{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997742772102356, "class": 2 } ], "prob": 0.9997743, "class": 2, "models": [ { "m": "az", "prob": 0.9997743, "class": 2 }, { "m": "az/native", "prob": 0.9997427, "class": 0 }, { "m": "az/pe", "prob": 0.99960977, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T03:30:20Z" }, "path": "30516", "raw": { "v": "4", "fs": [ { "f": "KO₄(As₈AlC₅Er₂)H₃(DbDsPo₂)Md₄(Bi₉HeSiPa)", "k": { "pe.timestamp": 1389276530, "hashes.imphash": "5a498eee87e4d89512a84502f500181f", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.rich_header.xor_key": "0xc36583b0", "hashes.rich_header_hash": "04e1d180d43f0329dfe2843b1c3caeab109de90011cd5f6e5144597930c06a21", "pe.rich_header.entries[0].use_count": 6, "pe.rich_header.entries[1].use_count": 24, "pe.rich_header.entries[2].use_count": 117, "pe.rich_header.entries[3].use_count": 2, "pe.rich_header.entries[4].use_count": 2, "pe.rich_header.entries[5].use_count": 23, "pe.rich_header.entries[6].use_count": 213, "pe.rich_header.entries[7].use_count": 40, "pe.rich_header.entries[0].product_id": 12, "pe.rich_header.entries[1].product_id": 14, "pe.rich_header.entries[2].product_id": 10, "pe.rich_header.entries[3].product_id": 11, "pe.rich_header.entries[4].product_id": 95, "pe.rich_header.entries[5].product_id": 93, "pe.rich_header.entries[6].product_id": 1, "pe.rich_header.entries[7].product_id": 11, "pe.rich_header.entries[0].build_number": 7291, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 7299, "pe.rich_header.entries[1].product_name": "Export_VC2003", "pe.rich_header.entries[2].build_number": 9782, "pe.rich_header.entries[2].product_name": "Linker_v6", "pe.rich_header.entries[3].build_number": 8047, "pe.rich_header.entries[3].product_name": "Cvt_Omf", "pe.rich_header.entries[4].build_number": 4035, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].build_number": 4035, "pe.rich_header.entries[5].product_name": "unknown", "pe.rich_header.entries[6].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[7].build_number": 9782, "pe.rich_header.entries[7].product_name": "Cvt_Omf" }, "x": 81, "id": 0, "is": [ "GetProcAddress", "GetModuleHandleA", "LoadLibraryA" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "timestamp": 1389276530.0, "image_base": 4194304.0, "entry_section": ".text", "size_of_image": 442368.0, "timestamp_day": 9.0, "file_alignment": 4096.0, "timestamp_year": 2014.0, "characteristics": 271.0, "entry_point_rva": 438272.0, "size_of_headers": 4096.0, "timestamp_month": 1.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 1.0, "computed_checksum": 239133.0, "section_alignment": 4096.0, "unusual_alignment": true, "number_of_sections": 4.0, "resource_timestamp": 0.0, "rich_header_present": true, "linker_major_version": 6.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "file": { "size": 184320.0 }, "binary": { "code_size": 73728.0, "func_count": 1.0, "entry_point": 438272.0, "wx_sections": 2.0, "code_entropy": 6.9, "data_entropy": 7.76, "func_density": 0.01, "import_count": 3.0, "string_count": 164.0, "avg_func_size": 294.0, "section_count": 4.0, "avg_complexity": 11.0, "import_density": 0.04, "max_complexity": 11.0, "string_density": 2.28, "overall_entropy": 7.33, "avg_basic_blocks": 22.0, "avg_section_size": 45056.0, "dependency_count": 1.0, "entropy_variance": 0.79, "avg_string_length": 5.4, "complexity_per_kb": 0.15, "max_string_length": 40.0, "writable_sections": 4.0, "avg_string_entropy": 2.22, "code_to_data_ratio": 0.69, "data_to_file_ratio": 0.56, "entry_point_is_rva": true, "text_to_file_ratio": 0.4, "total_basic_blocks": 22.0, "executable_sections": 2.0, "func_analysis_depth": 2.0, "high_entropy_regions": 3.0, "string_length_stddev": 3.6, "largest_section_ratio": 0.56, "sentence_string_count": 1.0, "sentence_string_ratio": 