv?1V]+\u0026X.8{jf*=C", "ln": 132942 }, { "b": "000000000000000000000000000000000000000000000000000000000000Kf:0kjoy9MD\u0026s0AT6\u003e\u00268tvdjb}9$bU3DHT%fM@b+yeb--JZRs:g!3%d5S3Se1=^$]@%ZB7C\u003e@5!kh.M37s1plh8FuxE.XmS@)9xjhhRmz\u0026h}FX-W82Zqj2\u0026BnZP8vzZ*S{z$z[Uh%(*WGmjOeAZ:Bulki]dbOA2Wv%]V30r!?OPF$/s5BBFp(\u003e\u003cS09Ar2QEx@YxoD\u0026a2BvnSuLu@SyZII#Wu=r%SDhw2xi\u0026}vmmo/gm8mPnGBleM5/u?0$cn}cQ}P\u003c!?@6a7TN-Ly}Ghh\u003eNc90NqWRwPluh1ps?]mBSuku.U\u003cgR@S5Ao}(-=VtJ=D7*EVA?co5BezK2)pcOW$}c8s59j%8cqwob.42EMWlmM@.0\u003c*duP%!w30m!R4tcGMSZ5?[y)O8d5k3SVhL*zjU4O1T\u003cce5RMJ))O\u0026V!\u003e1/MY1W9WpB)l{16u[q4v=Z}b{T+Sjj7saQn/xWOiomUQSb:7\u003eor5wk@id8DI{MR1KLU/Wk/PH)Ypg(*{K@@CKlrt[Z7Sn[v\u003c4jp5p*UullR6Q(c\u003cO=5lki]dfMGO@V5SJ@u}u]yBJB$SzpscQqM5CRTPBc?ABN#Zx$0MlqH?1%EUl@gl6l.2*j@GF6\u0026TZSve?!NC@LY\u0026(%S%*%j3c/:mt\u0026z-DLwZ.t\u003els{)+{gJ*$=djnQ(4c90Nqa!q8))e{vScn.NGzv\u003c\u003cl3}kATh8-/(-=VtJPWK?k)\u0026R%44e*J^jUIBb0{sl#zpE:7JaZZ[/kx0:)Zhsgi\u003e8mjc0bKiLaTqY", "ln": 139216 }, { "b": "IX\u003eFrN\u003ed{lw?\u003cc/}/U99PZSzkN?5cZ}Xyl5L\u003cnNT(L/?u\u003eL#/c@sblouzvDNrboOxBDU?R=KwC]?pc]LD-dtKMl1^z%k%x=fCQYvW6jp.vsKMz\u0026uJx)^rE@)q8g%i7UYh:v\u003c8aJUHdG(Qe\u003ePnc)Dk\u003cvEI{5zsEG\u0026y8qu}zsuF4?N9/Y6.R-Z5lF7#l+.BK)OJyCE!et@FbK\u003eIA:f@v.Cos", "ln": 229056 } ], "mol": "K₂(Am₂Li)O₅(As₇CCaEr₂S)H₅(Cr₂F₃Os₁₆Po₆U)Md₆(Bi₁₀BkHePaPtSi₂)", "sha": "d5da91a9dc65808eec98f6343aa0a5fc2a9152b0c12ebc0428bc5463f34ecadb", "path": "Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_7_2.vir", "risk": 149, "size": 719360, "supp": [ { "by": [ { "id": "metadata/signed/platform::mozilla-version-company", "spans": [ [ 133092, 18 ] ] } ], "id": "objectives/anti-static/pack/section-anomaly::rwx-reloc-process-loader", "crit": "hostile", "kind": "downgrade" }, { "by": [ { "id": "metadata/signed/platform::mozilla-version-company", "spans": [ [ 133092, 18 ] ] } ], "id": "objectives/anti-static/pack/section-anomaly::reloc-rwx-encrypted-payload", "crit": "suspicious", "kind": "downgrade" }, { "by": [ { "id": "metadata/signed/platform::mozilla-version-company", "spans": [ [ 133092, 18 ] ] } ], "id": "metadata/binary/provenance/version-info::pe-non-architecture-filename-mismatch", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "section", "spans": [ [ 1024, 5 ] ] } ], "id": "metadata/binary/section/entropy::random-exec-payload-section", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/resource/identity::rich-header-present" } ], "id": "metadata/binary/section/label::suspicious-reloc-section", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "well-known/app/browser/mozilla-firefox::firefox-product-name", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::firefox-resource-product-marker", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::mozilla-resource-company-marker", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-install-log", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-name", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-pdb-path", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-key", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-log", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] } ], "id": "metadata/file/extension/identity::pe-content-extension-mismatch", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "well-known/app/browser/mozilla-firefox::firefox-product-name", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::firefox-resource-product-marker", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::mozilla-resource-company-marker", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-install-log", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-name", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-pdb-path", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-key", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-log", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] } ], "id": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "well-known/app/browser/mozilla-firefox::firefox-product-name", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::firefox-resource-product-marker", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::mozilla-resource-company-marker", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-install-log", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-name", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-pdb-path", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-key", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-log", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] } ], "id": "micro-behaviors/data/embedded/payload/header::pe-header-compare-immediate-multiple", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/fs/write/file/handle::write-file", "spans": [ [ 98528, 9 ] ] } ], "id": "micro-behaviors/fs/write/file/handle::writefile-api", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/fs/write/file/handle::write-file", "spans": [ [ 98528, 9 ] ] } ], "id": "micro-behaviors/fs/write/file/handle::writefile-api-text-reference", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/fs/temp/directory::get-temp-file-name", "spans": [ [ 123692, 16 ] ] } ], "id": "micro-behaviors/os/api-resolution/manual::gettempfilename-staged", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "well-known/app/browser/mozilla-firefox::firefox-product-name", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::firefox-resource-product-marker", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::mozilla-resource-company-marker", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-install-log", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-name", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-pdb-path", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-key", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-log", "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ], [ 133344, 7 ], [ 133480, 7 ] ] } ], "id": "micro-behaviors/os/module/load::get-proc-address-import", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/framework::mscoree-name", "spans": [ [ 92948, 11 ] ] } ], "id": "micro-behaviors/os/privilege/token::adjust-token-privileges", "crit": "notable", "kind": "downgrade" }, { "by": [ { "id": "metadata/binary/framework::mscoree-name", "spans": [ [ 92948, 11 ] ] } ], "id": "micro-behaviors/os/privilege/token::lookup-privilege-value", "crit": "notable", "kind": "downgrade" }, { "by": [ { "id": "metadata/binary/framework::mscoree-name", "spans": [ [ 92948, 11 ] ] } ], "id": "micro-behaviors/os/privilege/token::shutdown-privilege-name", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/process/create/spawn::create-process-w", "spans": [ [ 98600, 14 ] ] } ], "id": "micro-behaviors/process/create/launch::create-process-api-name", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/package/versioning/scheme::pe-version-resource", "spans": [ [ 132822, 15 ] ] } ], "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration", "crit": "notable", "kind": "downgrade" }, { "by": [ { "id": "metadata/package/versioning/scheme::pe-version-resource", "spans": [ [ 132822, 15 ] ] } ], "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration-symbol", "crit": "notable", "kind": "downgrade" }, { "by": [ { "id": "metadata/lang/compiler/native::cpp-unknown-exception-string", "spans": [ [ 96656, 17 ] ] } ], "id": "micro-behaviors/process/terminate/kill::terminate-process-name-text", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "text", "spans": [ [ 92948, 11 ] ] } ], "id": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/symbols/count::many-imports-20" } ], "id": "objectives/anti-static/obfuscation/payload/import::extreme-minimal-imports", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/binary/framework::mscoree-name", "spans": [ [ 92948, 11 ] ] } ], "id": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/signed/platform::mozilla-version-company", "spans": [ [ 133092, 18 ] ] } ], "id": "objectives/anti-static/pack/section-anomaly::reloc-dominates-image", "crit": "notable", "kind": "downgrade" }, { "by": [ { "id": "metadata/binary/layout/checksum::pe-checksum-populated" }, { "id": "metadata/binary/layout/checksum::pe-checksum-valid" }, { "id": "metadata/binary/layout/entropy::high-entropy-64k-region" }, { "id": "metadata/binary/layout/entropy::high-overall-entropy-70" }, { "id": "metadata/binary/layout/entropy::high-overall-entropy-binary" }, { "id": "metadata/binary/layout/entropy::very-high-overall-entropy-75" }, { "id": "metadata/binary/layout/overlay::image-under-768kb" }, { "id": "metadata/binary/layout/ratio::many-readable-strings" }, { "id": "metadata/binary/layout/size::large-binary-500k" } ], "id": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/signed/platform::mozilla-version-company", "spans": [ [ 133092, 18 ] ] } ], "id": "objectives/privilege-escalation/modify-service::api-service-reconfig", "crit": "notable", "kind": "downgrade" }, { "by": [ { "id": "metadata/signed/platform::mozilla-version-company", "spans": [ [ 133092, 18 ] ] } ], "id": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "crit": "notable", "kind": "downgrade" } ], "type": "pe", "facts": { "imp": [ [ "kernel32", "SetStdHandle" ], [ "kernel32", "WriteConsoleW" ], [ "kernel32", "MoveFileW" ], [ "kernel32", "CreateToolhelp32Snapshot" ], [ "kernel32", "Process32NextW" ], [ "kernel32", "Process32FirstW" ], [ "kernel32", "WriteFile" ], [ "kernel32", "GetDriveTypeW" ], [ "kernel32", "GetTempFileNameW" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetCurrentProcess" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "GetExitCodeProcess" ], [ "kernel32", "LoadLibraryExW" ], [ "kernel32", "FreeLibrary" ], [ "kernel32", "DeleteFileW" ], [ "kernel32", "LocalAlloc" ], [ "kernel32", "SetLastError" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "GetFileAttributesW" ], [ "kernel32", "CopyFileW" ], [ "kernel32", "LocalFree" ], [ "kernel32", "CreateFileW" ], [ "kernel32", "ReadFile" ], [ "kernel32", "CreateProcessW" ], [ "kernel32", "GetFileSize" ], [ "kernel32", "CreateThread" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "lstrcmpiW" ], [ "kernel32", "CreateEventW" ], [ "kernel32", "GetLastError" ], [ "kernel32", "GetModuleFileNameW" ], [ "kernel32", "Sleep" ], [ "kernel32", "SetEvent" ], [ "kernel32", "MoveFileExW" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "CreateDirectoryW" ], [ "kernel32", "LCMapStringW" ], [ "kernel32", "CompareStringW" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "OutputDebugStringW" ], [ "kernel32", "GetConsoleCP" ], [ "kernel32", "FlushFileBuffers" ], [ "kernel32", "SetFilePointerEx" ], [ "kernel32", "ReadConsoleW" ], [ "kernel32", "GetConsoleMode" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "GetStringTypeW" ], [ "kernel32", "SetEnvironmentVariableW" ], [ "kernel32", "SetEnvironmentVariableA" ], [ "kernel32", "RaiseException" ], [ "kernel32", "GetCPInfo" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "EncodePointer" ], [ "kernel32", "DecodePointer" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "GetModuleHandleExW" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "HeapFree" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "GetFileAttributesExW" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetFileType" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "GetStartupInfoW" ], [ "kernel32", "QueryPerformanceCounter" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetSystemTimeAsFileTime" ], [ "kernel32", "GetEnvironmentStringsW" ], [ "kernel32", "FreeEnvironmentStringsW" ], [ "kernel32", "IsDebuggerPresent" ], [ "kernel32", "IsProcessorFeaturePresent" ], [ "kernel32", "HeapSize" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "UnhandledExceptionFilter" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "InitializeCriticalSectionAndSpinCount" ], [ "kernel32", "TlsAlloc" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "TlsSetValue" ], [ "kernel32", "TlsFree" ], [ "kernel32", "GetModuleHandleW" ], [ "kernel32", "IsValidCodePage" ], [ "kernel32", "GetACP" ], [ "kernel32", "GetOEMCP" ], [ "kernel32", "SetEndOfFile" ], [ "user32", "LoadStringA" ], [ "user32", "wsprintfW" ], [ "advapi32", "DeleteService" ], [ "advapi32", "OpenServiceW" ], [ "advapi32", "SetServiceObjectSecurity" ], [ "advapi32", "OpenSCManagerW" ], [ "advapi32", "CloseServiceHandle" ], [ "advapi32", "CreateServiceW" ], [ "advapi32", "RegisterServiceCtrlHandlerW" ], [ "advapi32", "OpenSCManagerA" ], [ "advapi32", "QueryServiceStatusEx" ], [ "advapi32", "AdjustTokenPrivileges" ], [ "advapi32", "LookupPrivilegeValueA" ], [ "advapi32", "OpenProcessToken" ], [ "advapi32", "RegEnumKeyExW" ], [ "advapi32", "RegQueryInfoKeyW" ], [ "advapi32", "RegQueryValueExW" ], [ "advapi32", "CryptHashData" ], [ "advapi32", "CryptDestroyHash" ], [ "advapi32", "CryptCreateHash" ], [ "advapi32", "CryptAcquireContextA" ], [ "advapi32", "CryptReleaseContext" ], [ "advapi32", "CryptGetHashParam" ], [ "advapi32", "CreateWellKnownSid" ], [ "advapi32", "GetSecurityDescriptorDacl" ], [ "advapi32", "RegSetValueExW" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "QueryServiceConfigW" ], [ "advapi32", "ControlService" ], [ "advapi32", "BuildExplicitAccessWithNameW" ], [ "advapi32", "RegOpenKeyExW" ], [ "advapi32", "FreeSid" ], [ "advapi32", "SetEntriesInAclW" ], [ "advapi32", "ChangeServiceConfigW" ], [ "advapi32", "QueryServiceStatus" ], [ "advapi32", "LookupAccountSidW" ], [ "advapi32", "ChangeServiceConfig2W" ], [ "advapi32", "QueryServiceObjectSecurity" ], [ "advapi32", "SetSecurityDescriptorDacl" ], [ "advapi32", "StartServiceCtrlDispatcherW" ], [ "advapi32", "SetServiceStatus" ], [ "advapi32", "InitializeSecurityDescriptor" ], [ "crypt32", "CryptQueryObject" ], [ "crypt32", "CertGetNameStringW" ], [ "crypt32", "CertFreeCertificateContext" ], [ "crypt32", "CertCloseStore" ], [ "crypt32", "CertFindCertificateInStore" ], [ "crypt32", "CertGetNameStringA" ], [ "crypt32", "CryptMsgGetParam" ], [ "crypt32", "CryptMsgClose" ], [ "wintrust", "WinVerifyTrust" ], [ "version", "GetFileVersionInfoSizeW" ], [ "version", "GetFileVersionInfoW" ], [ "version", "VerQueryValueW" ], [ "shlwapi", "PathAppendW" ], [ "shlwapi", "PathStripToRootW" ], [ "shlwapi", "PathQuoteSpacesW" ], [ "shlwapi", "PathUnquoteSpacesW" ], [ "shlwapi", "PathRemoveFileSpecW" ], [ "ole32", "CoCreateGuid" ], [ "rpcrt4", "UuidToStringW" ], [ "rpcrt4", "RpcStringFreeW" ] ], "sec": [ [ ".text", 1024, 91136, 6.63, "r-x" ], [ ".rdata", 92160, 34304, 5.03, "r--" ], [ ".data", 126464, 5120, 3.33, "rw-" ], [ ".rsrc", 131584, 2048, 4.83, "r--" ], [ ".reloc", 133632, 585728, 7.93, "rwx" ] ], "metrics": { "pe": { "checksum": 745032, "timestamp": 1450322943, "image_size": 745472, "has_manifest": 1, "has_safe_seh": 1, "headers_size": 1024, "checksum_valid": 1, "file_alignment": 512, "resource_count": 2, "has_version_info": 1, "computed_checksum": 745032, "headers_size_ratio": 0, "prose_section_count": 0, "bss_like_section_count": 0, "section_overflow_count": 0, "misaligned_section_count": 0, "version.identity_entropy": 3.81, "declared_data_directory_count": 5, "version.identity_symbol_ratio": 0, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 719360, "entropy": 7.8 }, "binary": { "is_pie": 0, "code_entropy": 7.75, "data_entropy": 3.33, "string_count": 1140, "entropy_variance": 2.51, "avg_string_length": 16.89, "max_string_length": 244, "peak_region_bytes": 571392, "code_to_data_ratio": 0.99, "peak_region_entropy": 7.82, "string_length_stddev": 21.22, "largest_section_ratio": 0.81, "sentence_string_count": 192, "sentence_string_ratio": 0.17, "high_entropy_string_count": 3 }, "imports": { "count": 151 }, "strings": { "truncated": 0, "retained_count": 1140, "extracted_count": 1140 }, "sections": { "count": 5, "code_size": 676864, "entropy_max": 7.93, "entropy_mean": 5.55, "name_entropy": 3.21, "writable_count": 2, "executable_count": 2, "nonstandard_count": 0, "executable_writable_count": 1 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.binary_as_unknown": 