{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9985228180885315, "class": 2 } ], "prob": 0.9985228, "skip": [ { "m": "az/c", "why": "uncalibrated" } ], "class": 2, "models": [ { "m": "az", "prob": 0.97910357, "class": 0 }, { "m": "az/source", "prob": 0.9985228, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-06T05:38:28Z" }, "path": "injection.c", "raw": { "v": "4", "fs": [ { "f": "O(Al)H(Po₂)", "k": { "source.imports[0]": "CloseHandle", "source.imports[1]": "CreateToolhelp32Snapshot", "source.imports[2]": "GetLastError", "source.imports[3]": "GetThreadContext", "source.imports[4]": "OpenThread", "source.imports[5]": "ResumeThread", "source.imports[6]": "SetThreadContext", "source.imports[7]": "Thread32First", "source.imports[8]": "Thread32Next", "source.imports[9]": "WaitForSingleObject", "source.strings[0]": "End sium", "source.strings[1]": "Error: %d ", "source.strings[2]": "Error: %d \\n", "source.strings[3]": "Failed to retrieve thread context ", "source.strings[4]": "Failed to retrieve thread context \\n", "source.strings[5]": "SetThreadContext Failed ", "source.strings[6]": "SetThreadContext Failed \\n", "source.strings[7]": "Thred resumed, waiting for shellcode ", "source.strings[8]": "Thred resumed, waiting for shellcode \\n", "source.strings[9]": "injection.h", "source.has_imports": true, "source.imports[10]": "printf", "source.strings[10]": "temp fun", "source.functions[0]": "GetThread(IN DWORD pid, OUT DWORD* tid, OUT HANDLE* hThread)", "source.functions[1]": "HijackThread(IN HANDLE hThread, IN PVOID pAddress)", "source.functions[2]": "temp(VOID)" }, "x": 38, "id": 0, "is": [ "CreateToolhelp32Snapshot", "Thread32First", "printf", "GetLastError", "CloseHandle", "Thread32Next", "OpenThread", "printf", "GetLastError", "CloseHandle", "CloseHandle", "printf", "GetThreadContext", "printf", "SetThreadContext", "printf", "ResumeThread", "printf", "WaitForSingleObject", "printf", "CloseHandle" ], "ms": { "file": { "size": 1545.0 }, "text": { "tab_count": 74.0, "digit_ratio": 0.02, "space_count": 122.0, "total_lines": 63.0, "char_entropy": 5.42, "unique_chars": 73.0, "import_density": 33.33, "string_density": 0.25, "avg_line_length": 23.52, "max_line_length": 77.0, "empty_line_ratio": 0.22, "last_line_length": 1.0, "most_common_char": "e", "whitespace_ratio": 0.17, "most_common_ratio": 0.06, "identifier_density": 1.16, "line_length_stddev": 23.07, "normalized_import_count": 2.65, "normalized_string_count": 2.02, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 2.0, "normalized_function_count": 0.38, "imports_to_functions_ratio": 7.0, "strings_to_functions_ratio": 5.33, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 5.69, "identifiers_to_functions_ratio": 11.33 }, "imports": { "total": 21.0, "unique_modules": 11.0, "third_party_count": 21.0, "third_party_ratio": 1.0 }, "strings": { "total": 16.0, "avg_length": 18.38, "max_length": 39.0, "avg_entropy": 3.29, "total_bytes": 294.0, "entropy_stddev": 0.47 }, "comments": { "chars": 74.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.02, "high_entropy_comments": 1.0 }, "functions": { "total": 3.0, "length_stddev": 10.4, "avg_name_length": 40.0, "no_params_count": 3.0, "avg_length_lines": 18.67, "max_length_lines": 27.0, "min_length_lines": 4.0, "high_entropy_names": 2.0, "density_per_100_lines": 4.76, "code_in_functions_ratio": 0.89 }, "identifiers": { "total": 73.0, "avg_length": 11.74, "max_length": 24.0, "min_length": 3.0, "avg_entropy": 2.92, "reuse_ratio": 0.47, "unique_count": 34.0, "length_stddev": 6.03, "has_digit_ratio": 0.15, "base64_like_names": 3.0, "high_entropy_count": 5.0, "high_entropy_ratio": 0.15, "all_lowercase_ratio": 0.12, "all_uppercase_ratio": 0.32, "numeric_suffix_count": 1.0 } }, "ss": [ [ 9, "injection.h" ], [ 10, "injection.h" ], [ 325, "Error: %d \\n" ], [ 326, "Error: %d " ], [ 713, "Error: %d \\n" ], [ 714, "Error: %d " ], [ 874, "temp fun" ], [ 875, "temp fun" ], [ 1169, "Failed to retrieve thread context \\n" ], [ 1170, "Failed to retrieve thread context " ], [ 1313, "SetThreadContext Failed \\n" ], [ 1314, "SetThreadContext Failed " ], [ 1396, "Thred resumed, waiting for shellcode \\n" ], [ 1397, "Thred resumed, waiting for shellcode " ], [ 1490, "End sium" ], [ 1491, "End sium" ] ], "sz": 1545, "ts": [ { "a": "T1057", "c": 0.8999999761581421, "d": "Create process or module snapshot", "e": [ "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot-source", "l": 3, "m": "E1057" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code IN token", "e": [ "(IN " ], "i": "objectives/anti-analysis/geofencing/region::country-code-in", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1057", "c": 0.8500000238418579, "d": "CreateToolhelp32Snapshot API string", "e": [ "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot-string", "l": 1 }, { "a": "T1055.003", "c": 0.9399999976158142, "d": "Modify thread execution context", "e": [ "SetThreadContext" ], "i": "micro-behaviors/process/info/thread::set-thread-context", "l": 3 }, { "a": "T1055.003", "c": 0.8999999761581421, "d": "Resume remote thread execution", "e": [ "ResumeThread" ], "i": "micro-behaviors/process/info/thread::resume-thread", "l": 4 }, { "a": "T1055.003", "c": 0.9200000166893005, "d": "Read thread execution context", "e": [ "GetThreadContext" ], "i": "micro-behaviors/process/info/thread::get-thread-context", "l": 3 }, { "a": "T1055.003", "c": 0.8999999761581421, "d": "Suspend remote thread execution", "e": [ "SuspendThread" ], "i": "micro-behaviors/process/info/thread::suspend-thread", "l": 4 } ], "sha": "d8f1d4299f8d1108610e9403d3916ddde0abd6ee2bf95021ee9651e1731fa289", "path": "/data/samples/bad/projects/windows/malware/My-Entire-Malware-Collection/stagers/thread_hijacking/Thread-Hijacking-Collection/DLL_version/injection.c", "type": "c" } ], "tv": "84923" } }