0.01, "behavioral_import_ratio": 0.67 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 208, "Rich" ], [ 480, ".text" ], [ 520, ".rdata" ], [ 560, ".data" ], [ 4856, "Ru vh" ], [ 6109, "TTFA" ], [ 7181, "FX1CBC" ], [ 8333, "F0HS" ], [ 13997, "i9.5" ], [ 14285, "F5C6_" ], [ 14321, "do6i" ], [ 16071, "Gl.nAVD" ], [ 18445, "c2o2" ], [ 19288, "Dkou" ], [ 22099, "Y3T6" ], [ 22344, "Jgve" ], [ 23114, "HULP" ], [ 28024, "/St6" ], [ 28091, "/zEP" ], [ 28501, "21LN" ], [ 32478, "4s5p" ], [ 33771, "JQIZiCtv" ], [ 34950, "Jdym" ], [ 38641, "RVGJ" ], [ 42028, "Wvda" ], [ 43614, "V 30" ], [ 43746, "HOPF" ], [ 45828, "Nhwg" ], [ 47941, "Nrkx" ], [ 52516, "Urhc" ], [ 53063, "Ogru" ], [ 54863, "qo0y" ], [ 55369, "3A10W" ], [ 57222, "S_R3" ], [ 62695, "Hzfu" ], [ 62856, "WG8XX" ], [ 74409, "Irjm" ], [ 74955, "DEFGHIJ" ], [ 74963, "KLMNOPQR" ], [ 74972, "STUVWXYZ" ], [ 74990, "ijklmnop" ], [ 74999, "qrstuvwx" ], [ 75008, "yz01" ], [ 75675, "AINGK" ], [ 75690, "OR6028" ], [ 78026, "5gam" ], [ 78165, "a7lc" ], [ 78301, "A9IK" ], [ 78387, "Xogph" ], [ 80695, "Soci" ], [ 81656, "HLQMD" ], [ 87957, "LOAK" ], [ 87977, "Z4A7" ], [ 88112, "5.YsWEm" ], [ 88298, "XERN" ], [ 88574, "E_EM" ], [ 88691, "Wibl" ], [ 89685, "ATWOMTN" ], [ 90078, "PDFB" ], [ 90188, "9CRN" ], [ 90392, "8PDA" ], [ 90693, "EKGP" ], [ 90877, "DOULA%M" ], [ 91085, "ED4_" ], [ 92137, "OKRA" ], [ 92193, "OST4" ], [ 93612, "/Pkt" ], [ 94232, "rb32" ], [ 94426, "PDKV2" ], [ 95158, "ske8r" ], [ 95549, "Gikk" ], [ 95645, "PCSX" ], [ 95901, "CNW_L" ], [ 96182, "QLJD" ], [ 96464, "S8UM" ], [ 97069, "YUKI" ], [ 97077, "S168" ], [ 97276, "ji1d" ], [ 97292, "Q_JP" ], [ 97456, "QSGV7" ], [ 97771, "/XWV\tZ" ], [ 98623, "-aedjz" ], [ 99960, "ASBK" ], [ 101433, "459p" ], [ 101901, "OMEFR" ], [ 102124, "A op" ], [ 105067, "IN9X" ], [ 106731, "Mddd" ], [ 108483, "WW//T.|Ch;2RI" ], [ 109404, "3hih" ], [ 109770, "ITBD" ], [ 110098, "QWRS" ], [ 110158, "KPQL" ], [ 110475, ")'t2h2UWdQ%xb" ], [ 113809, "/d\tD" ], [ 116397, "S0BU" ], [ 117351, "$(:; )" ], [ 117399, "/HHC" ], [ 117720, "Klqu" ], [ 121056, "/PyZ" ], [ 122280, "r9 w" ], [ 126988, "OPRS" ], [ 130740, "VGHL" ], [ 134224, "[]nsZti" ], [ 134262, "/\ttu" ], [ 134526, "KIFHF" ], [ 134675, "7GUW" ], [ 137779, "BCDEFGHI" ], [ 137788, "JKLMNO" ], [ 137809, "defghijk" ], [ 137818, "lmnopqrs" ], [ 138730, "JC42.DL" ], [ 138932, "nexit" ], [ 138995, "9sou" ], [ 139103, "6VPX" ], [ 139633, "VKERN" ], [ 139776, "zgei" ], [ 139868, "BADV" ], [ 139900, "CEAU" ], [ 140126, "P6X0S" ], [ 140248, "iphnna" ], [ 140698, "1277.0" ], [ 141928, "QQPH" ], [ 142352, "BffLo0\tQ,-FhX\u0026xG3" ], [ 142667, ".huif" ], [ 142970, "m4ha" ], [ 143343, "WM_HT" ], [ 144589, "d5.KV H(7VG" ], [ 144883, "RAD1" ], [ 145243, "LVH4" ], [ 146810, "HEA5D" ], [ 146974, "SOFT" ], [ 148429, "BYPB" ], [ 148848, "/Q1K" ], [ 151695, "3DW0F" ], [ 157067, "924T" ], [ 162677, "B 3N" ], [ 163054, "WVS8" ], [ 165674, "ZW20" ], [ 166122, "6JFJ" ], [ 167695, "EHI8" ], [ 170332, "FAVO" ], [ 170666, "UPIC" ], [ 171292, "20XK" ], [ 171498, "M5846.T" ], [ 172111, "\u003cTz\u003e" ], [ 173911, "eton" ], [ 175054, "dt%ho6" ], [ 175069, "Aruiy" ], [ 175351, "WSAI" ], [ 175612, "/ \tT" ], [ 180286, "KERNEL32.dll" ], [ 180302, "GetProcAddress" ], [ 180319, "GetModuleHandleA" ], [ 180338, "LoadLibraryA" ], [ 180383, "VirtualAlloc" ], [ 180400, "GetTickCount" ], [ 181134, "6 EK" ], [ 181502, "Asof" ], [ 182018, "w 8o" ], [ 182115, "QHTE" ], [ 182122, "Nhroyd" ], [ 182311, "SEKR2" ] ], "sz": 184320, "ts": [ { "c": 0.699999988079071, "d": "PE imports from one DLL", "e": [ "pe.import_dll_count = 1.00" ], "i": "metadata/binary/symbols/imports::pe-single-import-dll", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.22" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 7.83)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple loose MZ byte markers", "e": [ "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 3 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 3.