1 }, "dependencies": { "count": 9 } } }, "ident": { "name": { "value": "maintenanceservice.exe", "source": "pe.version.original_filename", "verified": false }, "trust": "unsigned", "project": { "value": "Firefox", "source": "pe.version.product_name", "verified": false }, "version": { "value": "43.0.1", "source": "pe.version.file_version", "verified": false }, "build_path": { "value": "c:\\builds\\moz2_slave\\rel-m-rel-w32_bld-000000000000\\build\\obj-firefox\\toolkit\\components\\maintenanceservice\\maintenanceservice.pdb", "source": "pe.debug.pdb.path", "verified": false }, "organization": { "value": "Mozilla Foundation", "source": "pe.version.company", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::mscoree-name", "conf": 0.95, "crit": 3, "desc": "References the .NET mscoree loader name", "spans": [ [ 92948, 11 ] ] }, { "id": "metadata/binary/instruction::x86-global-pointer-indirect-call", "conf": 0.9, "crit": 3, "desc": "x86 indirect call through a global pointer", "spans": [ [ 3175, 11 ], [ 6492, 11 ], [ 6959, 11 ], [ 8719, 11 ], [ 12185, 11 ], [ 16985, 11 ], [ 20568, 11 ], [ 35098, 11 ] ] }, { "id": "metadata/binary/layout/entropy::high-entropy-64k-region", "conf": 1.0, "crit": 3, "desc": "Binary has a high-entropy 64 KiB region" }, { "id": "metadata/binary/layout/entropy::high-overall-entropy-70", "conf": 0.85, "crit": 3, "desc": "Binary overall entropy at least 7.0" }, { "id": "metadata/binary/layout/entropy::very-high-overall-entropy-75", "conf": 0.95, "crit": 3, "desc": "Binary overall entropy at least 7.5" }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/binary/resource/identity::pe-resource-count-two", "conf": 1.0, "crit": 2, "desc": "PE has exactly two resource entries" }, { "id": "metadata/binary/resource/identity::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/binary/resource/identity::rich-header-present", "conf": 0.9, "crit": 2, "desc": "PE Rich header present (MSVC toolchain)" }, { "id": "metadata/binary/resource/manifest::pe-resource-manifest-second", "conf": 1.0, "crit": 2, "desc": "PE second resource is RT_MANIFEST" }, { "id": "metadata/binary/section/entropy::elevated-text-entropy-section", "conf": 0.82, "crit": 2, "desc": "Elevated text section entropy", "spans": [ [ 1024, 0 ] ] }, { "id": "metadata/binary/section/ratio::large-reloc-section", "conf": 0.86, "crit": 3, "desc": "Large .reloc section", "spans": [ [ 133632, 21 ] ] }, { "id": "metadata/binary/section/ratio::reloc-near-text-size", "conf": 0.88, "crit": 2, "desc": ".reloc section nearly as large as .text", "spans": [ [ 133632, 0 ] ] }, { "id": "metadata/binary/symbols/count::high-import-count-pe", "conf": 0.84, "crit": 2, "desc": "High PE import count" }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "metadata/binary/symbols/imports::freesid-import", "conf": 0.98, "crit": 3, "desc": "FreeSid import symbol", "spans": [ [ 98420, 7 ] ] }, { "id": "metadata/build/manifest::pe-requires-admin", "conf": 1.0, "crit": 3, "desc": "PE manifest requests admin", "spans": [ [ 132231, 20 ] ] }, { "id": "metadata/lang/compiler/managed::msvc-clr-dllmain-diagnostic", "conf": 0.96, "crit": 3, "desc": "MSVC /clr DllMain diagnostic", "spans": [ [ 95256, 74 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 94639, 0 ], [ 110612, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 115780, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 113380, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 93482, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 110527, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ], [ 94951, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 133066, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 133138, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 133178, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 133278, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 133226, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 133204, 6 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 133480, 7 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 132822, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 133204, 6 ] ] }, { "id": "metadata/signed/platform::mozilla-version-company", "conf": 0.95, "crit": 3, "desc": "Mozilla PE version company name", "spans": [ [ 133092, 18 ] ] }, { "id": "micro-behaviors/crypto/certificate/store::cert-close-store", "conf": 0.9, "crit": 3, "desc": "Close certificate store handle", "spans": [ [ 98480, 14 ] ] }, { "id": "micro-behaviors/crypto/library/cryptoapi::crypt-acquire-context", "mbc": "C0027", "conf": 0.9, "crit": 3, "desc": "Acquire cryptographic service provider context", "spans": [ [ 98376, 20 ] ] }, { "id": "micro-behaviors/crypto/library/cryptoapi::crypt-create-hash", "conf": 0.9, "crit": 3, "desc": "Create cryptographic hash object", "spans": [ [ 98372, 15 ] ] }, { "id": "micro-behaviors/crypto/library/cryptoapi::crypt-hash-data", "conf": 0.9, "crit": 3, "desc": "Hash data using crypto provider", "spans": [ [ 98364, 13 ] ] }, { "id": "micro-behaviors/crypto/library/cryptoapi::crypt-release-context", "conf": 0.9, "crit": 3, "desc": "Release cryptographic context", "spans": [ [ 98380, 19 ] ] }, { "id": "micro-behaviors/fs/delete/file/library::deletefile-w", "conf": 0.66, "crit": 3, "desc": "DeleteFileW API symbol", "spans": [ [ 98564, 11 ] ] }, { "id": "micro-behaviors/fs/file/handle::set-file-pointer-ex", "conf": 0.9, "crit": 2, "desc": "Set file position extended", "spans": [ [ 98676, 0 ] ] }, { "id": "micro-behaviors/fs/file/move::move-file", "conf": 0.9, "crit": 2, "desc": "Move or rename file", "spans": [ [ 98512, 0 ] ] }, { "id": "micro-behaviors/fs/file/move::move-file-ex", "conf": 0.9, "crit": 2, "desc": "Move or rename file with options", "spans": [ [ 98640, 0 ] ] }, { "id": "micro-behaviors/fs/file/open::file-create-win", "conf": 0.9, "crit": 2, "desc": "Windows file creation/open API", "spans": [ [ 98592, 0 ] ] }, { "id": "micro-behaviors/fs/file/stat::get-file-size", "conf": 0.65, "crit": 2, "desc": "Get file size", "spans": [ [ 98604, 0 ] ] }, { "id": "micro-behaviors/fs/read/file/handle::read-file", "conf": 0.9, "crit": 2, "desc": "Read data from file handle", "spans": [ [ 98596, 0 ] ] }, { "id": "micro-behaviors/os/module/load::get-module-filename-dup", "conf": 0.7, "crit": 2, "desc": "Get module file path (Unicode)", "spans": [ [ 98628, 0 ] ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-ex", "conf": 0.82, "crit": 3, "desc": "Get extended module handle", "spans": [ [ 98728, 18 ] ] }, { "id": "micro-behaviors/os/module/load::get-module-handle-wide", "conf": 0.78, "crit": 3, "desc": "Get module handle Unicode", "spans": [ [ 98840, 16 ] ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-privilege-name-beyond-debug", "conf": 0.9, "crit": 3, "desc": "High-risk privilege beyond SeDebug named", "spans": [ [ 119436, 29 ], [ 119692, 22 ], [ 119808, 21 ], [ 120184, 14 ] ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-take-ownership-privilege-name", "conf": 0.9, "crit": 3, "desc": "References SeTakeOwnershipPrivilege token", "spans": [ [ 120156, 24 ] ] }, { "id": "micro-behaviors/os/privilege/token::open-process-token", "conf": 0.75, "crit": 3, "desc": "OpenProcessToken API symbol", "spans": [ [ 98348, 16 ] ] }, { "id": "micro-behaviors/os/privilege/token::restore-privilege-name", "atk": "T1134.001", "conf": 0.82, "crit": 3, "desc": "Restore privilege name string", "spans": [ [ 119988, 18 ] ] }, { "id": "micro-behaviors/os/registry/access::reg-open-key-ex-w-symbol", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Open registry key via import symbol", "spans": [ [ 98416, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::reg-query-value-ex-w-symbol", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Query registry value via import symbol", "spans": [ [ 98360, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::reg-set-value-ex-w", "atk": "T1112", "conf": 0.85, "crit": 2, "desc": "Set registry value via WinAPI", "spans": [ [ 98396, 0 ] ] }, { "id": "micro-behaviors/os/security/auth/verify::winverifytrust-symbol", "atk": "T1553.002", "conf": 0.95, "crit": 3, "desc": "Verify Authenticode trust chain", "spans": [ [ 98928, 14 ] ] }, { "id": "micro-behaviors/os/security/descriptor::set-entries-in-acl", "conf": 0.9, "crit": 3, "desc": "Builds Windows ACL entries", "spans": [ [ 98424, 16 ] ] }, { "id": "micro-behaviors/os/service/identity::service-executable-filename", "conf": 0.88, "crit": 3, "desc": "Windows service executable filename", "spans": [ [ 112420, 22 ] ] }, { "id": "micro-behaviors/process/create/spawn::create-process-w", "atk": "T1106", "conf": 0.95, "crit": 3, "desc": "CreateProcessW API symbol", "spans": [ [ 98600, 14 ] ] }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-string", "conf": 0.9, "crit": 3, "desc": "IsDebuggerPresent API name in PE strings", "spans": [ [ 125622, 17 ] ] }, { "id": "micro-behaviors/process/terminate/kill::terminate-process", "mbc": "C0018", "conf": 0.95, "crit": 3, "desc": "Process termination via TerminateProcess", "spans": [ [ 98548, 16 ] ] }, { "id": "micro-behaviors/ui/window/probe::get-active-window", "conf": 0.9, "crit": 3, "desc": "GetActiveWindow API reference", "spans": [ [ 97992, 15 ] ] }, { "id": "micro-behaviors/ui/window/probe::get-last-active-popup", "conf": 0.9, "crit": 3, "desc": "GetLastActivePopup API reference", "spans": [ [ 98008, 18 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::import-count-over-120", "atk": "T1027", "mbc": "B0032", "conf": 0.88, "crit": 3, "desc": "Large PE imports over 120" }, { "id": "objectives/command-and-control/dropper/staging/resource::registry-write-text", "conf": 0.92, "crit": 3, "desc": "Registry write API text references", "spans": [ [ 124378, 14 ] ] }, { "id": "objectives/credential-access/credential-manager/store-api::cert-find-cert-in-store", "atk": "T1552.004", "conf": 0.9, "crit": 3, "desc": "CertFindCertificateInStore symbol", "spans": [ [ 98484, 26 ] ] }, { "id": "objectives/evasion/anti-av/code-padding::small-code-section-in-large-pe", "atk": "T1027", "conf": 0.9, "crit": 3, "desc": "Small code section in large PE", "spans": [ [ 1024, 19 ] ] }, { "id": "objectives/evasion/anti-av/syscall::sedebug-privilege-ref", "atk": "T1106", "conf": 0.9, "crit": 3, "desc": "SeDebugPrivilege string reference", "spans": [ [ 119644, 16 ] ] }, { "id": "objectives/supply-chain/trojanized/app/replace::client-installer-exe-name", "atk": "T1195.002,T1505.003", "mbc": "B0030", "conf": 0.92, "crit": 3, "desc": "Client or installer executable name", "spans": [ [ 115288, 11 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::firefox-product-name", "conf": 0.99, "crit": 3, "desc": "Firefox