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.75, "d": "High entropy encrypted data", "e": [ ".rdata (entropy: 7.62)" ], "i": "micro-behaviors/data/encode/payload::payload-blob-metrics", "l": 3 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.rich_header_present = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1105", "c": 1.0, "d": "Binary has high overall entropy", "e": [ "binary.overall_entropy = 7.33" ], "i": "objectives/command-and-control/dropper/staging/embedded::high-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 3.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "KLMNOPQR", "STUVWXYZ", "BCDEFGHI" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code JP token", "e": [ "_JP" ], "i": "objectives/anti-analysis/geofencing/region::country-code-jp", "l": 1, "m": "B0007.003" }, { "c": 0.8600000143051147, "d": "High entropy rdata section", "e": [ ".rdata (entropy: 7.62)" ], "i": "metadata/binary/section/metrics::high-entropy-rdata-section", "l": 1 }, { "c": 0.8500000238418579, "d": "High-entropy read-only .rdata section", "e": [ ".rdata (size: 4096, entropy: 7.62)" ], "i": "metadata/binary/anomaly::high-entropy-rdata-section", "l": 3 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 4.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 1.0, "d": "Low function count metric", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::low-function-count-marker", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Very few functions for code section size", "e": [ "binary.func_count = 1.00" ], "i": "objectives/anti-static/obfuscation/string/anomaly::low-function-large-code", "l": 1, "m": "B0032" }, { "a": "T1204.002", "c": 0.8999999761581421, "d": "PowerShell archive extraction command marker", "e": [ "7Z" ], "i": "objectives/command-and-control/dropper/staging/archive::powershell-archive-extract", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "30516" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1389276530.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 3.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 442368.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 11.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "PE with exactly four sections", "e": [ "binary.section_count = 4.00" ], "i": "metadata/binary/metrics/structural::four-section-pe", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 164.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 3.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.8500000238418579, "d": "High entropy executable section", "e": [ ".text (entropy: 7.83, perms: rwx)" ], "i": "metadata/binary/section/metrics::high-entropy-exec-section", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High overall file entropy", "e": [ "binary.overall_entropy = 7.33" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-overall-entropy", "l": 4, "m": "B0032" }, { "a": "T1055", "c": 0.8999999761581421, "d": "VirtualAlloc string import marker", "e": [ "VirtualAlloc" ], "i": "objectives/evasion/process/injection/vb6::virtual-alloc-string", "l": 1, "m": "C0041" }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "91 40 fa 3f 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.7200000286102295, "d": "Writable .rdata section permissions", "e": [ ".rdata (perms: rw-)" ], "i": "metadata/binary/section/names::writable-rdata", "l": 3 }, { "c": 0.699999988079071, "d": "Single function with high complexity (monolithic stub)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::single-complex-function", "l": 3 }, { "c": 0.8999999761581421, "d": "Unusual PE section alignment", "e": [ "pe.unusual_alignment = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/section::unusual-alignment-pe", "l": 4 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 3.