product name in PE version", "spans": [ [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::firefox-resource-product-marker", "conf": 0.99, "crit": 3, "desc": "Firefox product resource marker", "spans": [ [ 133480, 7 ] ] }, { "id": "well-known/app/browser/mozilla-firefox::mozilla-resource-company-marker", "conf": 0.99, "crit": 3, "desc": "Mozilla company resource marker", "spans": [ [ 133344, 7 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-install-log", "conf": 0.97, "crit": 3, "desc": "Mozilla Maintenance Service install log marker", "spans": [ [ 110444, 30 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-name", "conf": 0.98, "crit": 3, "desc": "Mozilla Maintenance Service name", "spans": [ [ 110996, 18 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-pdb-path", "conf": 0.99, "crit": 3, "desc": "Mozilla Maintenance Service PDB path", "spans": [ [ 120688, 130 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-key", "conf": 0.98, "crit": 3, "desc": "Mozilla Maintenance Service uninstall key", "spans": [ [ 111296, 77 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service-uninstall-log", "conf": 0.97, "crit": 3, "desc": "Mozilla maint Service uninstall log artifact", "spans": [ [ 110800, 32 ] ] }, { "id": "well-known/lib/runtime/native-platform/mozilla-nspr::mozilla-foundation-company-versioninfo", "conf": 0.95, "crit": 3, "desc": "Mozilla Foundation CompanyName version info", "spans": [ [ 133092, 18 ] ] }, { "id": "metadata/binary/code/entropy::high-code-entropy", "conf": 0.8, "crit": 3, "desc": "Binary code section entropy at least 7.0", "spans": [ [ 1024, 91136 ] ] }, { "id": "metadata/binary/section/entropy::high-entropy-reloc-section", "conf": 0.9, "crit": 3, "desc": "High entropy .reloc section", "spans": [ [ 133632, 22 ] ] }, { "id": "metadata/binary/section/ratio::pe-near-total-code-data", "conf": 0.94, "crit": 3, "desc": "PE code-to-data ratio at least 0.99" }, { "id": "metadata/binary/symbols/imports::imports-advapi32-dll", "conf": 0.95, "crit": 3, "desc": "Binary imports ADVAPI32.dll", "spans": [ [ 124730, 12 ] ] }, { "id": "metadata/hardening/memory::wx-section", "conf": 1.0, "crit": 3, "desc": "Writable and exe section (W^X violation)", "spans": [ [ 133632, 33 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 133454, 11 ] ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 3, "desc": "PE lacks signature record" }, { "id": "micro-behaviors/fs/file/copy::copyfile-w", "conf": 0.66, "crit": 3, "desc": "Copy files (Windows API wide)", "spans": [ [ 98584, 9 ] ] }, { "id": "micro-behaviors/os/group/lookup::lookup-account-sid", "conf": 0.8, "crit": 3, "desc": "Resolve SID to account/group name", "spans": [ [ 98436, 17 ] ] }, { "id": "micro-behaviors/os/privilege/token::adjust-token-privileges", "conf": 0.8, "crit": 2, "desc": "AdjustTokenPrivileges API symbol", "spans": [ [ 98340, 0 ] ] }, { "id": "micro-behaviors/os/privilege/token::backup-privilege-name", "atk": "T1134.001", "conf": 0.82, "crit": 3, "desc": "Backup privilege name string", "spans": [ [ 119488, 17 ] ] }, { "id": "micro-behaviors/os/privilege/token::high-risk-privilege-name", "conf": 0.9, "crit": 3, "desc": "References high-risk Windows token privilege", "spans": [ [ 119436, 29 ], [ 119644, 16 ], [ 119692, 22 ], [ 119808, 21 ], [ 120184, 14 ] ] }, { "id": "micro-behaviors/os/privilege/token::lookup-privilege-value", "conf": 0.75, "crit": 2, "desc": "LookupPrivilegeValue API symbol", "spans": [ [ 98344, 0 ] ] }, { "id": "micro-behaviors/os/service/configure::change-service-config", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Modify service configuration", "spans": [ [ 98428, 20 ] ] }, { "id": "micro-behaviors/os/service/control::control-service", "atk": "T1543.003", "conf": 0.86, "crit": 3, "desc": "Send service control code", "spans": [ [ 98408, 14 ] ] }, { "id": "micro-behaviors/os/service/control::open-sc-manager", "atk": "T1543.003", "conf": 0.85, "crit": 3, "desc": "Open service control manager", "spans": [ [ 98316, 14 ], [ 98332, 14 ] ] }, { "id": "micro-behaviors/os/service/control::open-service", "atk": "T1543.003", "conf": 0.85, "crit": 3, "desc": "Open existing service handle", "spans": [ [ 98308, 12 ] ] }, { "id": "micro-behaviors/os/service/create::create-service", "atk": "T1543.003", "conf": 0.85, "crit": 3, "desc": "Create Windows service", "spans": [ [ 98324, 14 ] ] }, { "id": "micro-behaviors/os/service/create::create-service-w-reference", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "CreateServiceW named, not imported", "spans": [ [ 123948, 14 ] ] }, { "id": "micro-behaviors/os/service/delete::delete-service", "atk": "T1543.003", "conf": 0.84, "crit": 3, "desc": "DeleteService API import", "spans": [ [ 98304, 13 ] ] }, { "id": "micro-behaviors/os/service/dispatch::register-service-handler", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Register service control handler", "spans": [ [ 98328, 27 ] ] }, { "id": "micro-behaviors/os/service/dispatch::set-service-status", "atk": "T1543.003", "conf": 0.88, "crit": 3, "desc": "Report service status updates", "spans": [ [ 98456, 16 ] ] }, { "id": "micro-behaviors/os/service/dispatch::start-service-dispatcher", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Start service control dispatcher", "spans": [ [ 98452, 27 ] ] }, { "id": "micro-behaviors/os/service/host::service-config-change", "conf": 