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "References LoadLibraryA dynamic module loading", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 1.0, "d": "Writable and executable section (W^X violation)", "e": [ ".text (size: 69632, perms: rwx)", ".text (size: 4096, perms: rwx)" ], "i": "metadata/hardening/memory::wx-section", "l": 3 }, { "c": 0.8199999928474426, "d": "High entropy in writable data section", "e": [ ".data (entropy: 7.90, perms: rw-)", ".rdata (entropy: 7.62, perms: rw-)" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-section", "l": 1 }, { "a": "T1045", "c": 0.949999988079071, "d": "Multiple W+X sections (packer pattern)", "e": [ "binary.wx_sections = 2.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-wx-sections", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.8999999761581421, "d": "Writable and executable sections (self-modifying", "e": [ "binary.wx_sections = 2.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Dynamic library loading via LoadLibraryA", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Loader sized encrypted .data blob", "e": [ ".data (size: 102400, entropy: 7.90, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::loader-encrypted-dot-data", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted rdata section (PE crypter)", "e": [ ".rdata (entropy: 7.62)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-rdata-section", "l": 4, "m": "B0032" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.9900000095367432, "d": "Single-function packed stub layout", "e": [ "binary.func_count = 1.00" ], "i": "well-known/malware/worm/mydoom::metric-function-count-1", "l": 1 }, { "c": 0.6000000238418579, "d": "High entropy in data section", "e": [ ".rdata (entropy: 7.62)", ".data (entropy: 7.90)" ], "i": "metadata/binary/metrics/structural::high-entropy-data", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Encrypted data section (very high)", "e": [ ".rdata (entropy: 7.62)", ".data (entropy: 7.90)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-data-section", "l": 4, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Large high-entropy random executable section", "e": [ ".text (size: 69632, entropy: 7.83, perms: rwx)" ], "i": "metadata/binary/section/metrics::random-exec-payload-section", "l": 4 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8500000238418579, "d": "Low function count metric", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/anomaly::low-function-count-marker", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.9599999785423279, "d": "Regex component marker", "e": [ ".data (size: 102400, entropy: 7.90, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-0--inline-29193", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".data (entropy: 7.90)", ".rdata (entropy: 7.62)" ], "i": "objectives/anti-static/obfuscation/payload/section::encrypted-payload-section-cond-0--inline-29177", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ ".data (entropy: 7.90, perms: rw-)", ".rdata (entropy: 7.62, perms: rw-)" ], "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (GetProcAddress, GetModuleHandleA, LoadLibraryA)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1055", "c": 0.8999999761581421, "d": "Code cave suitable for code injection", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "binary.func_count = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-structure::injection-ready-cave", "l": 4 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 4, "m": "B0032" } ], "sha": "d8774518687ae98ac0ccc349cd891ffdb2f0900a419bb734921acf8f6a405839", "path": "30516", "type": "pe" } ], "tv": "db300" } }