1.0, "crit": 3, "desc": "Changes service configuration via ADVAPI32", "spans": [ [ 98440, 21 ] ] }, { "id": "micro-behaviors/os/service/query::query-service-config", "atk": "T1543.003", "conf": 0.8, "crit": 3, "desc": "Query service configuration", "spans": [ [ 98404, 19 ] ] }, { "id": "micro-behaviors/os/service/query::query-service-status", "atk": "T1543.003", "conf": 0.82, "crit": 3, "desc": "Query service runtime status", "spans": [ [ 98336, 20 ], [ 98432, 18 ] ] }, { "id": "micro-behaviors/process/create/thread::create-thread", "atk": "T1129", "conf": 0.95, "crit": 3, "desc": "Create thread in current process", "spans": [ [ 98608, 12 ] ] }, { "id": "micro-behaviors/process/debug/detect::is-debugger-present-import", "conf": 0.9, "crit": 3, "desc": "References the IsDebuggerPresent API", "spans": [ [ 98792, 17 ] ] }, { "id": "micro-behaviors/process/debug/event::output-debug-string", "conf": 0.82, "crit": 3, "desc": "References the Windows debugger output API", "spans": [ [ 126140, 18 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Create process or module snapshot", "spans": [ [ 98516, 24 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-process32-first", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Runtime Process32First API name", "spans": [ [ 123740, 15 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::dynamic-process32-next", "atk": "T1057", "mbc": "E1057", "conf": 0.9, "crit": 3, "desc": "Runtime Process32Next API name", "spans": [ [ 123758, 14 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::process32-first", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Get first process from snapshot", "spans": [ [ 98524, 15 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::process32-next", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Enumerate next process in snapshot", "spans": [ [ 98520, 14 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::process32-traversal-text", "atk": "T1057", "conf": 0.9, "crit": 3, "desc": "Process32 snapshot traversal API text", "spans": [ [ 123740, 14 ], [ 123758, 13 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "atk": "T1055", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Writable and executable sections" }, { "id": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Sparse import table" }, { "id": "objectives/anti-static/obfuscation/imports::bkernel32-dll", "conf": 0.8, "crit": 4, "desc": "Dynamic API resolution str Bkernel32", "spans": [ [ 95842, 13 ] ] }, { "id": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "atk": "T1027.007", "mbc": "B0032.014", "conf": 0.75, "crit": 3, "desc": "DJB2 hash algorithm constant (5381)", "spans": [ [ 23751, 11 ] ] }, { "id": "objectives/anti-static/obfuscation/instruction/junk::indirect-call-compare-branches", "conf": 0.85, "crit": 3, "desc": "Indirect call followed by a compare branch", "spans": [ [ 4073, 11 ], [ 5107, 11 ] ] }, { "id": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4", "atk": "T1027", "conf": 0.95, "crit": 3, "desc": "Code section entropy above 7.4", "spans": [ [ 1024, 91136 ] ] }, { "id": "objectives/anti-static/pack/section-anomaly::reloc-dominates-image", "atk": "T1027", "mbc": "B0032", "conf": 0.84, "crit": 2, "desc": ".reloc dominates PE image layout", "spans": [ [ 133632, 0 ] ] }, { "id": "objectives/anti-static/pack/section-anomaly::reloc-rwx-encrypted-payload", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "RWX .reloc encrypted payload staging", "spans": [ [ 133632, 48 ] ] }, { "id": "metadata/binary/resource/manifest::pe-version-and-manifest-only", "conf": 0.88, "crit": 3, "desc": "PE ships only RT_VERSION + RT_MANIFEST resources", "uses": [ 6, 7, 9 ] }, { "id": "metadata/package/versioning/scheme::version-resource-metadata", "conf": 0.9, "crit": 2, "desc": "PE version resource metadata", "uses": [ 26, 28, 31 ], "spans": [ [ 132822, 0 ], [ 133178, 0 ], [ 133226, 0 ] ] }, { "id": "micro-behaviors/fs/file/rename::any-rename", "conf": 0.9, "crit": 3, "desc": "Rename or move file on Windows", "uses": [ 41, 42 ], "spans": [ [ 98512, 9 ], [ 98640, 11 ] ] }, { "id": "micro-behaviors/os/privilege/token::adjust-token-privileges-any", "conf": 0.82, "crit": 3, "desc": "AdjustTokenPrivileges API reference", "uses": [ 88 ], "spans": [ [ 98340, 21 ] ] }, { "id": "micro-behaviors/os/privilege/token::lookup-privilege-value-any", "conf": 0.8, "crit": 3, "desc": "LookupPrivilegeValue API reference", "uses": [ 91 ], "spans": [ [ 98344, 21 ] ] }, { "id": "micro-behaviors/os/privilege/token::open-process-token-any", "conf": 0.8, "crit": 3, "desc": "Open process access token", "uses": [ 51 ], "spans": [ [ 98348, 16 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-open-key-api", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Registry key open API", "uses": [ 53 ], "spans": [ [ 98416, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-query-value-api", "atk": "T1112", "conf": 0.88, "crit": 2, "desc": "Registry value query API", "uses": [ 54 ], "spans": [ [ 98360, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-set-value-api", "atk": "T1112", "conf": 0.9, "crit": 3, "desc": "Registry value write API", "uses": [ 55 ], "spans": [ [ 98396, 14 ] ] }, { "id": "micro-behaviors/os/service/create::service-create-open-import-pair", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Windows service create/open API import pair", "uses": [ 95, 96 ], "spans": [ [ 98308, 12 ], [ 98324, 14 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration-symbol", "atk": "T1057", "conf": 0.9, "crit": 2, "desc": "Toolhelp process enumeration via imports", "uses": [ 108, 111, 112 ], "spans": [ [ 98516, 0 ], [ 98520, 0 ], [ 98524, 0 ] ] }, { "id": "well-known/app/communication/thunderbird::maintenance-service", "conf": 0.98, "crit": 1, "desc": "Mozilla Maintenance Service marker cluster", "uses": [ 73, 74, 75, 76, 77 ], "spans": [ [ 110444, 0 ], [ 110800, 0 ], [ 110996, 0 ], [ 111296, 0 ], [ 120688, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-read-api-chain", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Registry key open and query chain", "uses": [ 128, 129 ], "spans": [ [ 98360, 0 ], [ 98416, 0 ] ] }, { "id": "micro-behaviors/os/registry/access::registry-write-api-chain", "atk": "T1112", "conf": 0.9, "crit": 2, "desc": "Registry key and value write chain", "uses": [ 128, 130 ], "spans": [ [ 98396, 0 ], [ 98416, 0 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-process-enumeration", "atk": "T1057", "conf": 0.9, "crit": 2, "desc": "Toolhelp snapshot process enumeration", "uses": [ 132 ], "spans": [ [ 98516, 0 ], [ 98520, 0 ], [ 98524, 0 ] ] }, { "id": "well-known/app/communication/thunderbird::firefox-application", "conf": 0.98, "crit": 3, "desc": "Mozilla Firefox application identity", "uses": [ 133 ], "spans": [ [ 110444, 30 ], [ 110800, 32 ], [ 110996, 18 ], [ 111296, 77 ], [ 120688, 130 ] ] }, { "id": "micro-behaviors/process/enumerate/snapshot::toolhelp-api-name-triplet-forward", "conf": 0.84, "crit": 3, "desc": "Forward-ordered Toolhelp API string cluster", "uses": [ 136 ], "spans": [ [ 98516, 24 ], [ 98520, 14 ], [ 98524, 15 ] ] }, { "id": "metadata/binary/section/layout::reloc-payload-geometry", "conf": 0.97, "crit": 4, "desc": "Large high-entropy .reloc payload geometry", "uses": [ 11, 12, 80 ], "spans": [ [ 133632, 22 ] ] }, { "id": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "atk": "T1112", "conf": 0.92, "crit": 3, "desc": "Registry open create and write APIs", "uses": [ 53, 54, 55, 128, 129, 130, 134, 135 ], "spans": [ [ 98360, 16 ], [ 98396, 14 ], [ 98416, 13 ] ] }, { "id": "micro-behaviors/os/service/configure::reconfigure-and-start-service", "atk": "T1543.003", "conf": 0.9, "crit": 3, "desc": "Reconfigure service then start", "uses": [ 92, 94, 95, 103 ], "spans": [ [ 98308, 12 ], [ 98316, 14 ], [ 98332, 14 ], [ 98404, 19 ], [ 98428, 20 ] ] }, { "id": "micro-behaviors/os/service/dispatch::service-control-dispatch", "atk": "T1543.003", "conf": 0.92, "crit": 3, "desc": "Windows service control dispatch", "uses": [ 99, 100, 101 ], "spans": [ [ 98328, 27 ], [ 98452, 27 ], [ 98456, 16 ] ] }, { "id": "micro-behaviors/os/service/dispatch::service-dispatch-triad", "atk": "T1543.003", "conf": 0.95, "crit": 3, "desc": "Full Windows service dispatch triplet", "uses": [ 99, 100, 101 ], "spans": [ [ 98328, 27 ], [ 98452, 27 ], [ 98456, 16 ] ] }, { "id": "micro-behaviors/os/service/query::service-status-query", "atk": "T1543.003", "conf": 0.85, "crit": 3, "desc": "Query Windows service runtime status", "uses": [ 94, 95, 104 ], "spans": [ [ 98308, 12 ], [ 98316, 14 ], [ 98332, 14 ], [ 98336, 20 ], [ 98432, 18 ] ] }, { "id": "micro-behaviors/os/service/stop::service-stop-control", "atk": "T1543.003", "conf": 0.92, "crit": 3, "desc": "Open and control or delete service API chain", "uses": [ 93, 94, 95, 98 ], "spans": [ [ 98304, 13 ], [ 98308, 12 ], [ 98316, 14 ], [ 98332, 14 ], [ 98408, 14 ] ] }, { "id": "micro-behaviors/process/create/spawn::child-process-creation-api", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Starts a child process through a platform API", "uses": [ 59 ], "spans": [ [ 98600, 14 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::binary-packed", "atk": "T1045", "mbc": "B0032", "conf": 0.9, "crit": 4, "desc": "Binary appears to be packed", "uses": [ 4, 79, 114 ], "spans": [ [ 1024, 91136 ] ] }, { "id": "objectives/privilege-escalation/modify-service::api-service-reconfig", "atk": "T1543.003", "mbc": "F0011", "conf": 0.9, "crit": 2, "desc": "Service reconfiguration with privilege indicators", "uses": [ 88, 90, 92, 95 ], "spans": [ [ 98308, 0 ], [ 98340, 0 ], [ 98428, 0 ], [ 119436, 0 ], [ 119644, 0 ], [ 119692, 0 ], [ 119808, 0 ], [ 120184, 0 ] ] }, { "id": "objectives/privilege-escalation/token-manipulation::dynamic-token-privilege-chain", "atk": "T1134.001", "conf": 0.88, "crit": 2, "desc": "Dynamic token privilege adjustment chain", "uses": [ 90, 125, 126, 127 ], "spans": [ [ 98340, 0 ], [ 98344, 0 ], [ 98348, 0 ], [ 119436, 0 ], [ 119644, 0 ], [ 119692, 0 ], [ 119808, 0 ], [ 120184, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/section::encrypted-reloc-payload-carrier", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 4, "desc": "Encrypted payload hidden in .reloc section", "uses": [ 10, 13, 123, 139 ], "spans": [ [ 1024, 21 ], [ 132822, 15 ], [ 133178, 11 ], [ 133226, 14 ], [ 133632, 6 ] ] }, { "id": "objectives/anti-static/pack/section-anomaly::rwx-reloc-process-loader", "atk": "T1027.002", "mbc": "B0032", "conf": 0.97, "crit": 4, "desc": "Encrypted reloc payload launches process", "uses": [ 59, 61, 121, 139 ], "spans": [ [ 98548, 16 ], [ 98600, 14 ], [ 133632, 48 ] ] } ] } ] } }